ieee1394: merge from Linus

Conflicts: drivers/ieee1394/hosts.c
Patch "lockdep: annotate ieee1394 skb-queue-head locking" was meddling
with patch "ieee1394: fix kerneldoc of hpsb_alloc_host".

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

1009 files changed, 42344 insertions, 15720 deletions

diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index bc2652d72fdc..56c5ba874623 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -107,7 +107,6 @@ config ACPI_BUTTON
 config ACPI_VIDEO
         tristate "Video"
         depends on X86
-        default y
         help
           This driver implement the ACPI Extensions For Display Adapters
           for integrated graphics devices on motherboard, as specified in
@@ -135,8 +134,7 @@ config ACPI_FAN
 
 config ACPI_DOCK
         tristate "Dock"
-        depends on !ACPI_IBM_DOCK
-        default y
+        depends on EXPERIMENTAL
         help
           This driver adds support for ACPI controlled docking stations
 
@@ -214,6 +212,7 @@ config ACPI_IBM
 config ACPI_IBM_DOCK
         bool "Legacy Docking Station Support"
         depends on ACPI_IBM
+        depends on ACPI_DOCK=n
         default n
         ---help---
           Allows the ibm_acpi driver to handle docking station events.
@@ -352,6 +351,17 @@ config ACPI_HOTPLUG_MEMORY
           If one selects "m," this driver can be loaded using the following
           command: 
                 $>modprobe acpi_memhotplug 
+
+config ACPI_SBS
+        tristate "Smart Battery System (EXPERIMENTAL)"
+        depends on X86 && I2C
+        depends on EXPERIMENTAL
+        help
+          This driver adds support for the Smart Battery System.
+          Depends on I2C (Device Drivers ---> I2C support)
+          A "Smart Battery" is quite old and quite rare compared
+          to today's ACPI "Control Method" battery.
+
 endif   # ACPI
 
 endmenu
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index f0a68ecf1e57..bce7ca27b429 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -58,3 +58,5 @@ obj-$(CONFIG_ACPI_IBM)		+= ibm_acpi.o
 obj-$(CONFIG_ACPI_TOSHIBA)      += toshiba_acpi.o
 obj-y                           += scan.o motherboard.o
 obj-$(CONFIG_ACPI_HOTPLUG_MEMORY)       += acpi_memhotplug.o
+obj-y                           += cm_sbs.o
+obj-$(CONFIG_ACPI_SBS)          += i2c_ec.o sbs.o
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 36ca365bcead..11abc7bf777e 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -50,6 +50,9 @@ ACPI_MODULE_NAME("acpi_ac")
 MODULE_DESCRIPTION(ACPI_AC_DRIVER_NAME);
 MODULE_LICENSE("GPL");
 
+extern struct proc_dir_entry *acpi_lock_ac_dir(void);
+extern void *acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir);
+
 static int acpi_ac_add(struct acpi_device *device);
 static int acpi_ac_remove(struct acpi_device *device, int type);
 static int acpi_ac_open_fs(struct inode *inode, struct file *file);
@@ -65,11 +68,11 @@ static struct acpi_driver acpi_ac_driver = {
 };
 
 struct acpi_ac {
-        acpi_handle handle;
+        struct acpi_device * device;
         unsigned long state;
 };
 
-static struct file_operations acpi_ac_fops = {
+static const struct file_operations acpi_ac_fops = {
         .open = acpi_ac_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -88,7 +91,7 @@ static int acpi_ac_get_state(struct acpi_ac *ac)
         if (!ac)
                 return -EINVAL;
 
-        status = acpi_evaluate_integer(ac->handle, "_PSR", NULL, &ac->state);
+        status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL, &ac->state);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Error reading AC Adapter state"));
                 ac->state = ACPI_AC_STATUS_UNKNOWN;
@@ -191,11 +194,11 @@ static void acpi_ac_notify(acpi_handle handle, u32 event, void *data)
         if (!ac)
                 return;
 
-        if (acpi_bus_get_device(ac->handle, &device))
-                return;
-
+        device = ac->device;
         switch (event) {
         case ACPI_AC_NOTIFY_STATUS:
+        case ACPI_NOTIFY_BUS_CHECK:
+        case ACPI_NOTIFY_DEVICE_CHECK:
                 acpi_ac_get_state(ac);
                 acpi_bus_generate_event(device, event, (u32) ac->state);
                 break;
@@ -223,7 +226,7 @@ static int acpi_ac_add(struct acpi_device *device)
                 return -ENOMEM;
         memset(ac, 0, sizeof(struct acpi_ac));
 
-        ac->handle = device->handle;
+        ac->device = device;
         strcpy(acpi_device_name(device), ACPI_AC_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_AC_CLASS);
         acpi_driver_data(device) = ac;
@@ -236,8 +239,8 @@ static int acpi_ac_add(struct acpi_device *device)
         if (result)
                 goto end;
 
-        status = acpi_install_notify_handler(ac->handle,
-                                             ACPI_DEVICE_NOTIFY, acpi_ac_notify,
+        status = acpi_install_notify_handler(device->handle,
+                                             ACPI_ALL_NOTIFY, acpi_ac_notify,
                                              ac);
         if (ACPI_FAILURE(status)) {
                 result = -ENODEV;
@@ -268,8 +271,8 @@ static int acpi_ac_remove(struct acpi_device *device, int type)
 
         ac = (struct acpi_ac *)acpi_driver_data(device);
 
-        status = acpi_remove_notify_handler(ac->handle,
-                                            ACPI_DEVICE_NOTIFY, acpi_ac_notify);
+        status = acpi_remove_notify_handler(device->handle,
+                                            ACPI_ALL_NOTIFY, acpi_ac_notify);
 
         acpi_ac_remove_fs(device);
 
@@ -280,17 +283,18 @@ static int acpi_ac_remove(struct acpi_device *device, int type)
 
 static int __init acpi_ac_init(void)
 {
-        int result = 0;
+        int result;
 
+        if (acpi_disabled)
+                return -ENODEV;
 
-        acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
+        acpi_ac_dir = acpi_lock_ac_dir();
         if (!acpi_ac_dir)
                 return -ENODEV;
-        acpi_ac_dir->owner = THIS_MODULE;
 
         result = acpi_bus_register_driver(&acpi_ac_driver);
         if (result < 0) {
-                remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
+                acpi_unlock_ac_dir(acpi_ac_dir);
                 return -ENODEV;
         }
 
@@ -302,7 +306,7 @@ static void __exit acpi_ac_exit(void)
 
         acpi_bus_unregister_driver(&acpi_ac_driver);
 
-        remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
+        acpi_unlock_ac_dir(acpi_ac_dir);
 
         return;
 }
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index cd57372a6729..1dda370f402b 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -80,7 +80,7 @@ struct acpi_memory_info {
 };
 
 struct acpi_memory_device {
-        acpi_handle handle;
+        struct acpi_device * device;
         unsigned int state;     /* State of the memory device */
         struct list_head res_list;
 };
@@ -129,11 +129,15 @@ acpi_memory_get_device_resources(struct acpi_memory_device *mem_device)
         struct acpi_memory_info *info, *n;
 
 
-        status = acpi_walk_resources(mem_device->handle, METHOD_NAME__CRS,
+        if (!list_empty(&mem_device->res_list))
+                return 0;
+
+        status = acpi_walk_resources(mem_device->device->handle, METHOD_NAME__CRS,
                                      acpi_memory_get_resource, mem_device);
         if (ACPI_FAILURE(status)) {
                 list_for_each_entry_safe(info, n, &mem_device->res_list, list)
                         kfree(info);
+                INIT_LIST_HEAD(&mem_device->res_list);
                 return -EINVAL;
         }
 
@@ -192,7 +196,7 @@ static int acpi_memory_check_device(struct acpi_memory_device *mem_device)
 
 
         /* Get device present/absent information from the _STA */
-        if (ACPI_FAILURE(acpi_evaluate_integer(mem_device->handle, "_STA",
+        if (ACPI_FAILURE(acpi_evaluate_integer(mem_device->device->handle, "_STA",
                                                NULL, &current_status)))
                 return -ENODEV;
         /*
@@ -222,7 +226,7 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
                 return result;
         }
 
-        node = acpi_get_node(mem_device->handle);
+        node = acpi_get_node(mem_device->device->handle);
         /*
          * Tell the VM there is more memory here...
          * Note: Assume that this function returns zero on success
@@ -230,17 +234,10 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
          * (i.e. memory-hot-remove function)
          */
         list_for_each_entry(info, &mem_device->res_list, list) {
-                u64 start_pfn, end_pfn;
-
-                start_pfn = info->start_addr >> PAGE_SHIFT;
-                end_pfn = (info->start_addr + info->length - 1) >> PAGE_SHIFT;
-
-                if (pfn_valid(start_pfn) || pfn_valid(end_pfn)) {
-                        /* already enabled. try next area */
+                if (info->enabled) { /* just sanity check...*/
                         num_enabled++;
                         continue;
                 }
-
                 result = add_memory(node, info->start_addr, info->length);
                 if (result)
                         continue;
@@ -269,7 +266,7 @@ static int acpi_memory_powerdown_device(struct acpi_memory_device *mem_device)
         arg_list.pointer = &arg;
         arg.type = ACPI_TYPE_INTEGER;
         arg.integer.value = 1;
-        status = acpi_evaluate_object(mem_device->handle,
+        status = acpi_evaluate_object(mem_device->device->handle,
                                       "_EJ0", &arg_list, NULL);
         /* Return on _EJ0 failure */
         if (ACPI_FAILURE(status)) {
@@ -278,7 +275,7 @@ static int acpi_memory_powerdown_device(struct acpi_memory_device *mem_device)
         }
 
         /* Evalute _STA to check if the device is disabled */
-        status = acpi_evaluate_integer(mem_device->handle, "_STA",
+        status = acpi_evaluate_integer(mem_device->device->handle, "_STA",
                                        NULL, &current_status);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
@@ -398,7 +395,7 @@ static int acpi_memory_device_add(struct acpi_device *device)
         memset(mem_device, 0, sizeof(struct acpi_memory_device));
 
         INIT_LIST_HEAD(&mem_device->res_list);
-        mem_device->handle = device->handle;
+        mem_device->device = device;
         sprintf(acpi_device_name(device), "%s", ACPI_MEMORY_DEVICE_NAME);
         sprintf(acpi_device_class(device), "%s", ACPI_MEMORY_DEVICE_CLASS);
         acpi_driver_data(device) = mem_device;
@@ -466,7 +463,7 @@ static acpi_status is_memory_device(acpi_handle handle)
 
         info = buffer.pointer;
         if (!(info->valid & ACPI_VALID_HID)) {
-                acpi_os_free(buffer.pointer);
+                kfree(buffer.pointer);
                 return AE_ERROR;
         }
 
@@ -475,7 +472,7 @@ static acpi_status is_memory_device(acpi_handle handle)
             (strcmp(hardware_id, ACPI_MEMORY_DEVICE_HID)))
                 status = AE_ERROR;
 
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
         return status;
 }
 
@@ -487,10 +484,8 @@ acpi_memory_register_notify_handler(acpi_handle handle,
 
 
         status = is_memory_device(handle);
-        if (ACPI_FAILURE(status)){
-                ACPI_EXCEPTION((AE_INFO, status, "handle is no memory device"));
+        if (ACPI_FAILURE(status))
                 return AE_OK;   /* continue */
-        }
 
         status = acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                                              acpi_memory_device_notify, NULL);
@@ -506,10 +501,8 @@ acpi_memory_deregister_notify_handler(acpi_handle handle,
 
 
         status = is_memory_device(handle);
-        if (ACPI_FAILURE(status)){
-                ACPI_EXCEPTION((AE_INFO, status, "handle is no memory device"));
+        if (ACPI_FAILURE(status))
                 return AE_OK;   /* continue */
-        }
 
         status = acpi_remove_notify_handler(handle,
                                             ACPI_SYSTEM_NOTIFY,
diff --git a/drivers/acpi/asus_acpi.c b/drivers/acpi/asus_acpi.c
index 055cfd5c8766..e9ee4c52a5f6 100644
--- a/drivers/acpi/asus_acpi.c
+++ b/drivers/acpi/asus_acpi.c
@@ -2,7 +2,7 @@
  *  asus_acpi.c - Asus Laptop ACPI Extras
  *
  *
- *  Copyright (C) 2002, 2003, 2004 Julien Lerouge, Karol Kozimor
+ *  Copyright (C) 2002-2005 Julien Lerouge, 2003-2006 Karol Kozimor
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -26,11 +26,8 @@
  *  Pontus Fuchs   - Helper functions, cleanup
  *  Johann Wiesner - Small compile fixes
  *  John Belmonte  - ACPI code for Toshiba laptop was a good starting point.
+ *  Éric Burghard  - LED display support for W1N
  *
- *  TODO:
- *  add Fn key status
- *  Add mode selection on module loading (parameter) -> still necessary?
- *  Complete display switching -- may require dirty hacks or calling _DOS?
  */
 
 #include <linux/kernel.h>
@@ -42,12 +39,14 @@
 #include <acpi/acpi_bus.h>
 #include <asm/uaccess.h>
 
-#define ASUS_ACPI_VERSION "0.29"
+#define ASUS_ACPI_VERSION "0.30"
 
 #define PROC_ASUS       "asus"  //the directory
 #define PROC_MLED       "mled"
 #define PROC_WLED       "wled"
 #define PROC_TLED       "tled"
+#define PROC_BT         "bluetooth"
+#define PROC_LEDD       "ledd"
 #define PROC_INFO       "info"
 #define PROC_LCD        "lcd"
 #define PROC_BRN        "brn"
@@ -67,9 +66,10 @@
 /*
  * Flags for hotk status
  */
-#define MLED_ON     0x01        //is MLED ON ?
-#define WLED_ON     0x02
-#define TLED_ON     0x04
+#define MLED_ON     0x01        //mail LED
+#define WLED_ON     0x02        //wireless LED
+#define TLED_ON     0x04        //touchpad LED
+#define BT_ON       0x08        //internal Bluetooth
 
 MODULE_AUTHOR("Julien Lerouge, Karol Kozimor");
 MODULE_DESCRIPTION(ACPI_HOTK_NAME);
@@ -92,7 +92,10 @@ struct model_data {
         char *wled_status;      //node to handle wled reading_______A
         char *mt_tled;          //method to handle tled_____________R
         char *tled_status;      //node to handle tled reading_______A
-        char *mt_lcd_switch;    //method to turn LCD ON/OFF_________A
+        char *mt_ledd;          //method to handle LED display______R
+        char *mt_bt_switch;     //method to switch Bluetooth on/off_R
+        char *bt_status;        //no model currently supports this__?
+        char *mt_lcd_switch;    //method to turn LCD on/off_________A
         char *lcd_status;       //node to read LCD panel state______A
         char *brightness_up;    //method to set brightness up_______A
         char *brightness_down;  //guess what ?______________________A
@@ -111,27 +114,31 @@ struct asus_hotk {
         struct acpi_device *device;     //the device we are in
         acpi_handle handle;     //the handle of the hotk device
         char status;            //status of the hotk, for LEDs, ...
+        u32 ledd_status;        //status of the LED display
         struct model_data *methods;     //methods available on the laptop
         u8 brightness;          //brightness level
         enum {
                 A1x = 0,        //A1340D, A1300F
                 A2x,            //A2500H
+                A4G,            //A4700G
                 D1x,            //D1
                 L2D,            //L2000D
                 L3C,            //L3800C
                 L3D,            //L3400D
-                L3H,            //L3H, but also L2000E
+                L3H,            //L3H, L2000E, L5D
                 L4R,            //L4500R
                 L5x,            //L5800C 
                 L8L,            //L8400L
                 M1A,            //M1300A
                 M2E,            //M2400E, L4400L
-                M6N,            //M6800N
-                M6R,            //M6700R
+                M6N,            //M6800N, W3400N
+                M6R,            //M6700R, A3000G
                 P30,            //Samsung P30
                 S1x,            //S1300A, but also L1400B and M2400A (L84F)
                 S2x,            //S200 (J1 reported), Victor MP-XP7210
-                xxN,            //M2400N, M3700N, M5200N, S1300N, S5200N, W1OOON
+                W1N,            //W1000N
+                W5A,            //W5A
+                xxN,            //M2400N, M3700N, M5200N, M6800N, S1300N, S5200N
                 //(Centrino)
                 END_MODEL
         } model;                //Models currently supported
@@ -149,17 +156,8 @@ struct asus_hotk {
 
 static struct model_data model_conf[END_MODEL] = {
         /*
-         * Those pathnames are relative to the HOTK / ATKD device :
-         *       - mt_mled
-         *       - mt_wled
-         *       - brightness_set
-         *       - brightness_get
-         *       - display_set
-         *       - display_get
-         *
          * TODO I have seen a SWBX and AIBX method on some models, like L1400B,
          * it seems to be a kind of switch, but what for ?
-         *
          */
 
         {
@@ -184,6 +182,16 @@ static struct model_data model_conf[END_MODEL] = {
          .display_get = "\\INFB"},
 
         {
+         .name = "A4G",
+         .mt_mled = "MLED",
+/* WLED present, but not controlled by ACPI */
+         .mt_lcd_switch = xxN_PREFIX "_Q10",
+         .brightness_set = "SPLV",
+         .brightness_get = "GPLV",
+         .display_set = "SDSP",
+         .display_get = "\\ADVG"},
+
+        {
          .name = "D1x",
          .mt_mled = "MLED",
          .mt_lcd_switch = "\\Q0D",
@@ -302,7 +310,8 @@ static struct model_data model_conf[END_MODEL] = {
          .brightness_set = "SPLV",
          .brightness_get = "GPLV",
          .display_set = "SDSP",
-         .display_get = "\\_SB.PCI0.P0P1.VGA.GETD"},
+         .display_get = "\\SSTE"},
+
         {
          .name = "M6R",
          .mt_mled = "MLED",
@@ -312,7 +321,7 @@ static struct model_data model_conf[END_MODEL] = {
          .brightness_set = "SPLV",
          .brightness_get = "GPLV",
          .display_set = "SDSP",
-         .display_get = "\\SSTE"},
+         .display_get = "\\_SB.PCI0.P0P1.VGA.GETD"},
 
         {
          .name = "P30",
@@ -345,6 +354,28 @@ static struct model_data model_conf[END_MODEL] = {
          .brightness_down = S2x_PREFIX "_Q0A"},
 
         {
+         .name = "W1N",
+         .mt_mled = "MLED",
+         .mt_wled = "WLED",
+         .mt_ledd = "SLCM",
+         .mt_lcd_switch = xxN_PREFIX "_Q10",
+         .lcd_status = "\\BKLT",
+         .brightness_set = "SPLV",
+         .brightness_get = "GPLV",
+         .display_set = "SDSP",
+         .display_get = "\\ADVG"},
+
+        {
+         .name = "W5A",
+         .mt_bt_switch = "BLED",
+         .mt_wled = "WLED",
+         .mt_lcd_switch = xxN_PREFIX "_Q10",
+         .brightness_set = "SPLV",
+         .brightness_get = "GPLV",
+         .display_set = "SDSP",
+         .display_get = "\\ADVG"},
+
+        {
          .name = "xxN",
          .mt_mled = "MLED",
 /* WLED present, but not controlled by ACPI */
@@ -563,6 +594,36 @@ proc_write_mled(struct file *file, const char __user * buffer,
 }
 
 /*
+ * Proc handlers for LED display
+ */
+static int
+proc_read_ledd(char *page, char **start, off_t off, int count, int *eof,
+               void *data)
+{
+        return sprintf(page, "0x%08x\n", hotk->ledd_status);
+}
+
+static int
+proc_write_ledd(struct file *file, const char __user * buffer,
+                unsigned long count, void *data)
+{
+        int value;
+
+        count = parse_arg(buffer, count, &value);
+        if (count > 0) {
+                if (!write_acpi_int
+                    (hotk->handle, hotk->methods->mt_ledd, value, NULL))
+                        printk(KERN_WARNING
+                               "Asus ACPI: LED display write failed\n");
+                else
+                        hotk->ledd_status = (u32) value;
+        } else if (count < 0)
+                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
+
+        return count;
+}
+
+/*
  * Proc handlers for WLED
  */
 static int
@@ -581,6 +642,25 @@ proc_write_wled(struct file *file, const char __user * buffer,
 }
 
 /*
+ * Proc handlers for Bluetooth
+ */
+static int
+proc_read_bluetooth(char *page, char **start, off_t off, int count, int *eof,
+                    void *data)
+{
+        return sprintf(page, "%d\n", read_led(hotk->methods->bt_status, BT_ON));
+}
+
+static int
+proc_write_bluetooth(struct file *file, const char __user * buffer,
+                     unsigned long count, void *data)
+{
+        /* Note: mt_bt_switch controls both internal Bluetooth adapter's 
+           presence and its LED */
+        return write_led(buffer, count, hotk->methods->mt_bt_switch, BT_ON, 0);
+}
+
+/*
  * Proc handlers for TLED
  */
 static int
@@ -876,6 +956,11 @@ static int asus_hotk_add_fs(struct acpi_device *device)
                               mode, device);
         }
 
+        if (hotk->methods->mt_ledd) {
+                asus_proc_add(PROC_LEDD, &proc_write_ledd, &proc_read_ledd,
+                              mode, device);
+        }
+
         if (hotk->methods->mt_mled) {
                 asus_proc_add(PROC_MLED, &proc_write_mled, &proc_read_mled,
                               mode, device);
@@ -886,6 +971,11 @@ static int asus_hotk_add_fs(struct acpi_device *device)
                               mode, device);
         }
 
+        if (hotk->methods->mt_bt_switch) {
+                asus_proc_add(PROC_BT, &proc_write_bluetooth,
+                              &proc_read_bluetooth, mode, device);
+        }
+
         /* 
          * We need both read node and write method as LCD switch is also accessible
          * from keyboard 
@@ -919,6 +1009,10 @@ static int asus_hotk_remove_fs(struct acpi_device *device)
                         remove_proc_entry(PROC_MLED, acpi_device_dir(device));
                 if (hotk->methods->mt_tled)
                         remove_proc_entry(PROC_TLED, acpi_device_dir(device));
+                if (hotk->methods->mt_ledd)
+                        remove_proc_entry(PROC_LEDD, acpi_device_dir(device));
+                if (hotk->methods->mt_bt_switch)
+                        remove_proc_entry(PROC_BT, acpi_device_dir(device));
                 if (hotk->methods->mt_lcd_switch && hotk->methods->lcd_status)
                         remove_proc_entry(PROC_LCD, acpi_device_dir(device));
                 if ((hotk->methods->brightness_up
@@ -951,6 +1045,65 @@ static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
 }
 
 /*
+ * Match the model string to the list of supported models. Return END_MODEL if
+ * no match or model is NULL.
+ */
+static int asus_model_match(char *model)
+{
+        if (model == NULL)
+                return END_MODEL;
+
+        if (strncmp(model, "L3D", 3) == 0)
+                return L3D;
+        else if (strncmp(model, "L2E", 3) == 0 ||
+                 strncmp(model, "L3H", 3) == 0 || strncmp(model, "L5D", 3) == 0)
+                return L3H;
+        else if (strncmp(model, "L3", 2) == 0 || strncmp(model, "L2B", 3) == 0)
+                return L3C;
+        else if (strncmp(model, "L8L", 3) == 0)
+                return L8L;
+        else if (strncmp(model, "L4R", 3) == 0)
+                return L4R;
+        else if (strncmp(model, "M6N", 3) == 0 || strncmp(model, "W3N", 3) == 0)
+                return M6N;
+        else if (strncmp(model, "M6R", 3) == 0 || strncmp(model, "A3G", 3) == 0)
+                return M6R;
+        else if (strncmp(model, "M2N", 3) == 0 ||
+                 strncmp(model, "M3N", 3) == 0 ||
+                 strncmp(model, "M5N", 3) == 0 ||
+                 strncmp(model, "M6N", 3) == 0 ||
+                 strncmp(model, "S1N", 3) == 0 ||
+                 strncmp(model, "S5N", 3) == 0 || strncmp(model, "W1N", 3) == 0)
+                return xxN;
+        else if (strncmp(model, "M1", 2) == 0)
+                return M1A;
+        else if (strncmp(model, "M2", 2) == 0 || strncmp(model, "L4E", 3) == 0)
+                return M2E;
+        else if (strncmp(model, "L2", 2) == 0)
+                return L2D;
+        else if (strncmp(model, "L8", 2) == 0)
+                return S1x;
+        else if (strncmp(model, "D1", 2) == 0)
+                return D1x;
+        else if (strncmp(model, "A1", 2) == 0)
+                return A1x;
+        else if (strncmp(model, "A2", 2) == 0)
+                return A2x;
+        else if (strncmp(model, "J1", 2) == 0)
+                return S2x;
+        else if (strncmp(model, "L5", 2) == 0)
+                return L5x;
+        else if (strncmp(model, "A4G", 3) == 0)
+                return A4G;
+        else if (strncmp(model, "W1N", 3) == 0)
+                return W1N;
+        else if (strncmp(model, "W5A", 3) == 0)
+                return W5A;
+        else
+                return END_MODEL;
+}
+
+/*
  * This function is used to initialize the hotk with right values. In this
  * method, we can make all the detection we want, and modify the hotk struct
  */
@@ -960,6 +1113,7 @@ static int asus_hotk_get_info(void)
         struct acpi_buffer dsdt = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *model = NULL;
         int bsts_result;
+        char *string = NULL;
         acpi_status status;
 
         /*
@@ -989,114 +1143,73 @@ static int asus_hotk_get_info(void)
                 printk(KERN_NOTICE "  BSTS called, 0x%02x returned\n",
                        bsts_result);
 
-        /* This is unlikely with implicit return */
-        if (buffer.pointer == NULL)
-                return -EINVAL;
-
-        model = (union acpi_object *) buffer.pointer;
         /*
-         * Samsung P30 has a device with a valid _HID whose INIT does not 
-         * return anything. It used to be possible to catch this exception,
-         * but the implicit return code will now happily confuse the 
-         * driver. We assume that every ACPI_TYPE_STRING is a valid model
-         * identifier but it's still possible to get completely bogus data.
+         * Try to match the object returned by INIT to the specific model.
+         * Handle every possible object (or the lack of thereof) the DSDT 
+         * writers might throw at us. When in trouble, we pass NULL to 
+         * asus_model_match() and try something completely different.
          */
-        if (model->type == ACPI_TYPE_STRING) {
-                printk(KERN_NOTICE "  %s model detected, ", model->string.pointer);
-        } else {
-                if (asus_info &&        /* Samsung P30 */
+        if (buffer.pointer) {
+                model = (union acpi_object *)buffer.pointer;
+                switch (model->type) {
+                case ACPI_TYPE_STRING:
+                        string = model->string.pointer;
+                        break;
+                case ACPI_TYPE_BUFFER:
+                        string = model->buffer.pointer;
+                        break;
+                default:
+                        kfree(model);
+                        break;
+                }
+        }
+        hotk->model = asus_model_match(string);
+        if (hotk->model == END_MODEL) { /* match failed */
+                if (asus_info &&
                     strncmp(asus_info->oem_table_id, "ODEM", 4) == 0) {
                         hotk->model = P30;
                         printk(KERN_NOTICE
                                "  Samsung P30 detected, supported\n");
                 } else {
                         hotk->model = M2E;
-                        printk(KERN_WARNING "  no string returned by INIT\n");
-                        printk(KERN_WARNING "  trying default values, supply "
-                               "the developers with your DSDT\n");
+                        printk(KERN_NOTICE "  unsupported model %s, trying "
+                               "default values\n", string);
+                        printk(KERN_NOTICE
+                               "  send /proc/acpi/dsdt to the developers\n");
                 }
                 hotk->methods = &model_conf[hotk->model];
-                
-                acpi_os_free(model);
-
                 return AE_OK;
         }
-
-        hotk->model = END_MODEL;
-        if (strncmp(model->string.pointer, "L3D", 3) == 0)
-                hotk->model = L3D;
-        else if (strncmp(model->string.pointer, "L3H", 3) == 0 ||
-                 strncmp(model->string.pointer, "L2E", 3) == 0)
-                hotk->model = L3H;
-        else if (strncmp(model->string.pointer, "L3", 2) == 0 ||
-                 strncmp(model->string.pointer, "L2B", 3) == 0)
-                hotk->model = L3C;
-        else if (strncmp(model->string.pointer, "L8L", 3) == 0)
-                hotk->model = L8L;
-        else if (strncmp(model->string.pointer, "L4R", 3) == 0)
-                hotk->model = L4R;
-        else if (strncmp(model->string.pointer, "M6N", 3) == 0)
-                hotk->model = M6N;
-        else if (strncmp(model->string.pointer, "M6R", 3) == 0)
-                hotk->model = M6R;
-        else if (strncmp(model->string.pointer, "M2N", 3) == 0 ||
-                 strncmp(model->string.pointer, "M3N", 3) == 0 ||
-                 strncmp(model->string.pointer, "M5N", 3) == 0 ||
-                 strncmp(model->string.pointer, "M6N", 3) == 0 ||
-                 strncmp(model->string.pointer, "S1N", 3) == 0 ||
-                 strncmp(model->string.pointer, "S5N", 3) == 0 ||
-                 strncmp(model->string.pointer, "W1N", 3) == 0)
-                hotk->model = xxN;
-        else if (strncmp(model->string.pointer, "M1", 2) == 0)
-                hotk->model = M1A;
-        else if (strncmp(model->string.pointer, "M2", 2) == 0 ||
-                 strncmp(model->string.pointer, "L4E", 3) == 0)
-                hotk->model = M2E;
-        else if (strncmp(model->string.pointer, "L2", 2) == 0)
-                hotk->model = L2D;
-        else if (strncmp(model->string.pointer, "L8", 2) == 0)
-                hotk->model = S1x;
-        else if (strncmp(model->string.pointer, "D1", 2) == 0)
-                hotk->model = D1x;
-        else if (strncmp(model->string.pointer, "A1", 2) == 0)
-                hotk->model = A1x;
-        else if (strncmp(model->string.pointer, "A2", 2) == 0)
-                hotk->model = A2x;
-        else if (strncmp(model->string.pointer, "J1", 2) == 0)
-                hotk->model = S2x;
-        else if (strncmp(model->string.pointer, "L5", 2) == 0)
-                hotk->model = L5x;
-
-        if (hotk->model == END_MODEL) {
-                printk("unsupported, trying default values, supply the "
-                       "developers with your DSDT\n");
-                hotk->model = M2E;
-        } else {
-                printk("supported\n");
-        }
-
         hotk->methods = &model_conf[hotk->model];
+        printk(KERN_NOTICE "  %s model detected, supported\n", string);
 
         /* Sort of per-model blacklist */
-        if (strncmp(model->string.pointer, "L2B", 3) == 0)
+        if (strncmp(string, "L2B", 3) == 0)
                 hotk->methods->lcd_status = NULL;
         /* L2B is similar enough to L3C to use its settings, with this only 
            exception */
-        else if (strncmp(model->string.pointer, "S5N", 3) == 0 ||
-                 strncmp(model->string.pointer, "M5N", 3) == 0)
+        else if (strncmp(string, "A3G", 3) == 0)
+                hotk->methods->lcd_status = "\\BLFG";
+        /* A3G is like M6R */
+        else if (strncmp(string, "S5N", 3) == 0 ||
+                 strncmp(string, "M5N", 3) == 0 ||
+                 strncmp(string, "W3N", 3) == 0)
                 hotk->methods->mt_mled = NULL;
-        /* S5N and M5N have no MLED */
-        else if (strncmp(model->string.pointer, "M2N", 3) == 0 ||
-                 strncmp(model->string.pointer, "W1N", 3) == 0)
+        /* S5N, M5N and W3N have no MLED */
+        else if (strncmp(string, "L5D", 3) == 0)
+                hotk->methods->mt_wled = NULL;
+        /* L5D's WLED is not controlled by ACPI */
+        else if (strncmp(string, "M2N", 3) == 0 ||
+                 strncmp(string, "S1N", 3) == 0)
                 hotk->methods->mt_wled = "WLED";
-        /* M2N and W1N have a usable WLED */
+        /* M2N and S1N have a usable WLED */
         else if (asus_info) {
                 if (strncmp(asus_info->oem_table_id, "L1", 2) == 0)
                         hotk->methods->mled_status = NULL;
                 /* S1300A reports L84F, but L1400B too, account for that */
         }
 
-        acpi_os_free(model);
+        kfree(model);
 
         return AE_OK;
 }
@@ -1164,8 +1277,7 @@ static int asus_hotk_add(struct acpi_device *device)
         /* For laptops without GPLV: init the hotk->brightness value */
         if ((!hotk->methods->brightness_get)
             && (!hotk->methods->brightness_status)
-            && (hotk->methods->brightness_up
-                && hotk->methods->brightness_down)) {
+            && (hotk->methods->brightness_up && hotk->methods->brightness_down)) {
                 status =
                     acpi_evaluate_object(NULL, hotk->methods->brightness_down,
                                          NULL, NULL);
@@ -1184,6 +1296,9 @@ static int asus_hotk_add(struct acpi_device *device)
 
         asus_hotk_found = 1;
 
+        /* LED display is off by default */
+        hotk->ledd_status = 0xFFF;
+
       end:
         if (result) {
                 kfree(hotk);
@@ -1256,7 +1371,7 @@ static void __exit asus_acpi_exit(void)
         acpi_bus_unregister_driver(&asus_hotk_driver);
         remove_proc_entry(PROC_ASUS, acpi_root_dir);
 
-        acpi_os_free(asus_info);
+        kfree(asus_info);
 
         return;
 }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 00b0728efe82..9810e2a55d0a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -59,6 +59,9 @@ ACPI_MODULE_NAME("acpi_battery")
 MODULE_DESCRIPTION(ACPI_BATTERY_DRIVER_NAME);
 MODULE_LICENSE("GPL");
 
+extern struct proc_dir_entry *acpi_lock_battery_dir(void);
+extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
+
 static int acpi_battery_add(struct acpi_device *device);
 static int acpi_battery_remove(struct acpi_device *device, int type);
 
@@ -108,7 +111,7 @@ struct acpi_battery_trips {
 };
 
 struct acpi_battery {
-        acpi_handle handle;
+        struct acpi_device * device;
         struct acpi_battery_flags flags;
         struct acpi_battery_trips trips;
         unsigned long alarm;
@@ -138,7 +141,7 @@ acpi_battery_get_info(struct acpi_battery *battery,
 
         /* Evalute _BIF */
 
-        status = acpi_evaluate_object(battery->handle, "_BIF", NULL, &buffer);
+        status = acpi_evaluate_object(battery->device->handle, "_BIF", NULL, &buffer);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _BIF"));
                 return -ENODEV;
@@ -171,7 +174,7 @@ acpi_battery_get_info(struct acpi_battery *battery,
         }
 
       end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         if (!result)
                 (*bif) = (struct acpi_battery_info *)data.pointer;
@@ -198,7 +201,7 @@ acpi_battery_get_status(struct acpi_battery *battery,
 
         /* Evalute _BST */
 
-        status = acpi_evaluate_object(battery->handle, "_BST", NULL, &buffer);
+        status = acpi_evaluate_object(battery->device->handle, "_BST", NULL, &buffer);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _BST"));
                 return -ENODEV;
@@ -231,7 +234,7 @@ acpi_battery_get_status(struct acpi_battery *battery,
         }
 
       end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         if (!result)
                 (*bst) = (struct acpi_battery_status *)data.pointer;
@@ -255,7 +258,7 @@ acpi_battery_set_alarm(struct acpi_battery *battery, unsigned long alarm)
 
         arg0.integer.value = alarm;
 
-        status = acpi_evaluate_object(battery->handle, "_BTP", &arg_list, NULL);
+        status = acpi_evaluate_object(battery->device->handle, "_BTP", &arg_list, NULL);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -278,9 +281,7 @@ static int acpi_battery_check(struct acpi_battery *battery)
         if (!battery)
                 return -EINVAL;
 
-        result = acpi_bus_get_device(battery->handle, &device);
-        if (result)
-                return result;
+        device = battery->device;
 
         result = acpi_bus_get_status(device);
         if (result)
@@ -305,7 +306,7 @@ static int acpi_battery_check(struct acpi_battery *battery)
 
                 /* See if alarms are supported, and if so, set default */
 
-                status = acpi_get_handle(battery->handle, "_BTP", &handle);
+                status = acpi_get_handle(battery->device->handle, "_BTP", &handle);
                 if (ACPI_SUCCESS(status)) {
                         battery->flags.alarm = 1;
                         acpi_battery_set_alarm(battery, battery->trips.warning);
@@ -556,7 +557,7 @@ static int acpi_battery_alarm_open_fs(struct inode *inode, struct file *file)
         return single_open(file, acpi_battery_read_alarm, PDE(inode)->data);
 }
 
-static struct file_operations acpi_battery_info_ops = {
+static const struct file_operations acpi_battery_info_ops = {
         .open = acpi_battery_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -564,7 +565,7 @@ static struct file_operations acpi_battery_info_ops = {
         .owner = THIS_MODULE,
 };
 
-static struct file_operations acpi_battery_state_ops = {
+static const struct file_operations acpi_battery_state_ops = {
         .open = acpi_battery_state_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -572,7 +573,7 @@ static struct file_operations acpi_battery_state_ops = {
         .owner = THIS_MODULE,
 };
 
-static struct file_operations acpi_battery_alarm_ops = {
+static const struct file_operations acpi_battery_alarm_ops = {
         .open = acpi_battery_alarm_open_fs,
         .read = seq_read,
         .write = acpi_battery_write_alarm,
@@ -662,12 +663,13 @@ static void acpi_battery_notify(acpi_handle handle, u32 event, void *data)
         if (!battery)
                 return;
 
-        if (acpi_bus_get_device(handle, &device))
-                return;
+        device = battery->device;
 
         switch (event) {
         case ACPI_BATTERY_NOTIFY_STATUS:
         case ACPI_BATTERY_NOTIFY_INFO:
+        case ACPI_NOTIFY_BUS_CHECK:
+        case ACPI_NOTIFY_DEVICE_CHECK:
                 acpi_battery_check(battery);
                 acpi_bus_generate_event(device, event, battery->flags.present);
                 break;
@@ -695,7 +697,7 @@ static int acpi_battery_add(struct acpi_device *device)
                 return -ENOMEM;
         memset(battery, 0, sizeof(struct acpi_battery));
 
-        battery->handle = device->handle;
+        battery->device = device;
         strcpy(acpi_device_name(device), ACPI_BATTERY_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_BATTERY_CLASS);
         acpi_driver_data(device) = battery;
@@ -708,8 +710,8 @@ static int acpi_battery_add(struct acpi_device *device)
         if (result)
                 goto end;
 
-        status = acpi_install_notify_handler(battery->handle,
-                                             ACPI_DEVICE_NOTIFY,
+        status = acpi_install_notify_handler(device->handle,
+                                             ACPI_ALL_NOTIFY,
                                              acpi_battery_notify, battery);
         if (ACPI_FAILURE(status)) {
                 result = -ENODEV;
@@ -740,8 +742,8 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
 
         battery = (struct acpi_battery *)acpi_driver_data(device);
 
-        status = acpi_remove_notify_handler(battery->handle,
-                                            ACPI_DEVICE_NOTIFY,
+        status = acpi_remove_notify_handler(device->handle,
+                                            ACPI_ALL_NOTIFY,
                                             acpi_battery_notify);
 
         acpi_battery_remove_fs(device);
@@ -753,17 +755,18 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
 
 static int __init acpi_battery_init(void)
 {
-        int result = 0;
+        int result;
 
+        if (acpi_disabled)
+                return -ENODEV;
 
-        acpi_battery_dir = proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
+        acpi_battery_dir = acpi_lock_battery_dir();
         if (!acpi_battery_dir)
                 return -ENODEV;
-        acpi_battery_dir->owner = THIS_MODULE;
 
         result = acpi_bus_register_driver(&acpi_battery_driver);
         if (result < 0) {
-                remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
+                acpi_unlock_battery_dir(acpi_battery_dir);
                 return -ENODEV;
         }
 
@@ -775,7 +778,7 @@ static void __exit acpi_battery_exit(void)
 
         acpi_bus_unregister_driver(&acpi_battery_driver);
 
-        remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
+        acpi_unlock_battery_dir(acpi_battery_dir);
 
         return;
 }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index ea5a0496a4fd..279c4bac92e5 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
+#include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/sched.h>
 #include <linux/pm.h>
@@ -68,7 +69,8 @@ int acpi_bus_get_device(acpi_handle handle, struct acpi_device **device)
 
         status = acpi_get_data(handle, acpi_bus_data_handler, (void **)device);
         if (ACPI_FAILURE(status) || !*device) {
-                ACPI_EXCEPTION((AE_INFO, status, "No context for object [%p]", handle));
+                ACPI_DEBUG_PRINT((ACPI_DB_INFO, "No context for object [%p]\n",
+                                  handle));
                 return -ENODEV;
         }
 
@@ -192,8 +194,8 @@ int acpi_bus_set_power(acpi_handle handle, int state)
         /* Make sure this is a valid target state */
 
         if (!device->flags.power_manageable) {
-                printk(KERN_DEBUG "Device `[%s]' is not power manageable",
-                                device->kobj.name);
+                ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device `[%s]' is not power manageable\n",
+                                device->kobj.name));
                 return -ENODEV;
         }
         /*
@@ -738,7 +740,10 @@ static int __init acpi_init(void)
                 return -ENODEV;
         }
 
-        firmware_register(&acpi_subsys);
+        result = firmware_register(&acpi_subsys);
+        if (result < 0)
+                printk(KERN_WARNING "%s: firmware_register error: %d\n",
+                        __FUNCTION__, result);
 
         result = acpi_bus_init();
 
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 02594639c4d9..5ef885e82c78 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -82,20 +82,19 @@ static struct acpi_driver acpi_button_driver = {
 };
 
 struct acpi_button {
-        acpi_handle handle;
         struct acpi_device *device;     /* Fixed button kludge */
         u8 type;
         unsigned long pushed;
 };
 
-static struct file_operations acpi_button_info_fops = {
+static const struct file_operations acpi_button_info_fops = {
         .open = acpi_button_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
         .release = single_release,
 };
 
-static struct file_operations acpi_button_state_fops = {
+static const struct file_operations acpi_button_state_fops = {
         .open = acpi_button_state_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -137,7 +136,7 @@ static int acpi_button_state_seq_show(struct seq_file *seq, void *offset)
         if (!button || !button->device)
                 return 0;
 
-        status = acpi_evaluate_integer(button->handle, "_LID", NULL, &state);
+        status = acpi_evaluate_integer(button->device->handle, "_LID", NULL, &state);
         if (ACPI_FAILURE(status)) {
                 seq_printf(seq, "state:      unsupported\n");
         } else {
@@ -282,7 +281,7 @@ static acpi_status acpi_button_notify_fixed(void *data)
         if (!button)
                 return AE_BAD_PARAMETER;
 
-        acpi_button_notify(button->handle, ACPI_BUTTON_NOTIFY_STATUS, button);
+        acpi_button_notify(button->device->handle, ACPI_BUTTON_NOTIFY_STATUS, button);
 
         return AE_OK;
 }
@@ -303,7 +302,6 @@ static int acpi_button_add(struct acpi_device *device)
         memset(button, 0, sizeof(struct acpi_button));
 
         button->device = device;
-        button->handle = device->handle;
         acpi_driver_data(device) = button;
 
         /*
@@ -362,7 +360,7 @@ static int acpi_button_add(struct acpi_device *device)
                                                      button);
                 break;
         default:
-                status = acpi_install_notify_handler(button->handle,
+                status = acpi_install_notify_handler(device->handle,
                                                      ACPI_DEVICE_NOTIFY,
                                                      acpi_button_notify,
                                                      button);
@@ -420,7 +418,7 @@ static int acpi_button_remove(struct acpi_device *device, int type)
                                                     acpi_button_notify_fixed);
                 break;
         default:
-                status = acpi_remove_notify_handler(button->handle,
+                status = acpi_remove_notify_handler(device->handle,
                                                     ACPI_DEVICE_NOTIFY,
                                                     acpi_button_notify);
                 break;
diff --git a/drivers/acpi/cm_sbs.c b/drivers/acpi/cm_sbs.c
new file mode 100644
index 000000000000..a01ce6700bfe
--- /dev/null
+++ b/drivers/acpi/cm_sbs.c
@@ -0,0 +1,113 @@
+/*
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or (at
+ *  your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/types.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <acpi/acpi_bus.h>
+#include <acpi/acpi_drivers.h>
+#include <acpi/acmacros.h>
+#include <acpi/actypes.h>
+#include <acpi/acutils.h>
+
+ACPI_MODULE_NAME("cm_sbs")
+#define ACPI_AC_CLASS           "ac_adapter"
+#define ACPI_BATTERY_CLASS      "battery"
+#define ACPI_SBS_COMPONENT      0x00080000
+#define _COMPONENT              ACPI_SBS_COMPONENT
+static struct proc_dir_entry *acpi_ac_dir;
+static struct proc_dir_entry *acpi_battery_dir;
+
+static DEFINE_MUTEX(cm_sbs_mutex);
+
+static int lock_ac_dir_cnt;
+static int lock_battery_dir_cnt;
+
+struct proc_dir_entry *acpi_lock_ac_dir(void)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (!acpi_ac_dir)
+                acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
+        if (acpi_ac_dir) {
+                lock_ac_dir_cnt++;
+        } else {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "Cannot create %s\n", ACPI_AC_CLASS));
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return acpi_ac_dir;
+}
+EXPORT_SYMBOL(acpi_lock_ac_dir);
+
+void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (acpi_ac_dir_param)
+                lock_ac_dir_cnt--;
+        if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
+                remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
+                acpi_ac_dir = 0;
+        }
+        mutex_unlock(&cm_sbs_mutex);
+}
+EXPORT_SYMBOL(acpi_unlock_ac_dir);
+
+struct proc_dir_entry *acpi_lock_battery_dir(void)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (!acpi_battery_dir) {
+                acpi_battery_dir =
+                    proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
+        }
+        if (acpi_battery_dir) {
+                lock_battery_dir_cnt++;
+        } else {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "Cannot create %s\n", ACPI_BATTERY_CLASS));
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return acpi_battery_dir;
+}
+EXPORT_SYMBOL(acpi_lock_battery_dir);
+
+void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (acpi_battery_dir_param)
+                lock_battery_dir_cnt--;
+        if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
+            && acpi_battery_dir) {
+                remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
+                acpi_battery_dir = 0;
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return;
+}
+EXPORT_SYMBOL(acpi_unlock_battery_dir);
+
+static int __init acpi_cm_sbs_init(void)
+{
+        return 0;
+}
+subsys_initcall(acpi_cm_sbs_init);
diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c
index 7f7e41d40a3b..871aa520ece7 100644
--- a/drivers/acpi/container.c
+++ b/drivers/acpi/container.c
@@ -236,7 +236,7 @@ container_walk_namespace_cb(acpi_handle handle,
         }
 
       end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         return AE_OK;
 }
diff --git a/drivers/acpi/dispatcher/dsinit.c b/drivers/acpi/dispatcher/dsinit.c
index daf51b5b5875..1888c055d10f 100644
--- a/drivers/acpi/dispatcher/dsinit.c
+++ b/drivers/acpi/dispatcher/dsinit.c
@@ -116,16 +116,6 @@ acpi_ds_init_one_object(acpi_handle obj_handle,
 
         case ACPI_TYPE_METHOD:
 
-                /*
-                 * Set the execution data width (32 or 64) based upon the
-                 * revision number of the parent ACPI table.
-                 * TBD: This is really for possible future support of integer width
-                 * on a per-table basis. Currently, we just use a global for the width.
-                 */
-                if (info->table_desc->pointer->revision == 1) {
-                        node->flags |= ANOBJ_DATA_WIDTH_32;
-                }
-
                 info->method_count++;
                 break;
 
diff --git a/drivers/acpi/dispatcher/dsmethod.c b/drivers/acpi/dispatcher/dsmethod.c
index a39a33f4847a..cf888add3191 100644
--- a/drivers/acpi/dispatcher/dsmethod.c
+++ b/drivers/acpi/dispatcher/dsmethod.c
@@ -134,7 +134,7 @@ acpi_ds_create_method_mutex(union acpi_operand_object *method_desc)
         union acpi_operand_object *mutex_desc;
         acpi_status status;
 
-        ACPI_FUNCTION_NAME(ds_create_method_mutex);
+        ACPI_FUNCTION_TRACE(ds_create_method_mutex);
 
         /* Create the new mutex object */
 
@@ -493,7 +493,7 @@ acpi_ds_restart_control_method(struct acpi_walk_state *walk_state,
 
         ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
                           "****Restart [%4.4s] Op %p ReturnValueFromCallee %p\n",
-                          (char *)&walk_state->method_node->name,
+                          acpi_ut_get_node_name(walk_state->method_node),
                           walk_state->method_call_op, return_desc));
 
         ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
@@ -610,6 +610,7 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
 
                         acpi_os_release_mutex(method_desc->method.mutex->mutex.
                                               os_mutex);
+                        method_desc->method.mutex->mutex.owner_thread = NULL;
                 }
         }
 
@@ -620,27 +621,11 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                  */
                 method_node = walk_state->method_node;
 
-                /* Lock namespace for possible update */
-
-                status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
-                if (ACPI_FAILURE(status)) {
-                        return_VOID;
-                }
-
-                /*
-                 * Delete any namespace entries created immediately underneath
-                 * the method
-                 */
-                if (method_node && method_node->child) {
-                        acpi_ns_delete_namespace_subtree(method_node);
-                }
-
                 /*
-                 * Delete any namespace entries created anywhere else within
+                 * Delete any namespace objects created anywhere within
                  * the namespace by the execution of this method
                  */
                 acpi_ns_delete_namespace_by_owner(method_desc->method.owner_id);
-                status = acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         }
 
         /* Decrement the thread count on the method */
diff --git a/drivers/acpi/dispatcher/dswexec.c b/drivers/acpi/dispatcher/dswexec.c
index b1ded62d0df1..d7a616c3104e 100644
--- a/drivers/acpi/dispatcher/dswexec.c
+++ b/drivers/acpi/dispatcher/dswexec.c
@@ -313,10 +313,10 @@ acpi_ds_exec_begin_op(struct acpi_walk_state *walk_state,
         case AML_CLASS_EXECUTE:
         case AML_CLASS_CREATE:
                 /*
-                 * Most operators with arguments.
+                 * Most operators with arguments (except create_xxx_field operators)
                  * Start a new result/operand state
                  */
-                if (walk_state->opcode != AML_CREATE_FIELD_OP) {
+                if (walk_state->op_info->object_type != ACPI_TYPE_BUFFER_FIELD) {
                         status = acpi_ds_result_stack_push(walk_state);
                 }
                 break;
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 510a94524298..578b99b71d9c 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -58,8 +58,8 @@ struct dock_dependent_device {
 };
 
 #define DOCK_DOCKING    0x00000001
-#define DOCK_EVENT      KOBJ_DOCK
-#define UNDOCK_EVENT    KOBJ_UNDOCK
+#define DOCK_EVENT      3
+#define UNDOCK_EVENT    2
 
 static struct dock_station *dock_station;
 
@@ -322,11 +322,10 @@ static void hotplug_dock_devices(struct dock_station *ds, u32 event)
 
 static void dock_event(struct dock_station *ds, u32 event, int num)
 {
-        struct acpi_device *device;
-
-        device = dock_create_acpi_device(ds->handle);
-        if (device)
-                kobject_uevent(&device->kobj, num);
+        /*
+         * we don't do events until someone tells me that
+         * they would like to have them.
+         */
 }
 
 /**
@@ -627,6 +626,7 @@ static int dock_add(acpi_handle handle)
         INIT_LIST_HEAD(&dock_station->hotplug_devices);
         spin_lock_init(&dock_station->dd_lock);
         spin_lock_init(&dock_station->hp_lock);
+        ATOMIC_INIT_NOTIFIER_HEAD(&dock_notifier_list);
 
         /* Find dependent devices */
         acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 8c5d7df7d343..e5d796362854 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -929,7 +929,7 @@ static int acpi_ec_info_open_fs(struct inode *inode, struct file *file)
         return single_open(file, acpi_ec_read_info, PDE(inode)->data);
 }
 
-static struct file_operations acpi_ec_info_ops = {
+static const struct file_operations acpi_ec_info_ops = {
         .open = acpi_ec_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
diff --git a/drivers/acpi/event.c b/drivers/acpi/event.c
index a901b23e95e7..959a893c8d1f 100644
--- a/drivers/acpi/event.c
+++ b/drivers/acpi/event.c
@@ -99,7 +99,7 @@ static unsigned int acpi_system_poll_event(struct file *file, poll_table * wait)
         return 0;
 }
 
-static struct file_operations acpi_system_event_ops = {
+static const struct file_operations acpi_system_event_ops = {
         .open = acpi_system_open_event,
         .read = acpi_system_read_event,
         .release = acpi_system_close_event,
diff --git a/drivers/acpi/events/evregion.c b/drivers/acpi/events/evregion.c
index 094a17e4c86d..21caae04fe85 100644
--- a/drivers/acpi/events/evregion.c
+++ b/drivers/acpi/events/evregion.c
@@ -528,34 +528,40 @@ acpi_ev_detach_region(union acpi_operand_object *region_obj,
                                 }
                         }
 
-                        /* Call the setup handler with the deactivate notification */
+                        /*
+                         * If the region has been activated, call the setup handler
+                         * with the deactivate notification
+                         */
+                        if (region_obj->region.flags & AOPOBJ_SETUP_COMPLETE) {
+                                region_setup = handler_obj->address_space.setup;
+                                status =
+                                    region_setup(region_obj,
+                                                 ACPI_REGION_DEACTIVATE,
+                                                 handler_obj->address_space.
+                                                 context, region_context);
 
-                        region_setup = handler_obj->address_space.setup;
-                        status =
-                            region_setup(region_obj, ACPI_REGION_DEACTIVATE,
-                                         handler_obj->address_space.context,
-                                         region_context);
+                                /* Init routine may fail, Just ignore errors */
 
-                        /* Init routine may fail, Just ignore errors */
+                                if (ACPI_FAILURE(status)) {
+                                        ACPI_EXCEPTION((AE_INFO, status,
+                                                        "from region handler - deactivate, [%s]",
+                                                        acpi_ut_get_region_name
+                                                        (region_obj->region.
+                                                         space_id)));
+                                }
 
-                        if (ACPI_FAILURE(status)) {
-                                ACPI_EXCEPTION((AE_INFO, status,
-                                                "from region init, [%s]",
-                                                acpi_ut_get_region_name
-                                                (region_obj->region.space_id)));
+                                region_obj->region.flags &=
+                                    ~(AOPOBJ_SETUP_COMPLETE);
                         }
 
-                        region_obj->region.flags &= ~(AOPOBJ_SETUP_COMPLETE);
-
                         /*
                          * Remove handler reference in the region
                          *
-                         * NOTE: this doesn't mean that the region goes away
-                         * The region is just inaccessible as indicated to
-                         * the _REG method
+                         * NOTE: this doesn't mean that the region goes away, the region
+                         * is just inaccessible as indicated to the _REG method
                          *
-                         * If the region is on the handler's list
-                         * this better be the region's handler
+                         * If the region is on the handler's list, this must be the
+                         * region's handler
                          */
                         region_obj->region.handler = NULL;
                         acpi_ut_remove_reference(handler_obj);
diff --git a/drivers/acpi/events/evxface.c b/drivers/acpi/events/evxface.c
index 4f948df17ab9..923fd2b46955 100644
--- a/drivers/acpi/events/evxface.c
+++ b/drivers/acpi/events/evxface.c
@@ -428,7 +428,7 @@ acpi_remove_notify_handler(acpi_handle device,
         node = acpi_ns_map_handle_to_node(device);
         if (!node) {
                 status = AE_BAD_PARAMETER;
-                goto unlock;
+                goto unlock_and_exit;
         }
 
         /* Root Object */
@@ -442,7 +442,7 @@ acpi_remove_notify_handler(acpi_handle device,
                     ((handler_type & ACPI_DEVICE_NOTIFY) &&
                      !acpi_gbl_device_notify.handler)) {
                         status = AE_NOT_EXIST;
-                        goto unlock;
+                        goto unlock_and_exit;
                 }
 
                 /* Make sure all deferred tasks are completed */
@@ -474,7 +474,7 @@ acpi_remove_notify_handler(acpi_handle device,
 
                 if (!acpi_ev_is_notify_object(node)) {
                         status = AE_TYPE;
-                        goto unlock;
+                        goto unlock_and_exit;
                 }
 
                 /* Check for an existing internal object */
@@ -482,17 +482,21 @@ acpi_remove_notify_handler(acpi_handle device,
                 obj_desc = acpi_ns_get_attached_object(node);
                 if (!obj_desc) {
                         status = AE_NOT_EXIST;
-                        goto unlock;
+                        goto unlock_and_exit;
                 }
 
                 /* Object exists - make sure there's an existing handler */
 
                 if (handler_type & ACPI_SYSTEM_NOTIFY) {
                         notify_obj = obj_desc->common_notify.system_notify;
-                        if ((!notify_obj) ||
-                            (notify_obj->notify.handler != handler)) {
+                        if (!notify_obj) {
+                                status = AE_NOT_EXIST;
+                                goto unlock_and_exit;
+                        }
+
+                        if (notify_obj->notify.handler != handler) {
                                 status = AE_BAD_PARAMETER;
-                                goto unlock;
+                                goto unlock_and_exit;
                         }
                         /* Make sure all deferred tasks are completed */
 
@@ -510,10 +514,14 @@ acpi_remove_notify_handler(acpi_handle device,
 
                 if (handler_type & ACPI_DEVICE_NOTIFY) {
                         notify_obj = obj_desc->common_notify.device_notify;
-                        if ((!notify_obj) ||
-                            (notify_obj->notify.handler != handler)) {
+                        if (!notify_obj) {
+                                status = AE_NOT_EXIST;
+                                goto unlock_and_exit;
+                        }
+
+                        if (notify_obj->notify.handler != handler) {
                                 status = AE_BAD_PARAMETER;
-                                goto unlock;
+                                goto unlock_and_exit;
                         }
                         /* Make sure all deferred tasks are completed */
 
@@ -530,9 +538,9 @@ acpi_remove_notify_handler(acpi_handle device,
                 }
         }
 
-unlock:
+      unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
-exit:
+      exit:
         if (ACPI_FAILURE(status))
                 ACPI_EXCEPTION((AE_INFO, status, "Removing notify handler"));
         return_ACPI_STATUS(status);
@@ -586,7 +594,7 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
         gpe_event_info = acpi_ev_get_gpe_event_info(gpe_device, gpe_number);
         if (!gpe_event_info) {
                 status = AE_BAD_PARAMETER;
-                goto unlock;
+                goto unlock_and_exit;
         }
 
         /* Make sure that there isn't a handler there already */
@@ -594,7 +602,7 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
         if ((gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK) ==
             ACPI_GPE_DISPATCH_HANDLER) {
                 status = AE_ALREADY_EXISTS;
-                goto unlock;
+                goto unlock_and_exit;
         }
 
         /* Allocate and init handler object */
@@ -602,7 +610,7 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
         handler = ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_handler_info));
         if (!handler) {
                 status = AE_NO_MEMORY;
-                goto unlock;
+                goto unlock_and_exit;
         }
 
         handler->address = address;
@@ -613,7 +621,7 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
 
         status = acpi_ev_disable_gpe(gpe_event_info);
         if (ACPI_FAILURE(status)) {
-                goto unlock;
+                goto unlock_and_exit;
         }
 
         /* Install the handler */
@@ -628,9 +636,9 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
 
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
 
-unlock:
+      unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
-exit:
+      exit:
         if (ACPI_FAILURE(status))
                 ACPI_EXCEPTION((AE_INFO, status,
                                 "Installing notify handler failed"));
diff --git a/drivers/acpi/events/evxfregn.c b/drivers/acpi/events/evxfregn.c
index e8b86a0baad0..83b12a9afa32 100644
--- a/drivers/acpi/events/evxfregn.c
+++ b/drivers/acpi/events/evxfregn.c
@@ -155,7 +155,11 @@ acpi_remove_address_space_handler(acpi_handle device,
         /* Convert and validate the device handle */
 
         node = acpi_ns_map_handle_to_node(device);
-        if (!node) {
+        if (!node ||
+            ((node->type != ACPI_TYPE_DEVICE) &&
+             (node->type != ACPI_TYPE_PROCESSOR) &&
+             (node->type != ACPI_TYPE_THERMAL) &&
+             (node != acpi_gbl_root_node))) {
                 status = AE_BAD_PARAMETER;
                 goto unlock_and_exit;
         }
@@ -178,6 +182,13 @@ acpi_remove_address_space_handler(acpi_handle device,
 
                 if (handler_obj->address_space.space_id == space_id) {
 
+                        /* Handler must be the same as the installed handler */
+
+                        if (handler_obj->address_space.handler != handler) {
+                                status = AE_BAD_PARAMETER;
+                                goto unlock_and_exit;
+                        }
+
                         /* Matched space_id, first dereference this in the Regions */
 
                         ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index 83fed079a276..c8341fa5fe01 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -502,7 +502,6 @@ acpi_status acpi_ex_unload_table(union acpi_operand_object *ddb_handle)
          * (Offset contains the table_id)
          */
         acpi_ns_delete_namespace_by_owner(table_info->owner_id);
-        acpi_ut_release_owner_id(&table_info->owner_id);
 
         /* Delete the table itself */
 
diff --git a/drivers/acpi/executer/exconvrt.c b/drivers/acpi/executer/exconvrt.c
index b732e399b1ef..544e81a6a438 100644
--- a/drivers/acpi/executer/exconvrt.c
+++ b/drivers/acpi/executer/exconvrt.c
@@ -170,6 +170,9 @@ acpi_ex_convert_to_integer(union acpi_operand_object *obj_desc,
                 return_ACPI_STATUS(AE_NO_MEMORY);
         }
 
+        ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Converted value: %8.8X%8.8X\n",
+                          ACPI_FORMAT_UINT64(result)));
+
         /* Save the Result */
 
         return_desc->integer.value = result;
diff --git a/drivers/acpi/executer/exmutex.c b/drivers/acpi/executer/exmutex.c
index d8ac2877cf05..3a39c2e8e104 100644
--- a/drivers/acpi/executer/exmutex.c
+++ b/drivers/acpi/executer/exmutex.c
@@ -267,9 +267,9 @@ acpi_ex_release_mutex(union acpi_operand_object *obj_desc,
             && (obj_desc->mutex.os_mutex != ACPI_GLOBAL_LOCK)) {
                 ACPI_ERROR((AE_INFO,
                             "Thread %X cannot release Mutex [%4.4s] acquired by thread %X",
-                            walk_state->thread->thread_id,
+                            (u32) walk_state->thread->thread_id,
                             acpi_ut_get_node_name(obj_desc->mutex.node),
-                            obj_desc->mutex.owner_thread->thread_id));
+                            (u32) obj_desc->mutex.owner_thread->thread_id));
                 return_ACPI_STATUS(AE_AML_NOT_OWNER);
         }
 
diff --git a/drivers/acpi/executer/exsystem.c b/drivers/acpi/executer/exsystem.c
index 6b5d1e6ce94b..28aef3e69ecc 100644
--- a/drivers/acpi/executer/exsystem.c
+++ b/drivers/acpi/executer/exsystem.c
@@ -60,7 +60,7 @@ ACPI_MODULE_NAME("exsystem")
  *
  * DESCRIPTION: Implements a semaphore wait with a check to see if the
  *              semaphore is available immediately.  If it is not, the
- *              interpreter is released.
+ *              interpreter is released before waiting.
  *
  ******************************************************************************/
 acpi_status acpi_ex_system_wait_semaphore(acpi_semaphore semaphore, u16 timeout)
@@ -110,9 +110,9 @@ acpi_status acpi_ex_system_wait_semaphore(acpi_semaphore semaphore, u16 timeout)
  *
  * RETURN:      Status
  *
- * DESCRIPTION: Implements a semaphore wait with a check to see if the
- *              semaphore is available immediately.  If it is not, the
- *              interpreter is released.
+ * DESCRIPTION: Implements a mutex wait with a check to see if the
+ *              mutex is available immediately.  If it is not, the
+ *              interpreter is released before waiting.
  *
  ******************************************************************************/
 
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 38acc69b21bc..045c89477e59 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -64,7 +64,7 @@ static struct acpi_driver acpi_fan_driver = {
 };
 
 struct acpi_fan {
-        acpi_handle handle;
+        struct acpi_device * device;
 };
 
 /* --------------------------------------------------------------------------
@@ -80,7 +80,7 @@ static int acpi_fan_read_state(struct seq_file *seq, void *offset)
 
 
         if (fan) {
-                if (acpi_bus_get_power(fan->handle, &state))
+                if (acpi_bus_get_power(fan->device->handle, &state))
                         seq_printf(seq, "status:                  ERROR\n");
                 else
                         seq_printf(seq, "status:                  %s\n",
@@ -112,7 +112,7 @@ acpi_fan_write_state(struct file *file, const char __user * buffer,
 
         state_string[count] = '\0';
 
-        result = acpi_bus_set_power(fan->handle,
+        result = acpi_bus_set_power(fan->device->handle,
                                     simple_strtoul(state_string, NULL, 0));
         if (result)
                 return result;
@@ -120,7 +120,7 @@ acpi_fan_write_state(struct file *file, const char __user * buffer,
         return count;
 }
 
-static struct file_operations acpi_fan_state_ops = {
+static const struct file_operations acpi_fan_state_ops = {
         .open = acpi_fan_state_open_fs,
         .read = seq_read,
         .write = acpi_fan_write_state,
@@ -191,12 +191,12 @@ static int acpi_fan_add(struct acpi_device *device)
                 return -ENOMEM;
         memset(fan, 0, sizeof(struct acpi_fan));
 
-        fan->handle = device->handle;
+        fan->device = device;
         strcpy(acpi_device_name(device), "Fan");
         strcpy(acpi_device_class(device), ACPI_FAN_CLASS);
         acpi_driver_data(device) = fan;
 
-        result = acpi_bus_get_power(fan->handle, &state);
+        result = acpi_bus_get_power(device->handle, &state);
         if (result) {
                 printk(KERN_ERR PREFIX "Reading power state\n");
                 goto end;
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 8daef57b994c..10f160dc75b1 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -152,7 +152,7 @@ static int get_root_bridge_busnr(acpi_handle handle)
                 bbn = bus;
         }
       exit:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
         return (int)bbn;
 }
 
@@ -192,7 +192,7 @@ find_pci_rootbridge(acpi_handle handle, u32 lvl, void *context, void **rv)
                 find->handle = handle;
         status = AE_OK;
       exit:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
         return status;
 }
 
@@ -224,7 +224,7 @@ do_acpi_find_child(acpi_handle handle, u32 lvl, void *context, void **rv)
                 info = buffer.pointer;
                 if (info->address == find->address)
                         find->handle = handle;
-                acpi_os_free(buffer.pointer);
+                kfree(buffer.pointer);
         }
         return AE_OK;
 }
@@ -330,7 +330,7 @@ static int acpi_platform_notify(struct device *dev)
 
                 acpi_get_name(dev->firmware_data, ACPI_FULL_PATHNAME, &buffer);
                 DBG("Device %s -> %s\n", dev->bus_id, (char *)buffer.pointer);
-                acpi_os_free(buffer.pointer);
+                kfree(buffer.pointer);
         } else
                 DBG("Device %s -> No ACPI support\n", dev->bus_id);
 #endif
diff --git a/drivers/acpi/hotkey.c b/drivers/acpi/hotkey.c
index fd81a0f5222f..1ba2db671865 100644
--- a/drivers/acpi/hotkey.c
+++ b/drivers/acpi/hotkey.c
@@ -91,6 +91,14 @@ enum {
         HK_EVENT_ENTERRING_S5,
 };
 
+enum conf_entry_enum {
+        bus_handle = 0,
+        bus_method = 1,
+        action_handle = 2,
+        method = 3,
+        LAST_CONF_ENTRY
+};
+
 /*  procdir we use */
 static struct proc_dir_entry *hotkey_proc_dir;
 static struct proc_dir_entry *hotkey_config;
@@ -184,7 +192,7 @@ static union acpi_hotkey *get_hotkey_by_event(struct
                                               *hotkey_list, int event);
 
 /* event based config */
-static struct file_operations hotkey_config_fops = {
+static const struct file_operations hotkey_config_fops = {
         .open = hotkey_open_config,
         .read = seq_read,
         .write = hotkey_write_config,
@@ -193,7 +201,7 @@ static struct file_operations hotkey_config_fops = {
 };
 
 /* polling based config */
-static struct file_operations hotkey_poll_config_fops = {
+static const struct file_operations hotkey_poll_config_fops = {
         .open = hotkey_poll_open_config,
         .read = seq_read,
         .write = hotkey_write_config,
@@ -202,7 +210,7 @@ static struct file_operations hotkey_poll_config_fops = {
 };
 
 /* hotkey driver info */
-static struct file_operations hotkey_info_fops = {
+static const struct file_operations hotkey_info_fops = {
         .open = hotkey_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -210,7 +218,7 @@ static struct file_operations hotkey_info_fops = {
 };
 
 /* action */
-static struct file_operations hotkey_action_fops = {
+static const struct file_operations hotkey_action_fops = {
         .open = hotkey_action_open_fs,
         .read = seq_read,
         .write = hotkey_execute_aml_method,
@@ -219,7 +227,7 @@ static struct file_operations hotkey_action_fops = {
 };
 
 /* polling results */
-static struct file_operations hotkey_polling_fops = {
+static const struct file_operations hotkey_polling_fops = {
         .open = hotkey_polling_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -244,19 +252,15 @@ static int hotkey_info_open_fs(struct inode *inode, struct file *file)
 
 static char *format_result(union acpi_object *object)
 {
-        char *buf = NULL;
-
-        buf = (char *)kmalloc(RESULT_STR_LEN, GFP_KERNEL);
-        if (buf)
-                memset(buf, 0, RESULT_STR_LEN);
-        else
-                goto do_fail;
+        char *buf;
 
+        buf = kzalloc(RESULT_STR_LEN, GFP_KERNEL);
+        if (!buf)
+                return NULL;
         /* Now, just support integer type */
         if (object->type == ACPI_TYPE_INTEGER)
                 sprintf(buf, "%d\n", (u32) object->integer.value);
-      do_fail:
-        return (buf);
+        return buf;
 }
 
 static int hotkey_polling_seq_show(struct seq_file *seq, void *offset)
@@ -486,98 +490,102 @@ static void free_hotkey_device(union acpi_hotkey *key)
 
 static void free_hotkey_buffer(union acpi_hotkey *key)
 {
+        /* key would never be null, action method could be */
         kfree(key->event_hotkey.action_method);
 }
 
 static void free_poll_hotkey_buffer(union acpi_hotkey *key)
 {
+        /* key would never be null, others could be*/
         kfree(key->poll_hotkey.action_method);
         kfree(key->poll_hotkey.poll_method);
         kfree(key->poll_hotkey.poll_result);
 }
 static int
-init_hotkey_device(union acpi_hotkey *key, char *bus_str, char *action_str,
-                   char *method, int std_num, int external_num)
+init_hotkey_device(union acpi_hotkey *key, char **config_entry,
+                   int std_num, int external_num)
 {
         acpi_handle tmp_handle;
         acpi_status status = AE_OK;
 
-
         if (std_num < 0 || IS_POLL(std_num) || !key)
                 goto do_fail;
 
-        if (!bus_str || !action_str || !method)
+        if (!config_entry[bus_handle] || !config_entry[action_handle]
+                        || !config_entry[method])
                 goto do_fail;
 
         key->link.hotkey_type = ACPI_HOTKEY_EVENT;
         key->link.hotkey_standard_num = std_num;
         key->event_hotkey.flag = 0;
-        key->event_hotkey.action_method = method;
+        key->event_hotkey.action_method = config_entry[method];
 
-        status =
-            acpi_get_handle(NULL, bus_str, &(key->event_hotkey.bus_handle));
+        status = acpi_get_handle(NULL, config_entry[bus_handle],
+                           &(key->event_hotkey.bus_handle));
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         key->event_hotkey.external_hotkey_num = external_num;
-        status =
-            acpi_get_handle(NULL, action_str,
+        status = acpi_get_handle(NULL, config_entry[action_handle],
                             &(key->event_hotkey.action_handle));
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         status = acpi_get_handle(key->event_hotkey.action_handle,
-                                 method, &tmp_handle);
+                                 config_entry[method], &tmp_handle);
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         return AE_OK;
-      do_fail:
+do_fail_zero:
+        key->event_hotkey.action_method = NULL;
+do_fail:
         return -ENODEV;
 }
 
 static int
-init_poll_hotkey_device(union acpi_hotkey *key,
-                        char *poll_str,
-                        char *poll_method,
-                        char *action_str, char *action_method, int std_num)
+init_poll_hotkey_device(union acpi_hotkey *key, char **config_entry,
+                        int std_num)
 {
         acpi_status status = AE_OK;
         acpi_handle tmp_handle;
 
-
         if (std_num < 0 || IS_EVENT(std_num) || !key)
                 goto do_fail;
-
-        if (!poll_str || !poll_method || !action_str || !action_method)
+        if (!config_entry[bus_handle] ||!config_entry[bus_method] ||
+                !config_entry[action_handle] || !config_entry[method])
                 goto do_fail;
 
         key->link.hotkey_type = ACPI_HOTKEY_POLLING;
         key->link.hotkey_standard_num = std_num;
         key->poll_hotkey.flag = 0;
-        key->poll_hotkey.poll_method = poll_method;
-        key->poll_hotkey.action_method = action_method;
+        key->poll_hotkey.poll_method = config_entry[bus_method];
+        key->poll_hotkey.action_method = config_entry[method];
 
-        status =
-            acpi_get_handle(NULL, poll_str, &(key->poll_hotkey.poll_handle));
+        status = acpi_get_handle(NULL, config_entry[bus_handle],
+                      &(key->poll_hotkey.poll_handle));
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         status = acpi_get_handle(key->poll_hotkey.poll_handle,
-                                 poll_method, &tmp_handle);
+                                 config_entry[bus_method], &tmp_handle);
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         status =
-            acpi_get_handle(NULL, action_str,
+            acpi_get_handle(NULL, config_entry[action_handle],
                             &(key->poll_hotkey.action_handle));
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         status = acpi_get_handle(key->poll_hotkey.action_handle,
-                                 action_method, &tmp_handle);
+                                 config_entry[method], &tmp_handle);
         if (ACPI_FAILURE(status))
-                goto do_fail;
+                goto do_fail_zero;
         key->poll_hotkey.poll_result =
             (union acpi_object *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
         if (!key->poll_hotkey.poll_result)
-                goto do_fail;
+                goto do_fail_zero;
         return AE_OK;
-      do_fail:
+
+do_fail_zero:
+        key->poll_hotkey.poll_method = NULL;
+        key->poll_hotkey.action_method = NULL;
+do_fail:
         return -ENODEV;
 }
 
@@ -652,17 +660,18 @@ static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset)
 }
 
 static int
-get_parms(char *config_record,
-          int *cmd,
-          char **bus_handle,
-          char **bus_method,
-          char **action_handle,
-          char **method, int *internal_event_num, int *external_event_num)
+get_parms(char *config_record, int *cmd, char **config_entry,
+               int *internal_event_num, int *external_event_num)
 {
+/* the format of *config_record =
+ * "1:\d+:*" : "cmd:internal_event_num"
+ * "\d+:\w+:\w+:\w+:\w+:\d+:\d+" :
+ * "cmd:bus_handle:bus_method:action_handle:method:internal_event_num:external_event_num"
+ */
         char *tmp, *tmp1, count;
+        int i;
 
         sscanf(config_record, "%d", cmd);
-
         if (*cmd == 1) {
                 if (sscanf(config_record, "%d:%d", cmd, internal_event_num) !=
                     2)
@@ -674,59 +683,27 @@ get_parms(char *config_record,
         if (!tmp)
                 goto do_fail;
         tmp++;
-        tmp1 = strchr(tmp, ':');
-        if (!tmp1)
-                goto do_fail;
-
-        count = tmp1 - tmp;
-        *bus_handle = (char *)kmalloc(count + 1, GFP_KERNEL);
-        if (!*bus_handle)
-                goto do_fail;
-        strncpy(*bus_handle, tmp, count);
-        *(*bus_handle + count) = 0;
-
-        tmp = tmp1;
-        tmp++;
-        tmp1 = strchr(tmp, ':');
-        if (!tmp1)
-                goto do_fail;
-        count = tmp1 - tmp;
-        *bus_method = (char *)kmalloc(count + 1, GFP_KERNEL);
-        if (!*bus_method)
-                goto do_fail;
-        strncpy(*bus_method, tmp, count);
-        *(*bus_method + count) = 0;
-
-        tmp = tmp1;
-        tmp++;
-        tmp1 = strchr(tmp, ':');
-        if (!tmp1)
-                goto do_fail;
-        count = tmp1 - tmp;
-        *action_handle = (char *)kmalloc(count + 1, GFP_KERNEL);
-        if (!*action_handle)
-                goto do_fail;
-        strncpy(*action_handle, tmp, count);
-        *(*action_handle + count) = 0;
-
-        tmp = tmp1;
-        tmp++;
-        tmp1 = strchr(tmp, ':');
-        if (!tmp1)
-                goto do_fail;
-        count = tmp1 - tmp;
-        *method = (char *)kmalloc(count + 1, GFP_KERNEL);
-        if (!*method)
-                goto do_fail;
-        strncpy(*method, tmp, count);
-        *(*method + count) = 0;
-
-        if (sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num) <=
-            0)
-                goto do_fail;
-
-        return 6;
-      do_fail:
+        for (i = 0; i < LAST_CONF_ENTRY; i++) {
+                tmp1 = strchr(tmp, ':');
+                if (!tmp1) {
+                        goto do_fail;
+                }
+                count = tmp1 - tmp;
+                config_entry[i] = kzalloc(count + 1, GFP_KERNEL);
+                if (!config_entry[i])
+                        goto handle_failure;
+                strncpy(config_entry[i], tmp, count);
+                tmp = tmp1 + 1;
+        }
+        if (sscanf(tmp, "%d:%d", internal_event_num, external_event_num) <= 0)
+                goto handle_failure;
+        if (!IS_OTHERS(*internal_event_num)) {
+                return 6;
+        }
+handle_failure:
+        while (i-- > 0)
+                kfree(config_entry[i]);
+do_fail:
         return -1;
 }
 
@@ -736,50 +713,34 @@ static ssize_t hotkey_write_config(struct file *file,
                                    size_t count, loff_t * data)
 {
         char *config_record = NULL;
-        char *bus_handle = NULL;
-        char *bus_method = NULL;
-        char *action_handle = NULL;
-        char *method = NULL;
+        char *config_entry[LAST_CONF_ENTRY];
         int cmd, internal_event_num, external_event_num;
         int ret = 0;
-        union acpi_hotkey *key = NULL;
+        union acpi_hotkey *key = kzalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
 
+        if (!key)
+                return -ENOMEM;
 
-        config_record = (char *)kmalloc(count + 1, GFP_KERNEL);
-        if (!config_record)
+        config_record = kzalloc(count + 1, GFP_KERNEL);
+        if (!config_record) {
+                kfree(key);
                 return -ENOMEM;
+        }
 
         if (copy_from_user(config_record, buffer, count)) {
                 kfree(config_record);
+                kfree(key);
                 printk(KERN_ERR PREFIX "Invalid data\n");
                 return -EINVAL;
         }
-        config_record[count] = 0;
-
-        ret = get_parms(config_record,
-                        &cmd,
-                        &bus_handle,
-                        &bus_method,
-                        &action_handle,
-                        &method, &internal_event_num, &external_event_num);
-
+        ret = get_parms(config_record, &cmd, config_entry,
+                       &internal_event_num, &external_event_num);
         kfree(config_record);
-        if (IS_OTHERS(internal_event_num))
-                goto do_fail;
         if (ret != 6) {
-              do_fail:
-                kfree(bus_handle);
-                kfree(bus_method);
-                kfree(action_handle);
-                kfree(method);
                 printk(KERN_ERR PREFIX "Invalid data format ret=%d\n", ret);
                 return -EINVAL;
         }
 
-        key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-        if (!key)
-                goto do_fail;
-        memset(key, 0, sizeof(union acpi_hotkey));
         if (cmd == 1) {
                 union acpi_hotkey *tmp = NULL;
                 tmp = get_hotkey_by_event(&global_hotkey_list,
@@ -791,34 +752,19 @@ static ssize_t hotkey_write_config(struct file *file,
                 goto cont_cmd;
         }
         if (IS_EVENT(internal_event_num)) {
-                kfree(bus_method);
-                ret = init_hotkey_device(key, bus_handle, action_handle, method,
-                                         internal_event_num,
-                                         external_event_num);
-        } else
-                ret = init_poll_hotkey_device(key, bus_handle, bus_method,
-                                              action_handle, method,
-                                              internal_event_num);
-        if (ret) {
-                kfree(bus_handle);
-                kfree(action_handle);
-                if (IS_EVENT(internal_event_num))
-                        free_hotkey_buffer(key);
-                else
-                        free_poll_hotkey_buffer(key);
-                kfree(key);
-                printk(KERN_ERR PREFIX "Invalid hotkey\n");
-                return -EINVAL;
+                if (init_hotkey_device(key, config_entry,
+                        internal_event_num, external_event_num))
+                        goto init_hotkey_fail;
+        } else {
+                if (init_poll_hotkey_device(key, config_entry,
+                               internal_event_num))
+                        goto init_poll_hotkey_fail;
         }
-
-      cont_cmd:
-        kfree(bus_handle);
-        kfree(action_handle);
-
+cont_cmd:
         switch (cmd) {
         case 0:
-                if (get_hotkey_by_event
-                    (&global_hotkey_list, key->link.hotkey_standard_num))
+                if (get_hotkey_by_event(&global_hotkey_list,
+                                key->link.hotkey_standard_num))
                         goto fail_out;
                 else
                         hotkey_add(key);
@@ -827,6 +773,7 @@ static ssize_t hotkey_write_config(struct file *file,
                 hotkey_remove(key);
                 break;
         case 2:
+                /* key is kfree()ed if matched*/
                 if (hotkey_update(key))
                         goto fail_out;
                 break;
@@ -835,11 +782,22 @@ static ssize_t hotkey_write_config(struct file *file,
                 break;
         }
         return count;
-      fail_out:
-        if (IS_EVENT(internal_event_num))
-                free_hotkey_buffer(key);
-        else
-                free_poll_hotkey_buffer(key);
+
+init_poll_hotkey_fail:          /* failed init_poll_hotkey_device */
+        kfree(config_entry[bus_method]);
+        config_entry[bus_method] = NULL;
+init_hotkey_fail:               /* failed init_hotkey_device */
+        kfree(config_entry[method]);
+fail_out:
+        kfree(config_entry[bus_handle]);
+        kfree(config_entry[action_handle]);
+        /* No double free since elements =NULL for error cases */
+        if (IS_EVENT(internal_event_num)) {
+                if (config_entry[bus_method])
+                        kfree(config_entry[bus_method]);
+                free_hotkey_buffer(key);        /* frees [method] */
+        } else
+                free_poll_hotkey_buffer(key);  /* frees [bus_method]+[method] */
         kfree(key);
         printk(KERN_ERR PREFIX "invalid key\n");
         return -EINVAL;
@@ -923,10 +881,9 @@ static ssize_t hotkey_execute_aml_method(struct file *file,
         union acpi_hotkey *key;
 
 
-        arg = (char *)kmalloc(count + 1, GFP_KERNEL);
+        arg = kzalloc(count + 1, GFP_KERNEL);
         if (!arg)
                 return -ENOMEM;
-        arg[count] = 0;
 
         if (copy_from_user(arg, buffer, count)) {
                 kfree(arg);
diff --git a/drivers/acpi/i2c_ec.c b/drivers/acpi/i2c_ec.c
new file mode 100644
index 000000000000..6809c283ec58
--- /dev/null
+++ b/drivers/acpi/i2c_ec.c
@@ -0,0 +1,406 @@
+/*
+ * SMBus driver for ACPI Embedded Controller ($Revision: 1.3 $)
+ *
+ * Copyright (c) 2002, 2005 Ducrot Bruno
+ * Copyright (c) 2005 Rich Townsend (tiny hacks & tweaks)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation version 2.
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/stddef.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/acpi.h>
+#include <linux/delay.h>
+
+#include "i2c_ec.h"
+
+#define xudelay(t)      udelay(t)
+#define xmsleep(t)      msleep(t)
+
+#define ACPI_EC_HC_COMPONENT    0x00080000
+#define ACPI_EC_HC_CLASS        "ec_hc_smbus"
+#define ACPI_EC_HC_HID          "ACPI0001"
+#define ACPI_EC_HC_DRIVER_NAME  "ACPI EC HC smbus driver"
+#define ACPI_EC_HC_DEVICE_NAME  "EC HC smbus"
+
+#define _COMPONENT              ACPI_EC_HC_COMPONENT
+
+ACPI_MODULE_NAME("acpi_smbus")
+
+static int acpi_ec_hc_add(struct acpi_device *device);
+static int acpi_ec_hc_remove(struct acpi_device *device, int type);
+
+static struct acpi_driver acpi_ec_hc_driver = {
+        .name = ACPI_EC_HC_DRIVER_NAME,
+        .class = ACPI_EC_HC_CLASS,
+        .ids = ACPI_EC_HC_HID,
+        .ops = {
+                .add = acpi_ec_hc_add,
+                .remove = acpi_ec_hc_remove,
+                },
+};
+
+/* Various bit mask for EC_SC (R) */
+#define OBF             0x01
+#define IBF             0x02
+#define CMD             0x08
+#define BURST           0x10
+#define SCI_EVT         0x20
+#define SMI_EVT         0x40
+
+/* Commands for EC_SC (W) */
+#define RD_EC           0x80
+#define WR_EC           0x81
+#define BE_EC           0x82
+#define BD_EC           0x83
+#define QR_EC           0x84
+
+/*
+ * ACPI 2.0 chapter 13 SMBus 2.0 EC register model
+ */
+
+#define ACPI_EC_SMB_PRTCL       0x00    /* protocol, PEC */
+#define ACPI_EC_SMB_STS         0x01    /* status */
+#define ACPI_EC_SMB_ADDR        0x02    /* address */
+#define ACPI_EC_SMB_CMD         0x03    /* command */
+#define ACPI_EC_SMB_DATA        0x04    /* 32 data registers */
+#define ACPI_EC_SMB_BCNT        0x24    /* number of data bytes */
+#define ACPI_EC_SMB_ALRM_A      0x25    /* alarm address */
+#define ACPI_EC_SMB_ALRM_D      0x26    /* 2 bytes alarm data */
+
+#define ACPI_EC_SMB_STS_DONE    0x80
+#define ACPI_EC_SMB_STS_ALRM    0x40
+#define ACPI_EC_SMB_STS_RES     0x20
+#define ACPI_EC_SMB_STS_STATUS  0x1f
+
+#define ACPI_EC_SMB_STATUS_OK           0x00
+#define ACPI_EC_SMB_STATUS_FAIL         0x07
+#define ACPI_EC_SMB_STATUS_DNAK         0x10
+#define ACPI_EC_SMB_STATUS_DERR         0x11
+#define ACPI_EC_SMB_STATUS_CMD_DENY     0x12
+#define ACPI_EC_SMB_STATUS_UNKNOWN      0x13
+#define ACPI_EC_SMB_STATUS_ACC_DENY     0x17
+#define ACPI_EC_SMB_STATUS_TIMEOUT      0x18
+#define ACPI_EC_SMB_STATUS_NOTSUP       0x19
+#define ACPI_EC_SMB_STATUS_BUSY         0x1A
+#define ACPI_EC_SMB_STATUS_PEC          0x1F
+
+#define ACPI_EC_SMB_PRTCL_WRITE                 0x00
+#define ACPI_EC_SMB_PRTCL_READ                  0x01
+#define ACPI_EC_SMB_PRTCL_QUICK                 0x02
+#define ACPI_EC_SMB_PRTCL_BYTE                  0x04
+#define ACPI_EC_SMB_PRTCL_BYTE_DATA             0x06
+#define ACPI_EC_SMB_PRTCL_WORD_DATA             0x08
+#define ACPI_EC_SMB_PRTCL_BLOCK_DATA            0x0a
+#define ACPI_EC_SMB_PRTCL_PROC_CALL             0x0c
+#define ACPI_EC_SMB_PRTCL_BLOCK_PROC_CALL       0x0d
+#define ACPI_EC_SMB_PRTCL_I2C_BLOCK_DATA        0x4a
+#define ACPI_EC_SMB_PRTCL_PEC                   0x80
+
+/* Length of pre/post transaction sleep (msec) */
+#define ACPI_EC_SMB_TRANSACTION_SLEEP           1
+#define ACPI_EC_SMB_ACCESS_SLEEP1               1
+#define ACPI_EC_SMB_ACCESS_SLEEP2               10
+
+static int acpi_ec_smb_read(struct acpi_ec_smbus *smbus, u8 address, u8 * data)
+{
+        u8 val;
+        int err;
+
+        err = ec_read(smbus->base + address, &val);
+        if (!err) {
+                *data = val;
+        }
+        xmsleep(ACPI_EC_SMB_TRANSACTION_SLEEP);
+        return (err);
+}
+
+static int acpi_ec_smb_write(struct acpi_ec_smbus *smbus, u8 address, u8 data)
+{
+        int err;
+
+        err = ec_write(smbus->base + address, data);
+        return (err);
+}
+
+static int
+acpi_ec_smb_access(struct i2c_adapter *adap, u16 addr, unsigned short flags,
+                   char read_write, u8 command, int size,
+                   union i2c_smbus_data *data)
+{
+        struct acpi_ec_smbus *smbus = adap->algo_data;
+        unsigned char protocol, len = 0, pec, temp[2] = { 0, 0 };
+        int i;
+
+        if (read_write == I2C_SMBUS_READ) {
+                protocol = ACPI_EC_SMB_PRTCL_READ;
+        } else {
+                protocol = ACPI_EC_SMB_PRTCL_WRITE;
+        }
+        pec = (flags & I2C_CLIENT_PEC) ? ACPI_EC_SMB_PRTCL_PEC : 0;
+
+        switch (size) {
+
+        case I2C_SMBUS_QUICK:
+                protocol |= ACPI_EC_SMB_PRTCL_QUICK;
+                read_write = I2C_SMBUS_WRITE;
+                break;
+
+        case I2C_SMBUS_BYTE:
+                if (read_write == I2C_SMBUS_WRITE) {
+                        acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA, data->byte);
+                }
+                protocol |= ACPI_EC_SMB_PRTCL_BYTE;
+                break;
+
+        case I2C_SMBUS_BYTE_DATA:
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_CMD, command);
+                if (read_write == I2C_SMBUS_WRITE) {
+                        acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA, data->byte);
+                }
+                protocol |= ACPI_EC_SMB_PRTCL_BYTE_DATA;
+                break;
+
+        case I2C_SMBUS_WORD_DATA:
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_CMD, command);
+                if (read_write == I2C_SMBUS_WRITE) {
+                        acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA, data->word);
+                        acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA + 1,
+                                          data->word >> 8);
+                }
+                protocol |= ACPI_EC_SMB_PRTCL_WORD_DATA | pec;
+                break;
+
+        case I2C_SMBUS_BLOCK_DATA:
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_CMD, command);
+                if (read_write == I2C_SMBUS_WRITE) {
+                        len = min_t(u8, data->block[0], 32);
+                        acpi_ec_smb_write(smbus, ACPI_EC_SMB_BCNT, len);
+                        for (i = 0; i < len; i++)
+                                acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA + i,
+                                                  data->block[i + 1]);
+                }
+                protocol |= ACPI_EC_SMB_PRTCL_BLOCK_DATA | pec;
+                break;
+
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                len = min_t(u8, data->block[0], 32);
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_CMD, command);
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_BCNT, len);
+                if (read_write == I2C_SMBUS_WRITE) {
+                        for (i = 0; i < len; i++) {
+                                acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA + i,
+                                                  data->block[i + 1]);
+                        }
+                }
+                protocol |= ACPI_EC_SMB_PRTCL_I2C_BLOCK_DATA;
+                break;
+
+        case I2C_SMBUS_PROC_CALL:
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_CMD, command);
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA, data->word);
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA + 1, data->word >> 8);
+                protocol = ACPI_EC_SMB_PRTCL_PROC_CALL | pec;
+                read_write = I2C_SMBUS_READ;
+                break;
+
+        case I2C_SMBUS_BLOCK_PROC_CALL:
+                protocol |= pec;
+                len = min_t(u8, data->block[0], 31);
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_CMD, command);
+                acpi_ec_smb_write(smbus, ACPI_EC_SMB_BCNT, len);
+                for (i = 0; i < len; i++)
+                        acpi_ec_smb_write(smbus, ACPI_EC_SMB_DATA + i,
+                                          data->block[i + 1]);
+                protocol = ACPI_EC_SMB_PRTCL_BLOCK_PROC_CALL | pec;
+                read_write = I2C_SMBUS_READ;
+                break;
+
+        default:
+                ACPI_DEBUG_PRINT((ACPI_DB_WARN, "EC SMBus adapter: "
+                                  "Unsupported transaction %d\n", size));
+                return (-1);
+        }
+
+        acpi_ec_smb_write(smbus, ACPI_EC_SMB_ADDR, addr << 1);
+        acpi_ec_smb_write(smbus, ACPI_EC_SMB_PRTCL, protocol);
+
+        acpi_ec_smb_read(smbus, ACPI_EC_SMB_STS, temp + 0);
+
+        if (~temp[0] & ACPI_EC_SMB_STS_DONE) {
+                xudelay(500);
+                acpi_ec_smb_read(smbus, ACPI_EC_SMB_STS, temp + 0);
+        }
+        if (~temp[0] & ACPI_EC_SMB_STS_DONE) {
+                xmsleep(ACPI_EC_SMB_ACCESS_SLEEP2);
+                acpi_ec_smb_read(smbus, ACPI_EC_SMB_STS, temp + 0);
+        }
+        if ((~temp[0] & ACPI_EC_SMB_STS_DONE)
+            || (temp[0] & ACPI_EC_SMB_STS_STATUS)) {
+                return (-1);
+        }
+
+        if (read_write == I2C_SMBUS_WRITE) {
+                return (0);
+        }
+
+        switch (size) {
+
+        case I2C_SMBUS_BYTE:
+        case I2C_SMBUS_BYTE_DATA:
+                acpi_ec_smb_read(smbus, ACPI_EC_SMB_DATA, &data->byte);
+                break;
+
+        case I2C_SMBUS_WORD_DATA:
+        case I2C_SMBUS_PROC_CALL:
+                acpi_ec_smb_read(smbus, ACPI_EC_SMB_DATA, temp + 0);
+                acpi_ec_smb_read(smbus, ACPI_EC_SMB_DATA + 1, temp + 1);
+                data->word = (temp[1] << 8) | temp[0];
+                break;
+
+        case I2C_SMBUS_BLOCK_DATA:
+        case I2C_SMBUS_BLOCK_PROC_CALL:
+                len = 0;
+                acpi_ec_smb_read(smbus, ACPI_EC_SMB_BCNT, &len);
+                len = min_t(u8, len, 32);
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                for (i = 0; i < len; i++)
+                        acpi_ec_smb_read(smbus, ACPI_EC_SMB_DATA + i,
+                                         data->block + i + 1);
+                data->block[0] = len;
+                break;
+        }
+
+        return (0);
+}
+
+static u32 acpi_ec_smb_func(struct i2c_adapter *adapter)
+{
+
+        return (I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
+                I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
+                I2C_FUNC_SMBUS_BLOCK_DATA |
+                I2C_FUNC_SMBUS_PROC_CALL |
+                I2C_FUNC_SMBUS_BLOCK_PROC_CALL |
+                I2C_FUNC_SMBUS_I2C_BLOCK | I2C_FUNC_SMBUS_HWPEC_CALC);
+}
+
+static struct i2c_algorithm acpi_ec_smbus_algorithm = {
+        .smbus_xfer = acpi_ec_smb_access,
+        .functionality = acpi_ec_smb_func,
+};
+
+static int acpi_ec_hc_add(struct acpi_device *device)
+{
+        int status;
+        unsigned long val;
+        struct acpi_ec_hc *ec_hc;
+        struct acpi_ec_smbus *smbus;
+
+        if (!device) {
+                return -EINVAL;
+        }
+
+        ec_hc = kmalloc(sizeof(struct acpi_ec_hc), GFP_KERNEL);
+        if (!ec_hc) {
+                return -ENOMEM;
+        }
+        memset(ec_hc, 0, sizeof(struct acpi_ec_hc));
+
+        smbus = kmalloc(sizeof(struct acpi_ec_smbus), GFP_KERNEL);
+        if (!smbus) {
+                kfree(ec_hc);
+                return -ENOMEM;
+        }
+        memset(smbus, 0, sizeof(struct acpi_ec_smbus));
+
+        ec_hc->handle = device->handle;
+        strcpy(acpi_device_name(device), ACPI_EC_HC_DEVICE_NAME);
+        strcpy(acpi_device_class(device), ACPI_EC_HC_CLASS);
+        acpi_driver_data(device) = ec_hc;
+
+        status = acpi_evaluate_integer(ec_hc->handle, "_EC", NULL, &val);
+        if (ACPI_FAILURE(status)) {
+                ACPI_DEBUG_PRINT((ACPI_DB_WARN, "Error obtaining _EC\n"));
+                kfree(ec_hc);
+                kfree(smbus);
+                return -EIO;
+        }
+
+        smbus->ec = acpi_driver_data(device->parent);
+        smbus->base = (val & 0xff00ull) >> 8;
+        smbus->alert = val & 0xffull;
+
+        smbus->adapter.owner = THIS_MODULE;
+        smbus->adapter.algo = &acpi_ec_smbus_algorithm;
+        smbus->adapter.algo_data = smbus;
+
+        if (i2c_add_adapter(&smbus->adapter)) {
+                ACPI_DEBUG_PRINT((ACPI_DB_WARN,
+                                  "EC SMBus adapter: Failed to register adapter\n"));
+                kfree(smbus);
+                kfree(ec_hc);
+                return -EIO;
+        }
+
+        ec_hc->smbus = smbus;
+
+        printk(KERN_INFO PREFIX "%s [%s]\n",
+               acpi_device_name(device), acpi_device_bid(device));
+
+        return AE_OK;
+}
+
+static int acpi_ec_hc_remove(struct acpi_device *device, int type)
+{
+        struct acpi_ec_hc *ec_hc;
+
+        if (!device) {
+                return -EINVAL;
+        }
+        ec_hc = acpi_driver_data(device);
+
+        i2c_del_adapter(&ec_hc->smbus->adapter);
+        kfree(ec_hc->smbus);
+        kfree(ec_hc);
+
+        return AE_OK;
+}
+
+static int __init acpi_ec_hc_init(void)
+{
+        int result;
+
+        result = acpi_bus_register_driver(&acpi_ec_hc_driver);
+        if (result < 0) {
+                return -ENODEV;
+        }
+        return 0;
+}
+
+static void __exit acpi_ec_hc_exit(void)
+{
+        acpi_bus_unregister_driver(&acpi_ec_hc_driver);
+}
+
+struct acpi_ec_hc *acpi_get_ec_hc(struct acpi_device *device)
+{
+        return ((struct acpi_ec_hc *)acpi_driver_data(device->parent));
+}
+
+EXPORT_SYMBOL(acpi_get_ec_hc);
+
+module_init(acpi_ec_hc_init);
+module_exit(acpi_ec_hc_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Ducrot Bruno");
+MODULE_DESCRIPTION("ACPI EC SMBus driver");
diff --git a/drivers/acpi/i2c_ec.h b/drivers/acpi/i2c_ec.h
new file mode 100644
index 000000000000..7c53fb732d61
--- /dev/null
+++ b/drivers/acpi/i2c_ec.h
@@ -0,0 +1,23 @@
+/*
+ * SMBus driver for ACPI Embedded Controller ($Revision: 1.2 $)
+ *
+ * Copyright (c) 2002, 2005 Ducrot Bruno
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation version 2.
+ */
+
+struct acpi_ec_smbus {
+        struct i2c_adapter adapter;
+        union acpi_ec *ec;
+        int base;
+        int alert;
+};
+
+struct acpi_ec_hc {
+        acpi_handle handle;
+        struct acpi_ec_smbus *smbus;
+};
+
+struct acpi_ec_hc *acpi_get_ec_hc(struct acpi_device *device);
diff --git a/drivers/acpi/namespace/nsalloc.c b/drivers/acpi/namespace/nsalloc.c
index dc3f0739a46b..55b407aae266 100644
--- a/drivers/acpi/namespace/nsalloc.c
+++ b/drivers/acpi/namespace/nsalloc.c
@@ -386,14 +386,17 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
  *              specific ID.  Used to delete entire ACPI tables.  All
  *              reference counts are updated.
  *
+ * MUTEX:       Locks namespace during deletion walk.
+ *
  ******************************************************************************/
 
 void acpi_ns_delete_namespace_by_owner(acpi_owner_id owner_id)
 {
         struct acpi_namespace_node *child_node;
         struct acpi_namespace_node *deletion_node;
-        u32 level;
         struct acpi_namespace_node *parent_node;
+        u32 level;
+        acpi_status status;
 
         ACPI_FUNCTION_TRACE_U32(ns_delete_namespace_by_owner, owner_id);
 
@@ -401,6 +404,13 @@ void acpi_ns_delete_namespace_by_owner(acpi_owner_id owner_id)
                 return_VOID;
         }
 
+        /* Lock namespace for possible update */
+
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                return_VOID;
+        }
+
         deletion_node = NULL;
         parent_node = acpi_gbl_root_node;
         child_node = NULL;
@@ -469,5 +479,6 @@ void acpi_ns_delete_namespace_by_owner(acpi_owner_id owner_id)
                 }
         }
 
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_VOID;
 }
diff --git a/drivers/acpi/namespace/nsxfeval.c b/drivers/acpi/namespace/nsxfeval.c
index 6d9bd45af30a..dca6799ac678 100644
--- a/drivers/acpi/namespace/nsxfeval.c
+++ b/drivers/acpi/namespace/nsxfeval.c
@@ -133,7 +133,7 @@ acpi_evaluate_object_typed(acpi_handle handle,
 
                 /* Caller used ACPI_ALLOCATE_BUFFER, free the return buffer */
 
-                acpi_os_free(return_buffer->pointer);
+                ACPI_FREE(return_buffer->pointer);
                 return_buffer->pointer = NULL;
         }
 
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 4d622981f61a..e5e448edca41 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -259,12 +259,10 @@ int acpi_get_node(acpi_handle *handle)
 {
         int pxm, node = -1;
 
-        ACPI_FUNCTION_TRACE("acpi_get_node");
-
         pxm = acpi_get_pxm(handle);
         if (pxm >= 0)
                 node = acpi_map_pxm_to_node(pxm);
 
-        return_VALUE(node);
+        return node;
 }
 EXPORT_SYMBOL(acpi_get_node);
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 5a468e2779ae..507f051d1cef 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -36,7 +36,6 @@
 #include <linux/delay.h>
 #include <linux/workqueue.h>
 #include <linux/nmi.h>
-#include <linux/kthread.h>
 #include <acpi/acpi.h>
 #include <asm/io.h>
 #include <acpi/acpi_bus.h>
@@ -136,23 +135,6 @@ void acpi_os_vprintf(const char *fmt, va_list args)
 #endif
 }
 
-
-extern int acpi_in_resume;
-void *acpi_os_allocate(acpi_size size)
-{
-        if (acpi_in_resume)
-                return kmalloc(size, GFP_ATOMIC);
-        else
-                return kmalloc(size, GFP_KERNEL);
-}
-
-void acpi_os_free(void *ptr)
-{
-        kfree(ptr);
-}
-
-EXPORT_SYMBOL(acpi_os_free);
-
 acpi_status acpi_os_get_root_pointer(u32 flags, struct acpi_pointer *addr)
 {
         if (efi_enabled) {
@@ -600,16 +582,6 @@ static void acpi_os_execute_deferred(void *context)
         return;
 }
 
-static int acpi_os_execute_thread(void *context)
-{
-        struct acpi_os_dpc *dpc = (struct acpi_os_dpc *)context;
-        if (dpc) {
-                dpc->function(dpc->context);
-                kfree(dpc);
-        }
-        do_exit(0);
-}
-
 /*******************************************************************************
  *
  * FUNCTION:    acpi_os_execute
@@ -631,10 +603,16 @@ acpi_status acpi_os_execute(acpi_execute_type type,
         acpi_status status = AE_OK;
         struct acpi_os_dpc *dpc;
         struct work_struct *task;
-        struct task_struct *p;
+
+        ACPI_FUNCTION_TRACE("os_queue_for_execution");
+
+        ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+                          "Scheduling function [%p(%p)] for deferred execution.\n",
+                          function, context));
 
         if (!function)
-                return AE_BAD_PARAMETER;
+                return_ACPI_STATUS(AE_BAD_PARAMETER);
+
         /*
          * Allocate/initialize DPC structure.  Note that this memory will be
          * freed by the callee.  The kernel handles the tq_struct list  in a
@@ -645,34 +623,27 @@ acpi_status acpi_os_execute(acpi_execute_type type,
          * We can save time and code by allocating the DPC and tq_structs
          * from the same memory.
          */
-        if (type == OSL_NOTIFY_HANDLER) {
-                dpc = kmalloc(sizeof(struct acpi_os_dpc), GFP_KERNEL);
-        } else {
-                dpc = kmalloc(sizeof(struct acpi_os_dpc) +
-                                sizeof(struct work_struct), GFP_ATOMIC);
-        }
+
+        dpc =
+            kmalloc(sizeof(struct acpi_os_dpc) + sizeof(struct work_struct),
+                    GFP_ATOMIC);
         if (!dpc)
-                return AE_NO_MEMORY;
+                return_ACPI_STATUS(AE_NO_MEMORY);
+
         dpc->function = function;
         dpc->context = context;
 
-        if (type == OSL_NOTIFY_HANDLER) {
-                p = kthread_create(acpi_os_execute_thread, dpc, "kacpid_notify");
-                if (!IS_ERR(p)) {
-                        wake_up_process(p);
-                } else {
-                        status = AE_NO_MEMORY;
-                        kfree(dpc);
-                }
-        } else {
-                task = (void *)(dpc + 1);
-                INIT_WORK(task, acpi_os_execute_deferred, (void *)dpc);
-                if (!queue_work(kacpid_wq, task)) {
-                        status = AE_ERROR;
-                        kfree(dpc);
-                }
+        task = (void *)(dpc + 1);
+        INIT_WORK(task, acpi_os_execute_deferred, (void *)dpc);
+
+        if (!queue_work(kacpid_wq, task)) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "Call to queue_work() failed.\n"));
+                kfree(dpc);
+                status = AE_ERROR;
         }
-        return status;
+
+        return_ACPI_STATUS(status);
 }
 
 EXPORT_SYMBOL(acpi_os_execute);
@@ -742,7 +713,7 @@ acpi_status acpi_os_delete_semaphore(acpi_handle handle)
 
         ACPI_DEBUG_PRINT((ACPI_DB_MUTEX, "Deleting semaphore[%p].\n", handle));
 
-        acpi_os_free(sem);
+        kfree(sem);
         sem = NULL;
 
         return AE_OK;
@@ -775,6 +746,16 @@ acpi_status acpi_os_wait_semaphore(acpi_handle handle, u32 units, u16 timeout)
         ACPI_DEBUG_PRINT((ACPI_DB_MUTEX, "Waiting for semaphore[%p|%d|%d]\n",
                           handle, units, timeout));
 
+        /*
+         * This can be called during resume with interrupts off.
+         * Like boot-time, we should be single threaded and will
+         * always get the lock if we try -- timeout or not.
+         * If this doesn't succeed, then we will oops courtesy of
+         * might_sleep() in down().
+         */
+        if (!down_trylock(sem))
+                return AE_OK;
+
         switch (timeout) {
                 /*
                  * No Wait:
@@ -1122,26 +1103,6 @@ acpi_status acpi_os_release_object(acpi_cache_t * cache, void *object)
         return (AE_OK);
 }
 
-/*******************************************************************************
- *
- * FUNCTION:    acpi_os_acquire_object
- *
- * PARAMETERS:  Cache           - Handle to cache object
- *              ReturnObject    - Where the object is returned
- *
- * RETURN:      Status
- *
- * DESCRIPTION: Return a zero-filled object.
- *
- ******************************************************************************/
-
-void *acpi_os_acquire_object(acpi_cache_t * cache)
-{
-        void *object = kmem_cache_zalloc(cache, GFP_KERNEL);
-        WARN_ON(!object);
-        return object;
-}
-
 /******************************************************************************
  *
  * FUNCTION:    acpi_os_validate_interface
diff --git a/drivers/acpi/parser/psutils.c b/drivers/acpi/parser/psutils.c
index 182474ae8ce9..d405387b7414 100644
--- a/drivers/acpi/parser/psutils.c
+++ b/drivers/acpi/parser/psutils.c
@@ -139,12 +139,10 @@ union acpi_parse_object *acpi_ps_alloc_op(u16 opcode)
                 /* The generic op (default) is by far the most common (16 to 1) */
 
                 op = acpi_os_acquire_object(acpi_gbl_ps_node_cache);
-                memset(op, 0, sizeof(struct acpi_parse_obj_common));
         } else {
                 /* Extended parseop */
 
                 op = acpi_os_acquire_object(acpi_gbl_ps_node_ext_cache);
-                memset(op, 0, sizeof(struct acpi_parse_obj_named));
         }
 
         /* Initialize the Op */
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 1badce27a83f..7f3e7e77e794 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -83,7 +83,6 @@ struct acpi_pci_link_irq {
 struct acpi_pci_link {
         struct list_head node;
         struct acpi_device *device;
-        acpi_handle handle;
         struct acpi_pci_link_irq irq;
         int refcnt;
 };
@@ -175,7 +174,7 @@ static int acpi_pci_link_get_possible(struct acpi_pci_link *link)
         if (!link)
                 return -EINVAL;
 
-        status = acpi_walk_resources(link->handle, METHOD_NAME__PRS,
+        status = acpi_walk_resources(link->device->handle, METHOD_NAME__PRS,
                                      acpi_pci_link_check_possible, link);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _PRS"));
@@ -249,8 +248,7 @@ static int acpi_pci_link_get_current(struct acpi_pci_link *link)
         acpi_status status = AE_OK;
         int irq = 0;
 
-
-        if (!link || !link->handle)
+        if (!link)
                 return -EINVAL;
 
         link->irq.active = 0;
@@ -274,7 +272,7 @@ static int acpi_pci_link_get_current(struct acpi_pci_link *link)
          * Query and parse _CRS to get the current IRQ assignment. 
          */
 
-        status = acpi_walk_resources(link->handle, METHOD_NAME__CRS,
+        status = acpi_walk_resources(link->device->handle, METHOD_NAME__CRS,
                                      acpi_pci_link_check_current, &irq);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _CRS"));
@@ -360,7 +358,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
         resource->end.type = ACPI_RESOURCE_TYPE_END_TAG;
 
         /* Attempt to set the resource */
-        status = acpi_set_current_resources(link->handle, &buffer);
+        status = acpi_set_current_resources(link->device->handle, &buffer);
 
         /* check for total failure */
         if (ACPI_FAILURE(status)) {
@@ -699,7 +697,7 @@ int acpi_pci_link_free_irq(acpi_handle handle)
                           acpi_device_bid(link->device)));
 
         if (link->refcnt == 0) {
-                acpi_ut_evaluate_object(link->handle, "_DIS", 0, NULL);
+                acpi_ut_evaluate_object(link->device->handle, "_DIS", 0, NULL);
         }
         mutex_unlock(&acpi_link_lock);
         return (link->irq.active);
@@ -726,7 +724,6 @@ static int acpi_pci_link_add(struct acpi_device *device)
         memset(link, 0, sizeof(struct acpi_pci_link));
 
         link->device = device;
-        link->handle = device->handle;
         strcpy(acpi_device_name(device), ACPI_PCI_LINK_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_PCI_LINK_CLASS);
         acpi_driver_data(device) = link;
@@ -765,7 +762,7 @@ static int acpi_pci_link_add(struct acpi_device *device)
 
       end:
         /* disable all links -- to be activated on use */
-        acpi_ut_evaluate_object(link->handle, "_DIS", 0, NULL);
+        acpi_ut_evaluate_object(device->handle, "_DIS", 0, NULL);
         mutex_unlock(&acpi_link_lock);
 
         if (result)
@@ -783,11 +780,6 @@ static int acpi_pci_link_resume(struct acpi_pci_link *link)
                 return 0;
 }
 
-/*
- * FIXME: this is a workaround to avoid nasty warning.  It will be removed
- * after every device calls pci_disable_device in .resume.
- */
-int acpi_in_resume;
 static int irqrouter_resume(struct sys_device *dev)
 {
         struct list_head *node = NULL;
@@ -797,7 +789,6 @@ static int irqrouter_resume(struct sys_device *dev)
         /* Make sure SCI is enabled again (Apple firmware bug?) */
         acpi_set_register(ACPI_BITREG_SCI_ENABLE, 1, ACPI_MTX_DO_NOT_LOCK);
 
-        acpi_in_resume = 1;
         list_for_each(node, &acpi_link.entries) {
                 link = list_entry(node, struct acpi_pci_link, node);
                 if (!link) {
@@ -806,7 +797,6 @@ static int irqrouter_resume(struct sys_device *dev)
                 }
                 acpi_pci_link_resume(link);
         }
-        acpi_in_resume = 0;
         return 0;
 }
 
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 8f10442119f0..0984a1ee24ed 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -58,7 +58,7 @@ static struct acpi_driver acpi_pci_root_driver = {
 
 struct acpi_pci_root {
         struct list_head node;
-        acpi_handle handle;
+        struct acpi_device * device;
         struct acpi_pci_id id;
         struct pci_bus *bus;
 };
@@ -83,7 +83,7 @@ int acpi_pci_register_driver(struct acpi_pci_driver *driver)
         list_for_each(entry, &acpi_pci_roots) {
                 struct acpi_pci_root *root;
                 root = list_entry(entry, struct acpi_pci_root, node);
-                driver->add(root->handle);
+                driver->add(root->device->handle);
                 n++;
         }
 
@@ -110,7 +110,7 @@ void acpi_pci_unregister_driver(struct acpi_pci_driver *driver)
         list_for_each(entry, &acpi_pci_roots) {
                 struct acpi_pci_root *root;
                 root = list_entry(entry, struct acpi_pci_root, node);
-                driver->remove(root->handle);
+                driver->remove(root->device->handle);
         }
 }
 
@@ -170,7 +170,7 @@ static int acpi_pci_root_add(struct acpi_device *device)
         memset(root, 0, sizeof(struct acpi_pci_root));
         INIT_LIST_HEAD(&root->node);
 
-        root->handle = device->handle;
+        root->device = device;
         strcpy(acpi_device_name(device), ACPI_PCI_ROOT_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_PCI_ROOT_CLASS);
         acpi_driver_data(device) = root;
@@ -185,7 +185,7 @@ static int acpi_pci_root_add(struct acpi_device *device)
          * -------
          * Obtained via _SEG, if exists, otherwise assumed to be zero (0).
          */
-        status = acpi_evaluate_integer(root->handle, METHOD_NAME__SEG, NULL,
+        status = acpi_evaluate_integer(device->handle, METHOD_NAME__SEG, NULL,
                                        &value);
         switch (status) {
         case AE_OK:
@@ -207,7 +207,7 @@ static int acpi_pci_root_add(struct acpi_device *device)
          * ---
          * Obtained via _BBN, if exists, otherwise assumed to be zero (0).
          */
-        status = acpi_evaluate_integer(root->handle, METHOD_NAME__BBN, NULL,
+        status = acpi_evaluate_integer(device->handle, METHOD_NAME__BBN, NULL,
                                        &value);
         switch (status) {
         case AE_OK:
@@ -234,7 +234,7 @@ static int acpi_pci_root_add(struct acpi_device *device)
                                     "Wrong _BBN value, reboot"
                                     " and use option 'pci=noacpi'\n");
 
-                        status = try_get_root_bridge_busnr(root->handle, &bus);
+                        status = try_get_root_bridge_busnr(device->handle, &bus);
                         if (ACPI_FAILURE(status))
                                 break;
                         if (bus != root->id.bus) {
@@ -294,9 +294,9 @@ static int acpi_pci_root_add(struct acpi_device *device)
          * -----------------
          * Evaluate and parse _PRT, if exists.
          */
-        status = acpi_get_handle(root->handle, METHOD_NAME__PRT, &handle);
+        status = acpi_get_handle(device->handle, METHOD_NAME__PRT, &handle);
         if (ACPI_SUCCESS(status))
-                result = acpi_pci_irq_add_prt(root->handle, root->id.segment,
+                result = acpi_pci_irq_add_prt(device->handle, root->id.segment,
                                               root->id.bus);
 
       end:
@@ -315,7 +315,7 @@ static int acpi_pci_root_start(struct acpi_device *device)
 
 
         list_for_each_entry(root, &acpi_pci_roots, node) {
-                if (root->handle == device->handle) {
+                if (root->device == device) {
                         pci_bus_add_devices(root->bus);
                         return 0;
                 }
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 224f729f700e..fec225d1b6b7 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -70,7 +70,7 @@ static struct acpi_driver acpi_power_driver = {
 };
 
 struct acpi_power_resource {
-        acpi_handle handle;
+        struct acpi_device * device;
         acpi_bus_id name;
         u32 system_level;
         u32 order;
@@ -80,7 +80,7 @@ struct acpi_power_resource {
 
 static struct list_head acpi_power_resource_list;
 
-static struct file_operations acpi_power_fops = {
+static const struct file_operations acpi_power_fops = {
         .open = acpi_power_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -124,7 +124,7 @@ static int acpi_power_get_state(struct acpi_power_resource *resource)
         if (!resource)
                 return -EINVAL;
 
-        status = acpi_evaluate_integer(resource->handle, "_STA", NULL, &sta);
+        status = acpi_evaluate_integer(resource->device->handle, "_STA", NULL, &sta);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -192,7 +192,7 @@ static int acpi_power_on(acpi_handle handle)
                 return 0;
         }
 
-        status = acpi_evaluate_object(resource->handle, "_ON", NULL, NULL);
+        status = acpi_evaluate_object(resource->device->handle, "_ON", NULL, NULL);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -203,10 +203,8 @@ static int acpi_power_on(acpi_handle handle)
                 return -ENOEXEC;
 
         /* Update the power resource's _device_ power state */
-        result = acpi_bus_get_device(resource->handle, &device);
-        if (result)
-                return result;
-        device->power.state = ACPI_STATE_D0;
+        device = resource->device;
+        resource->device->power.state = ACPI_STATE_D0;
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] turned on\n",
                           resource->name));
@@ -242,7 +240,7 @@ static int acpi_power_off_device(acpi_handle handle)
                 return 0;
         }
 
-        status = acpi_evaluate_object(resource->handle, "_OFF", NULL, NULL);
+        status = acpi_evaluate_object(resource->device->handle, "_OFF", NULL, NULL);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -253,9 +251,7 @@ static int acpi_power_off_device(acpi_handle handle)
                 return -ENOEXEC;
 
         /* Update the power resource's _device_ power state */
-        result = acpi_bus_get_device(resource->handle, &device);
-        if (result)
-                return result;
+        device = resource->device;
         device->power.state = ACPI_STATE_D3;
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] turned off\n",
@@ -544,14 +540,14 @@ static int acpi_power_add(struct acpi_device *device)
                 return -ENOMEM;
         memset(resource, 0, sizeof(struct acpi_power_resource));
 
-        resource->handle = device->handle;
+        resource->device = device;
         strcpy(resource->name, device->pnp.bus_id);
         strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_POWER_CLASS);
         acpi_driver_data(device) = resource;
 
         /* Evalute the object to get the system level and resource order. */
-        status = acpi_evaluate_object(resource->handle, NULL, NULL, &buffer);
+        status = acpi_evaluate_object(device->handle, NULL, NULL, &buffer);
         if (ACPI_FAILURE(status)) {
                 result = -ENODEV;
                 goto end;
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 52674323b14d..b13d64415b7a 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -102,7 +102,7 @@ static struct acpi_driver acpi_processor_driver = {
 #define INSTALL_NOTIFY_HANDLER          1
 #define UNINSTALL_NOTIFY_HANDLER        2
 
-static struct file_operations acpi_processor_info_fops = {
+static const struct file_operations acpi_processor_info_fops = {
         .open = acpi_processor_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index e439eb77d283..71066066d626 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -768,7 +768,7 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
                 status = -EFAULT;
 
       end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         return status;
 }
@@ -1070,7 +1070,7 @@ static int acpi_processor_power_open_fs(struct inode *inode, struct file *file)
                            PDE(inode)->data);
 }
 
-static struct file_operations acpi_processor_power_fops = {
+static const struct file_operations acpi_processor_power_fops = {
         .open = acpi_processor_power_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 14a00e5a8f6a..7ba5e49ab302 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -216,7 +216,7 @@ static int acpi_processor_get_performance_control(struct acpi_processor *pr)
                sizeof(struct acpi_pct_register));
 
       end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         return result;
 }
@@ -294,7 +294,7 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
         }
 
       end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         return result;
 }
@@ -592,7 +592,7 @@ static int acpi_processor_get_psd(struct acpi_processor	*pr)
         }
 
 end:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
         return result;
 }
 
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
new file mode 100644
index 000000000000..62bef0b3b614
--- /dev/null
+++ b/drivers/acpi/sbs.c
@@ -0,0 +1,1769 @@
+/*
+ *  acpi_sbs.c - ACPI Smart Battery System Driver ($Revision: 1.16 $)
+ *
+ *  Copyright (c) 2005 Rich Townsend <rhdt@bartol.udel.edu>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or (at
+ *  your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <asm/uaccess.h>
+#include <linux/acpi.h>
+#include <linux/i2c.h>
+#include <linux/delay.h>
+
+#include "i2c_ec.h"
+
+#define DEF_CAPACITY_UNIT       3
+#define MAH_CAPACITY_UNIT       1
+#define MWH_CAPACITY_UNIT       2
+#define CAPACITY_UNIT           DEF_CAPACITY_UNIT
+
+#define REQUEST_UPDATE_MODE     1
+#define QUEUE_UPDATE_MODE       2
+
+#define DATA_TYPE_COMMON        0
+#define DATA_TYPE_INFO          1
+#define DATA_TYPE_STATE         2
+#define DATA_TYPE_ALARM         3
+#define DATA_TYPE_AC_STATE      4
+
+extern struct proc_dir_entry *acpi_lock_ac_dir(void);
+extern struct proc_dir_entry *acpi_lock_battery_dir(void);
+extern void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir);
+extern void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
+
+#define ACPI_SBS_COMPONENT              0x00080000
+#define ACPI_SBS_CLASS                  "sbs"
+#define ACPI_AC_CLASS                   "ac_adapter"
+#define ACPI_BATTERY_CLASS              "battery"
+#define ACPI_SBS_HID                    "ACPI0002"
+#define ACPI_SBS_DRIVER_NAME            "ACPI Smart Battery System Driver"
+#define ACPI_SBS_DEVICE_NAME            "Smart Battery System"
+#define ACPI_SBS_FILE_INFO              "info"
+#define ACPI_SBS_FILE_STATE             "state"
+#define ACPI_SBS_FILE_ALARM             "alarm"
+#define ACPI_BATTERY_DIR_NAME           "BAT%i"
+#define ACPI_AC_DIR_NAME                "AC0"
+#define ACPI_SBC_SMBUS_ADDR             0x9
+#define ACPI_SBSM_SMBUS_ADDR            0xa
+#define ACPI_SB_SMBUS_ADDR              0xb
+#define ACPI_SBS_AC_NOTIFY_STATUS       0x80
+#define ACPI_SBS_BATTERY_NOTIFY_STATUS  0x80
+#define ACPI_SBS_BATTERY_NOTIFY_INFO    0x81
+
+#define _COMPONENT                      ACPI_SBS_COMPONENT
+
+#define MAX_SBS_BAT                     4
+#define MAX_SMBUS_ERR                   1
+
+ACPI_MODULE_NAME("acpi_sbs");
+
+MODULE_AUTHOR("Rich Townsend");
+MODULE_DESCRIPTION("Smart Battery System ACPI interface driver");
+MODULE_LICENSE("GPL");
+
+static struct semaphore sbs_sem;
+
+#define UPDATE_MODE             QUEUE_UPDATE_MODE
+/* REQUEST_UPDATE_MODE  QUEUE_UPDATE_MODE */
+#define UPDATE_INFO_MODE        0
+#define UPDATE_TIME             60
+#define UPDATE_TIME2            0
+
+static int capacity_mode = CAPACITY_UNIT;
+static int update_mode = UPDATE_MODE;
+static int update_info_mode = UPDATE_INFO_MODE;
+static int update_time = UPDATE_TIME;
+static int update_time2 = UPDATE_TIME2;
+
+module_param(capacity_mode, int, CAPACITY_UNIT);
+module_param(update_mode, int, UPDATE_MODE);
+module_param(update_info_mode, int, UPDATE_INFO_MODE);
+module_param(update_time, int, UPDATE_TIME);
+module_param(update_time2, int, UPDATE_TIME2);
+
+static int acpi_sbs_add(struct acpi_device *device);
+static int acpi_sbs_remove(struct acpi_device *device, int type);
+static void acpi_battery_smbus_err_handler(struct acpi_ec_smbus *smbus);
+static void acpi_sbs_update_queue(void *data);
+
+static struct acpi_driver acpi_sbs_driver = {
+        .name = ACPI_SBS_DRIVER_NAME,
+        .class = ACPI_SBS_CLASS,
+        .ids = ACPI_SBS_HID,
+        .ops = {
+                .add = acpi_sbs_add,
+                .remove = acpi_sbs_remove,
+                },
+};
+
+struct acpi_battery_info {
+        int capacity_mode;
+        s16 full_charge_capacity;
+        s16 design_capacity;
+        s16 design_voltage;
+        int vscale;
+        int ipscale;
+        s16 serial_number;
+        char manufacturer_name[I2C_SMBUS_BLOCK_MAX + 3];
+        char device_name[I2C_SMBUS_BLOCK_MAX + 3];
+        char device_chemistry[I2C_SMBUS_BLOCK_MAX + 3];
+};
+
+struct acpi_battery_state {
+        s16 voltage;
+        s16 amperage;
+        s16 remaining_capacity;
+        s16 average_time_to_empty;
+        s16 average_time_to_full;
+        s16 battery_status;
+};
+
+struct acpi_battery_alarm {
+        s16 remaining_capacity;
+};
+
+struct acpi_battery {
+        int alive;
+        int battery_present;
+        int id;
+        int init_state;
+        struct acpi_sbs *sbs;
+        struct acpi_battery_info info;
+        struct acpi_battery_state state;
+        struct acpi_battery_alarm alarm;
+        struct proc_dir_entry *battery_entry;
+};
+
+struct acpi_sbs {
+        acpi_handle handle;
+        struct acpi_device *device;
+        struct acpi_ec_smbus *smbus;
+        int sbsm_present;
+        int sbsm_batteries_supported;
+        int ac_present;
+        struct proc_dir_entry *ac_entry;
+        struct acpi_battery battery[MAX_SBS_BAT];
+        int update_info_mode;
+        int zombie;
+        int update_time;
+        int update_time2;
+        struct timer_list update_timer;
+};
+
+static void acpi_update_delay(struct acpi_sbs *sbs);
+static int acpi_sbs_update_run(struct acpi_sbs *sbs, int data_type);
+
+/* --------------------------------------------------------------------------
+                               SMBus Communication
+   -------------------------------------------------------------------------- */
+
+static void acpi_battery_smbus_err_handler(struct acpi_ec_smbus *smbus)
+{
+        union i2c_smbus_data data;
+        int result = 0;
+        char *err_str;
+        int err_number;
+
+        data.word = 0;
+
+        result = smbus->adapter.algo->
+            smbus_xfer(&smbus->adapter,
+                       ACPI_SB_SMBUS_ADDR,
+                       0, I2C_SMBUS_READ, 0x16, I2C_SMBUS_BLOCK_DATA, &data);
+
+        err_number = (data.word & 0x000f);
+
+        switch (data.word & 0x000f) {
+        case 0x0000:
+                err_str = "unexpected bus error";
+                break;
+        case 0x0001:
+                err_str = "busy";
+                break;
+        case 0x0002:
+                err_str = "reserved command";
+                break;
+        case 0x0003:
+                err_str = "unsupported command";
+                break;
+        case 0x0004:
+                err_str = "access denied";
+                break;
+        case 0x0005:
+                err_str = "overflow/underflow";
+                break;
+        case 0x0006:
+                err_str = "bad size";
+                break;
+        case 0x0007:
+                err_str = "unknown error";
+                break;
+        default:
+                err_str = "unrecognized error";
+        }
+        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                          "%s: ret %i, err %i\n", err_str, result, err_number));
+}
+
+static int
+acpi_sbs_smbus_read_word(struct acpi_ec_smbus *smbus, int addr, int func,
+                         u16 * word,
+                         void (*err_handler) (struct acpi_ec_smbus * smbus))
+{
+        union i2c_smbus_data data;
+        int result = 0;
+        int i;
+
+        if (err_handler == NULL) {
+                err_handler = acpi_battery_smbus_err_handler;
+        }
+
+        for (i = 0; i < MAX_SMBUS_ERR; i++) {
+                result =
+                    smbus->adapter.algo->smbus_xfer(&smbus->adapter, addr, 0,
+                                                    I2C_SMBUS_READ, func,
+                                                    I2C_SMBUS_WORD_DATA, &data);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "try %i: smbus->adapter.algo->smbus_xfer() failed\n",
+                                          i));
+                        if (err_handler) {
+                                err_handler(smbus);
+                        }
+                } else {
+                        *word = data.word;
+                        break;
+                }
+        }
+
+        return result;
+}
+
+static int
+acpi_sbs_smbus_read_str(struct acpi_ec_smbus *smbus, int addr, int func,
+                        char *str,
+                        void (*err_handler) (struct acpi_ec_smbus * smbus))
+{
+        union i2c_smbus_data data;
+        int result = 0;
+        int i;
+
+        if (err_handler == NULL) {
+                err_handler = acpi_battery_smbus_err_handler;
+        }
+
+        for (i = 0; i < MAX_SMBUS_ERR; i++) {
+                result =
+                    smbus->adapter.algo->smbus_xfer(&smbus->adapter, addr, 0,
+                                                    I2C_SMBUS_READ, func,
+                                                    I2C_SMBUS_BLOCK_DATA,
+                                                    &data);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "try %i: smbus->adapter.algo->smbus_xfer() failed\n",
+                                          i));
+                        if (err_handler) {
+                                err_handler(smbus);
+                        }
+                } else {
+                        strncpy(str, (const char *)data.block + 1,
+                                data.block[0]);
+                        str[data.block[0]] = 0;
+                        break;
+                }
+        }
+
+        return result;
+}
+
+static int
+acpi_sbs_smbus_write_word(struct acpi_ec_smbus *smbus, int addr, int func,
+                          int word,
+                          void (*err_handler) (struct acpi_ec_smbus * smbus))
+{
+        union i2c_smbus_data data;
+        int result = 0;
+        int i;
+
+        if (err_handler == NULL) {
+                err_handler = acpi_battery_smbus_err_handler;
+        }
+
+        data.word = word;
+
+        for (i = 0; i < MAX_SMBUS_ERR; i++) {
+                result =
+                    smbus->adapter.algo->smbus_xfer(&smbus->adapter, addr, 0,
+                                                    I2C_SMBUS_WRITE, func,
+                                                    I2C_SMBUS_WORD_DATA, &data);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "try %i: smbus->adapter.algo"
+                                          "->smbus_xfer() failed\n", i));
+                        if (err_handler) {
+                                err_handler(smbus);
+                        }
+                } else {
+                        break;
+                }
+        }
+
+        return result;
+}
+
+/* --------------------------------------------------------------------------
+                            Smart Battery System Management
+   -------------------------------------------------------------------------- */
+
+/* Smart Battery */
+
+static int acpi_sbs_generate_event(struct acpi_device *device,
+                                   int event, int state, char *bid, char *class)
+{
+        char bid_saved[5];
+        char class_saved[20];
+        int result = 0;
+
+        strcpy(bid_saved, acpi_device_bid(device));
+        strcpy(class_saved, acpi_device_class(device));
+
+        strcpy(acpi_device_bid(device), bid);
+        strcpy(acpi_device_class(device), class);
+
+        result = acpi_bus_generate_event(device, event, state);
+
+        strcpy(acpi_device_bid(device), bid_saved);
+        strcpy(acpi_device_class(device), class_saved);
+
+        return result;
+}
+
+static int acpi_battery_get_present(struct acpi_battery *battery)
+{
+        s16 state;
+        int result = 0;
+        int is_present = 0;
+
+        result = acpi_sbs_smbus_read_word(battery->sbs->smbus,
+                                          ACPI_SBSM_SMBUS_ADDR, 0x01,
+                                          &state, NULL);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed"));
+        }
+        if (!result) {
+                is_present = (state & 0x000f) & (1 << battery->id);
+        }
+        battery->battery_present = is_present;
+
+        return result;
+}
+
+static int acpi_battery_is_present(struct acpi_battery *battery)
+{
+        return (battery->battery_present);
+}
+
+static int acpi_ac_is_present(struct acpi_sbs *sbs)
+{
+        return (sbs->ac_present);
+}
+
+static int acpi_battery_select(struct acpi_battery *battery)
+{
+        struct acpi_ec_smbus *smbus = battery->sbs->smbus;
+        int result = 0;
+        s16 state;
+        int foo;
+
+        if (battery->sbs->sbsm_present) {
+
+                /* Take special care not to knobble other nibbles of
+                 * state (aka selector_state), since
+                 * it causes charging to halt on SBSELs */
+
+                result =
+                    acpi_sbs_smbus_read_word(smbus, ACPI_SBSM_SMBUS_ADDR, 0x01,
+                                             &state, NULL);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_smbus_read_word() failed\n"));
+                        goto end;
+                }
+
+                foo = (state & 0x0fff) | (1 << (battery->id + 12));
+                result =
+                    acpi_sbs_smbus_write_word(smbus, ACPI_SBSM_SMBUS_ADDR, 0x01,
+                                              foo, NULL);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_smbus_write_word() failed\n"));
+                        goto end;
+                }
+        }
+
+      end:
+        return result;
+}
+
+static int acpi_sbsm_get_info(struct acpi_sbs *sbs)
+{
+        struct acpi_ec_smbus *smbus = sbs->smbus;
+        int result = 0;
+        s16 battery_system_info;
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SBSM_SMBUS_ADDR, 0x04,
+                                          &battery_system_info, NULL);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        sbs->sbsm_batteries_supported = battery_system_info & 0x000f;
+
+      end:
+
+        return result;
+}
+
+static int acpi_battery_get_info(struct acpi_battery *battery)
+{
+        struct acpi_ec_smbus *smbus = battery->sbs->smbus;
+        int result = 0;
+        s16 battery_mode;
+        s16 specification_info;
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x03,
+                                          &battery_mode,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+        battery->info.capacity_mode = (battery_mode & 0x8000) >> 15;
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x10,
+                                          &battery->info.full_charge_capacity,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x18,
+                                          &battery->info.design_capacity,
+                                          &acpi_battery_smbus_err_handler);
+
+        if (result) {
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x19,
+                                          &battery->info.design_voltage,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x1a,
+                                          &specification_info,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        switch ((specification_info & 0x0f00) >> 8) {
+        case 1:
+                battery->info.vscale = 10;
+                break;
+        case 2:
+                battery->info.vscale = 100;
+                break;
+        case 3:
+                battery->info.vscale = 1000;
+                break;
+        default:
+                battery->info.vscale = 1;
+        }
+
+        switch ((specification_info & 0xf000) >> 12) {
+        case 1:
+                battery->info.ipscale = 10;
+                break;
+        case 2:
+                battery->info.ipscale = 100;
+                break;
+        case 3:
+                battery->info.ipscale = 1000;
+                break;
+        default:
+                battery->info.ipscale = 1;
+        }
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x1c,
+                                          &battery->info.serial_number,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_str(smbus, ACPI_SB_SMBUS_ADDR, 0x20,
+                                         battery->info.manufacturer_name,
+                                         &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_str() failed\n"));
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_str(smbus, ACPI_SB_SMBUS_ADDR, 0x21,
+                                         battery->info.device_name,
+                                         &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_str() failed\n"));
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_str(smbus, ACPI_SB_SMBUS_ADDR, 0x22,
+                                         battery->info.device_chemistry,
+                                         &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_str() failed\n"));
+                goto end;
+        }
+
+      end:
+        return result;
+}
+
+static void acpi_update_delay(struct acpi_sbs *sbs)
+{
+        if (sbs->zombie) {
+                return;
+        }
+        if (sbs->update_time2 > 0) {
+                msleep(sbs->update_time2 * 1000);
+        }
+}
+
+static int acpi_battery_get_state(struct acpi_battery *battery)
+{
+        struct acpi_ec_smbus *smbus = battery->sbs->smbus;
+        int result = 0;
+
+        acpi_update_delay(battery->sbs);
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x09,
+                                          &battery->state.voltage,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x0a,
+                                          &battery->state.amperage,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x0f,
+                                          &battery->state.remaining_capacity,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x12,
+                                          &battery->state.average_time_to_empty,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x13,
+                                          &battery->state.average_time_to_full,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x16,
+                                          &battery->state.battery_status,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+
+      end:
+        return result;
+}
+
+static int acpi_battery_get_alarm(struct acpi_battery *battery)
+{
+        struct acpi_ec_smbus *smbus = battery->sbs->smbus;
+        int result = 0;
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x01,
+                                          &battery->alarm.remaining_capacity,
+                                          &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        acpi_update_delay(battery->sbs);
+
+      end:
+
+        return result;
+}
+
+static int acpi_battery_set_alarm(struct acpi_battery *battery,
+                                  unsigned long alarm)
+{
+        struct acpi_ec_smbus *smbus = battery->sbs->smbus;
+        int result = 0;
+        s16 battery_mode;
+        int foo;
+
+        result = acpi_battery_select(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_select() failed\n"));
+                goto end;
+        }
+
+        /* If necessary, enable the alarm */
+
+        if (alarm > 0) {
+                result =
+                    acpi_sbs_smbus_read_word(smbus, ACPI_SB_SMBUS_ADDR, 0x03,
+                                             &battery_mode,
+                                             &acpi_battery_smbus_err_handler);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_smbus_read_word() failed\n"));
+                        goto end;
+                }
+
+                result =
+                    acpi_sbs_smbus_write_word(smbus, ACPI_SB_SMBUS_ADDR, 0x01,
+                                              battery_mode & 0xbfff,
+                                              &acpi_battery_smbus_err_handler);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_smbus_write_word() failed\n"));
+                        goto end;
+                }
+        }
+
+        foo = alarm / (battery->info.capacity_mode ? 10 : 1);
+        result = acpi_sbs_smbus_write_word(smbus, ACPI_SB_SMBUS_ADDR, 0x01,
+                                           foo,
+                                           &acpi_battery_smbus_err_handler);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_write_word() failed\n"));
+                goto end;
+        }
+
+      end:
+
+        return result;
+}
+
+static int acpi_battery_set_mode(struct acpi_battery *battery)
+{
+        int result = 0;
+        s16 battery_mode;
+
+        if (capacity_mode == DEF_CAPACITY_UNIT) {
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_word(battery->sbs->smbus,
+                                          ACPI_SB_SMBUS_ADDR, 0x03,
+                                          &battery_mode, NULL);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        if (capacity_mode == MAH_CAPACITY_UNIT) {
+                battery_mode &= 0x7fff;
+        } else {
+                battery_mode |= 0x8000;
+        }
+        result = acpi_sbs_smbus_write_word(battery->sbs->smbus,
+                                           ACPI_SB_SMBUS_ADDR, 0x03,
+                                           battery_mode, NULL);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_write_word() failed\n"));
+                goto end;
+        }
+
+        result = acpi_sbs_smbus_read_word(battery->sbs->smbus,
+                                          ACPI_SB_SMBUS_ADDR, 0x03,
+                                          &battery_mode, NULL);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+      end:
+        return result;
+}
+
+static int acpi_battery_init(struct acpi_battery *battery)
+{
+        int result = 0;
+
+        result = acpi_battery_select(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_init() failed\n"));
+                goto end;
+        }
+
+        result = acpi_battery_set_mode(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_set_mode() failed\n"));
+                goto end;
+        }
+
+        result = acpi_battery_get_info(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_get_info() failed\n"));
+                goto end;
+        }
+
+        result = acpi_battery_get_state(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_get_state() failed\n"));
+                goto end;
+        }
+
+        result = acpi_battery_get_alarm(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_get_alarm() failed\n"));
+                goto end;
+        }
+
+      end:
+        return result;
+}
+
+static int acpi_ac_get_present(struct acpi_sbs *sbs)
+{
+        struct acpi_ec_smbus *smbus = sbs->smbus;
+        int result = 0;
+        s16 charger_status;
+
+        result = acpi_sbs_smbus_read_word(smbus, ACPI_SBC_SMBUS_ADDR, 0x13,
+                                          &charger_status, NULL);
+
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_smbus_read_word() failed\n"));
+                goto end;
+        }
+
+        sbs->ac_present = (charger_status & 0x8000) >> 15;
+
+      end:
+
+        return result;
+}
+
+/* --------------------------------------------------------------------------
+                              FS Interface (/proc/acpi)
+   -------------------------------------------------------------------------- */
+
+/* Generic Routines */
+
+static int
+acpi_sbs_generic_add_fs(struct proc_dir_entry **dir,
+                        struct proc_dir_entry *parent_dir,
+                        char *dir_name,
+                        struct file_operations *info_fops,
+                        struct file_operations *state_fops,
+                        struct file_operations *alarm_fops, void *data)
+{
+        struct proc_dir_entry *entry = NULL;
+
+        if (!*dir) {
+                *dir = proc_mkdir(dir_name, parent_dir);
+                if (!*dir) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "proc_mkdir() failed\n"));
+                        return -ENODEV;
+                }
+                (*dir)->owner = THIS_MODULE;
+        }
+
+        /* 'info' [R] */
+        if (info_fops) {
+                entry = create_proc_entry(ACPI_SBS_FILE_INFO, S_IRUGO, *dir);
+                if (!entry) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "create_proc_entry() failed\n"));
+                } else {
+                        entry->proc_fops = info_fops;
+                        entry->data = data;
+                        entry->owner = THIS_MODULE;
+                }
+        }
+
+        /* 'state' [R] */
+        if (state_fops) {
+                entry = create_proc_entry(ACPI_SBS_FILE_STATE, S_IRUGO, *dir);
+                if (!entry) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "create_proc_entry() failed\n"));
+                } else {
+                        entry->proc_fops = state_fops;
+                        entry->data = data;
+                        entry->owner = THIS_MODULE;
+                }
+        }
+
+        /* 'alarm' [R/W] */
+        if (alarm_fops) {
+                entry = create_proc_entry(ACPI_SBS_FILE_ALARM, S_IRUGO, *dir);
+                if (!entry) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "create_proc_entry() failed\n"));
+                } else {
+                        entry->proc_fops = alarm_fops;
+                        entry->data = data;
+                        entry->owner = THIS_MODULE;
+                }
+        }
+
+        return 0;
+}
+
+static void
+acpi_sbs_generic_remove_fs(struct proc_dir_entry **dir,
+                           struct proc_dir_entry *parent_dir)
+{
+
+        if (*dir) {
+                remove_proc_entry(ACPI_SBS_FILE_INFO, *dir);
+                remove_proc_entry(ACPI_SBS_FILE_STATE, *dir);
+                remove_proc_entry(ACPI_SBS_FILE_ALARM, *dir);
+                remove_proc_entry((*dir)->name, parent_dir);
+                *dir = NULL;
+        }
+
+}
+
+/* Smart Battery Interface */
+
+static struct proc_dir_entry *acpi_battery_dir = NULL;
+
+static int acpi_battery_read_info(struct seq_file *seq, void *offset)
+{
+        struct acpi_battery *battery = (struct acpi_battery *)seq->private;
+        int cscale;
+        int result = 0;
+
+        if (battery->sbs->zombie) {
+                return -ENODEV;
+        }
+
+        down(&sbs_sem);
+
+        if (update_mode == REQUEST_UPDATE_MODE) {
+                result = acpi_sbs_update_run(battery->sbs, DATA_TYPE_INFO);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_update_run() failed\n"));
+                }
+        }
+
+        if (acpi_battery_is_present(battery)) {
+                seq_printf(seq, "present:                 yes\n");
+        } else {
+                seq_printf(seq, "present:                 no\n");
+                goto end;
+        }
+
+        if (battery->info.capacity_mode) {
+                cscale = battery->info.vscale * battery->info.ipscale;
+        } else {
+                cscale = battery->info.ipscale;
+        }
+        seq_printf(seq, "design capacity:         %i%s",
+                   battery->info.design_capacity * cscale,
+                   battery->info.capacity_mode ? "0 mWh\n" : " mAh\n");
+
+        seq_printf(seq, "last full capacity:      %i%s",
+                   battery->info.full_charge_capacity * cscale,
+                   battery->info.capacity_mode ? "0 mWh\n" : " mAh\n");
+
+        seq_printf(seq, "battery technology:      rechargeable\n");
+
+        seq_printf(seq, "design voltage:          %i mV\n",
+                   battery->info.design_voltage * battery->info.vscale);
+
+        seq_printf(seq, "design capacity warning: unknown\n");
+        seq_printf(seq, "design capacity low:     unknown\n");
+        seq_printf(seq, "capacity granularity 1:  unknown\n");
+        seq_printf(seq, "capacity granularity 2:  unknown\n");
+
+        seq_printf(seq, "model number:            %s\n",
+                   battery->info.device_name);
+
+        seq_printf(seq, "serial number:           %i\n",
+                   battery->info.serial_number);
+
+        seq_printf(seq, "battery type:            %s\n",
+                   battery->info.device_chemistry);
+
+        seq_printf(seq, "OEM info:                %s\n",
+                   battery->info.manufacturer_name);
+
+      end:
+
+        up(&sbs_sem);
+
+        return result;
+}
+
+static int acpi_battery_info_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_battery_read_info, PDE(inode)->data);
+}
+
+static int acpi_battery_read_state(struct seq_file *seq, void *offset)
+{
+        struct acpi_battery *battery = (struct acpi_battery *)seq->private;
+        int result = 0;
+        int cscale;
+        int foo;
+
+        if (battery->sbs->zombie) {
+                return -ENODEV;
+        }
+
+        down(&sbs_sem);
+
+        if (update_mode == REQUEST_UPDATE_MODE) {
+                result = acpi_sbs_update_run(battery->sbs, DATA_TYPE_STATE);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_update_run() failed\n"));
+                }
+        }
+
+        if (acpi_battery_is_present(battery)) {
+                seq_printf(seq, "present:                 yes\n");
+        } else {
+                seq_printf(seq, "present:                 no\n");
+                goto end;
+        }
+
+        if (battery->info.capacity_mode) {
+                cscale = battery->info.vscale * battery->info.ipscale;
+        } else {
+                cscale = battery->info.ipscale;
+        }
+
+        if (battery->state.battery_status & 0x0010) {
+                seq_printf(seq, "capacity state:          critical\n");
+        } else {
+                seq_printf(seq, "capacity state:          ok\n");
+        }
+        if (battery->state.amperage < 0) {
+                seq_printf(seq, "charging state:          discharging\n");
+                foo = battery->state.remaining_capacity * cscale * 60 /
+                    (battery->state.average_time_to_empty == 0 ? 1 :
+                     battery->state.average_time_to_empty);
+                seq_printf(seq, "present rate:            %i%s\n",
+                           foo, battery->info.capacity_mode ? "0 mW" : " mA");
+        } else if (battery->state.amperage > 0) {
+                seq_printf(seq, "charging state:          charging\n");
+                foo = (battery->info.full_charge_capacity -
+                       battery->state.remaining_capacity) * cscale * 60 /
+                    (battery->state.average_time_to_full == 0 ? 1 :
+                     battery->state.average_time_to_full);
+                seq_printf(seq, "present rate:            %i%s\n",
+                           foo, battery->info.capacity_mode ? "0 mW" : " mA");
+        } else {
+                seq_printf(seq, "charging state:          charged\n");
+                seq_printf(seq, "present rate:            0 %s\n",
+                           battery->info.capacity_mode ? "mW" : "mA");
+        }
+
+        seq_printf(seq, "remaining capacity:      %i%s",
+                   battery->state.remaining_capacity * cscale,
+                   battery->info.capacity_mode ? "0 mWh\n" : " mAh\n");
+
+        seq_printf(seq, "present voltage:         %i mV\n",
+                   battery->state.voltage * battery->info.vscale);
+
+      end:
+
+        up(&sbs_sem);
+
+        return result;
+}
+
+static int acpi_battery_state_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_battery_read_state, PDE(inode)->data);
+}
+
+static int acpi_battery_read_alarm(struct seq_file *seq, void *offset)
+{
+        struct acpi_battery *battery = (struct acpi_battery *)seq->private;
+        int result = 0;
+        int cscale;
+
+        if (battery->sbs->zombie) {
+                return -ENODEV;
+        }
+
+        down(&sbs_sem);
+
+        if (update_mode == REQUEST_UPDATE_MODE) {
+                result = acpi_sbs_update_run(battery->sbs, DATA_TYPE_ALARM);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_update_run() failed\n"));
+                }
+        }
+
+        if (!acpi_battery_is_present(battery)) {
+                seq_printf(seq, "present:                 no\n");
+                goto end;
+        }
+
+        if (battery->info.capacity_mode) {
+                cscale = battery->info.vscale * battery->info.ipscale;
+        } else {
+                cscale = battery->info.ipscale;
+        }
+
+        seq_printf(seq, "alarm:                   ");
+        if (battery->alarm.remaining_capacity) {
+                seq_printf(seq, "%i%s",
+                           battery->alarm.remaining_capacity * cscale,
+                           battery->info.capacity_mode ? "0 mWh\n" : " mAh\n");
+        } else {
+                seq_printf(seq, "disabled\n");
+        }
+
+      end:
+
+        up(&sbs_sem);
+
+        return result;
+}
+
+static ssize_t
+acpi_battery_write_alarm(struct file *file, const char __user * buffer,
+                         size_t count, loff_t * ppos)
+{
+        struct seq_file *seq = (struct seq_file *)file->private_data;
+        struct acpi_battery *battery = (struct acpi_battery *)seq->private;
+        char alarm_string[12] = { '\0' };
+        int result, old_alarm, new_alarm;
+
+        if (battery->sbs->zombie) {
+                return -ENODEV;
+        }
+
+        down(&sbs_sem);
+
+        if (!acpi_battery_is_present(battery)) {
+                result = -ENODEV;
+                goto end;
+        }
+
+        if (count > sizeof(alarm_string) - 1) {
+                result = -EINVAL;
+                goto end;
+        }
+
+        if (copy_from_user(alarm_string, buffer, count)) {
+                result = -EFAULT;
+                goto end;
+        }
+
+        alarm_string[count] = 0;
+
+        old_alarm = battery->alarm.remaining_capacity;
+        new_alarm = simple_strtoul(alarm_string, NULL, 0);
+
+        result = acpi_battery_set_alarm(battery, new_alarm);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_set_alarm() failed\n"));
+                (void)acpi_battery_set_alarm(battery, old_alarm);
+                goto end;
+        }
+        result = acpi_battery_get_alarm(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_get_alarm() failed\n"));
+                (void)acpi_battery_set_alarm(battery, old_alarm);
+                goto end;
+        }
+
+      end:
+        up(&sbs_sem);
+
+        if (result) {
+                return result;
+        } else {
+                return count;
+        }
+}
+
+static int acpi_battery_alarm_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_battery_read_alarm, PDE(inode)->data);
+}
+
+static struct file_operations acpi_battery_info_fops = {
+        .open = acpi_battery_info_open_fs,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+        .owner = THIS_MODULE,
+};
+
+static struct file_operations acpi_battery_state_fops = {
+        .open = acpi_battery_state_open_fs,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+        .owner = THIS_MODULE,
+};
+
+static struct file_operations acpi_battery_alarm_fops = {
+        .open = acpi_battery_alarm_open_fs,
+        .read = seq_read,
+        .write = acpi_battery_write_alarm,
+        .llseek = seq_lseek,
+        .release = single_release,
+        .owner = THIS_MODULE,
+};
+
+/* Legacy AC Adapter Interface */
+
+static struct proc_dir_entry *acpi_ac_dir = NULL;
+
+static int acpi_ac_read_state(struct seq_file *seq, void *offset)
+{
+        struct acpi_sbs *sbs = (struct acpi_sbs *)seq->private;
+        int result;
+
+        if (sbs->zombie) {
+                return -ENODEV;
+        }
+
+        down(&sbs_sem);
+
+        if (update_mode == REQUEST_UPDATE_MODE) {
+                result = acpi_sbs_update_run(sbs, DATA_TYPE_AC_STATE);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_update_run() failed\n"));
+                }
+        }
+
+        seq_printf(seq, "state:                   %s\n",
+                   sbs->ac_present ? "on-line" : "off-line");
+
+        up(&sbs_sem);
+
+        return 0;
+}
+
+static int acpi_ac_state_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_ac_read_state, PDE(inode)->data);
+}
+
+static struct file_operations acpi_ac_state_fops = {
+        .open = acpi_ac_state_open_fs,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+        .owner = THIS_MODULE,
+};
+
+/* --------------------------------------------------------------------------
+                                 Driver Interface
+   -------------------------------------------------------------------------- */
+
+/* Smart Battery */
+
+static int acpi_battery_add(struct acpi_sbs *sbs, int id)
+{
+        int is_present;
+        int result;
+        char dir_name[32];
+        struct acpi_battery *battery;
+
+        battery = &sbs->battery[id];
+
+        battery->alive = 0;
+
+        battery->init_state = 0;
+        battery->id = id;
+        battery->sbs = sbs;
+
+        result = acpi_battery_select(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_select() failed\n"));
+                goto end;
+        }
+
+        result = acpi_battery_get_present(battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_battery_get_present() failed\n"));
+                goto end;
+        }
+
+        is_present = acpi_battery_is_present(battery);
+
+        if (is_present) {
+                result = acpi_battery_init(battery);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_battery_init() failed\n"));
+                        goto end;
+                }
+                battery->init_state = 1;
+        }
+
+        (void)sprintf(dir_name, ACPI_BATTERY_DIR_NAME, id);
+
+        result = acpi_sbs_generic_add_fs(&battery->battery_entry,
+                                         acpi_battery_dir,
+                                         dir_name,
+                                         &acpi_battery_info_fops,
+                                         &acpi_battery_state_fops,
+                                         &acpi_battery_alarm_fops, battery);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_generic_add_fs() failed\n"));
+                goto end;
+        }
+        battery->alive = 1;
+
+      end:
+        return result;
+}
+
+static void acpi_battery_remove(struct acpi_sbs *sbs, int id)
+{
+
+        if (sbs->battery[id].battery_entry) {
+                acpi_sbs_generic_remove_fs(&(sbs->battery[id].battery_entry),
+                                           acpi_battery_dir);
+        }
+}
+
+static int acpi_ac_add(struct acpi_sbs *sbs)
+{
+        int result;
+
+        result = acpi_ac_get_present(sbs);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_ac_get_present() failed\n"));
+                goto end;
+        }
+
+        result = acpi_sbs_generic_add_fs(&sbs->ac_entry,
+                                         acpi_ac_dir,
+                                         ACPI_AC_DIR_NAME,
+                                         NULL, &acpi_ac_state_fops, NULL, sbs);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_generic_add_fs() failed\n"));
+                goto end;
+        }
+
+      end:
+
+        return result;
+}
+
+static void acpi_ac_remove(struct acpi_sbs *sbs)
+{
+
+        if (sbs->ac_entry) {
+                acpi_sbs_generic_remove_fs(&sbs->ac_entry, acpi_ac_dir);
+        }
+}
+
+static void acpi_sbs_update_queue_run(unsigned long data)
+{
+        acpi_os_execute(OSL_GPE_HANDLER, acpi_sbs_update_queue, (void *)data);
+}
+
+static int acpi_sbs_update_run(struct acpi_sbs *sbs, int data_type)
+{
+        struct acpi_battery *battery;
+        int result = 0;
+        int old_ac_present;
+        int old_battery_present;
+        int new_ac_present;
+        int new_battery_present;
+        int id;
+        char dir_name[32];
+        int do_battery_init, do_ac_init;
+        s16 old_remaining_capacity;
+
+        if (sbs->zombie) {
+                goto end;
+        }
+
+        old_ac_present = acpi_ac_is_present(sbs);
+
+        result = acpi_ac_get_present(sbs);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_ac_get_present() failed\n"));
+        }
+
+        new_ac_present = acpi_ac_is_present(sbs);
+
+        do_ac_init = (old_ac_present != new_ac_present);
+
+        if (data_type == DATA_TYPE_AC_STATE) {
+                goto end;
+        }
+
+        for (id = 0; id < MAX_SBS_BAT; id++) {
+                battery = &sbs->battery[id];
+                if (battery->alive == 0) {
+                        continue;
+                }
+
+                old_remaining_capacity = battery->state.remaining_capacity;
+
+                old_battery_present = acpi_battery_is_present(battery);
+
+                result = acpi_battery_select(battery);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_battery_select() failed\n"));
+                }
+                if (sbs->zombie) {
+                        goto end;
+                }
+
+                result = acpi_battery_get_present(battery);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_battery_get_present() failed\n"));
+                }
+                if (sbs->zombie) {
+                        goto end;
+                }
+
+                new_battery_present = acpi_battery_is_present(battery);
+
+                do_battery_init = ((old_battery_present != new_battery_present)
+                                   && new_battery_present);
+
+                if (sbs->zombie) {
+                        goto end;
+                }
+                if (do_ac_init || do_battery_init ||
+                    update_info_mode || sbs->update_info_mode) {
+                        if (sbs->update_info_mode) {
+                                sbs->update_info_mode = 0;
+                        } else {
+                                sbs->update_info_mode = 1;
+                        }
+                        result = acpi_battery_init(battery);
+                        if (result) {
+                                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                                  "acpi_battery_init() "
+                                                  "failed\n"));
+                        }
+                }
+                if (data_type == DATA_TYPE_INFO) {
+                        continue;
+                }
+
+                if (sbs->zombie) {
+                        goto end;
+                }
+                if (new_battery_present) {
+                        result = acpi_battery_get_alarm(battery);
+                        if (result) {
+                                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                                  "acpi_battery_get_alarm() "
+                                                  "failed\n"));
+                        }
+                        if (data_type == DATA_TYPE_ALARM) {
+                                continue;
+                        }
+
+                        result = acpi_battery_get_state(battery);
+                        if (result) {
+                                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                                  "acpi_battery_get_state() "
+                                                  "failed\n"));
+                        }
+                }
+                if (sbs->zombie) {
+                        goto end;
+                }
+                if (data_type != DATA_TYPE_COMMON) {
+                        continue;
+                }
+
+                if (old_battery_present != new_battery_present) {
+                        (void)sprintf(dir_name, ACPI_BATTERY_DIR_NAME, id);
+                        result = acpi_sbs_generate_event(sbs->device,
+                                                         ACPI_SBS_BATTERY_NOTIFY_STATUS,
+                                                         new_battery_present,
+                                                         dir_name,
+                                                         ACPI_BATTERY_CLASS);
+                        if (result) {
+                                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                                  "acpi_sbs_generate_event() "
+                                                  "failed\n"));
+                        }
+                }
+                if (old_remaining_capacity != battery->state.remaining_capacity) {
+                        (void)sprintf(dir_name, ACPI_BATTERY_DIR_NAME, id);
+                        result = acpi_sbs_generate_event(sbs->device,
+                                                         ACPI_SBS_BATTERY_NOTIFY_STATUS,
+                                                         new_battery_present,
+                                                         dir_name,
+                                                         ACPI_BATTERY_CLASS);
+                        if (result) {
+                                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                                  "acpi_sbs_generate_event() failed\n"));
+                        }
+                }
+
+        }
+        if (sbs->zombie) {
+                goto end;
+        }
+        if (data_type != DATA_TYPE_COMMON) {
+                goto end;
+        }
+
+        if (old_ac_present != new_ac_present) {
+                result = acpi_sbs_generate_event(sbs->device,
+                                                 ACPI_SBS_AC_NOTIFY_STATUS,
+                                                 new_ac_present,
+                                                 ACPI_AC_DIR_NAME,
+                                                 ACPI_AC_CLASS);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_generate_event() failed\n"));
+                }
+        }
+
+      end:
+        return result;
+}
+
+static void acpi_sbs_update_queue(void *data)
+{
+        struct acpi_sbs *sbs = data;
+        unsigned long delay = -1;
+        int result;
+
+        if (sbs->zombie) {
+                goto end;
+        }
+
+        result = acpi_sbs_update_run(sbs, DATA_TYPE_COMMON);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_sbs_update_run() failed\n"));
+        }
+
+        if (sbs->zombie) {
+                goto end;
+        }
+
+        if (update_mode == REQUEST_UPDATE_MODE) {
+                goto end;
+        }
+
+        delay = jiffies + HZ * update_time;
+        sbs->update_timer.data = (unsigned long)data;
+        sbs->update_timer.function = acpi_sbs_update_queue_run;
+        sbs->update_timer.expires = delay;
+        add_timer(&sbs->update_timer);
+      end:
+        ;
+}
+
+static int acpi_sbs_add(struct acpi_device *device)
+{
+        struct acpi_sbs *sbs = NULL;
+        struct acpi_ec_hc *ec_hc = NULL;
+        int result, remove_result = 0;
+        unsigned long sbs_obj;
+        int id, cnt;
+        acpi_status status = AE_OK;
+
+        sbs = kmalloc(sizeof(struct acpi_sbs), GFP_KERNEL);
+        if (!sbs) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "kmalloc() failed\n"));
+                return -ENOMEM;
+        }
+        memset(sbs, 0, sizeof(struct acpi_sbs));
+
+        cnt = 0;
+        while (cnt < 10) {
+                cnt++;
+                ec_hc = acpi_get_ec_hc(device);
+                if (ec_hc) {
+                        break;
+                }
+                msleep(1000);
+        }
+
+        if (!ec_hc) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_get_ec_hc() failed: "
+                                  "NO driver found for EC HC SMBus\n"));
+                result = -ENODEV;
+                goto end;
+        }
+
+        sbs->device = device;
+        sbs->smbus = ec_hc->smbus;
+
+        strcpy(acpi_device_name(device), ACPI_SBS_DEVICE_NAME);
+        strcpy(acpi_device_class(device), ACPI_SBS_CLASS);
+        acpi_driver_data(device) = sbs;
+
+        sbs->update_time = 0;
+        sbs->update_time2 = 0;
+
+        result = acpi_ac_add(sbs);
+        if (result) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "acpi_ac_add() failed\n"));
+                goto end;
+        }
+        result = acpi_evaluate_integer(device->handle, "_SBS", NULL, &sbs_obj);
+        if (ACPI_FAILURE(result)) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_evaluate_integer() failed\n"));
+                result = -EIO;
+                goto end;
+        }
+
+        if (sbs_obj > 0) {
+                result = acpi_sbsm_get_info(sbs);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbsm_get_info() failed\n"));
+                        goto end;
+                }
+                sbs->sbsm_present = 1;
+        }
+        if (sbs->sbsm_present == 0) {
+                result = acpi_battery_add(sbs, 0);
+                if (result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_battery_add() failed\n"));
+                        goto end;
+                }
+        } else {
+                for (id = 0; id < MAX_SBS_BAT; id++) {
+                        if ((sbs->sbsm_batteries_supported & (1 << id))) {
+                                result = acpi_battery_add(sbs, id);
+                                if (result) {
+                                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                                          "acpi_battery_add() "
+                                                          "failed\n"));
+                                        goto end;
+                                }
+                        }
+                }
+        }
+
+        sbs->handle = device->handle;
+
+        init_timer(&sbs->update_timer);
+        if (update_mode == QUEUE_UPDATE_MODE) {
+                status = acpi_os_execute(OSL_GPE_HANDLER,
+                                         acpi_sbs_update_queue, (void *)sbs);
+                if (status != AE_OK) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_os_execute() failed\n"));
+                }
+        }
+        sbs->update_time = update_time;
+        sbs->update_time2 = update_time2;
+
+        printk(KERN_INFO PREFIX "%s [%s]\n",
+               acpi_device_name(device), acpi_device_bid(device));
+
+      end:
+        if (result) {
+                remove_result = acpi_sbs_remove(device, 0);
+                if (remove_result) {
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                          "acpi_sbs_remove() failed\n"));
+                }
+        }
+
+        return result;
+}
+
+int acpi_sbs_remove(struct acpi_device *device, int type)
+{
+        struct acpi_sbs *sbs = (struct acpi_sbs *)acpi_driver_data(device);
+        int id;
+
+        if (!device || !sbs) {
+                return -EINVAL;
+        }
+
+        sbs->zombie = 1;
+        sbs->update_time = 0;
+        sbs->update_time2 = 0;
+        del_timer_sync(&sbs->update_timer);
+        acpi_os_wait_events_complete(NULL);
+        del_timer_sync(&sbs->update_timer);
+
+        for (id = 0; id < MAX_SBS_BAT; id++) {
+                acpi_battery_remove(sbs, id);
+        }
+
+        acpi_ac_remove(sbs);
+
+        kfree(sbs);
+
+        return 0;
+}
+
+static int __init acpi_sbs_init(void)
+{
+        int result = 0;
+
+        if (acpi_disabled)
+                return -ENODEV;
+
+        init_MUTEX(&sbs_sem);
+
+        if (capacity_mode != DEF_CAPACITY_UNIT
+            && capacity_mode != MAH_CAPACITY_UNIT
+            && capacity_mode != MWH_CAPACITY_UNIT) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "acpi_sbs_init: "
+                                  "invalid capacity_mode = %d\n",
+                                  capacity_mode));
+                return -EINVAL;
+        }
+
+        acpi_ac_dir = acpi_lock_ac_dir();
+        if (!acpi_ac_dir) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_lock_ac_dir() failed\n"));
+                return -ENODEV;
+        }
+
+        acpi_battery_dir = acpi_lock_battery_dir();
+        if (!acpi_battery_dir) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_lock_battery_dir() failed\n"));
+                return -ENODEV;
+        }
+
+        result = acpi_bus_register_driver(&acpi_sbs_driver);
+        if (result < 0) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                  "acpi_bus_register_driver() failed\n"));
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+static void __exit acpi_sbs_exit(void)
+{
+
+        acpi_bus_unregister_driver(&acpi_sbs_driver);
+
+        acpi_unlock_ac_dir(acpi_ac_dir);
+        acpi_ac_dir = NULL;
+        acpi_unlock_battery_dir(acpi_battery_dir);
+        acpi_battery_dir = NULL;
+
+        return;
+}
+
+module_init(acpi_sbs_init);
+module_exit(acpi_sbs_exit);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 861ac378ce42..698a1540e303 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -4,6 +4,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/acpi.h>
 
 #include <acpi/acpi_drivers.h>
@@ -113,6 +114,8 @@ static struct kset acpi_namespace_kset = {
 static void acpi_device_register(struct acpi_device *device,
                                  struct acpi_device *parent)
 {
+        int err;
+
         /*
          * Linkage
          * -------
@@ -138,7 +141,10 @@ static void acpi_device_register(struct acpi_device *device,
                 device->kobj.parent = &parent->kobj;
         device->kobj.ktype = &ktype_acpi_ns;
         device->kobj.kset = &acpi_namespace_kset;
-        kobject_register(&device->kobj);
+        err = kobject_register(&device->kobj);
+        if (err < 0)
+                printk(KERN_WARNING "%s: kobject_register error: %d\n",
+                        __FUNCTION__, err);
         create_sysfs_device_files(device);
 }
 
@@ -319,7 +325,7 @@ static int acpi_bus_get_wakeup_device_flags(struct acpi_device *device)
                 goto end;
         }
 
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         device->wakeup.flags.valid = 1;
         /* Power button, Lid switch always enable wakeup */
@@ -854,7 +860,7 @@ static void acpi_device_set_id(struct acpi_device *device,
                         printk(KERN_ERR "Memory allocation error\n");
         }
 
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 }
 
 static int acpi_device_set_context(struct acpi_device *device, int type)
@@ -1450,7 +1456,9 @@ static int __init acpi_scan_init(void)
         if (acpi_disabled)
                 return 0;
 
-        kset_register(&acpi_namespace_kset);
+        result = kset_register(&acpi_namespace_kset);
+        if (result < 0)
+                printk(KERN_ERR PREFIX "kset_register error: %d\n", result);
 
         result = bus_register(&acpi_bus_type);
         if (result) {
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 4696a85a98b9..34962578039d 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -434,7 +434,7 @@ acpi_system_wakeup_device_open_fs(struct inode *inode, struct file *file)
                            PDE(inode)->data);
 }
 
-static struct file_operations acpi_system_wakeup_device_fops = {
+static const struct file_operations acpi_system_wakeup_device_fops = {
         .open = acpi_system_wakeup_device_open_fs,
         .read = seq_read,
         .write = acpi_system_write_wakeup_device,
@@ -443,7 +443,7 @@ static struct file_operations acpi_system_wakeup_device_fops = {
 };
 
 #ifdef  CONFIG_ACPI_SLEEP_PROC_SLEEP
-static struct file_operations acpi_system_sleep_fops = {
+static const struct file_operations acpi_system_sleep_fops = {
         .open = acpi_system_sleep_open_fs,
         .read = seq_read,
         .write = acpi_system_write_sleep,
@@ -452,7 +452,7 @@ static struct file_operations acpi_system_sleep_fops = {
 };
 #endif                          /* CONFIG_ACPI_SLEEP_PROC_SLEEP */
 
-static struct file_operations acpi_system_alarm_fops = {
+static const struct file_operations acpi_system_alarm_fops = {
         .open = acpi_system_alarm_open_fs,
         .read = seq_read,
         .write = acpi_system_write_alarm,
diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c
index c90bd2f70b3f..d86dcb3c2366 100644
--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -57,7 +57,7 @@ static int acpi_system_info_open_fs(struct inode *inode, struct file *file)
         return single_open(file, acpi_system_read_info, PDE(inode)->data);
 }
 
-static struct file_operations acpi_system_info_ops = {
+static const struct file_operations acpi_system_info_ops = {
         .open = acpi_system_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -67,7 +67,7 @@ static struct file_operations acpi_system_info_ops = {
 static ssize_t acpi_system_read_dsdt(struct file *, char __user *, size_t,
                                      loff_t *);
 
-static struct file_operations acpi_system_dsdt_ops = {
+static const struct file_operations acpi_system_dsdt_ops = {
         .read = acpi_system_read_dsdt,
 };
 
@@ -86,7 +86,7 @@ acpi_system_read_dsdt(struct file *file,
 
         res = simple_read_from_buffer(buffer, count, ppos,
                                       dsdt.pointer, dsdt.length);
-        acpi_os_free(dsdt.pointer);
+        kfree(dsdt.pointer);
 
         return res;
 }
@@ -94,7 +94,7 @@ acpi_system_read_dsdt(struct file *file,
 static ssize_t acpi_system_read_fadt(struct file *, char __user *, size_t,
                                      loff_t *);
 
-static struct file_operations acpi_system_fadt_ops = {
+static const struct file_operations acpi_system_fadt_ops = {
         .read = acpi_system_read_fadt,
 };
 
@@ -113,7 +113,7 @@ acpi_system_read_fadt(struct file *file,
 
         res = simple_read_from_buffer(buffer, count, ppos,
                                       fadt.pointer, fadt.length);
-        acpi_os_free(fadt.pointer);
+        kfree(fadt.pointer);
 
         return res;
 }
diff --git a/drivers/acpi/tables/tbget.c b/drivers/acpi/tables/tbget.c
index 99eacceff563..7856db759af0 100644
--- a/drivers/acpi/tables/tbget.c
+++ b/drivers/acpi/tables/tbget.c
@@ -320,6 +320,16 @@ acpi_tb_get_this_table(struct acpi_pointer *address,
 
         ACPI_FUNCTION_TRACE(tb_get_this_table);
 
+        /* Validate minimum length */
+
+        if (header->length < sizeof(struct acpi_table_header)) {
+                ACPI_ERROR((AE_INFO,
+                            "Table length (%X) is smaller than minimum (%X)",
+                            header->length, sizeof(struct acpi_table_header)));
+
+                return_ACPI_STATUS(AE_INVALID_TABLE_LENGTH);
+        }
+
         /*
          * Flags contains the current processor mode (Virtual or Physical
          * addressing) The pointer_type is either Logical or Physical
@@ -356,7 +366,7 @@ acpi_tb_get_this_table(struct acpi_pointer *address,
                  */
                 status = acpi_os_map_memory(address->pointer.physical,
                                             (acpi_size) header->length,
-                                            (void *)&full_table);
+                                            ACPI_CAST_PTR(void, &full_table));
                 if (ACPI_FAILURE(status)) {
                         ACPI_ERROR((AE_INFO,
                                     "Could not map memory for table [%4.4s] at %8.8X%8.8X for length %X",
diff --git a/drivers/acpi/tables/tbinstal.c b/drivers/acpi/tables/tbinstal.c
index 7ca2df75bb11..1668a232fb67 100644
--- a/drivers/acpi/tables/tbinstal.c
+++ b/drivers/acpi/tables/tbinstal.c
@@ -256,7 +256,7 @@ acpi_tb_init_table_descriptor(acpi_table_type table_type,
 
         status = acpi_ut_allocate_owner_id(&table_desc->owner_id);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_exit1;
         }
 
         /* Install the table into the global data structure */
@@ -274,8 +274,8 @@ acpi_tb_init_table_descriptor(acpi_table_type table_type,
                  * at this location, so return an error.
                  */
                 if (list_head->next) {
-                        ACPI_FREE(table_desc);
-                        return_ACPI_STATUS(AE_ALREADY_EXISTS);
+                        status = AE_ALREADY_EXISTS;
+                        goto error_exit2;
                 }
 
                 table_desc->next = list_head->next;
@@ -335,6 +335,17 @@ acpi_tb_init_table_descriptor(acpi_table_type table_type,
         table_info->owner_id = table_desc->owner_id;
         table_info->installed_desc = table_desc;
         return_ACPI_STATUS(AE_OK);
+
+        /* Error exit with cleanup */
+
+      error_exit2:
+
+        acpi_ut_release_owner_id(&table_desc->owner_id);
+
+      error_exit1:
+
+        ACPI_FREE(table_desc);
+        return_ACPI_STATUS(status);
 }
 
 /*******************************************************************************
@@ -525,6 +536,10 @@ struct acpi_table_desc *acpi_tb_uninstall_table(struct acpi_table_desc
 
         acpi_tb_delete_single_table(table_desc);
 
+        /* Free the owner ID associated with this table */
+
+        acpi_ut_release_owner_id(&table_desc->owner_id);
+
         /* Free the table descriptor */
 
         next_desc = table_desc->next;
diff --git a/drivers/acpi/tables/tbrsdt.c b/drivers/acpi/tables/tbrsdt.c
index abcb08c2592a..0ad3dbb9ebca 100644
--- a/drivers/acpi/tables/tbrsdt.c
+++ b/drivers/acpi/tables/tbrsdt.c
@@ -183,6 +183,17 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
 
         ACPI_FUNCTION_ENTRY();
 
+        /* Validate minimum length */
+
+        if (table_ptr->length < sizeof(struct acpi_table_header)) {
+                ACPI_ERROR((AE_INFO,
+                            "RSDT/XSDT length (%X) is smaller than minimum (%X)",
+                            table_ptr->length,
+                            sizeof(struct acpi_table_header)));
+
+                return (AE_INVALID_TABLE_LENGTH);
+        }
+
         /* Search for appropriate signature, RSDT or XSDT */
 
         if (acpi_gbl_root_table_type == ACPI_TABLE_TYPE_RSDT) {
@@ -210,7 +221,7 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
                         ACPI_ERROR((AE_INFO, "Looking for XSDT"));
                 }
 
-                ACPI_DUMP_BUFFER((char *)table_ptr, 48);
+                ACPI_DUMP_BUFFER(ACPI_CAST_PTR(char, table_ptr), 48);
                 return (AE_BAD_SIGNATURE);
         }
 
@@ -258,7 +269,7 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
         status = acpi_tb_validate_rsdt(table_info.pointer);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_cleanup;
         }
 
         /* Get the number of tables defined in the RSDT or XSDT */
@@ -270,14 +281,14 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
         status = acpi_tb_convert_to_xsdt(&table_info);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_cleanup;
         }
 
         /* Save the table pointers and allocation info */
 
         status = acpi_tb_init_table_descriptor(ACPI_TABLE_ID_XSDT, &table_info);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_cleanup;
         }
 
         acpi_gbl_XSDT =
@@ -285,4 +296,12 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "XSDT located at %p\n", acpi_gbl_XSDT));
         return_ACPI_STATUS(status);
+
+      error_cleanup:
+
+        /* Free table allocated by acpi_tb_get_table */
+
+        acpi_tb_delete_single_table(&table_info);
+
+        return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/tables/tbxface.c b/drivers/acpi/tables/tbxface.c
index 4e91f2984815..7767987be15a 100644
--- a/drivers/acpi/tables/tbxface.c
+++ b/drivers/acpi/tables/tbxface.c
@@ -134,8 +134,8 @@ ACPI_EXPORT_SYMBOL(acpi_load_tables)
  * RETURN:      Status
  *
  * DESCRIPTION: This function is called to load a table from the caller's
- *              buffer.  The buffer must contain an entire ACPI Table including
- *              a valid header.  The header fields will be verified, and if it
+ *              buffer. The buffer must contain an entire ACPI Table including
+ *              a valid header. The header fields will be verified, and if it
  *              is determined that the table is invalid, the call will fail.
  *
  ******************************************************************************/
@@ -245,15 +245,18 @@ acpi_status acpi_unload_table(acpi_table_type table_type)
         /* Find all tables of the requested type */
 
         table_desc = acpi_gbl_table_lists[table_type].next;
+        if (!table_desc) {
+                return_ACPI_STATUS(AE_NOT_EXIST);
+        }
+
         while (table_desc) {
                 /*
-                 * Delete all namespace entries owned by this table.  Note that these
-                 * entries can appear anywhere in the namespace by virtue of the AML
-                 * "Scope" operator.  Thus, we need to track ownership by an ID, not
+                 * Delete all namespace objects owned by this table. Note that these
+                 * objects can appear anywhere in the namespace by virtue of the AML
+                 * "Scope" operator. Thus, we need to track ownership by an ID, not
                  * simply a position within the hierarchy
                  */
                 acpi_ns_delete_namespace_by_owner(table_desc->owner_id);
-                acpi_ut_release_owner_id(&table_desc->owner_id);
                 table_desc = table_desc->next;
         }
 
@@ -275,12 +278,12 @@ ACPI_EXPORT_SYMBOL(acpi_unload_table)
  *                                see acpi_gbl_acpi_table_flag
  *              out_table_header - pointer to the struct acpi_table_header if successful
  *
- * DESCRIPTION: This function is called to get an ACPI table header.  The caller
+ * DESCRIPTION: This function is called to get an ACPI table header. The caller
  *              supplies an pointer to a data area sufficient to contain an ACPI
  *              struct acpi_table_header structure.
  *
  *              The header contains a length field that can be used to determine
- *              the size of the buffer needed to contain the entire table.  This
+ *              the size of the buffer needed to contain the entire table. This
  *              function is not valid for the RSD PTR table since it does not
  *              have a standard header and is fixed length.
  *
@@ -322,7 +325,8 @@ acpi_get_table_header(acpi_table_type table_type,
 
         /* Copy the header to the caller's buffer */
 
-        ACPI_MEMCPY((void *)out_table_header, (void *)tbl_ptr,
+        ACPI_MEMCPY(ACPI_CAST_PTR(void, out_table_header),
+                    ACPI_CAST_PTR(void, tbl_ptr),
                     sizeof(struct acpi_table_header));
 
         return_ACPI_STATUS(status);
@@ -344,10 +348,10 @@ ACPI_EXPORT_SYMBOL(acpi_get_table_header)
  *
  * RETURN:      Status
  *
- * DESCRIPTION: This function is called to get an ACPI table.  The caller
+ * DESCRIPTION: This function is called to get an ACPI table. The caller
  *              supplies an out_buffer large enough to contain the entire ACPI
- *              table.  The caller should call the acpi_get_table_header function
- *              first to determine the buffer size needed.  Upon completion
+ *              table. The caller should call the acpi_get_table_header function
+ *              first to determine the buffer size needed. Upon completion
  *              the out_buffer->Length field will indicate the number of bytes
  *              copied into the out_buffer->buf_ptr buffer. This table will be
  *              a complete table including the header.
@@ -417,7 +421,9 @@ acpi_get_table(acpi_table_type table_type,
 
         /* Copy the table to the buffer */
 
-        ACPI_MEMCPY((void *)ret_buffer->pointer, (void *)tbl_ptr, table_length);
+        ACPI_MEMCPY(ACPI_CAST_PTR(void, ret_buffer->pointer),
+                    ACPI_CAST_PTR(void, tbl_ptr), table_length);
+
         return_ACPI_STATUS(AE_OK);
 }
 
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index c855f4446b5f..5753d06b7860 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -162,7 +162,7 @@ struct acpi_thermal_flags {
 };
 
 struct acpi_thermal {
-        acpi_handle handle;
+        struct acpi_device * device;
         acpi_bus_id name;
         unsigned long temperature;
         unsigned long last_temperature;
@@ -176,21 +176,21 @@ struct acpi_thermal {
         struct timer_list timer;
 };
 
-static struct file_operations acpi_thermal_state_fops = {
+static const struct file_operations acpi_thermal_state_fops = {
         .open = acpi_thermal_state_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
         .release = single_release,
 };
 
-static struct file_operations acpi_thermal_temp_fops = {
+static const struct file_operations acpi_thermal_temp_fops = {
         .open = acpi_thermal_temp_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
         .release = single_release,
 };
 
-static struct file_operations acpi_thermal_trip_fops = {
+static const struct file_operations acpi_thermal_trip_fops = {
         .open = acpi_thermal_trip_open_fs,
         .read = seq_read,
         .write = acpi_thermal_write_trip_points,
@@ -198,7 +198,7 @@ static struct file_operations acpi_thermal_trip_fops = {
         .release = single_release,
 };
 
-static struct file_operations acpi_thermal_cooling_fops = {
+static const struct file_operations acpi_thermal_cooling_fops = {
         .open = acpi_thermal_cooling_open_fs,
         .read = seq_read,
         .write = acpi_thermal_write_cooling_mode,
@@ -206,7 +206,7 @@ static struct file_operations acpi_thermal_cooling_fops = {
         .release = single_release,
 };
 
-static struct file_operations acpi_thermal_polling_fops = {
+static const struct file_operations acpi_thermal_polling_fops = {
         .open = acpi_thermal_polling_open_fs,
         .read = seq_read,
         .write = acpi_thermal_write_polling,
@@ -229,7 +229,7 @@ static int acpi_thermal_get_temperature(struct acpi_thermal *tz)
         tz->last_temperature = tz->temperature;
 
         status =
-            acpi_evaluate_integer(tz->handle, "_TMP", NULL, &tz->temperature);
+            acpi_evaluate_integer(tz->device->handle, "_TMP", NULL, &tz->temperature);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -248,7 +248,7 @@ static int acpi_thermal_get_polling_frequency(struct acpi_thermal *tz)
                 return -EINVAL;
 
         status =
-            acpi_evaluate_integer(tz->handle, "_TZP", NULL,
+            acpi_evaluate_integer(tz->device->handle, "_TZP", NULL,
                                   &tz->polling_frequency);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
@@ -285,7 +285,7 @@ static int acpi_thermal_set_cooling_mode(struct acpi_thermal *tz, int mode)
         if (!tz)
                 return -EINVAL;
 
-        status = acpi_get_handle(tz->handle, "_SCP", &handle);
+        status = acpi_get_handle(tz->device->handle, "_SCP", &handle);
         if (ACPI_FAILURE(status)) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "_SCP not present\n"));
                 return -ENODEV;
@@ -316,7 +316,7 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
 
         /* Critical Shutdown (required) */
 
-        status = acpi_evaluate_integer(tz->handle, "_CRT", NULL,
+        status = acpi_evaluate_integer(tz->device->handle, "_CRT", NULL,
                                        &tz->trips.critical.temperature);
         if (ACPI_FAILURE(status)) {
                 tz->trips.critical.flags.valid = 0;
@@ -332,7 +332,7 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
         /* Critical Sleep (optional) */
 
         status =
-            acpi_evaluate_integer(tz->handle, "_HOT", NULL,
+            acpi_evaluate_integer(tz->device->handle, "_HOT", NULL,
                                   &tz->trips.hot.temperature);
         if (ACPI_FAILURE(status)) {
                 tz->trips.hot.flags.valid = 0;
@@ -346,7 +346,7 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
         /* Passive: Processors (optional) */
 
         status =
-            acpi_evaluate_integer(tz->handle, "_PSV", NULL,
+            acpi_evaluate_integer(tz->device->handle, "_PSV", NULL,
                                   &tz->trips.passive.temperature);
         if (ACPI_FAILURE(status)) {
                 tz->trips.passive.flags.valid = 0;
@@ -355,25 +355,25 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
                 tz->trips.passive.flags.valid = 1;
 
                 status =
-                    acpi_evaluate_integer(tz->handle, "_TC1", NULL,
+                    acpi_evaluate_integer(tz->device->handle, "_TC1", NULL,
                                           &tz->trips.passive.tc1);
                 if (ACPI_FAILURE(status))
                         tz->trips.passive.flags.valid = 0;
 
                 status =
-                    acpi_evaluate_integer(tz->handle, "_TC2", NULL,
+                    acpi_evaluate_integer(tz->device->handle, "_TC2", NULL,
                                           &tz->trips.passive.tc2);
                 if (ACPI_FAILURE(status))
                         tz->trips.passive.flags.valid = 0;
 
                 status =
-                    acpi_evaluate_integer(tz->handle, "_TSP", NULL,
+                    acpi_evaluate_integer(tz->device->handle, "_TSP", NULL,
                                           &tz->trips.passive.tsp);
                 if (ACPI_FAILURE(status))
                         tz->trips.passive.flags.valid = 0;
 
                 status =
-                    acpi_evaluate_reference(tz->handle, "_PSL", NULL,
+                    acpi_evaluate_reference(tz->device->handle, "_PSL", NULL,
                                             &tz->trips.passive.devices);
                 if (ACPI_FAILURE(status))
                         tz->trips.passive.flags.valid = 0;
@@ -393,14 +393,14 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
                 char name[5] = { '_', 'A', 'C', ('0' + i), '\0' };
 
                 status =
-                    acpi_evaluate_integer(tz->handle, name, NULL,
+                    acpi_evaluate_integer(tz->device->handle, name, NULL,
                                           &tz->trips.active[i].temperature);
                 if (ACPI_FAILURE(status))
                         break;
 
                 name[2] = 'L';
                 status =
-                    acpi_evaluate_reference(tz->handle, name, NULL,
+                    acpi_evaluate_reference(tz->device->handle, name, NULL,
                                             &tz->trips.active[i].devices);
                 if (ACPI_SUCCESS(status)) {
                         tz->trips.active[i].flags.valid = 1;
@@ -424,7 +424,7 @@ static int acpi_thermal_get_devices(struct acpi_thermal *tz)
                 return -EINVAL;
 
         status =
-            acpi_evaluate_reference(tz->handle, "_TZD", NULL, &tz->devices);
+            acpi_evaluate_reference(tz->device->handle, "_TZD", NULL, &tz->devices);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -453,10 +453,6 @@ static int acpi_thermal_call_usermode(char *path)
 
 static int acpi_thermal_critical(struct acpi_thermal *tz)
 {
-        int result = 0;
-        struct acpi_device *device = NULL;
-
-
         if (!tz || !tz->trips.critical.flags.valid)
                 return -EINVAL;
 
@@ -466,14 +462,10 @@ static int acpi_thermal_critical(struct acpi_thermal *tz)
         } else if (tz->trips.critical.flags.enabled)
                 tz->trips.critical.flags.enabled = 0;
 
-        result = acpi_bus_get_device(tz->handle, &device);
-        if (result)
-                return result;
-
         printk(KERN_EMERG
                "Critical temperature reached (%ld C), shutting down.\n",
                KELVIN_TO_CELSIUS(tz->temperature));
-        acpi_bus_generate_event(device, ACPI_THERMAL_NOTIFY_CRITICAL,
+        acpi_bus_generate_event(tz->device, ACPI_THERMAL_NOTIFY_CRITICAL,
                                 tz->trips.critical.flags.enabled);
 
         acpi_thermal_call_usermode(ACPI_THERMAL_PATH_POWEROFF);
@@ -483,10 +475,6 @@ static int acpi_thermal_critical(struct acpi_thermal *tz)
 
 static int acpi_thermal_hot(struct acpi_thermal *tz)
 {
-        int result = 0;
-        struct acpi_device *device = NULL;
-
-
         if (!tz || !tz->trips.hot.flags.valid)
                 return -EINVAL;
 
@@ -496,11 +484,7 @@ static int acpi_thermal_hot(struct acpi_thermal *tz)
         } else if (tz->trips.hot.flags.enabled)
                 tz->trips.hot.flags.enabled = 0;
 
-        result = acpi_bus_get_device(tz->handle, &device);
-        if (result)
-                return result;
-
-        acpi_bus_generate_event(device, ACPI_THERMAL_NOTIFY_HOT,
+        acpi_bus_generate_event(tz->device, ACPI_THERMAL_NOTIFY_HOT,
                                 tz->trips.hot.flags.enabled);
 
         /* TBD: Call user-mode "sleep(S4)" function */
@@ -1193,8 +1177,7 @@ static void acpi_thermal_notify(acpi_handle handle, u32 event, void *data)
         if (!tz)
                 return;
 
-        if (acpi_bus_get_device(tz->handle, &device))
-                return;
+        device = tz->device;
 
         switch (event) {
         case ACPI_THERMAL_NOTIFY_TEMPERATURE:
@@ -1293,7 +1276,7 @@ static int acpi_thermal_add(struct acpi_device *device)
                 return -ENOMEM;
         memset(tz, 0, sizeof(struct acpi_thermal));
 
-        tz->handle = device->handle;
+        tz->device = device;
         strcpy(tz->name, device->pnp.bus_id);
         strcpy(acpi_device_name(device), ACPI_THERMAL_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_THERMAL_CLASS);
@@ -1311,7 +1294,7 @@ static int acpi_thermal_add(struct acpi_device *device)
 
         acpi_thermal_check(tz);
 
-        status = acpi_install_notify_handler(tz->handle,
+        status = acpi_install_notify_handler(device->handle,
                                              ACPI_DEVICE_NOTIFY,
                                              acpi_thermal_notify, tz);
         if (ACPI_FAILURE(status)) {
@@ -1352,7 +1335,7 @@ static int acpi_thermal_remove(struct acpi_device *device, int type)
         /* deferred task may reinsert timer */
         del_timer_sync(&(tz->timer));
 
-        status = acpi_remove_notify_handler(tz->handle,
+        status = acpi_remove_notify_handler(device->handle,
                                             ACPI_DEVICE_NOTIFY,
                                             acpi_thermal_notify);
 
@@ -1376,13 +1359,28 @@ static int acpi_thermal_remove(struct acpi_device *device, int type)
 static int acpi_thermal_resume(struct acpi_device *device, int state)
 {
         struct acpi_thermal *tz = NULL;
+        int i;
 
         if (!device || !acpi_driver_data(device))
                 return -EINVAL;
 
         tz = (struct acpi_thermal *)acpi_driver_data(device);
 
-        acpi_thermal_check(tz);
+        acpi_thermal_get_temperature(tz);
+
+        for (i = 0; i < ACPI_THERMAL_MAX_ACTIVE; i++) {
+                if (tz->trips.active[i].flags.valid) {
+                        tz->temperature = tz->trips.active[i].temperature;
+                        tz->trips.active[i].flags.enabled = 0;
+
+                        acpi_thermal_active(tz);
+
+                        tz->state.active |= tz->trips.active[i].flags.enabled;
+                        tz->state.active_index = i;
+                }
+        }
+
+        acpi_thermal_check(tz);
 
         return AE_OK;
 }
diff --git a/drivers/acpi/utilities/utalloc.c b/drivers/acpi/utilities/utalloc.c
index 7940fc1bd69e..f6cbc0b1bfd0 100644
--- a/drivers/acpi/utilities/utalloc.c
+++ b/drivers/acpi/utilities/utalloc.c
@@ -166,10 +166,10 @@ acpi_status acpi_ut_delete_caches(void)
 
         /* Free memory lists */
 
-        acpi_os_free(acpi_gbl_global_list);
+        ACPI_FREE(acpi_gbl_global_list);
         acpi_gbl_global_list = NULL;
 
-        acpi_os_free(acpi_gbl_ns_node_list);
+        ACPI_FREE(acpi_gbl_ns_node_list);
         acpi_gbl_ns_node_list = NULL;
 #endif
 
@@ -285,6 +285,7 @@ acpi_ut_initialize_buffer(struct acpi_buffer * buffer,
         return (status);
 }
 
+#ifdef NOT_USED_BY_LINUX
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ut_allocate
@@ -360,3 +361,4 @@ void *acpi_ut_allocate_zeroed(acpi_size size,
 
         return (allocation);
 }
+#endif
diff --git a/drivers/acpi/utilities/utcache.c b/drivers/acpi/utilities/utcache.c
index 56270a30718a..1a1f8109159c 100644
--- a/drivers/acpi/utilities/utcache.c
+++ b/drivers/acpi/utilities/utcache.c
@@ -162,7 +162,7 @@ acpi_status acpi_os_delete_cache(struct acpi_memory_list * cache)
 
         /* Now we can delete the cache object */
 
-        acpi_os_free(cache);
+        ACPI_FREE(cache);
         return (AE_OK);
 }
 
diff --git a/drivers/acpi/utilities/utdebug.c b/drivers/acpi/utilities/utdebug.c
index 5ec1cfcc611d..bb1eaf9aa653 100644
--- a/drivers/acpi/utilities/utdebug.c
+++ b/drivers/acpi/utilities/utdebug.c
@@ -47,7 +47,7 @@
 ACPI_MODULE_NAME("utdebug")
 
 #ifdef ACPI_DEBUG_OUTPUT
-static u32 acpi_gbl_prev_thread_id = 0xFFFFFFFF;
+static acpi_thread_id acpi_gbl_prev_thread_id;
 static char *acpi_gbl_fn_entry_str = "----Entry";
 static char *acpi_gbl_fn_exit_str = "----Exit-";
 
@@ -181,7 +181,7 @@ acpi_ut_debug_print(u32 requested_debug_level,
                 if (ACPI_LV_THREADS & acpi_dbg_level) {
                         acpi_os_printf
                             ("\n**** Context Switch from TID %X to TID %X ****\n\n",
-                             acpi_gbl_prev_thread_id, thread_id);
+                             (u32) acpi_gbl_prev_thread_id, (u32) thread_id);
                 }
 
                 acpi_gbl_prev_thread_id = thread_id;
diff --git a/drivers/acpi/utilities/utdelete.c b/drivers/acpi/utilities/utdelete.c
index 38ebe1c54330..9d3f1149ba21 100644
--- a/drivers/acpi/utilities/utdelete.c
+++ b/drivers/acpi/utilities/utdelete.c
@@ -447,11 +447,16 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
                  */
                 switch (ACPI_GET_OBJECT_TYPE(object)) {
                 case ACPI_TYPE_DEVICE:
+                case ACPI_TYPE_PROCESSOR:
+                case ACPI_TYPE_POWER:
+                case ACPI_TYPE_THERMAL:
 
-                        acpi_ut_update_ref_count(object->device.system_notify,
-                                                 action);
-                        acpi_ut_update_ref_count(object->device.device_notify,
-                                                 action);
+                        /* Update the notify objects for these types (if present) */
+
+                        acpi_ut_update_ref_count(object->common_notify.
+                                                 system_notify, action);
+                        acpi_ut_update_ref_count(object->common_notify.
+                                                 device_notify, action);
                         break;
 
                 case ACPI_TYPE_PACKAGE:
diff --git a/drivers/acpi/utilities/utmisc.c b/drivers/acpi/utilities/utmisc.c
index 33268310c738..6d8a8211be90 100644
--- a/drivers/acpi/utilities/utmisc.c
+++ b/drivers/acpi/utilities/utmisc.c
@@ -65,7 +65,7 @@ ACPI_MODULE_NAME("utmisc")
 u8 acpi_ut_is_aml_table(struct acpi_table_header *table)
 {
 
-        /* Ignore tables that contain AML */
+        /* These are the only tables that contain executable AML */
 
         if (ACPI_COMPARE_NAME(table->signature, DSDT_SIG) ||
             ACPI_COMPARE_NAME(table->signature, PSDT_SIG) ||
@@ -419,10 +419,15 @@ void acpi_ut_set_integer_width(u8 revision)
 {
 
         if (revision <= 1) {
+
+                /* 32-bit case */
+
                 acpi_gbl_integer_bit_width = 32;
                 acpi_gbl_integer_nybble_width = 8;
                 acpi_gbl_integer_byte_width = 4;
         } else {
+                /* 64-bit case (ACPI 2.0+) */
+
                 acpi_gbl_integer_bit_width = 64;
                 acpi_gbl_integer_nybble_width = 16;
                 acpi_gbl_integer_byte_width = 8;
@@ -502,6 +507,7 @@ acpi_ut_display_init_pathname(u8 type,
  * FUNCTION:    acpi_ut_valid_acpi_char
  *
  * PARAMETERS:  Char            - The character to be examined
+ *              Position        - Byte position (0-3)
  *
  * RETURN:      TRUE if the character is valid, FALSE otherwise
  *
@@ -609,7 +615,9 @@ acpi_name acpi_ut_repair_name(acpi_name name)
  *
  * RETURN:      Status and Converted value
  *
- * DESCRIPTION: Convert a string into an unsigned value.
+ * DESCRIPTION: Convert a string into an unsigned value. Performs either a
+ *              32-bit or 64-bit conversion, depending on the current mode
+ *              of the interpreter.
  *              NOTE: Does not support Octal strings, not needed.
  *
  ******************************************************************************/
@@ -627,7 +635,7 @@ acpi_ut_strtoul64(char *string, u32 base, acpi_integer * ret_integer)
         u8 sign_of0x = 0;
         u8 term = 0;
 
-        ACPI_FUNCTION_TRACE(ut_stroul64);
+        ACPI_FUNCTION_TRACE_STR(ut_stroul64, string);
 
         switch (base) {
         case ACPI_ANY_BASE:
@@ -675,11 +683,13 @@ acpi_ut_strtoul64(char *string, u32 base, acpi_integer * ret_integer)
                 }
         }
 
+        /*
+         * Perform a 32-bit or 64-bit conversion, depending upon the current
+         * execution mode of the interpreter
+         */
         dividend = (mode32) ? ACPI_UINT32_MAX : ACPI_UINT64_MAX;
 
-        /* At least one character in the string here */
-
-        /* Main loop: convert the string to a 64-bit integer */
+        /* Main loop: convert the string to a 32- or 64-bit integer */
 
         while (*string) {
                 if (ACPI_IS_DIGIT(*string)) {
@@ -754,6 +764,9 @@ acpi_ut_strtoul64(char *string, u32 base, acpi_integer * ret_integer)
 
       all_done:
 
+        ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Converted value: %8.8X%8.8X\n",
+                          ACPI_FORMAT_UINT64(return_value)));
+
         *ret_integer = return_value;
         return_ACPI_STATUS(AE_OK);
 
diff --git a/drivers/acpi/utilities/utmutex.c b/drivers/acpi/utilities/utmutex.c
index dfc8f30ca892..c39062a047cd 100644
--- a/drivers/acpi/utilities/utmutex.c
+++ b/drivers/acpi/utilities/utmutex.c
@@ -244,14 +244,14 @@ acpi_status acpi_ut_acquire_mutex(acpi_mutex_handle mutex_id)
 
         ACPI_DEBUG_PRINT((ACPI_DB_MUTEX,
                           "Thread %X attempting to acquire Mutex [%s]\n",
-                          this_thread_id, acpi_ut_get_mutex_name(mutex_id)));
+                          (u32) this_thread_id, acpi_ut_get_mutex_name(mutex_id)));
 
         status = acpi_os_acquire_mutex(acpi_gbl_mutex_info[mutex_id].mutex,
                                        ACPI_WAIT_FOREVER);
         if (ACPI_SUCCESS(status)) {
                 ACPI_DEBUG_PRINT((ACPI_DB_MUTEX,
                                   "Thread %X acquired Mutex [%s]\n",
-                                  this_thread_id,
+                                  (u32) this_thread_id,
                                   acpi_ut_get_mutex_name(mutex_id)));
 
                 acpi_gbl_mutex_info[mutex_id].use_count++;
@@ -259,7 +259,7 @@ acpi_status acpi_ut_acquire_mutex(acpi_mutex_handle mutex_id)
         } else {
                 ACPI_EXCEPTION((AE_INFO, status,
                                 "Thread %X could not acquire Mutex [%X]",
-                                this_thread_id, mutex_id));
+                                (u32) this_thread_id, mutex_id));
         }
 
         return (status);
@@ -285,7 +285,7 @@ acpi_status acpi_ut_release_mutex(acpi_mutex_handle mutex_id)
 
         this_thread_id = acpi_os_get_thread_id();
         ACPI_DEBUG_PRINT((ACPI_DB_MUTEX,
-                          "Thread %X releasing Mutex [%s]\n", this_thread_id,
+                          "Thread %X releasing Mutex [%s]\n", (u32) this_thread_id,
                           acpi_ut_get_mutex_name(mutex_id)));
 
         if (mutex_id > ACPI_MAX_MUTEX) {
diff --git a/drivers/acpi/utilities/utstate.c b/drivers/acpi/utilities/utstate.c
index 0f5c5bb5deff..eaa13d05c859 100644
--- a/drivers/acpi/utilities/utstate.c
+++ b/drivers/acpi/utilities/utstate.c
@@ -199,6 +199,13 @@ struct acpi_thread_state *acpi_ut_create_thread_state(void)
         state->common.descriptor_type = ACPI_DESC_TYPE_STATE_THREAD;
         state->thread.thread_id = acpi_os_get_thread_id();
 
+        /* Check for invalid thread ID - zero is very bad, it will break things */
+
+        if (!state->thread.thread_id) {
+                ACPI_ERROR((AE_INFO, "Invalid zero ID from AcpiOsGetThreadId"));
+                state->thread.thread_id = (acpi_thread_id) 1;
+        }
+
         return_PTR((struct acpi_thread_state *)state);
 }
 
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index 1930e1a75b22..d0d84c43a9d4 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -262,7 +262,7 @@ acpi_evaluate_integer(acpi_handle handle,
         if (!data)
                 return AE_BAD_PARAMETER;
 
-        element = kmalloc(sizeof(union acpi_object), GFP_KERNEL);
+        element = kmalloc(sizeof(union acpi_object), irqs_disabled() ? GFP_ATOMIC: GFP_KERNEL);
         if (!element)
                 return AE_NO_MEMORY;
 
@@ -332,7 +332,7 @@ acpi_evaluate_string(acpi_handle handle,
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Return value [%s]\n", *data));
 
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         return AE_OK;
 }
@@ -418,7 +418,7 @@ acpi_evaluate_reference(acpi_handle handle,
                 //kfree(list->handles);
         }
 
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
 
         return status;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 9feb633087a9..56666a982476 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -117,7 +117,7 @@ struct acpi_video_enumerated_device {
 };
 
 struct acpi_video_bus {
-        acpi_handle handle;
+        struct acpi_device *device;
         u8 dos_setting;
         struct acpi_video_enumerated_device *attached_array;
         u8 attached_count;
@@ -155,7 +155,6 @@ struct acpi_video_device_brightness {
 };
 
 struct acpi_video_device {
-        acpi_handle handle;
         unsigned long device_id;
         struct acpi_video_device_flags flags;
         struct acpi_video_device_cap cap;
@@ -272,7 +271,8 @@ static int
 acpi_video_device_query(struct acpi_video_device *device, unsigned long *state)
 {
         int status;
-        status = acpi_evaluate_integer(device->handle, "_DGS", NULL, state);
+
+        status = acpi_evaluate_integer(device->dev->handle, "_DGS", NULL, state);
 
         return status;
 }
@@ -283,8 +283,7 @@ acpi_video_device_get_state(struct acpi_video_device *device,
 {
         int status;
 
-
-        status = acpi_evaluate_integer(device->handle, "_DCS", NULL, state);
+        status = acpi_evaluate_integer(device->dev->handle, "_DCS", NULL, state);
 
         return status;
 }
@@ -299,7 +298,7 @@ acpi_video_device_set_state(struct acpi_video_device *device, int state)
 
 
         arg0.integer.value = state;
-        status = acpi_evaluate_integer(device->handle, "_DSS", &args, &ret);
+        status = acpi_evaluate_integer(device->dev->handle, "_DSS", &args, &ret);
 
         return status;
 }
@@ -315,7 +314,7 @@ acpi_video_device_lcd_query_levels(struct acpi_video_device *device,
 
         *levels = NULL;
 
-        status = acpi_evaluate_object(device->handle, "_BCL", NULL, &buffer);
+        status = acpi_evaluate_object(device->dev->handle, "_BCL", NULL, &buffer);
         if (!ACPI_SUCCESS(status))
                 return status;
         obj = (union acpi_object *)buffer.pointer;
@@ -344,7 +343,7 @@ acpi_video_device_lcd_set_level(struct acpi_video_device *device, int level)
 
 
         arg0.integer.value = level;
-        status = acpi_evaluate_object(device->handle, "_BCM", &args, NULL);
+        status = acpi_evaluate_object(device->dev->handle, "_BCM", &args, NULL);
 
         printk(KERN_DEBUG "set_level status: %x\n", status);
         return status;
@@ -356,7 +355,7 @@ acpi_video_device_lcd_get_level_current(struct acpi_video_device *device,
 {
         int status;
 
-        status = acpi_evaluate_integer(device->handle, "_BQC", NULL, level);
+        status = acpi_evaluate_integer(device->dev->handle, "_BQC", NULL, level);
 
         return status;
 }
@@ -383,7 +382,7 @@ acpi_video_device_EDID(struct acpi_video_device *device,
         else
                 return -EINVAL;
 
-        status = acpi_evaluate_object(device->handle, "_DDC", &args, &buffer);
+        status = acpi_evaluate_object(device->dev->handle, "_DDC", &args, &buffer);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -413,7 +412,7 @@ acpi_video_bus_set_POST(struct acpi_video_bus *video, unsigned long option)
 
         arg0.integer.value = option;
 
-        status = acpi_evaluate_integer(video->handle, "_SPD", &args, &tmp);
+        status = acpi_evaluate_integer(video->device->handle, "_SPD", &args, &tmp);
         if (ACPI_SUCCESS(status))
                 status = tmp ? (-EINVAL) : (AE_OK);
 
@@ -425,8 +424,7 @@ acpi_video_bus_get_POST(struct acpi_video_bus *video, unsigned long *id)
 {
         int status;
 
-
-        status = acpi_evaluate_integer(video->handle, "_GPD", NULL, id);
+        status = acpi_evaluate_integer(video->device->handle, "_GPD", NULL, id);
 
         return status;
 }
@@ -437,7 +435,7 @@ acpi_video_bus_POST_options(struct acpi_video_bus *video,
 {
         int status;
 
-        status = acpi_evaluate_integer(video->handle, "_VPO", NULL, options);
+        status = acpi_evaluate_integer(video->device->handle, "_VPO", NULL, options);
         *options &= 3;
 
         return status;
@@ -478,7 +476,7 @@ acpi_video_bus_DOS(struct acpi_video_bus *video, int bios_flag, int lcd_flag)
         }
         arg0.integer.value = (lcd_flag << 2) | bios_flag;
         video->dos_setting = arg0.integer.value;
-        acpi_evaluate_object(video->handle, "_DOS", &args, NULL);
+        acpi_evaluate_object(video->device->handle, "_DOS", &args, NULL);
 
       Failed:
         return status;
@@ -506,25 +504,25 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
 
         memset(&device->cap, 0, 4);
 
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_ADR", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_ADR", &h_dummy1))) {
                 device->cap._ADR = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_BCL", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_BCL", &h_dummy1))) {
                 device->cap._BCL = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_BCM", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_BCM", &h_dummy1))) {
                 device->cap._BCM = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DDC", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_DDC", &h_dummy1))) {
                 device->cap._DDC = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DCS", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_DCS", &h_dummy1))) {
                 device->cap._DCS = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DGS", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_DGS", &h_dummy1))) {
                 device->cap._DGS = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DSS", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(device->dev->handle, "_DSS", &h_dummy1))) {
                 device->cap._DSS = 1;
         }
 
@@ -588,22 +586,22 @@ static void acpi_video_bus_find_cap(struct acpi_video_bus *video)
         acpi_handle h_dummy1;
 
         memset(&video->cap, 0, 4);
-        if (ACPI_SUCCESS(acpi_get_handle(video->handle, "_DOS", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_DOS", &h_dummy1))) {
                 video->cap._DOS = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(video->handle, "_DOD", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_DOD", &h_dummy1))) {
                 video->cap._DOD = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(video->handle, "_ROM", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_ROM", &h_dummy1))) {
                 video->cap._ROM = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(video->handle, "_GPD", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_GPD", &h_dummy1))) {
                 video->cap._GPD = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(video->handle, "_SPD", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_SPD", &h_dummy1))) {
                 video->cap._SPD = 1;
         }
-        if (ACPI_SUCCESS(acpi_get_handle(video->handle, "_VPO", &h_dummy1))) {
+        if (ACPI_SUCCESS(acpi_get_handle(video->device->handle, "_VPO", &h_dummy1))) {
                 video->cap._VPO = 1;
         }
 }
@@ -1271,7 +1269,6 @@ acpi_video_bus_get_one_device(struct acpi_device *device,
 
                 memset(data, 0, sizeof(struct acpi_video_device));
 
-                data->handle = device->handle;
                 strcpy(acpi_device_name(device), ACPI_VIDEO_DEVICE_NAME);
                 strcpy(acpi_device_class(device), ACPI_VIDEO_CLASS);
                 acpi_driver_data(device) = data;
@@ -1298,7 +1295,7 @@ acpi_video_bus_get_one_device(struct acpi_device *device,
                 acpi_video_device_bind(video, data);
                 acpi_video_device_find_cap(data);
 
-                status = acpi_install_notify_handler(data->handle,
+                status = acpi_install_notify_handler(device->handle,
                                                      ACPI_DEVICE_NOTIFY,
                                                      acpi_video_device_notify,
                                                      data);
@@ -1400,8 +1397,7 @@ static int acpi_video_device_enumerate(struct acpi_video_bus *video)
         union acpi_object *dod = NULL;
         union acpi_object *obj;
 
-
-        status = acpi_evaluate_object(video->handle, "_DOD", NULL, &buffer);
+        status = acpi_evaluate_object(video->device->handle, "_DOD", NULL, &buffer);
         if (!ACPI_SUCCESS(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _DOD"));
                 return status;
@@ -1450,7 +1446,7 @@ static int acpi_video_device_enumerate(struct acpi_video_bus *video)
         video->attached_array = active_device_list;
         video->attached_count = count;
       out:
-        acpi_os_free(buffer.pointer);
+        kfree(buffer.pointer);
         return status;
 }
 
@@ -1569,7 +1565,7 @@ static int acpi_video_bus_put_one_device(struct acpi_video_device *device)
         up(&video->sem);
         acpi_video_device_remove_fs(device->dev);
 
-        status = acpi_remove_notify_handler(device->handle,
+        status = acpi_remove_notify_handler(device->dev->handle,
                                             ACPI_DEVICE_NOTIFY,
                                             acpi_video_device_notify);
 
@@ -1624,8 +1620,7 @@ static void acpi_video_bus_notify(acpi_handle handle, u32 event, void *data)
         if (!video)
                 return;
 
-        if (acpi_bus_get_device(handle, &device))
-                return;
+        device = video->device;
 
         switch (event) {
         case ACPI_VIDEO_NOTIFY_SWITCH:  /* User request that a switch occur,
@@ -1668,8 +1663,7 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data)
         if (!video_device)
                 return;
 
-        if (acpi_bus_get_device(handle, &device))
-                return;
+        device = video_device->dev;
 
         switch (event) {
         case ACPI_VIDEO_NOTIFY_SWITCH:  /* change in status (cycle output device) */
@@ -1707,7 +1701,7 @@ static int acpi_video_bus_add(struct acpi_device *device)
                 return -ENOMEM;
         memset(video, 0, sizeof(struct acpi_video_bus));
 
-        video->handle = device->handle;
+        video->device = device;
         strcpy(acpi_device_name(device), ACPI_VIDEO_BUS_NAME);
         strcpy(acpi_device_class(device), ACPI_VIDEO_CLASS);
         acpi_driver_data(device) = video;
@@ -1727,7 +1721,7 @@ static int acpi_video_bus_add(struct acpi_device *device)
         acpi_video_bus_get_devices(video, device);
         acpi_video_bus_start_devices(video);
 
-        status = acpi_install_notify_handler(video->handle,
+        status = acpi_install_notify_handler(device->handle,
                                              ACPI_DEVICE_NOTIFY,
                                              acpi_video_bus_notify, video);
         if (ACPI_FAILURE(status)) {
@@ -1767,7 +1761,7 @@ static int acpi_video_bus_remove(struct acpi_device *device, int type)
 
         acpi_video_bus_stop_devices(video);
 
-        status = acpi_remove_notify_handler(video->handle,
+        status = acpi_remove_notify_handler(video->device->handle,
                                             ACPI_DEVICE_NOTIFY,
                                             acpi_video_bus_notify);
 
diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig
index 01a9f1cb7743..cfa5af883e13 100644
--- a/drivers/atm/Kconfig
+++ b/drivers/atm/Kconfig
@@ -398,7 +398,7 @@ config ATM_FORE200E_USE_TASKLET
         default n
         help
           This defers work to be done by the interrupt handler to a
-          tasklet instead of hanlding everything at interrupt time.  This
+          tasklet instead of handling everything at interrupt time.  This
           may improve the responsive of the host.
 
 config ATM_FORE200E_TX_RETRY
diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
index d3b426313a41..4521a249dd56 100644
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -31,6 +31,7 @@
 #include <linux/atmdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/poison.h>
 
 #include <asm/atomic.h>
 #include <asm/io.h>
@@ -1995,7 +1996,7 @@ static int __devinit ucode_init (loader_block * lb, amb_dev * dev) {
     }
     i += 1;
   }
-  if (*pointer == 0xdeadbeef) {
+  if (*pointer == ATM_POISON) {
     return loader_start (lb, dev, ucode_start);
   } else {
     // cast needed as there is no %? for pointer differnces
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 5d1c6c95262c..b0369bb20f08 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -35,6 +35,7 @@ static char const rcsid[] =
 
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/poison.h>
 #include <linux/skbuff.h>
 #include <linux/kernel.h>
 #include <linux/vmalloc.h>
@@ -3657,7 +3658,7 @@ probe_sram(struct idt77252_dev *card)
         writel(SAR_CMD_WRITE_SRAM | (0 << 2), SAR_REG_CMD);
 
         for (addr = 0x4000; addr < 0x80000; addr += 0x4000) {
-                writel(0xdeadbeef, SAR_REG_DR0);
+                writel(ATM_POISON, SAR_REG_DR0);
                 writel(SAR_CMD_WRITE_SRAM | (addr << 2), SAR_REG_CMD);
 
                 writel(SAR_CMD_READ_SRAM | (0 << 2), SAR_REG_CMD);
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 80502dc6ed66..0b4e22436935 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -20,7 +20,7 @@ config PREVENT_FIRMWARE_BUILD
 
 config FW_LOADER
         tristate "Userspace firmware loading support"
-        select HOTPLUG
+        depends on HOTPLUG
         ---help---
           This option is provided for the case where no in-kernel-tree modules
           require userspace firmware loading support, but a module built outside
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 83fa8b291a59..2e954d07175a 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -129,7 +129,7 @@ static struct kobj_type ktype_bus = {
 
 };
 
-decl_subsys(bus, &ktype_bus, NULL);
+static decl_subsys(bus, &ktype_bus, NULL);
 
 
 #ifdef CONFIG_HOTPLUG
@@ -598,12 +598,13 @@ void put_bus(struct bus_type * bus)
  *
  *      Note that kset_find_obj increments bus' reference count.
  */
-
+#if 0
 struct bus_type * find_bus(char * name)
 {
         struct kobject * k = kset_find_obj(&bus_subsys.kset, name);
         return k ? to_bus(k) : NULL;
 }
+#endif  /*  0  */
 
 
 /**
diff --git a/drivers/base/core.c b/drivers/base/core.c
index b21f864c9ce8..be6b5bc0677d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -559,20 +559,20 @@ static void device_create_release(struct device *dev)
 
 /**
  * device_create - creates a device and registers it with sysfs
- * @cs: pointer to the struct class that this device should be registered to.
- * @parent: pointer to the parent struct device of this new device, if any.
- * @dev: the dev_t for the char device to be added.
- * @fmt: string for the class device's name
+ * @class: pointer to the struct class that this device should be registered to
+ * @parent: pointer to the parent struct device of this new device, if any
+ * @devt: the dev_t for the char device to be added
+ * @fmt: string for the device's name
+ *
+ * This function can be used by char device classes.  A struct device
+ * will be created in sysfs, registered to the specified class.
  *
- * This function can be used by char device classes.  A struct
- * device will be created in sysfs, registered to the specified
- * class.
  * A "dev" file will be created, showing the dev_t for the device, if
  * the dev_t is not 0,0.
- * If a pointer to a parent struct device is passed in, the newly
- * created struct device will be a child of that device in sysfs.  The
- * pointer to the struct device will be returned from the call.  Any
- * further sysfs files that might be required can be created using this
+ * If a pointer to a parent struct device is passed in, the newly created
+ * struct device will be a child of that device in sysfs.
+ * The pointer to the struct device will be returned from the call.
+ * Any further sysfs files that might be required can be created using this
  * pointer.
  *
  * Note: the struct class passed to this function must have previously
@@ -620,11 +620,11 @@ EXPORT_SYMBOL_GPL(device_create);
 
 /**
  * device_destroy - removes a device that was created with device_create()
- * @class: the pointer to the struct class that this device was registered * with.
- * @dev: the dev_t of the device that was previously registered.
+ * @class: pointer to the struct class that this device was registered with
+ * @devt: the dev_t of the device that was previously registered
  *
- * This call unregisters and cleans up a class device that was created with a
- * call to class_device_create()
+ * This call unregisters and cleans up a device that was created with a
+ * call to device_create().
  */
 void device_destroy(struct class *class, dev_t devt)
 {
diff --git a/drivers/base/node.c b/drivers/base/node.c
index d7de1753e094..e9b0957f15d1 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -64,7 +64,7 @@ static ssize_t node_read_meminfo(struct sys_device * dev, char * buf)
                        "Node %d Mapped:       %8lu kB\n"
                        "Node %d AnonPages:    %8lu kB\n"
                        "Node %d PageTables:   %8lu kB\n"
-                       "Node %d NFS Unstable: %8lu kB\n"
+                       "Node %d NFS_Unstable: %8lu kB\n"
                        "Node %d Bounce:       %8lu kB\n"
                        "Node %d Slab:         %8lu kB\n",
                        nid, K(i.totalram),
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index c2d621632383..3ef9d514b916 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -139,7 +139,7 @@ static int __cpuinit topology_sysfs_init(void)
                                 (void *)(long)i);
         }
 
-        register_cpu_notifier(&topology_cpu_notifier);
+        register_hotcpu_notifier(&topology_cpu_notifier);
 
         return 0;
 }
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 93d94749310b..b5382cedf0c0 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -400,6 +400,16 @@ config BLK_DEV_RAM_SIZE
           what are you doing. If you are using IBM S/390, then set this to
           8192.
 
+config BLK_DEV_RAM_BLOCKSIZE
+        int "Default RAM disk block size (bytes)"
+        depends on BLK_DEV_RAM
+        default "1024"
+        help
+          The default value is 1024 kilobytes.  PAGE_SIZE is a much more
+          efficient choice however.  The default is kept to ensure initrd
+          setups function - apparently needed by the rd_load_image routine
+          that supposes the filesystem in the image uses a 1024 blocksize.
+
 config BLK_DEV_INITRD
         bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
         depends on BROKEN || !FRV
diff --git a/drivers/block/aoe/aoechr.c b/drivers/block/aoe/aoechr.c
index 5327f553b4f5..1bc1cf9603f1 100644
--- a/drivers/block/aoe/aoechr.c
+++ b/drivers/block/aoe/aoechr.c
@@ -162,7 +162,7 @@ aoechr_open(struct inode *inode, struct file *filp)
 {
         int n, i;
 
-        n = MINOR(inode->i_rdev);
+        n = iminor(inode);
         filp->private_data = (void *) (unsigned long) n;
 
         for (i = 0; i < ARRAY_SIZE(chardevs); ++i)
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 1c4df22dfd2a..2cd3391ff878 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -48,14 +48,14 @@
 #include <linux/completion.h>
 
 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
-#define DRIVER_NAME "HP CISS Driver (v 2.6.10)"
-#define DRIVER_VERSION CCISS_DRIVER_VERSION(2,6,10)
+#define DRIVER_NAME "HP CISS Driver (v 3.6.10)"
+#define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,10)
 
 /* Embedded module documentation macros - see modules.h */
 MODULE_AUTHOR("Hewlett-Packard Company");
-MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 2.6.10");
+MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.10");
 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
-                        " SA6i P600 P800 P400 P400i E200 E200i");
+                        " SA6i P600 P800 P400 P400i E200 E200i E500");
 MODULE_LICENSE("GPL");
 
 #include "cciss_cmd.h"
@@ -82,6 +82,7 @@ static const struct pci_device_id cciss_pci_device_id[] = {
         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
+        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3233},
         {0,}
 };
 
@@ -110,6 +111,7 @@ static struct board_type products[] = {
         {0x3213103C, "Smart Array E200i", &SA5_access},
         {0x3214103C, "Smart Array E200i", &SA5_access},
         {0x3215103C, "Smart Array E200i", &SA5_access},
+        {0x3233103C, "Smart Array E500", &SA5_access},
 };
 
 /* How long to wait (in milliseconds) for board to go into simple mode */
@@ -1233,6 +1235,50 @@ static inline void complete_buffers(struct bio *bio, int status)
         }
 }
 
+static void cciss_check_queues(ctlr_info_t *h)
+{
+        int start_queue = h->next_to_run;
+        int i;
+
+        /* check to see if we have maxed out the number of commands that can
+         * be placed on the queue.  If so then exit.  We do this check here
+         * in case the interrupt we serviced was from an ioctl and did not
+         * free any new commands.
+         */
+        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
+                return;
+
+        /* We have room on the queue for more commands.  Now we need to queue
+         * them up.  We will also keep track of the next queue to run so
+         * that every queue gets a chance to be started first.
+         */
+        for (i = 0; i < h->highest_lun + 1; i++) {
+                int curr_queue = (start_queue + i) % (h->highest_lun + 1);
+                /* make sure the disk has been added and the drive is real
+                 * because this can be called from the middle of init_one.
+                 */
+                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
+                        continue;
+                blk_start_queue(h->gendisk[curr_queue]->queue);
+
+                /* check to see if we have maxed out the number of commands
+                 * that can be placed on the queue.
+                 */
+                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
+                        if (curr_queue == start_queue) {
+                                h->next_to_run =
+                                    (start_queue + 1) % (h->highest_lun + 1);
+                                break;
+                        } else {
+                                h->next_to_run = curr_queue;
+                                break;
+                        }
+                } else {
+                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
+                }
+        }
+}
+
 static void cciss_softirq_done(struct request *rq)
 {
         CommandList_struct *cmd = rq->completion_data;
@@ -1264,6 +1310,7 @@ static void cciss_softirq_done(struct request *rq)
         spin_lock_irqsave(&h->lock, flags);
         end_that_request_last(rq, rq->errors);
         cmd_free(h, cmd, 1);
+        cciss_check_queues(h);
         spin_unlock_irqrestore(&h->lock, flags);
 }
 
@@ -2528,8 +2575,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
         CommandList_struct *c;
         unsigned long flags;
         __u32 a, a1, a2;
-        int j;
-        int start_queue = h->next_to_run;
 
         if (interrupt_not_for_us(h))
                 return IRQ_NONE;
@@ -2588,45 +2633,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                 }
         }
 
-        /* check to see if we have maxed out the number of commands that can
-         * be placed on the queue.  If so then exit.  We do this check here
-         * in case the interrupt we serviced was from an ioctl and did not
-         * free any new commands.
-         */
-        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
-                goto cleanup;
-
-        /* We have room on the queue for more commands.  Now we need to queue
-         * them up.  We will also keep track of the next queue to run so
-         * that every queue gets a chance to be started first.
-         */
-        for (j = 0; j < h->highest_lun + 1; j++) {
-                int curr_queue = (start_queue + j) % (h->highest_lun + 1);
-                /* make sure the disk has been added and the drive is real
-                 * because this can be called from the middle of init_one.
-                 */
-                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
-                        continue;
-                blk_start_queue(h->gendisk[curr_queue]->queue);
-
-                /* check to see if we have maxed out the number of commands
-                 * that can be placed on the queue.
-                 */
-                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
-                        if (curr_queue == start_queue) {
-                                h->next_to_run =
-                                    (start_queue + 1) % (h->highest_lun + 1);
-                                goto cleanup;
-                        } else {
-                                h->next_to_run = curr_queue;
-                                goto cleanup;
-                        }
-                } else {
-                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
-                }
-        }
-
-      cleanup:
         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
         return IRQ_HANDLED;
 }
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 757f42dd8e86..78082edc14b4 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -1739,8 +1739,6 @@ static void getgeometry(int ctlr)
              (log_index < id_ctlr_buf->nr_drvs)
              && (log_unit < NWD);
              log_unit++) {
-                struct gendisk *disk = ida_gendisk[ctlr][log_unit];
-
                 size = sizeof(sense_log_drv_stat_t);
 
                 /*
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 0242cbb86a87..ad1d7065a1b2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -249,18 +249,6 @@ static int irqdma_allocated;
 #include <linux/cdrom.h>        /* for the compatibility eject ioctl */
 #include <linux/completion.h>
 
-/*
- * Interrupt freeing also means /proc VFS work - dont do it
- * from interrupt context. We push this work into keventd:
- */
-static void fd_free_irq_fn(void *data)
-{
-        fd_free_irq();
-}
-
-static DECLARE_WORK(fd_free_irq_work, fd_free_irq_fn, NULL);
-
-
 static struct request *current_req;
 static struct request_queue *floppy_queue;
 static void do_fd_request(request_queue_t * q);
@@ -826,15 +814,6 @@ static int set_dor(int fdc, char mask, char data)
                         UDRS->select_date = jiffies;
                 }
         }
-        /*
-         *      We should propagate failures to grab the resources back
-         *      nicely from here. Actually we ought to rewrite the fd
-         *      driver some day too.
-         */
-        if (newdor & FLOPPY_MOTOR_MASK)
-                floppy_grab_irq_and_dma();
-        if (olddor & FLOPPY_MOTOR_MASK)
-                floppy_release_irq_and_dma();
         return olddor;
 }
 
@@ -892,8 +871,6 @@ static int _lock_fdc(int drive, int interruptible, int line)
                        line);
                 return -1;
         }
-        if (floppy_grab_irq_and_dma() == -1)
-                return -EBUSY;
 
         if (test_and_set_bit(0, &fdc_busy)) {
                 DECLARE_WAITQUEUE(wait, current);
@@ -915,6 +892,8 @@ static int _lock_fdc(int drive, int interruptible, int line)
 
                 set_current_state(TASK_RUNNING);
                 remove_wait_queue(&fdc_wait, &wait);
+
+                flush_scheduled_work();
         }
         command_status = FD_COMMAND_NONE;
 
@@ -948,7 +927,6 @@ static inline void unlock_fdc(void)
         if (elv_next_request(floppy_queue))
                 do_fd_request(floppy_queue);
         spin_unlock_irqrestore(&floppy_lock, flags);
-        floppy_release_irq_and_dma();
         wake_up(&fdc_wait);
 }
 
@@ -3694,8 +3672,8 @@ static int floppy_release(struct inode *inode, struct file *filp)
         }
         if (!UDRS->fd_ref)
                 opened_bdev[drive] = NULL;
-        floppy_release_irq_and_dma();
         mutex_unlock(&open_lock);
+
         return 0;
 }
 
@@ -3726,9 +3704,6 @@ static int floppy_open(struct inode *inode, struct file *filp)
         if (UDRS->fd_ref == -1 || (UDRS->fd_ref && (filp->f_flags & O_EXCL)))
                 goto out2;
 
-        if (floppy_grab_irq_and_dma())
-                goto out2;
-
         if (filp->f_flags & O_EXCL)
                 UDRS->fd_ref = -1;
         else
@@ -3805,7 +3780,6 @@ out:
                 UDRS->fd_ref--;
         if (!UDRS->fd_ref)
                 opened_bdev[drive] = NULL;
-        floppy_release_irq_and_dma();
 out2:
         mutex_unlock(&open_lock);
         return res;
@@ -3822,14 +3796,9 @@ static int check_floppy_change(struct gendisk *disk)
                 return 1;
 
         if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
-                if (floppy_grab_irq_and_dma()) {
-                        return 1;
-                }
-
                 lock_fdc(drive, 0);
                 poll_drive(0, 0);
                 process_fd_request();
-                floppy_release_irq_and_dma();
         }
 
         if (UTESTF(FD_DISK_CHANGED) ||
@@ -4208,6 +4177,11 @@ static int __init floppy_init(void)
         int i, unit, drive;
         int err, dr;
 
+#if defined(CONFIG_PPC_MERGE)
+        if (check_legacy_ioport(FDC1))
+                return -ENODEV;
+#endif
+
         raw_cmd = NULL;
 
         for (dr = 0; dr < N_DRIVE; dr++) {
@@ -4265,13 +4239,6 @@ static int __init floppy_init(void)
         }
 
         use_virtual_dma = can_use_virtual_dma & 1;
-#if defined(CONFIG_PPC_MERGE)
-        if (check_legacy_ioport(FDC1)) {
-                del_timer(&fd_timeout);
-                err = -ENODEV;
-                goto out_unreg_region;
-        }
-#endif
         fdc_state[0].address = FDC1;
         if (fdc_state[0].address == -1) {
                 del_timer(&fd_timeout);
@@ -4346,7 +4313,6 @@ static int __init floppy_init(void)
         fdc = 0;
         del_timer(&fd_timeout);
         current_drive = 0;
-        floppy_release_irq_and_dma();
         initialising = 0;
         if (have_no_fdc) {
                 DPRINT("no floppy controllers found\n");
@@ -4504,7 +4470,7 @@ static void floppy_release_irq_and_dma(void)
         if (irqdma_allocated) {
                 fd_disable_dma();
                 fd_free_dma();
-                schedule_work(&fd_free_irq_work);
+                fd_free_irq();
                 irqdma_allocated = 0;
         }
         set_dor(0, ~0, 8);
@@ -4600,8 +4566,6 @@ void cleanup_module(void)
         /* eject disk, if any */
         fd_eject(0);
 
-        flush_scheduled_work();         /* fd_free_irq() might be pending */
-
         wait_for_completion(&device_release);
 }
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 0a1b1ea36ddc..bdbade9a5cf5 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -300,6 +300,15 @@ static struct request *nbd_read_stat(struct nbd_device *lo)
                                 lo->disk->disk_name, result);
                 goto harderror;
         }
+
+        if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
+                printk(KERN_ERR "%s: Wrong magic (0x%lx)\n",
+                                lo->disk->disk_name,
+                                (unsigned long)ntohl(reply.magic));
+                result = -EPROTO;
+                goto harderror;
+        }
+
         req = nbd_find_request(lo, reply.handle);
         if (unlikely(IS_ERR(req))) {
                 result = PTR_ERR(req);
@@ -312,13 +321,6 @@ static struct request *nbd_read_stat(struct nbd_device *lo)
                 goto harderror;
         }
 
-        if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
-                printk(KERN_ERR "%s: Wrong magic (0x%lx)\n",
-                                lo->disk->disk_name,
-                                (unsigned long)ntohl(reply.magic));
-                result = -EPROTO;
-                goto harderror;
-        }
         if (ntohl(reply.error)) {
                 printk(KERN_ERR "%s: Other side returned error (%d)\n",
                                 lo->disk->disk_name, ntohl(reply.error));
@@ -339,7 +341,8 @@ static struct request *nbd_read_stat(struct nbd_device *lo)
                                         printk(KERN_ERR "%s: Receive data failed (result %d)\n",
                                                         lo->disk->disk_name,
                                                         result);
-                                        goto harderror;
+                                        req->errors++;
+                                        return req;
                                 }
                                 dprintk(DBG_RX, "%s: request %p: got %d bytes data\n",
                                         lo->disk->disk_name, req, bvec->bv_len);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index bde2c64b6346..451b996bba91 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2577,19 +2577,19 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
         case PKT_CTRL_CMD_SETUP:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                mutex_lock(&ctl_mutex);
+                mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
                 ret = pkt_setup_dev(&ctrl_cmd);
                 mutex_unlock(&ctl_mutex);
                 break;
         case PKT_CTRL_CMD_TEARDOWN:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                mutex_lock(&ctl_mutex);
+                mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
                 ret = pkt_remove_dev(&ctrl_cmd);
                 mutex_unlock(&ctl_mutex);
                 break;
         case PKT_CTRL_CMD_STATUS:
-                mutex_lock(&ctl_mutex);
+                mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
                 pkt_get_status(&ctrl_cmd);
                 mutex_unlock(&ctl_mutex);
                 break;
diff --git a/drivers/block/rd.c b/drivers/block/rd.c
index 3cf246abb5ec..a3f64bfe6b58 100644
--- a/drivers/block/rd.c
+++ b/drivers/block/rd.c
@@ -84,7 +84,7 @@ int rd_size = CONFIG_BLK_DEV_RAM_SIZE;		/* Size of the RAM disks */
  * behaviour. The default is still BLOCK_SIZE (needed by rd_load_image that
  * supposes the filesystem in the image uses a BLOCK_SIZE blocksize).
  */
-static int rd_blocksize = BLOCK_SIZE;           /* blocksize of the RAM disks */
+static int rd_blocksize = CONFIG_BLK_DEV_RAM_BLOCKSIZE;
 
 /*
  * Copyright (C) 2000 Linus Torvalds.
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 3721e12135d9..cc42e762396f 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -250,8 +250,6 @@ static int floppy_open(struct inode *inode, struct file *filp);
 static int floppy_release(struct inode *inode, struct file *filp);
 static int floppy_check_change(struct gendisk *disk);
 static int floppy_revalidate(struct gendisk *disk);
-static int swim3_add_device(struct device_node *swims);
-int swim3_init(void);
 
 #ifndef CONFIG_PMAC_MEDIABAY
 #define check_media_bay(which, what)    1
@@ -1011,114 +1009,63 @@ static struct block_device_operations floppy_fops = {
         .revalidate_disk= floppy_revalidate,
 };
 
-int swim3_init(void)
-{
-        struct device_node *swim;
-        int err = -ENOMEM;
-        int i;
-
-        swim = find_devices("floppy");
-        while (swim && (floppy_count < MAX_FLOPPIES))
-        {
-                swim3_add_device(swim);
-                swim = swim->next;
-        }
-
-        swim = find_devices("swim3");
-        while (swim && (floppy_count < MAX_FLOPPIES))
-        {
-                swim3_add_device(swim);
-                swim = swim->next;
-        }
-
-        if (!floppy_count)
-                return -ENODEV;
-
-        for (i = 0; i < floppy_count; i++) {
-                disks[i] = alloc_disk(1);
-                if (!disks[i])
-                        goto out;
-        }
-
-        if (register_blkdev(FLOPPY_MAJOR, "fd")) {
-                err = -EBUSY;
-                goto out;
-        }
-
-        swim3_queue = blk_init_queue(do_fd_request, &swim3_lock);
-        if (!swim3_queue) {
-                err = -ENOMEM;
-                goto out_queue;
-        }
-
-        for (i = 0; i < floppy_count; i++) {
-                struct gendisk *disk = disks[i];
-                disk->major = FLOPPY_MAJOR;
-                disk->first_minor = i;
-                disk->fops = &floppy_fops;
-                disk->private_data = &floppy_states[i];
-                disk->queue = swim3_queue;
-                disk->flags |= GENHD_FL_REMOVABLE;
-                sprintf(disk->disk_name, "fd%d", i);
-                set_capacity(disk, 2880);
-                add_disk(disk);
-        }
-        return 0;
-
-out_queue:
-        unregister_blkdev(FLOPPY_MAJOR, "fd");
-out:
-        while (i--)
-                put_disk(disks[i]);
-        /* shouldn't we do something with results of swim_add_device()? */
-        return err;
-}
-
-static int swim3_add_device(struct device_node *swim)
+static int swim3_add_device(struct macio_dev *mdev, int index)
 {
+        struct device_node *swim = mdev->ofdev.node;
         struct device_node *mediabay;
-        struct floppy_state *fs = &floppy_states[floppy_count];
-        struct resource res_reg, res_dma;
+        struct floppy_state *fs = &floppy_states[index];
+        int rc = -EBUSY;
 
-        if (of_address_to_resource(swim, 0, &res_reg) ||
-            of_address_to_resource(swim, 1, &res_dma)) {
-                printk(KERN_ERR "swim3: Can't get addresses\n");
-                return -EINVAL;
+        /* Check & Request resources */
+        if (macio_resource_count(mdev) < 2) {
+                printk(KERN_WARNING "ifd%d: no address for %s\n",
+                       index, swim->full_name);
+                return -ENXIO;
         }
-        if (request_mem_region(res_reg.start, res_reg.end - res_reg.start + 1,
-                               " (reg)") == NULL) {
-                printk(KERN_ERR "swim3: Can't request register space\n");
-                return -EINVAL;
+        if (macio_irq_count(mdev) < 2) {
+                printk(KERN_WARNING "fd%d: no intrs for device %s\n",
+                        index, swim->full_name);
         }
-        if (request_mem_region(res_dma.start, res_dma.end - res_dma.start + 1,
-                               " (dma)") == NULL) {
-                release_mem_region(res_reg.start,
-                                   res_reg.end - res_reg.start + 1);
-                printk(KERN_ERR "swim3: Can't request DMA space\n");
-                return -EINVAL;
+        if (macio_request_resource(mdev, 0, "swim3 (mmio)")) {
+                printk(KERN_ERR "fd%d: can't request mmio resource for %s\n",
+                       index, swim->full_name);
+                return -EBUSY;
         }
-
-        if (swim->n_intrs < 2) {
-                printk(KERN_INFO "swim3: expecting 2 intrs (n_intrs:%d)\n",
-                       swim->n_intrs);
-                release_mem_region(res_reg.start,
-                                   res_reg.end - res_reg.start + 1);
-                release_mem_region(res_dma.start,
-                                   res_dma.end - res_dma.start + 1);
-                return -EINVAL;
+        if (macio_request_resource(mdev, 1, "swim3 (dma)")) {
+                printk(KERN_ERR "fd%d: can't request dma resource for %s\n",
+                       index, swim->full_name);
+                macio_release_resource(mdev, 0);
+                return -EBUSY;
         }
+        dev_set_drvdata(&mdev->ofdev.dev, fs);
 
-        mediabay = (strcasecmp(swim->parent->type, "media-bay") == 0) ? swim->parent : NULL;
+        mediabay = (strcasecmp(swim->parent->type, "media-bay") == 0) ?
+                swim->parent : NULL;
         if (mediabay == NULL)
                 pmac_call_feature(PMAC_FTR_SWIM3_ENABLE, swim, 0, 1);
         
         memset(fs, 0, sizeof(*fs));
         spin_lock_init(&fs->lock);
         fs->state = idle;
-        fs->swim3 = (struct swim3 __iomem *)ioremap(res_reg.start, 0x200);
-        fs->dma = (struct dbdma_regs __iomem *)ioremap(res_dma.start, 0x200);
-        fs->swim3_intr = swim->intrs[0].line;
-        fs->dma_intr = swim->intrs[1].line;
+        fs->swim3 = (struct swim3 __iomem *)
+                ioremap(macio_resource_start(mdev, 0), 0x200);
+        if (fs->swim3 == NULL) {
+                printk("fd%d: couldn't map registers for %s\n",
+                       index, swim->full_name);
+                rc = -ENOMEM;
+                goto out_release;
+        }
+        fs->dma = (struct dbdma_regs __iomem *)
+                ioremap(macio_resource_start(mdev, 1), 0x200);
+        if (fs->dma == NULL) {
+                printk("fd%d: couldn't map DMA for %s\n",
+                       index, swim->full_name);
+                iounmap(fs->swim3);
+                rc = -ENOMEM;
+                goto out_release;
+        }
+        fs->swim3_intr = macio_irq(mdev, 0);
+        fs->dma_intr = macio_irq(mdev, 1);;
         fs->cur_cyl = -1;
         fs->cur_sector = -1;
         fs->secpercyl = 36;
@@ -1132,15 +1079,16 @@ static int swim3_add_device(struct device_node *swim)
         st_le16(&fs->dma_cmd[1].command, DBDMA_STOP);
 
         if (request_irq(fs->swim3_intr, swim3_interrupt, 0, "SWIM3", fs)) {
-                printk(KERN_ERR "Couldn't get irq %d for SWIM3\n", fs->swim3_intr);
+                printk(KERN_ERR "fd%d: couldn't request irq %d for %s\n",
+                       index, fs->swim3_intr, swim->full_name);
                 pmac_call_feature(PMAC_FTR_SWIM3_ENABLE, swim, 0, 0);
+                goto out_unmap;
                 return -EBUSY;
         }
 /*
         if (request_irq(fs->dma_intr, fd_dma_interrupt, 0, "SWIM3-dma", fs)) {
                 printk(KERN_ERR "Couldn't get irq %d for SWIM3 DMA",
                        fs->dma_intr);
-                pmac_call_feature(PMAC_FTR_SWIM3_ENABLE, swim, 0, 0);
                 return -EBUSY;
         }
 */
@@ -1150,8 +1098,90 @@ static int swim3_add_device(struct device_node *swim)
         printk(KERN_INFO "fd%d: SWIM3 floppy controller %s\n", floppy_count,
                 mediabay ? "in media bay" : "");
 
-        floppy_count++;
-        
+        return 0;
+
+ out_unmap:
+        iounmap(fs->dma);
+        iounmap(fs->swim3);
+
+ out_release:
+        macio_release_resource(mdev, 0);
+        macio_release_resource(mdev, 1);
+
+        return rc;
+}
+
+static int __devinit swim3_attach(struct macio_dev *mdev, const struct of_device_id *match)
+{
+        int i, rc;
+        struct gendisk *disk;
+
+        /* Add the drive */
+        rc = swim3_add_device(mdev, floppy_count);
+        if (rc)
+                return rc;
+
+        /* Now create the queue if not there yet */
+        if (swim3_queue == NULL) {
+                /* If we failed, there isn't much we can do as the driver is still
+                 * too dumb to remove the device, just bail out
+                 */
+                if (register_blkdev(FLOPPY_MAJOR, "fd"))
+                        return 0;
+                swim3_queue = blk_init_queue(do_fd_request, &swim3_lock);
+                if (swim3_queue == NULL) {
+                        unregister_blkdev(FLOPPY_MAJOR, "fd");
+                        return 0;
+                }
+        }
+
+        /* Now register that disk. Same comment about failure handling */
+        i = floppy_count++;
+        disk = disks[i] = alloc_disk(1);
+        if (disk == NULL)
+                return 0;
+
+        disk->major = FLOPPY_MAJOR;
+        disk->first_minor = i;
+        disk->fops = &floppy_fops;
+        disk->private_data = &floppy_states[i];
+        disk->queue = swim3_queue;
+        disk->flags |= GENHD_FL_REMOVABLE;
+        sprintf(disk->disk_name, "fd%d", i);
+        set_capacity(disk, 2880);
+        add_disk(disk);
+
+        return 0;
+}
+
+static struct of_device_id swim3_match[] =
+{
+        {
+        .name           = "swim3",
+        },
+        {
+        .compatible     = "ohare-swim3"
+        },
+        {
+        .compatible     = "swim3"
+        },
+};
+
+static struct macio_driver swim3_driver =
+{
+        .name           = "swim3",
+        .match_table    = swim3_match,
+        .probe          = swim3_attach,
+#if 0
+        .suspend        = swim3_suspend,
+        .resume         = swim3_resume,
+#endif
+};
+
+
+int swim3_init(void)
+{
+        macio_register_driver(&swim3_driver);
         return 0;
 }
 
diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 6f67141f4de0..13ba729cdd57 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -234,6 +234,7 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
         data->fw_data = kmalloc(firmware->size, GFP_KERNEL);
         if (!data->fw_data) {
                 BT_ERR("Can't allocate memory for firmware image");
+                release_firmware(firmware);
                 usb_free_urb(data->urb);
                 kfree(data->buffer);
                 kfree(data);
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 2830f58d6f77..8eebf9ca3786 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -739,6 +739,7 @@ static int bluecard_open(bluecard_info_t *info)
 
         hdev->type = HCI_PCCARD;
         hdev->driver_data = info;
+        SET_HCIDEV_DEV(hdev, &info->p_dev->dev);
 
         hdev->open     = bluecard_hci_open;
         hdev->close    = bluecard_hci_close;
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index c9dba5565cac..df7bb016df49 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -582,6 +582,7 @@ static int bt3c_open(bt3c_info_t *info)
 
         hdev->type = HCI_PCCARD;
         hdev->driver_data = info;
+        SET_HCIDEV_DEV(hdev, &info->p_dev->dev);
 
         hdev->open     = bt3c_hci_open;
         hdev->close    = bt3c_hci_close;
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index c889bf8109a1..746ccca97f6f 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -502,6 +502,7 @@ static int btuart_open(btuart_info_t *info)
 
         hdev->type = HCI_PCCARD;
         hdev->driver_data = info;
+        SET_HCIDEV_DEV(hdev, &info->p_dev->dev);
 
         hdev->open     = btuart_hci_open;
         hdev->close    = btuart_hci_close;
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index be6eed175aa3..0e99def8a1e3 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -484,6 +484,7 @@ static int dtl1_open(dtl1_info_t *info)
 
         hdev->type = HCI_PCCARD;
         hdev->driver_data = info;
+        SET_HCIDEV_DEV(hdev, &info->p_dev->dev);
 
         hdev->open     = dtl1_hci_open;
         hdev->close    = dtl1_hci_close;
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 1994270c16e1..93ba25b7ea32 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -191,7 +191,7 @@ static int hci_uart_flush(struct hci_dev *hdev)
 
         /* Flush any pending characters in the driver and discipline. */
         tty_ldisc_flush(tty);
-        if (tty->driver->flush_buffer)
+        if (tty->driver && tty->driver->flush_buffer)
                 tty->driver->flush_buffer(tty);
 
         if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
@@ -290,7 +290,7 @@ static int hci_uart_tty_open(struct tty_struct *tty)
         if (tty->ldisc.flush_buffer)
                 tty->ldisc.flush_buffer(tty);
 
-        if (tty->driver->flush_buffer)
+        if (tty->driver && tty->driver->flush_buffer)
                 tty->driver->flush_buffer(tty);
 
         return 0;
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index a7d9d7e99e72..e2d4beac7420 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -67,6 +67,8 @@ static int ignore = 0;
 static int ignore_dga = 0;
 static int ignore_csr = 0;
 static int ignore_sniffer = 0;
+static int disable_scofix = 0;
+static int force_scofix = 0;
 static int reset = 0;
 
 #ifdef CONFIG_BT_HCIUSB_SCO
@@ -107,9 +109,12 @@ static struct usb_device_id blacklist_ids[] = {
         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = HCI_IGNORE },
 
         /* Broadcom BCM2035 */
-        { USB_DEVICE(0x0a5c, 0x200a), .driver_info = HCI_RESET | HCI_BROKEN_ISOC },
+        { USB_DEVICE(0x0a5c, 0x200a), .driver_info = HCI_RESET | HCI_WRONG_SCO_MTU },
         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = HCI_BCM92035 },
 
+        /* IBM/Lenovo ThinkPad with Broadcom chip */
+        { USB_DEVICE(0x0a5c, 0x201e), .driver_info = HCI_WRONG_SCO_MTU },
+
         /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
         { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
 
@@ -119,8 +124,13 @@ static struct usb_device_id blacklist_ids[] = {
         /* ISSC Bluetooth Adapter v3.1 */
         { USB_DEVICE(0x1131, 0x1001), .driver_info = HCI_RESET },
 
-        /* RTX Telecom based adapter with buggy SCO support */
+        /* RTX Telecom based adapters with buggy SCO support */
         { USB_DEVICE(0x0400, 0x0807), .driver_info = HCI_BROKEN_ISOC },
+        { USB_DEVICE(0x0400, 0x080a), .driver_info = HCI_BROKEN_ISOC },
+
+        /* Belkin F8T012 and F8T013 devices */
+        { USB_DEVICE(0x050d, 0x0012), .driver_info = HCI_WRONG_SCO_MTU },
+        { USB_DEVICE(0x050d, 0x0013), .driver_info = HCI_WRONG_SCO_MTU },
 
         /* Digianswer devices */
         { USB_DEVICE(0x08fd, 0x0001), .driver_info = HCI_DIGIANSWER },
@@ -129,6 +139,9 @@ static struct usb_device_id blacklist_ids[] = {
         /* CSR BlueCore Bluetooth Sniffer */
         { USB_DEVICE(0x0a12, 0x0002), .driver_info = HCI_SNIFFER },
 
+        /* Frontline ComProbe Bluetooth Sniffer */
+        { USB_DEVICE(0x16d3, 0x0002), .driver_info = HCI_SNIFFER },
+
         { }     /* Terminating entry */
 };
 
@@ -984,6 +997,11 @@ static int hci_usb_probe(struct usb_interface *intf, const struct usb_device_id
         if (reset || id->driver_info & HCI_RESET)
                 set_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks);
 
+        if (force_scofix || id->driver_info & HCI_WRONG_SCO_MTU) {
+                if (!disable_scofix)
+                        set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
+        }
+
         if (id->driver_info & HCI_SNIFFER) {
                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
@@ -1042,10 +1060,81 @@ static void hci_usb_disconnect(struct usb_interface *intf)
         hci_free_dev(hdev);
 }
 
+static int hci_usb_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct hci_usb *husb = usb_get_intfdata(intf);
+        struct list_head killed;
+        unsigned long flags;
+        int i;
+
+        if (!husb || intf == husb->isoc_iface)
+                return 0;
+
+        hci_suspend_dev(husb->hdev);
+
+        INIT_LIST_HEAD(&killed);
+
+        for (i = 0; i < 4; i++) {
+                struct _urb_queue *q = &husb->pending_q[i];
+                struct _urb *_urb, *_tmp;
+
+                while ((_urb = _urb_dequeue(q))) {
+                        /* reset queue since _urb_dequeue sets it to NULL */
+                        _urb->queue = q;
+                        usb_kill_urb(&_urb->urb);
+                        list_add(&_urb->list, &killed);
+                }
+
+                spin_lock_irqsave(&q->lock, flags);
+
+                list_for_each_entry_safe(_urb, _tmp, &killed, list) {
+                        list_move_tail(&_urb->list, &q->head);
+                }
+
+                spin_unlock_irqrestore(&q->lock, flags);
+        }
+
+        return 0;
+}
+
+static int hci_usb_resume(struct usb_interface *intf)
+{
+        struct hci_usb *husb = usb_get_intfdata(intf);
+        unsigned long flags;
+        int i, err = 0;
+
+        if (!husb || intf == husb->isoc_iface)
+                return 0;
+        
+        for (i = 0; i < 4; i++) {
+                struct _urb_queue *q = &husb->pending_q[i];
+                struct _urb *_urb;
+
+                spin_lock_irqsave(&q->lock, flags);
+
+                list_for_each_entry(_urb, &q->head, list) {
+                        err = usb_submit_urb(&_urb->urb, GFP_ATOMIC);
+                        if (err)
+                                break;
+                }
+
+                spin_unlock_irqrestore(&q->lock, flags);
+
+                if (err)
+                        return -EIO;
+        }
+
+        hci_resume_dev(husb->hdev);
+
+        return 0;
+}
+
 static struct usb_driver hci_usb_driver = {
         .name           = "hci_usb",
         .probe          = hci_usb_probe,
         .disconnect     = hci_usb_disconnect,
+        .suspend        = hci_usb_suspend,
+        .resume         = hci_usb_resume,
         .id_table       = bluetooth_ids,
 };
 
@@ -1081,6 +1170,12 @@ MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
 module_param(ignore_sniffer, bool, 0644);
 MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
 
+module_param(disable_scofix, bool, 0644);
+MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
+
+module_param(force_scofix, bool, 0644);
+MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
+
 module_param(reset, bool, 0644);
 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
 
diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h
index 37100a6ea1a8..963fc55cdc85 100644
--- a/drivers/bluetooth/hci_usb.h
+++ b/drivers/bluetooth/hci_usb.h
@@ -35,6 +35,7 @@
 #define HCI_SNIFFER             0x10
 #define HCI_BCM92035            0x20
 #define HCI_BROKEN_ISOC         0x40
+#define HCI_WRONG_SCO_MTU       0x80
 
 #define HCI_MAX_IFACE_NUM       3
 
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index ea589007fa26..aac67a3a6019 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -277,7 +277,6 @@ static int vhci_open(struct inode *inode, struct file *file)
 
         hdev->type = HCI_VHCI;
         hdev->driver_data = vhci;
-        SET_HCIDEV_DEV(hdev, vhci_miscdev.dev);
 
         hdev->open     = vhci_open_dev;
         hdev->close    = vhci_close_dev;
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index ca27ee89240b..d239cf8b20bd 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1837,7 +1837,7 @@ static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s)
         init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
         cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
         cgc.cmd[7] = s->type;
-        cgc.cmd[9] = cgc.buflen = 0xff;
+        cgc.cmd[9] = cgc.buflen & 0xff;
 
         if ((ret = cdo->generic_packet(cdi, &cgc)))
                 return ret;
diff --git a/drivers/cdrom/gscd.c b/drivers/cdrom/gscd.c
index b6ee50a2916d..fa7082489765 100644
--- a/drivers/cdrom/gscd.c
+++ b/drivers/cdrom/gscd.c
@@ -266,7 +266,7 @@ repeat:
                 goto out;
 
         if (req->cmd != READ) {
-                printk("GSCD: bad cmd %lu\n", rq_data_dir(req));
+                printk("GSCD: bad cmd %u\n", rq_data_dir(req));
                 end_request(req, 0);
                 goto repeat;
         }
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index ffcf15c30e90..d9c5a9142ad1 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -1059,7 +1059,7 @@ ioctl_out:
         return ret_val;
 }
 
-static struct file_operations agp_fops =
+static const struct file_operations agp_fops =
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index bcc4668835b5..10a389dafd60 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -112,7 +112,7 @@ static int ac_ioctl(struct inode *, struct file *, unsigned int,
                     unsigned long);
 static irqreturn_t ac_interrupt(int, void *, struct pt_regs *);
 
-static struct file_operations ac_fops = {
+static const struct file_operations ac_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .read = ac_read,
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 46d66037b917..8ce3f34cfc22 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -158,7 +158,7 @@ static int cs5535_gpio_open(struct inode *inode, struct file *file)
         return nonseekable_open(inode, file);
 }
 
-static struct file_operations cs5535_gpio_fops = {
+static const struct file_operations cs5535_gpio_fops = {
         .owner  = THIS_MODULE,
         .write  = cs5535_gpio_write,
         .read   = cs5535_gpio_read,
diff --git a/drivers/char/drm/radeon_state.c b/drivers/char/drm/radeon_state.c
index 5bb2234a9094..39a7f685e3fd 100644
--- a/drivers/char/drm/radeon_state.c
+++ b/drivers/char/drm/radeon_state.c
@@ -175,6 +175,14 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
                 }
                 break;
 
+        case R200_EMIT_VAP_CTL:{
+                        RING_LOCALS;
+                        BEGIN_RING(2);
+                        OUT_RING_REG(RADEON_SE_TCL_STATE_FLUSH, 0);
+                        ADVANCE_RING();
+                }
+                break;
+
         case RADEON_EMIT_RB3D_COLORPITCH:
         case RADEON_EMIT_RE_LINE_PATTERN:
         case RADEON_EMIT_SE_LINE_WIDTH:
@@ -202,7 +210,6 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
         case R200_EMIT_TCL_LIGHT_MODEL_CTL_0:
         case R200_EMIT_TFACTOR_0:
         case R200_EMIT_VTX_FMT_0:
-        case R200_EMIT_VAP_CTL:
         case R200_EMIT_MATRIX_SELECT_0:
         case R200_EMIT_TEX_PROC_CTL_2:
         case R200_EMIT_TCL_UCP_VERT_BLEND_CTL:
diff --git a/drivers/char/ds1286.c b/drivers/char/ds1286.c
index d755cac14bc1..21c8229f5443 100644
--- a/drivers/char/ds1286.c
+++ b/drivers/char/ds1286.c
@@ -281,7 +281,7 @@ static unsigned int ds1286_poll(struct file *file, poll_table *wait)
  *      The various file operations we support.
  */
 
-static struct file_operations ds1286_fops = {
+static const struct file_operations ds1286_fops = {
         .llseek         = no_llseek,
         .read           = ds1286_read,
         .poll           = ds1286_poll,
diff --git a/drivers/char/ds1302.c b/drivers/char/ds1302.c
index 625e8b517005..bcdb107aa967 100644
--- a/drivers/char/ds1302.c
+++ b/drivers/char/ds1302.c
@@ -282,7 +282,7 @@ get_rtc_status(char *buf)
 
 /* The various file operations we support. */
 
-static struct file_operations rtc_fops = {
+static const struct file_operations rtc_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = rtc_ioctl,
 };
diff --git a/drivers/char/ds1620.c b/drivers/char/ds1620.c
index 953e670dcd09..48cb8f0e8ebf 100644
--- a/drivers/char/ds1620.c
+++ b/drivers/char/ds1620.c
@@ -336,7 +336,7 @@ proc_therm_ds1620_read(char *buf, char **start, off_t offset,
 static struct proc_dir_entry *proc_therm_ds1620;
 #endif
 
-static struct file_operations ds1620_fops = {
+static const struct file_operations ds1620_fops = {
         .owner          = THIS_MODULE,
         .open           = nonseekable_open,
         .read           = ds1620_read,
diff --git a/drivers/char/dsp56k.c b/drivers/char/dsp56k.c
index 09b413618b57..9b1bf60ffbe7 100644
--- a/drivers/char/dsp56k.c
+++ b/drivers/char/dsp56k.c
@@ -483,7 +483,7 @@ static int dsp56k_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations dsp56k_fops = {
+static const struct file_operations dsp56k_fops = {
         .owner          = THIS_MODULE,
         .read           = dsp56k_read,
         .write          = dsp56k_write,
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index da2c89f1b8bc..5e82c3bad2e3 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -94,7 +94,7 @@ static int dtlk_release(struct inode *, struct file *);
 static int dtlk_ioctl(struct inode *inode, struct file *file,
                       unsigned int cmd, unsigned long arg);
 
-static struct file_operations dtlk_fops =
+static const struct file_operations dtlk_fops =
 {
         .owner          = THIS_MODULE,
         .read           = dtlk_read,
diff --git a/drivers/char/efirtc.c b/drivers/char/efirtc.c
index 0090e7a4fcd3..004141d535a2 100644
--- a/drivers/char/efirtc.c
+++ b/drivers/char/efirtc.c
@@ -285,7 +285,7 @@ efi_rtc_close(struct inode *inode, struct file *file)
  *      The various file operations we support.
  */
 
-static struct file_operations efi_rtc_fops = {
+static const struct file_operations efi_rtc_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = efi_rtc_ioctl,
         .open           = efi_rtc_open,
diff --git a/drivers/char/ftape/zftape/zftape-init.c b/drivers/char/ftape/zftape/zftape-init.c
index 55272566b740..164a1aa77a2f 100644
--- a/drivers/char/ftape/zftape/zftape-init.c
+++ b/drivers/char/ftape/zftape/zftape-init.c
@@ -86,7 +86,7 @@ static ssize_t zft_read (struct file *fp, char __user *buff,
 static ssize_t zft_write(struct file *fp, const char __user *buff,
                          size_t req_len, loff_t *ppos);
 
-static struct file_operations zft_cdev =
+static const struct file_operations zft_cdev =
 {
         .owner          = THIS_MODULE,
         .read           = zft_read,
diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
index bebd7e34f792..817dc409ac20 100644
--- a/drivers/char/genrtc.c
+++ b/drivers/char/genrtc.c
@@ -482,7 +482,7 @@ static inline int gen_rtc_proc_init(void) { return 0; }
  *      The various file operations we support.
  */
 
-static struct file_operations gen_rtc_fops = {
+static const struct file_operations gen_rtc_fops = {
         .owner          = THIS_MODULE,
 #ifdef CONFIG_GEN_RTC_X
         .read           = gen_rtc_read,
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index e5643f3aa73f..8afba339f05a 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -553,7 +553,7 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
         return err;
 }
 
-static struct file_operations hpet_fops = {
+static const struct file_operations hpet_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .read = hpet_read,
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index ca2f538e549e..613d67f1c7f0 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -668,6 +668,7 @@ int khvcd(void *unused)
         do {
                 poll_mask = 0;
                 hvc_kicked = 0;
+                try_to_freeze();
                 wmb();
                 if (cpus_empty(cpus_in_xmon)) {
                         spin_lock(&hvc_structs_lock);
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index 8dc205b275e3..017f755632a3 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -311,7 +311,8 @@ static void hvsi_recv_control(struct hvsi_struct *hp, uint8_t *packet,
                                 /* CD went away; no more connection */
                                 pr_debug("hvsi%i: CD dropped\n", hp->index);
                                 hp->mctrl &= TIOCM_CD;
-                                if (!(hp->tty->flags & CLOCAL))
+                                /* If userland hasn't done an open(2) yet, hp->tty is NULL. */
+                                if (hp->tty && !(hp->tty->flags & CLOCAL))
                                         *to_hangup = hp->tty;
                         }
                         break;
@@ -986,10 +987,7 @@ static void hvsi_write_worker(void *arg)
                 start_j = 0;
 #endif /* DEBUG */
                 wake_up_all(&hp->emptyq);
-                if (test_bit(TTY_DO_WRITE_WAKEUP, &hp->tty->flags)
-                                && hp->tty->ldisc.write_wakeup)
-                        hp->tty->ldisc.write_wakeup(hp->tty);
-                wake_up_interruptible(&hp->tty->write_wait);
+                tty_wakeup(hp->tty);
         }
 
 out:
@@ -1299,13 +1297,12 @@ static int __init hvsi_console_init(void)
                 hp->inbuf_end = hp->inbuf;
                 hp->state = HVSI_CLOSED;
                 hp->vtermno = *vtermno;
-                hp->virq = virt_irq_create_mapping(irq[0]);
+                hp->virq = irq_create_mapping(NULL, irq[0]);
                 if (hp->virq == NO_IRQ) {
                         printk(KERN_ERR "%s: couldn't create irq mapping for 0x%x\n",
-                                __FUNCTION__, hp->virq);
+                                __FUNCTION__, irq[0]);
                         continue;
-                } else
-                        hp->virq = irq_offset_up(hp->virq);
+                }
 
                 hvsi_count++;
         }
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 88b026639f10..154a81d328c1 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -149,7 +149,7 @@ out:
 }
 
 
-static struct file_operations rng_chrdev_ops = {
+static const struct file_operations rng_chrdev_ops = {
         .owner          = THIS_MODULE,
         .open           = rng_dev_open,
         .read           = rng_dev_read,
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index be61f22ee7bb..d37ced0d132b 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -107,10 +107,14 @@ found:
         if (err) {
                 printk(KERN_ERR PFX "RNG registering failed (%d)\n",
                        err);
-                goto out;
+                goto err_unmap;
         }
 out:
         return err;
+
+err_unmap:
+        iounmap(mem);
+        goto out;
 }
 
 static void __exit mod_exit(void)
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 6594bd5645f4..ccd7e7102234 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -164,7 +164,7 @@ static int __init mod_init(void)
         if (err) {
                 printk(KERN_ERR PFX "RNG registering failed (%d)\n",
                        err);
-                goto out;
+                goto err_unmap;
         }
 out:
         return err;
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 819516b35a79..a01d796d1eeb 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -25,12 +25,12 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/random.h>
+#include <linux/clk.h>
 #include <linux/err.h>
-#include <linux/device.h>
+#include <linux/platform_device.h>
 #include <linux/hw_random.h>
 
 #include <asm/io.h>
-#include <asm/hardware/clock.h>
 
 #define RNG_OUT_REG             0x00            /* Output register */
 #define RNG_STAT_REG            0x04            /* Status register
@@ -52,7 +52,7 @@
 
 static void __iomem *rng_base;
 static struct clk *rng_ick;
-static struct device *rng_dev;
+static struct platform_device *rng_dev;
 
 static u32 omap_rng_read_reg(int reg)
 {
@@ -83,9 +83,8 @@ static struct hwrng omap_rng_ops = {
         .data_read      = omap_rng_data_read,
 };
 
-static int __init omap_rng_probe(struct device *dev)
+static int __init omap_rng_probe(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
         struct resource *res, *mem;
         int ret;
 
@@ -95,16 +94,14 @@ static int __init omap_rng_probe(struct device *dev)
          */
         BUG_ON(rng_dev);
 
-        if (cpu_is_omap24xx()) {
+        if (cpu_is_omap24xx()) {
                 rng_ick = clk_get(NULL, "rng_ick");
                 if (IS_ERR(rng_ick)) {
-                        dev_err(dev, "Could not get rng_ick\n");
+                        dev_err(&pdev->dev, "Could not get rng_ick\n");
                         ret = PTR_ERR(rng_ick);
                         return ret;
-                }
-                else {
-                        clk_use(rng_ick);
-                }
+                } else
+                        clk_enable(rng_ick);
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -117,7 +114,7 @@ static int __init omap_rng_probe(struct device *dev)
         if (mem == NULL)
                 return -EBUSY;
 
-        dev_set_drvdata(dev, mem);
+        dev_set_drvdata(&pdev->dev, mem);
         rng_base = (u32 __iomem *)io_p2v(res->start);
 
         ret = hwrng_register(&omap_rng_ops);
@@ -127,25 +124,25 @@ static int __init omap_rng_probe(struct device *dev)
                 return ret;
         }
 
-        dev_info(dev, "OMAP Random Number Generator ver. %02x\n",
+        dev_info(&pdev->dev, "OMAP Random Number Generator ver. %02x\n",
                 omap_rng_read_reg(RNG_REV_REG));
         omap_rng_write_reg(RNG_MASK_REG, 0x1);
 
-        rng_dev = dev;
+        rng_dev = pdev;
 
         return 0;
 }
 
-static int __exit omap_rng_remove(struct device *dev)
+static int __exit omap_rng_remove(struct platform_device *pdev)
 {
-        struct resource *mem = dev_get_drvdata(dev);
+        struct resource *mem = dev_get_drvdata(&pdev->dev);
 
         hwrng_unregister(&omap_rng_ops);
 
         omap_rng_write_reg(RNG_MASK_REG, 0x0);
 
         if (cpu_is_omap24xx()) {
-                clk_unuse(rng_ick);
+                clk_disable(rng_ick);
                 clk_put(rng_ick);
         }
 
@@ -157,18 +154,16 @@ static int __exit omap_rng_remove(struct device *dev)
 
 #ifdef CONFIG_PM
 
-static int omap_rng_suspend(struct device *dev, pm_message_t message, u32 level)
+static int omap_rng_suspend(struct platform_device *pdev, pm_message_t message)
 {
         omap_rng_write_reg(RNG_MASK_REG, 0x0);
-
         return 0;
 }
 
-static int omap_rng_resume(struct device *dev, pm_message_t message, u32 level)
+static int omap_rng_resume(struct platform_device *pdev)
 {
         omap_rng_write_reg(RNG_MASK_REG, 0x1);
-
-        return 1;
+        return 0;
 }
 
 #else
@@ -179,9 +174,11 @@ static int omap_rng_resume(struct device *dev, pm_message_t message, u32 level)
 #endif
 
 
-static struct device_driver omap_rng_driver = {
-        .name           = "omap_rng",
-        .bus            = &platform_bus_type,
+static struct platform_driver omap_rng_driver = {
+        .driver = {
+                .name           = "omap_rng",
+                .owner          = THIS_MODULE,
+        },
         .probe          = omap_rng_probe,
         .remove         = __exit_p(omap_rng_remove),
         .suspend        = omap_rng_suspend,
@@ -193,12 +190,12 @@ static int __init omap_rng_init(void)
         if (!cpu_is_omap16xx() && !cpu_is_omap24xx())
                 return -ENODEV;
 
-        return driver_register(&omap_rng_driver);
+        return platform_driver_register(&omap_rng_driver);
 }
 
 static void __exit omap_rng_exit(void)
 {
-        driver_unregister(&omap_rng_driver);
+        platform_driver_unregister(&omap_rng_driver);
 }
 
 module_init(omap_rng_init);
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index f3c3aaf4560e..353d9f3cf8d7 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -80,7 +80,7 @@ static int i8k_open_fs(struct inode *inode, struct file *file);
 static int i8k_ioctl(struct inode *, struct file *, unsigned int,
                      unsigned long);
 
-static struct file_operations i8k_fops = {
+static const struct file_operations i8k_fops = {
         .open           = i8k_open_fs,
         .read           = seq_read,
         .llseek         = seq_lseek,
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index a4200a2b0811..7907ae88c2f4 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -233,7 +233,7 @@ static void  *DevTableMem[IP2_MAX_BOARDS];
 /* This is the driver descriptor for the ip2ipl device, which is used to
  * download the loadware to the boards.
  */
-static struct file_operations ip2_ipl = {
+static const struct file_operations ip2_ipl = {
         .owner          = THIS_MODULE,
         .read           = ip2_ipl_read,
         .write          = ip2_ipl_write,
@@ -3186,3 +3186,10 @@ ip2trace (unsigned short pn, unsigned char cat, unsigned char label, unsigned lo
 
 
 MODULE_LICENSE("GPL");
+
+static struct pci_device_id ip2main_pci_tbl[] __devinitdata = {
+        { PCI_DEVICE(PCI_VENDOR_ID_COMPUTONE, PCI_DEVICE_ID_COMPUTONE_IP2EX) },
+        { }
+};
+
+MODULE_DEVICE_TABLE(pci, ip2main_pci_tbl);
diff --git a/drivers/char/ip27-rtc.c b/drivers/char/ip27-rtc.c
index 3acdac3c967e..a48da02aad2f 100644
--- a/drivers/char/ip27-rtc.c
+++ b/drivers/char/ip27-rtc.c
@@ -196,7 +196,7 @@ static int rtc_release(struct inode *inode, struct file *file)
  *      The various file operations we support.
  */
 
-static struct file_operations rtc_fops = {
+static const struct file_operations rtc_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = rtc_ioctl,
         .open           = rtc_open,
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 2fc894fef1cb..68d7c61a864e 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -765,7 +765,7 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
 }
 #endif
 
-static struct file_operations ipmi_fops = {
+static const struct file_operations ipmi_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = ipmi_ioctl,
 #ifdef CONFIG_COMPAT
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0aa5d608fe6f..843d34c8627c 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3428,6 +3428,7 @@ struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
 
         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
         if (rv) {
+                rv->user = NULL;
                 rv->done = free_recv_msg;
                 atomic_inc(&recv_msg_inuse_count);
         }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index f57eba0bf253..abca98beac14 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -402,10 +402,10 @@ static void handle_flags(struct smi_info *smi_info)
                         smi_info->curr_msg->data,
                         smi_info->curr_msg->data_size);
                 smi_info->si_state = SI_GETTING_EVENTS;
-        } else if (smi_info->msg_flags & OEM_DATA_AVAIL) {
-                if (smi_info->oem_data_avail_handler)
-                        if (smi_info->oem_data_avail_handler(smi_info))
-                                goto retry;
+        } else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
+                   smi_info->oem_data_avail_handler) {
+                if (smi_info->oem_data_avail_handler(smi_info))
+                        goto retry;
         } else {
                 smi_info->si_state = SI_NORMAL;
         }
@@ -2481,6 +2481,7 @@ static __devinit int init_ipmi_si(void)
 #ifdef CONFIG_PCI
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
+                driver_unregister(&ipmi_driver);
                 printk("ipmi_si: Unable to find any System Interface(s)\n");
                 return -ENODEV;
         } else {
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 74a889c58333..accaaf1a6b69 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -807,7 +807,7 @@ static int ipmi_close(struct inode *ino, struct file *filep)
         return 0;
 }
 
-static struct file_operations ipmi_wdog_fops = {
+static const struct file_operations ipmi_wdog_fops = {
         .owner   = THIS_MODULE,
         .read    = ipmi_read,
         .poll    = ipmi_poll,
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index fbce2f0669d6..84dfc4278139 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -748,7 +748,7 @@ static int	stli_initpcibrd(int brdtype, struct pci_dev *devp);
  *      will give access to the shared memory on the Stallion intelligent
  *      board. This is also a very useful debugging tool.
  */
-static struct file_operations   stli_fsiomem = {
+static const struct file_operations     stli_fsiomem = {
         .owner          = THIS_MODULE,
         .read           = stli_memread,
         .write          = stli_memwrite,
diff --git a/drivers/char/ite_gpio.c b/drivers/char/ite_gpio.c
index 747ba45e50e5..cde562d70c4f 100644
--- a/drivers/char/ite_gpio.c
+++ b/drivers/char/ite_gpio.c
@@ -357,7 +357,7 @@ DEB(printk("interrupt 0x%x %d\n",ITE_GPAISR, i));
         }
 }
 
-static struct file_operations ite_gpio_fops = {
+static const struct file_operations ite_gpio_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = ite_gpio_ioctl,
         .open           = ite_gpio_open,
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 056ebe84b81d..3e90aac37510 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -107,7 +107,6 @@ const int NR_TYPES = ARRAY_SIZE(max_vals);
 
 struct kbd_struct kbd_table[MAX_NR_CONSOLES];
 static struct kbd_struct *kbd = kbd_table;
-static struct kbd_struct kbd0;
 
 int spawnpid, spawnsig;
 
@@ -223,13 +222,13 @@ static void kd_nosound(unsigned long ignored)
 {
         struct list_head *node;
 
-        list_for_each(node,&kbd_handler.h_list) {
+        list_for_each(node, &kbd_handler.h_list) {
                 struct input_handle *handle = to_handle_h(node);
                 if (test_bit(EV_SND, handle->dev->evbit)) {
                         if (test_bit(SND_TONE, handle->dev->sndbit))
-                                input_event(handle->dev, EV_SND, SND_TONE, 0);
+                                input_inject_event(handle, EV_SND, SND_TONE, 0);
                         if (test_bit(SND_BELL, handle->dev->sndbit))
-                                input_event(handle->dev, EV_SND, SND_BELL, 0);
+                                input_inject_event(handle, EV_SND, SND_BELL, 0);
                 }
         }
 }
@@ -247,11 +246,11 @@ void kd_mksound(unsigned int hz, unsigned int ticks)
                         struct input_handle *handle = to_handle_h(node);
                         if (test_bit(EV_SND, handle->dev->evbit)) {
                                 if (test_bit(SND_TONE, handle->dev->sndbit)) {
-                                        input_event(handle->dev, EV_SND, SND_TONE, hz);
+                                        input_inject_event(handle, EV_SND, SND_TONE, hz);
                                         break;
                                 }
                                 if (test_bit(SND_BELL, handle->dev->sndbit)) {
-                                        input_event(handle->dev, EV_SND, SND_BELL, 1);
+                                        input_inject_event(handle, EV_SND, SND_BELL, 1);
                                         break;
                                 }
                         }
@@ -272,15 +271,15 @@ int kbd_rate(struct kbd_repeat *rep)
         unsigned int d = 0;
         unsigned int p = 0;
 
-        list_for_each(node,&kbd_handler.h_list) {
+        list_for_each(node, &kbd_handler.h_list) {
                 struct input_handle *handle = to_handle_h(node);
                 struct input_dev *dev = handle->dev;
 
                 if (test_bit(EV_REP, dev->evbit)) {
                         if (rep->delay > 0)
-                                input_event(dev, EV_REP, REP_DELAY, rep->delay);
+                                input_inject_event(handle, EV_REP, REP_DELAY, rep->delay);
                         if (rep->period > 0)
-                                input_event(dev, EV_REP, REP_PERIOD, rep->period);
+                                input_inject_event(handle, EV_REP, REP_PERIOD, rep->period);
                         d = dev->rep[REP_DELAY];
                         p = dev->rep[REP_PERIOD];
                 }
@@ -988,7 +987,7 @@ static inline unsigned char getleds(void)
  * interrupt routines for this thing allows us to easily mask
  * this when we don't want any of the above to happen.
  * This allows for easy and efficient race-condition prevention
- * for kbd_refresh_leds => input_event(dev, EV_LED, ...) => ...
+ * for kbd_start => input_inject_event(dev, EV_LED, ...) => ...
  */
 
 static void kbd_bh(unsigned long dummy)
@@ -998,11 +997,11 @@ static void kbd_bh(unsigned long dummy)
 
         if (leds != ledstate) {
                 list_for_each(node, &kbd_handler.h_list) {
-                        struct input_handle * handle = to_handle_h(node);
-                        input_event(handle->dev, EV_LED, LED_SCROLLL, !!(leds & 0x01));
-                        input_event(handle->dev, EV_LED, LED_NUML,    !!(leds & 0x02));
-                        input_event(handle->dev, EV_LED, LED_CAPSL,   !!(leds & 0x04));
-                        input_sync(handle->dev);
+                        struct input_handle *handle = to_handle_h(node);
+                        input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
+                        input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
+                        input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
+                        input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
                 }
         }
 
@@ -1011,23 +1010,6 @@ static void kbd_bh(unsigned long dummy)
 
 DECLARE_TASKLET_DISABLED(keyboard_tasklet, kbd_bh, 0);
 
-/*
- * This allows a newly plugged keyboard to pick the LED state.
- */
-static void kbd_refresh_leds(struct input_handle *handle)
-{
-        unsigned char leds = ledstate;
-
-        tasklet_disable(&keyboard_tasklet);
-        if (leds != 0xff) {
-                input_event(handle->dev, EV_LED, LED_SCROLLL, !!(leds & 0x01));
-                input_event(handle->dev, EV_LED, LED_NUML,    !!(leds & 0x02));
-                input_event(handle->dev, EV_LED, LED_CAPSL,   !!(leds & 0x04));
-                input_sync(handle->dev);
-        }
-        tasklet_enable(&keyboard_tasklet);
-}
-
 #if defined(CONFIG_X86) || defined(CONFIG_IA64) || defined(CONFIG_ALPHA) ||\
     defined(CONFIG_MIPS) || defined(CONFIG_PPC) || defined(CONFIG_SPARC) ||\
     defined(CONFIG_PARISC) || defined(CONFIG_SUPERH) ||\
@@ -1043,7 +1025,7 @@ static const unsigned short x86_keycodes[256] =
          48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63,
          64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79,
          80, 81, 82, 83, 84,118, 86, 87, 88,115,120,119,121,112,123, 92,
-        284,285,309,298,312, 91,327,328,329,331,333,335,336,337,338,339,
+        284,285,309,  0,312, 91,327,328,329,331,333,335,336,337,338,339,
         367,288,302,304,350, 89,334,326,267,126,268,269,125,347,348,349,
         360,261,262,263,268,376,100,101,321,316,373,286,289,102,351,355,
         103,104,105,275,287,279,306,106,274,107,294,364,358,363,362,361,
@@ -1065,38 +1047,55 @@ extern void sun_do_break(void);
 static int emulate_raw(struct vc_data *vc, unsigned int keycode,
                        unsigned char up_flag)
 {
-        if (keycode > 255 || !x86_keycodes[keycode])
-                return -1;
+        int code;
 
         switch (keycode) {
                 case KEY_PAUSE:
                         put_queue(vc, 0xe1);
                         put_queue(vc, 0x1d | up_flag);
                         put_queue(vc, 0x45 | up_flag);
-                        return 0;
+                        break;
+
                 case KEY_HANGEUL:
                         if (!up_flag)
                                 put_queue(vc, 0xf2);
-                        return 0;
+                        break;
+
                 case KEY_HANJA:
                         if (!up_flag)
                                 put_queue(vc, 0xf1);
-                        return 0;
-        }
+                        break;
 
-        if (keycode == KEY_SYSRQ && sysrq_alt) {
-                put_queue(vc, 0x54 | up_flag);
-                return 0;
-        }
+                case KEY_SYSRQ:
+                        /*
+                         * Real AT keyboards (that's what we're trying
+                         * to emulate here emit 0xe0 0x2a 0xe0 0x37 when
+                         * pressing PrtSc/SysRq alone, but simply 0x54
+                         * when pressing Alt+PrtSc/SysRq.
+                         */
+                        if (sysrq_alt) {
+                                put_queue(vc, 0x54 | up_flag);
+                        } else {
+                                put_queue(vc, 0xe0);
+                                put_queue(vc, 0x2a | up_flag);
+                                put_queue(vc, 0xe0);
+                                put_queue(vc, 0x37 | up_flag);
+                        }
+                        break;
+
+                default:
+                        if (keycode > 255)
+                                return -1;
 
-        if (x86_keycodes[keycode] & 0x100)
-                put_queue(vc, 0xe0);
+                        code = x86_keycodes[keycode];
+                        if (!code)
+                                return -1;
 
-        put_queue(vc, (x86_keycodes[keycode] & 0x7f) | up_flag);
+                        if (code & 0x100)
+                                put_queue(vc, 0xe0);
+                        put_queue(vc, (code & 0x7f) | up_flag);
 
-        if (keycode == KEY_SYSRQ) {
-                put_queue(vc, 0xe0);
-                put_queue(vc, 0x37 | up_flag);
+                        break;
         }
 
         return 0;
@@ -1298,16 +1297,15 @@ static struct input_handle *kbd_connect(struct input_handler *handler,
         if (i == BTN_MISC && !test_bit(EV_SND, dev->evbit))
                 return NULL;
 
-        if (!(handle = kmalloc(sizeof(struct input_handle), GFP_KERNEL)))
+        handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
+        if (!handle)
                 return NULL;
-        memset(handle, 0, sizeof(struct input_handle));
 
         handle->dev = dev;
         handle->handler = handler;
         handle->name = "kbd";
 
         input_open_device(handle);
-        kbd_refresh_leds(handle);
 
         return handle;
 }
@@ -1318,6 +1316,24 @@ static void kbd_disconnect(struct input_handle *handle)
         kfree(handle);
 }
 
+/*
+ * Start keyboard handler on the new keyboard by refreshing LED state to
+ * match the rest of the system.
+ */
+static void kbd_start(struct input_handle *handle)
+{
+        unsigned char leds = ledstate;
+
+        tasklet_disable(&keyboard_tasklet);
+        if (leds != 0xff) {
+                input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
+                input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
+                input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
+                input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
+        }
+        tasklet_enable(&keyboard_tasklet);
+}
+
 static struct input_device_id kbd_ids[] = {
         {
                 .flags = INPUT_DEVICE_ID_MATCH_EVBIT,
@@ -1338,6 +1354,7 @@ static struct input_handler kbd_handler = {
         .event          = kbd_event,
         .connect        = kbd_connect,
         .disconnect     = kbd_disconnect,
+        .start          = kbd_start,
         .name           = "kbd",
         .id_table       = kbd_ids,
 };
@@ -1346,15 +1363,15 @@ int __init kbd_init(void)
 {
         int i;
 
-        kbd0.ledflagstate = kbd0.default_ledflagstate = KBD_DEFLEDS;
-        kbd0.ledmode = LED_SHOW_FLAGS;
-        kbd0.lockstate = KBD_DEFLOCK;
-        kbd0.slockstate = 0;
-        kbd0.modeflags = KBD_DEFMODE;
-        kbd0.kbdmode = VC_XLATE;
-
-        for (i = 0 ; i < MAX_NR_CONSOLES ; i++)
-                kbd_table[i] = kbd0;
+        for (i = 0; i < MAX_NR_CONSOLES; i++) {
+                kbd_table[i].ledflagstate = KBD_DEFLEDS;
+                kbd_table[i].default_ledflagstate = KBD_DEFLEDS;
+                kbd_table[i].ledmode = LED_SHOW_FLAGS;
+                kbd_table[i].lockstate = KBD_DEFLOCK;
+                kbd_table[i].slockstate = 0;
+                kbd_table[i].modeflags = KBD_DEFMODE;
+                kbd_table[i].kbdmode = VC_XLATE;
+        }
 
         input_register_handler(&kbd_handler);
 
diff --git a/drivers/char/lcd.c b/drivers/char/lcd.c
index 7d49b241de56..da601fd6c07a 100644
--- a/drivers/char/lcd.c
+++ b/drivers/char/lcd.c
@@ -598,7 +598,7 @@ static ssize_t lcd_read(struct file *file, char *buf,
  *      The various file operations we support.
  */
 
-static struct file_operations lcd_fops = {
+static const struct file_operations lcd_fops = {
         .read = lcd_read,
         .ioctl = lcd_ioctl,
         .open = lcd_open,
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 582cdbdb0c42..f875fda3b089 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -666,7 +666,7 @@ static int lp_ioctl(struct inode *inode, struct file *file,
         return retval;
 }
 
-static struct file_operations lp_fops = {
+static const struct file_operations lp_fops = {
         .owner          = THIS_MODULE,
         .write          = lp_write,
         .ioctl          = lp_ioctl,
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 70f3954d6dfd..917b20402664 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -95,7 +95,7 @@ static inline int valid_phys_addr_range(unsigned long addr, size_t count)
         return 1;
 }
 
-static inline int valid_mmap_phys_addr_range(unsigned long addr, size_t size)
+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
 {
         return 1;
 }
@@ -242,7 +242,7 @@ static int mmap_mem(struct file * file, struct vm_area_struct * vma)
 {
         size_t size = vma->vm_end - vma->vm_start;
 
-        if (!valid_mmap_phys_addr_range(vma->vm_pgoff << PAGE_SHIFT, size))
+        if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
                 return -EINVAL;
 
         vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
@@ -776,7 +776,7 @@ static int open_port(struct inode * inode, struct file * filp)
 #define open_kmem       open_mem
 #define open_oldmem     open_mem
 
-static struct file_operations mem_fops = {
+static const struct file_operations mem_fops = {
         .llseek         = memory_lseek,
         .read           = read_mem,
         .write          = write_mem,
@@ -784,7 +784,7 @@ static struct file_operations mem_fops = {
         .open           = open_mem,
 };
 
-static struct file_operations kmem_fops = {
+static const struct file_operations kmem_fops = {
         .llseek         = memory_lseek,
         .read           = read_kmem,
         .write          = write_kmem,
@@ -792,7 +792,7 @@ static struct file_operations kmem_fops = {
         .open           = open_kmem,
 };
 
-static struct file_operations null_fops = {
+static const struct file_operations null_fops = {
         .llseek         = null_lseek,
         .read           = read_null,
         .write          = write_null,
@@ -800,7 +800,7 @@ static struct file_operations null_fops = {
 };
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
-static struct file_operations port_fops = {
+static const struct file_operations port_fops = {
         .llseek         = memory_lseek,
         .read           = read_port,
         .write          = write_port,
@@ -808,7 +808,7 @@ static struct file_operations port_fops = {
 };
 #endif
 
-static struct file_operations zero_fops = {
+static const struct file_operations zero_fops = {
         .llseek         = zero_lseek,
         .read           = read_zero,
         .write          = write_zero,
@@ -819,14 +819,14 @@ static struct backing_dev_info zero_bdi = {
         .capabilities   = BDI_CAP_MAP_COPY,
 };
 
-static struct file_operations full_fops = {
+static const struct file_operations full_fops = {
         .llseek         = full_lseek,
         .read           = read_full,
         .write          = write_full,
 };
 
 #ifdef CONFIG_CRASH_DUMP
-static struct file_operations oldmem_fops = {
+static const struct file_operations oldmem_fops = {
         .read   = read_oldmem,
         .open   = open_oldmem,
 };
@@ -853,7 +853,7 @@ static ssize_t kmsg_write(struct file * file, const char __user * buf,
         return ret;
 }
 
-static struct file_operations kmsg_fops = {
+static const struct file_operations kmsg_fops = {
         .write =        kmsg_write,
 };
 
@@ -903,7 +903,7 @@ static int memory_open(struct inode * inode, struct file * filp)
         return 0;
 }
 
-static struct file_operations memory_fops = {
+static const struct file_operations memory_fops = {
         .open           = memory_open,  /* just a selector for the real open */
 };
 
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index d5fa19da330b..62ebe09656e3 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -113,7 +113,7 @@ static int misc_seq_open(struct inode *inode, struct file *file)
         return seq_open(file, &misc_seq_ops);
 }
 
-static struct file_operations misc_proc_fops = {
+static const struct file_operations misc_proc_fops = {
         .owner   = THIS_MODULE,
         .open    = misc_seq_open,
         .read    = seq_read,
@@ -176,7 +176,7 @@ fail:
  */
 static struct class *misc_class;
 
-static struct file_operations misc_fops = {
+static const struct file_operations misc_fops = {
         .owner          = THIS_MODULE,
         .open           = misc_open,
 };
diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
index 70b774ff5aa4..1f0f2b6dae26 100644
--- a/drivers/char/mmtimer.c
+++ b/drivers/char/mmtimer.c
@@ -63,7 +63,7 @@ static int mmtimer_mmap(struct file *file, struct vm_area_struct *vma);
  */
 static unsigned long mmtimer_femtoperiod = 0;
 
-static struct file_operations mmtimer_fops = {
+static const struct file_operations mmtimer_fops = {
         .owner =        THIS_MODULE,
         .mmap =         mmtimer_mmap,
         .ioctl =        mmtimer_ioctl,
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 4ea7bd5f4f56..a369dd6877d8 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -142,6 +142,7 @@ typedef struct _moxa_board_conf {
 
 static moxa_board_conf moxa_boards[MAX_BOARDS];
 static void __iomem *moxaBaseAddr[MAX_BOARDS];
+static int loadstat[MAX_BOARDS];
 
 struct moxa_str {
         int type;
@@ -1688,6 +1689,8 @@ int MoxaDriverPoll(void)
         if (moxaCard == 0)
                 return (-1);
         for (card = 0; card < MAX_BOARDS; card++) {
+                if (loadstat[card] == 0)
+                        continue;
                 if ((ports = moxa_boards[card].numPorts) == 0)
                         continue;
                 if (readb(moxaIntPend[card]) == 0xff) {
@@ -2903,6 +2906,7 @@ static int moxaloadcode(int cardno, unsigned char __user *tmp, int len)
                 }
                 break;
         }
+        loadstat[cardno] = 1;
         return (0);
 }
 
@@ -2920,7 +2924,7 @@ static int moxaloadc218(int cardno, void __iomem *baseAddr, int len)
         len1 = len >> 1;
         ptr = (ushort *) moxaBuff;
         for (i = 0; i < len1; i++)
-                usum += *(ptr + i);
+                usum += le16_to_cpu(*(ptr + i));
         retry = 0;
         do {
                 len1 = len >> 1;
@@ -2992,7 +2996,7 @@ static int moxaloadc320(int cardno, void __iomem *baseAddr, int len, int *numPor
         wlen = len >> 1;
         uptr = (ushort *) moxaBuff;
         for (i = 0; i < wlen; i++)
-                usum += uptr[i];
+                usum += le16_to_cpu(uptr[i]);
         retry = 0;
         j = 0;
         do {
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index d3ba2f860ef0..39a2e661ff55 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -454,7 +454,7 @@ static int register_serial_portandirq(unsigned int port, int irq)
 }
 
 
-static struct file_operations mwave_fops = {
+static const struct file_operations mwave_fops = {
         .owner          = THIS_MODULE,
         .read           = mwave_read,
         .write          = mwave_write,
diff --git a/drivers/char/nsc_gpio.c b/drivers/char/nsc_gpio.c
index 5b91e4e25641..7719bd75810b 100644
--- a/drivers/char/nsc_gpio.c
+++ b/drivers/char/nsc_gpio.c
@@ -68,13 +68,11 @@ ssize_t nsc_gpio_write(struct file *file, const char __user *data,
                         amp->gpio_config(m, ~1, 0);
                         break;
                 case 'T':
-                        dev_dbg(dev, "GPIO%d output is push pull\n",
-                               m);
+                        dev_dbg(dev, "GPIO%d output is push pull\n", m);
                         amp->gpio_config(m, ~2, 2);
                         break;
                 case 't':
-                        dev_dbg(dev, "GPIO%d output is open drain\n",
-                               m);
+                        dev_dbg(dev, "GPIO%d output is open drain\n", m);
                         amp->gpio_config(m, ~2, 0);
                         break;
                 case 'P':
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index 8c5f102622b6..a39f19c35a6a 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -437,7 +437,7 @@ nvram_read_proc(char *buffer, char **start, off_t offset,
 
 #endif /* CONFIG_PROC_FS */
 
-static struct file_operations nvram_fops = {
+static const struct file_operations nvram_fops = {
         .owner          = THIS_MODULE,
         .llseek         = nvram_llseek,
         .read           = nvram_read,
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index f240a104d250..7c57ebfa8640 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -183,7 +183,7 @@ static int button_read (struct file *filp, char __user *buffer,
  * attempts to perform these operations on the device.
  */
 
-static struct file_operations button_fops = {
+static const struct file_operations button_fops = {
         .owner          = THIS_MODULE,
         .read           = button_read,
 };
diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index 8865387d3448..206cf6f50695 100644
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -642,7 +642,7 @@ static void kick_open(void)
         udelay(25);
 }
 
-static struct file_operations flash_fops =
+static const struct file_operations flash_fops =
 {
         .owner          = THIS_MODULE,
         .llseek         = flash_llseek,
diff --git a/drivers/char/pc8736x_gpio.c b/drivers/char/pc8736x_gpio.c
index c860de6a6fde..84e5a68635f1 100644
--- a/drivers/char/pc8736x_gpio.c
+++ b/drivers/char/pc8736x_gpio.c
@@ -3,18 +3,18 @@
    National Semiconductor PC8736x GPIO driver.  Allows a user space
    process to play with the GPIO pins.
 
-   Copyright (c) 2005 Jim Cromie <jim.cromie@gmail.com>
+   Copyright (c) 2005,2006 Jim Cromie <jim.cromie@gmail.com>
 
    adapted from linux/drivers/char/scx200_gpio.c
    Copyright (c) 2001,2002 Christer Weinigel <wingel@nano-system.com>,
 */
 
-#include <linux/config.h>
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/cdev.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
 #include <linux/mutex.h>
@@ -25,7 +25,7 @@
 #define DEVNAME "pc8736x_gpio"
 
 MODULE_AUTHOR("Jim Cromie <jim.cromie@gmail.com>");
-MODULE_DESCRIPTION("NatSemi PC-8736x GPIO Pin Driver");
+MODULE_DESCRIPTION("NatSemi/Winbond PC-8736x GPIO Pin Driver");
 MODULE_LICENSE("GPL");
 
 static int major;               /* default to dynamic major */
@@ -38,14 +38,14 @@ static u8 pc8736x_gpio_shadow[4];
 
 #define SIO_BASE1       0x2E    /* 1st command-reg to check */
 #define SIO_BASE2       0x4E    /* alt command-reg to check */
-#define SIO_BASE_OFFSET 0x20
 
 #define SIO_SID         0x20    /* SuperI/O ID Register */
 #define SIO_SID_VALUE   0xe9    /* Expected value in SuperI/O ID Register */
 
 #define SIO_CF1         0x21    /* chip config, bit0 is chip enable */
 
-#define PC8736X_GPIO_SIZE       16
+#define PC8736X_GPIO_RANGE      16 /* ioaddr range */
+#define PC8736X_GPIO_CT         32 /* minors matching 4 8 bit ports */
 
 #define SIO_UNIT_SEL    0x7     /* unit select reg */
 #define SIO_UNIT_ACT    0x30    /* unit enable */
@@ -212,14 +212,12 @@ static void pc8736x_gpio_change(unsigned index)
         pc8736x_gpio_set(index, !pc8736x_gpio_current(index));
 }
 
-static struct nsc_gpio_ops pc8736x_access = {
+static struct nsc_gpio_ops pc8736x_gpio_ops = {
         .owner          = THIS_MODULE,
         .gpio_config    = pc8736x_gpio_configure,
         .gpio_dump      = nsc_gpio_dump,
         .gpio_get       = pc8736x_gpio_get,
         .gpio_set       = pc8736x_gpio_set,
-        .gpio_set_high  = pc8736x_gpio_set_high,
-        .gpio_set_low   = pc8736x_gpio_set_low,
         .gpio_change    = pc8736x_gpio_change,
         .gpio_current   = pc8736x_gpio_current
 };
@@ -227,16 +225,16 @@ static struct nsc_gpio_ops pc8736x_access = {
 static int pc8736x_gpio_open(struct inode *inode, struct file *file)
 {
         unsigned m = iminor(inode);
-        file->private_data = &pc8736x_access;
+        file->private_data = &pc8736x_gpio_ops;
 
         dev_dbg(&pdev->dev, "open %d\n", m);
 
-        if (m > 63)
+        if (m >= PC8736X_GPIO_CT)
                 return -EINVAL;
         return nonseekable_open(inode, file);
 }
 
-static struct file_operations pc8736x_gpio_fops = {
+static const struct file_operations pc8736x_gpio_fileops = {
         .owner  = THIS_MODULE,
         .open   = pc8736x_gpio_open,
         .write  = nsc_gpio_write,
@@ -255,9 +253,12 @@ static void __init pc8736x_init_shadow(void)
 
 }
 
+static struct cdev pc8736x_gpio_cdev;
+
 static int __init pc8736x_gpio_init(void)
 {
-        int rc = 0;
+        int rc;
+        dev_t devid;
 
         pdev = platform_device_alloc(DEVNAME, 0);
         if (!pdev)
@@ -275,7 +276,7 @@ static int __init pc8736x_gpio_init(void)
                 dev_err(&pdev->dev, "no device found\n");
                 goto undo_platform_dev_add;
         }
-        pc8736x_access.dev = &pdev->dev;
+        pc8736x_gpio_ops.dev = &pdev->dev;
 
         /* Verify that chip and it's GPIO unit are both enabled.
            My BIOS does this, so I take minimum action here
@@ -297,7 +298,7 @@ static int __init pc8736x_gpio_init(void)
         pc8736x_gpio_base = (superio_inb(SIO_BASE_HADDR) << 8
                              | superio_inb(SIO_BASE_LADDR));
 
-        if (!request_region(pc8736x_gpio_base, 16, DEVNAME)) {
+        if (!request_region(pc8736x_gpio_base, PC8736X_GPIO_RANGE, DEVNAME)) {
                 rc = -ENODEV;
                 dev_err(&pdev->dev, "GPIO ioport %x busy\n",
                         pc8736x_gpio_base);
@@ -305,10 +306,17 @@ static int __init pc8736x_gpio_init(void)
         }
         dev_info(&pdev->dev, "GPIO ioport %x reserved\n", pc8736x_gpio_base);
 
-        rc = register_chrdev(major, DEVNAME, &pc8736x_gpio_fops);
+        if (major) {
+                devid = MKDEV(major, 0);
+                rc = register_chrdev_region(devid, PC8736X_GPIO_CT, DEVNAME);
+        } else {
+                rc = alloc_chrdev_region(&devid, 0, PC8736X_GPIO_CT, DEVNAME);
+                major = MAJOR(devid);
+        }
+
         if (rc < 0) {
                 dev_err(&pdev->dev, "register-chrdev failed: %d\n", rc);
-                goto undo_platform_dev_add;
+                goto undo_request_region;
         }
         if (!major) {
                 major = rc;
@@ -316,8 +324,15 @@ static int __init pc8736x_gpio_init(void)
         }
 
         pc8736x_init_shadow();
+
+        /* ignore minor errs, and succeed */
+        cdev_init(&pc8736x_gpio_cdev, &pc8736x_gpio_fileops);
+        cdev_add(&pc8736x_gpio_cdev, devid, PC8736X_GPIO_CT);
+
         return 0;
 
+undo_request_region:
+        release_region(pc8736x_gpio_base, PC8736X_GPIO_RANGE);
 undo_platform_dev_add:
         platform_device_del(pdev);
 undo_platform_dev_alloc:
@@ -328,14 +343,15 @@ undo_platform_dev_alloc:
 
 static void __exit pc8736x_gpio_cleanup(void)
 {
-        dev_dbg(&pdev->dev, " cleanup\n");
+        dev_dbg(&pdev->dev, "cleanup\n");
 
-        release_region(pc8736x_gpio_base, 16);
+        cdev_del(&pc8736x_gpio_cdev);
+        unregister_chrdev_region(MKDEV(major,0), PC8736X_GPIO_CT);
+        release_region(pc8736x_gpio_base, PC8736X_GPIO_RANGE);
 
-        unregister_chrdev(major, DEVNAME);
+        platform_device_del(pdev);
+        platform_device_put(pdev);
 }
 
-EXPORT_SYMBOL(pc8736x_access);
-
 module_init(pc8736x_gpio_init);
 module_exit(pc8736x_gpio_cleanup);
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 31c8a21f9d87..50d20aafeb18 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1938,7 +1938,7 @@ static void cm4000_detach(struct pcmcia_device *link)
         return;
 }
 
-static struct file_operations cm4000_fops = {
+static const struct file_operations cm4000_fops = {
         .owner  = THIS_MODULE,
         .read   = cmm_read,
         .write  = cmm_write,
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 47a8465bf95b..55cf4be42976 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -688,7 +688,7 @@ static void reader_detach(struct pcmcia_device *link)
         return;
 }
 
-static struct file_operations reader_fops = {
+static const struct file_operations reader_fops = {
         .owner          = THIS_MODULE,
         .read           = cm4040_read,
         .write          = cm4040_write,
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 17bc8abd5df5..00f574cbb0d4 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1174,8 +1174,12 @@ static void dcd_change(MGSLPC_INFO *info)
         else
                 info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-        if (info->netcount)
-                hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, info->netdev);
+        if (info->netcount) {
+                if (info->serial_signals & SerialSignal_DCD)
+                        netif_carrier_on(info->netdev);
+                else
+                        netif_carrier_off(info->netdev);
+        }
 #endif
         wake_up_interruptible(&info->status_event_wait_q);
         wake_up_interruptible(&info->event_wait_q);
@@ -4251,8 +4255,10 @@ static int hdlcdev_open(struct net_device *dev)
         spin_lock_irqsave(&info->lock, flags);
         get_signals(info);
         spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
-
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
         return 0;
 }
 
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 24231d9743dc..520d2cf82bc0 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -739,7 +739,7 @@ static unsigned int pp_poll (struct file * file, poll_table * wait)
 
 static struct class *ppdev_class;
 
-static struct file_operations pp_fops = {
+static const struct file_operations pp_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .read           = pp_read,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 164bddae047f..4c3a5ca9d8f7 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -416,7 +416,7 @@ static struct entropy_store input_pool = {
         .poolinfo = &poolinfo_table[0],
         .name = "input",
         .limit = 1,
-        .lock = SPIN_LOCK_UNLOCKED,
+        .lock = __SPIN_LOCK_UNLOCKED(&input_pool.lock),
         .pool = input_pool_data
 };
 
@@ -425,7 +425,7 @@ static struct entropy_store blocking_pool = {
         .name = "blocking",
         .limit = 1,
         .pull = &input_pool,
-        .lock = SPIN_LOCK_UNLOCKED,
+        .lock = __SPIN_LOCK_UNLOCKED(&blocking_pool.lock),
         .pool = blocking_pool_data
 };
 
@@ -433,7 +433,7 @@ static struct entropy_store nonblocking_pool = {
         .poolinfo = &poolinfo_table[1],
         .name = "nonblocking",
         .pull = &input_pool,
-        .lock = SPIN_LOCK_UNLOCKED,
+        .lock = __SPIN_LOCK_UNLOCKED(&nonblocking_pool.lock),
         .pool = nonblocking_pool_data
 };
 
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 9bf97c5e38c0..579868af4a54 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -30,7 +30,7 @@ struct raw_device_data {
 static struct class *raw_class;
 static struct raw_device_data raw_devices[MAX_RAW_MINORS];
 static DEFINE_MUTEX(raw_mutex);
-static struct file_operations raw_ctl_fops;          /* forward declaration */
+static const struct file_operations raw_ctl_fops; /* forward declaration */
 
 /*
  * Open/close code for raw IO.
@@ -261,7 +261,7 @@ static ssize_t raw_file_aio_write(struct kiocb *iocb, const char __user *buf,
 }
 
 
-static struct file_operations raw_fops = {
+static const struct file_operations raw_fops = {
         .read   =       generic_file_read,
         .aio_read =     generic_file_aio_read,
         .write  =       raw_file_write,
@@ -274,7 +274,7 @@ static struct file_operations raw_fops = {
         .owner  =       THIS_MODULE,
 };
 
-static struct file_operations raw_ctl_fops = {
+static const struct file_operations raw_ctl_fops = {
         .ioctl  =       raw_ctl_ioctl,
         .open   =       raw_open,
         .owner  =       THIS_MODULE,
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index 3afc6a47ebbc..3fa80aaf4527 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -243,7 +243,7 @@ static struct real_driver rio_real_driver = {
  *
  */
 
-static struct file_operations rio_fw_fops = {
+static const struct file_operations rio_fw_fops = {
         .owner = THIS_MODULE,
         .ioctl = rio_fw_ioctl,
 };
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index aefac4ac0bf5..6e6a7c7a7eff 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -46,13 +46,12 @@
  *      1.11a   Daniele Bellucci: Audit create_proc_read_entry in rtc_init
  *      1.12    Venkatesh Pallipadi: Hooks for emulating rtc on HPET base-timer
  *              CONFIG_HPET_EMULATE_RTC
+ *      1.12a   Maciej W. Rozycki: Handle memory-mapped chips properly.
  *      1.12ac  Alan Cox: Allow read access to the day of week register
  */
 
 #define RTC_VERSION             "1.12ac"
 
-#define RTC_IO_EXTENT   0x8
-
 /*
  *      Note that *all* calls to CMOS_READ and CMOS_WRITE are done with
  *      interrupts disabled. Due to the index-port/data-port (0x70/0x71)
@@ -337,7 +336,15 @@ static ssize_t rtc_read(struct file *file, char __user *buf,
         if (rtc_has_irq == 0)
                 return -EIO;
 
-        if (count < sizeof(unsigned))
+        /*
+         * Historically this function used to assume that sizeof(unsigned long)
+         * is the same in userspace and kernelspace.  This lead to problems
+         * for configurations with multiple ABIs such a the MIPS o32 and 64
+         * ABIs supported on the same kernel.  So now we support read of both
+         * 4 and 8 bytes and assume that's the sizeof(unsigned long) in the
+         * userspace ABI.
+         */
+        if (count != sizeof(unsigned int) && count !=  sizeof(unsigned long))
                 return -EINVAL;
 
         add_wait_queue(&rtc_wait, &wait);
@@ -368,10 +375,12 @@ static ssize_t rtc_read(struct file *file, char __user *buf,
                 schedule();
         } while (1);
 
-        if (count < sizeof(unsigned long))
-                retval = put_user(data, (unsigned int __user *)buf) ?: sizeof(int); 
+        if (count == sizeof(unsigned int))
+                retval = put_user(data, (unsigned int __user *)buf) ?: sizeof(int);
         else
                 retval = put_user(data, (unsigned long __user *)buf) ?: sizeof(long);
+        if (!retval)
+                retval = count;
  out:
         current->state = TASK_RUNNING;
         remove_wait_queue(&rtc_wait, &wait);
@@ -877,7 +886,7 @@ int rtc_control(rtc_task_t *task, unsigned int cmd, unsigned long arg)
  *      The various file operations we support.
  */
 
-static struct file_operations rtc_fops = {
+static const struct file_operations rtc_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .read           = rtc_read,
@@ -896,7 +905,7 @@ static struct miscdevice rtc_dev = {
         .fops           = &rtc_fops,
 };
 
-static struct file_operations rtc_proc_fops = {
+static const struct file_operations rtc_proc_fops = {
         .owner = THIS_MODULE,
         .open = rtc_proc_open,
         .read  = seq_read,
@@ -923,6 +932,9 @@ static int __init rtc_init(void)
         struct sparc_isa_device *isa_dev;
 #endif
 #endif
+#ifndef __sparc__
+        void *r;
+#endif
 
 #ifdef __sparc__
         for_each_ebus(ebus) {
@@ -964,8 +976,13 @@ found:
         }
 no_irq:
 #else
-        if (!request_region(RTC_PORT(0), RTC_IO_EXTENT, "rtc")) {
-                printk(KERN_ERR "rtc: I/O port %d is not free.\n", RTC_PORT (0));
+        if (RTC_IOMAPPED)
+                r = request_region(RTC_PORT(0), RTC_IO_EXTENT, "rtc");
+        else
+                r = request_mem_region(RTC_PORT(0), RTC_IO_EXTENT, "rtc");
+        if (!r) {
+                printk(KERN_ERR "rtc: I/O resource %lx is not free.\n",
+                       (long)(RTC_PORT(0)));
                 return -EIO;
         }
 
@@ -979,7 +996,10 @@ no_irq:
         if(request_irq(RTC_IRQ, rtc_int_handler_ptr, IRQF_DISABLED, "rtc", NULL)) {
                 /* Yeah right, seeing as irq 8 doesn't even hit the bus. */
                 printk(KERN_ERR "rtc: IRQ %d is not free.\n", RTC_IRQ);
-                release_region(RTC_PORT(0), RTC_IO_EXTENT);
+                if (RTC_IOMAPPED)
+                        release_region(RTC_PORT(0), RTC_IO_EXTENT);
+                else
+                        release_mem_region(RTC_PORT(0), RTC_IO_EXTENT);
                 return -EIO;
         }
         hpet_rtc_timer_init();
@@ -1079,7 +1099,10 @@ static void __exit rtc_exit (void)
         if (rtc_has_irq)
                 free_irq (rtc_irq, &rtc_port);
 #else
-        release_region (RTC_PORT (0), RTC_IO_EXTENT);
+        if (RTC_IOMAPPED)
+                release_region(RTC_PORT(0), RTC_IO_EXTENT);
+        else
+                release_mem_region(RTC_PORT(0), RTC_IO_EXTENT);
 #ifdef RTC_IRQ
         if (rtc_has_irq)
                 free_irq (RTC_IRQ, NULL);
@@ -1222,7 +1245,7 @@ static int rtc_proc_open(struct inode *inode, struct file *file)
 
 void rtc_get_rtc_time(struct rtc_time *rtc_tm)
 {
-        unsigned long uip_watchdog = jiffies;
+        unsigned long uip_watchdog = jiffies, flags;
         unsigned char ctrl;
 #ifdef CONFIG_MACH_DECSTATION
         unsigned int real_year;
@@ -1249,7 +1272,7 @@ void rtc_get_rtc_time(struct rtc_time *rtc_tm)
          * RTC has RTC_DAY_OF_WEEK, we should usually ignore it, as it is
          * only updated by the RTC when initially set to a non-zero value.
          */
-        spin_lock_irq(&rtc_lock);
+        spin_lock_irqsave(&rtc_lock, flags);
         rtc_tm->tm_sec = CMOS_READ(RTC_SECONDS);
         rtc_tm->tm_min = CMOS_READ(RTC_MINUTES);
         rtc_tm->tm_hour = CMOS_READ(RTC_HOURS);
@@ -1263,7 +1286,7 @@ void rtc_get_rtc_time(struct rtc_time *rtc_tm)
         real_year = CMOS_READ(RTC_DEC_YEAR);
 #endif
         ctrl = CMOS_READ(RTC_CONTROL);
-        spin_unlock_irq(&rtc_lock);
+        spin_unlock_irqrestore(&rtc_lock, flags);
 
         if (!(ctrl & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
         {
diff --git a/drivers/char/scx200_gpio.c b/drivers/char/scx200_gpio.c
index 45083e5dd23b..b956c7babd18 100644
--- a/drivers/char/scx200_gpio.c
+++ b/drivers/char/scx200_gpio.c
@@ -5,7 +5,6 @@
 
    Copyright (c) 2001,2002 Christer Weinigel <wingel@nano-system.com> */
 
-#include <linux/config.h>
 #include <linux/device.h>
 #include <linux/fs.h>
 #include <linux/module.h>
@@ -22,37 +21,37 @@
 #include <linux/scx200_gpio.h>
 #include <linux/nsc_gpio.h>
 
-#define NAME "scx200_gpio"
-#define DEVNAME NAME
+#define DRVNAME "scx200_gpio"
 
 static struct platform_device *pdev;
 
 MODULE_AUTHOR("Christer Weinigel <wingel@nano-system.com>");
-MODULE_DESCRIPTION("NatSemi SCx200 GPIO Pin Driver");
+MODULE_DESCRIPTION("NatSemi/AMD SCx200 GPIO Pin Driver");
 MODULE_LICENSE("GPL");
 
 static int major = 0;           /* default to dynamic major */
 module_param(major, int, 0);
 MODULE_PARM_DESC(major, "Major device number");
 
-struct nsc_gpio_ops scx200_access = {
+#define MAX_PINS 32             /* 64 later, when known ok */
+
+struct nsc_gpio_ops scx200_gpio_ops = {
         .owner          = THIS_MODULE,
         .gpio_config    = scx200_gpio_configure,
         .gpio_dump      = nsc_gpio_dump,
         .gpio_get       = scx200_gpio_get,
         .gpio_set       = scx200_gpio_set,
-        .gpio_set_high  = scx200_gpio_set_high,
-        .gpio_set_low   = scx200_gpio_set_low,
         .gpio_change    = scx200_gpio_change,
         .gpio_current   = scx200_gpio_current
 };
+EXPORT_SYMBOL(scx200_gpio_ops);
 
 static int scx200_gpio_open(struct inode *inode, struct file *file)
 {
         unsigned m = iminor(inode);
-        file->private_data = &scx200_access;
+        file->private_data = &scx200_gpio_ops;
 
-        if (m > 63)
+        if (m >= MAX_PINS)
                 return -EINVAL;
         return nonseekable_open(inode, file);
 }
@@ -62,8 +61,7 @@ static int scx200_gpio_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-
-static struct file_operations scx200_gpio_fops = {
+static const struct file_operations scx200_gpio_fileops = {
         .owner   = THIS_MODULE,
         .write   = nsc_gpio_write,
         .read    = nsc_gpio_read,
@@ -71,21 +69,20 @@ static struct file_operations scx200_gpio_fops = {
         .release = scx200_gpio_release,
 };
 
-struct cdev *scx200_devices;
-static int num_pins = 32;
+struct cdev scx200_gpio_cdev;  /* use 1 cdev for all pins */
 
 static int __init scx200_gpio_init(void)
 {
-        int rc, i;
-        dev_t dev = MKDEV(major, 0);
+        int rc;
+        dev_t devid;
 
         if (!scx200_gpio_present()) {
-                printk(KERN_ERR NAME ": no SCx200 gpio present\n");
+                printk(KERN_ERR DRVNAME ": no SCx200 gpio present\n");
                 return -ENODEV;
         }
 
         /* support dev_dbg() with pdev->dev */
-        pdev = platform_device_alloc(DEVNAME, 0);
+        pdev = platform_device_alloc(DRVNAME, 0);
         if (!pdev)
                 return -ENOMEM;
 
@@ -94,37 +91,25 @@ static int __init scx200_gpio_init(void)
                 goto undo_malloc;
 
         /* nsc_gpio uses dev_dbg(), so needs this */
-        scx200_access.dev = &pdev->dev;
-
-        if (major)
-                rc = register_chrdev_region(dev, num_pins, "scx200_gpio");
-        else {
-                rc = alloc_chrdev_region(&dev, 0, num_pins, "scx200_gpio");
-                major = MAJOR(dev);
+        scx200_gpio_ops.dev = &pdev->dev;
+
+        if (major) {
+                devid = MKDEV(major, 0);
+                rc = register_chrdev_region(devid, MAX_PINS, "scx200_gpio");
+        } else {
+                rc = alloc_chrdev_region(&devid, 0, MAX_PINS, "scx200_gpio");
+                major = MAJOR(devid);
         }
         if (rc < 0) {
                 dev_err(&pdev->dev, "SCx200 chrdev_region err: %d\n", rc);
                 goto undo_platform_device_add;
         }
-        scx200_devices = kzalloc(num_pins * sizeof(struct cdev), GFP_KERNEL);
-        if (!scx200_devices) {
-                rc = -ENOMEM;
-                goto undo_chrdev_region;
-        }
-        for (i = 0; i < num_pins; i++) {
-                struct cdev *cdev = &scx200_devices[i];
-                cdev_init(cdev, &scx200_gpio_fops);
-                cdev->owner = THIS_MODULE;
-                rc = cdev_add(cdev, MKDEV(major, i), 1);
-                /* tolerate 'minor' errors */
-                if (rc)
-                        dev_err(&pdev->dev, "Error %d on minor %d", rc, i);
-        }
+
+        cdev_init(&scx200_gpio_cdev, &scx200_gpio_fileops);
+        cdev_add(&scx200_gpio_cdev, devid, MAX_PINS);
 
         return 0; /* succeed */
 
-undo_chrdev_region:
-        unregister_chrdev_region(dev, num_pins);
 undo_platform_device_add:
         platform_device_del(pdev);
 undo_malloc:
@@ -135,10 +120,11 @@ undo_malloc:
 
 static void __exit scx200_gpio_cleanup(void)
 {
-        kfree(scx200_devices);
-        unregister_chrdev_region(MKDEV(major, 0), num_pins);
+        cdev_del(&scx200_gpio_cdev);
+        /* cdev_put(&scx200_gpio_cdev); */
+
+        unregister_chrdev_region(MKDEV(major, 0), MAX_PINS);
         platform_device_unregister(pdev);
-        /* kfree(pdev); */
 }
 
 module_init(scx200_gpio_init);
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index 203240b6c08f..07e0b75f2338 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -347,7 +347,7 @@ scdrv_poll(struct file *file, struct poll_table_struct *wait)
         return mask;
 }
 
-static struct file_operations scdrv_fops = {
+static const struct file_operations scdrv_fops = {
         .owner =        THIS_MODULE,
         .read =         scdrv_read,
         .write =        scdrv_write,
@@ -374,7 +374,12 @@ scdrv_init(void)
         struct sysctl_data_s *scd;
         void *salbuf;
         dev_t first_dev, dev;
-        nasid_t event_nasid = ia64_sn_get_console_nasid();
+        nasid_t event_nasid;
+
+        if (!ia64_platform_is("sn2"))
+                return -ENODEV;
+
+        event_nasid = ia64_sn_get_console_nasid();
 
         if (alloc_chrdev_region(&first_dev, 0, num_cnodes,
                                 SYSCTL_BASENAME) < 0) {
diff --git a/drivers/char/snsc_event.c b/drivers/char/snsc_event.c
index 8b2210b633df..d12d4f629cec 100644
--- a/drivers/char/snsc_event.c
+++ b/drivers/char/snsc_event.c
@@ -220,20 +220,7 @@ scdrv_dispatch_event(char *event, int len)
                                " Sending SIGPWR to init...\n");
 
                 /* give a SIGPWR signal to init proc */
-
-                /* first find init's task */
-                read_lock(&tasklist_lock);
-                for_each_process(p) {
-                        if (p->pid == 1)
-                                break;
-                }
-                if (p) {
-                        force_sig(SIGPWR, p);
-                } else {
-                        printk(KERN_ERR "Failed to signal init!\n");
-                        snsc_shutting_down = 0; /* so can try again (?) */
-                }
-                read_unlock(&tasklist_lock);
+                kill_proc(1, SIGPWR, 0);
         } else {
                 /* print to system log */
                 printk("%s|$(0x%x)%s\n", severity, esp_code, desc);
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 45508a039508..d4e434d694b7 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1106,7 +1106,7 @@ static int sonypi_misc_ioctl(struct inode *ip, struct file *fp,
         return ret;
 }
 
-static struct file_operations sonypi_misc_fops = {
+static const struct file_operations sonypi_misc_fops = {
         .owner          = THIS_MODULE,
         .read           = sonypi_misc_read,
         .poll           = sonypi_misc_poll,
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index cb2859249d49..a1d303f9a33d 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -2584,6 +2584,12 @@ static void __exit specialix_exit_module(void)
         func_exit();
 }
 
+static struct pci_device_id specialx_pci_tbl[] __devinitdata = {
+        { PCI_DEVICE(PCI_VENDOR_ID_SPECIALIX, PCI_DEVICE_ID_SPECIALIX_IO8) },
+        { }
+};
+MODULE_DEVICE_TABLE(pci, specialx_pci_tbl);
+
 module_init(specialix_init_module);
 module_exit(specialix_exit_module);
 
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index ed7b8eaf0367..3beb2203d24b 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -707,7 +707,7 @@ static unsigned int	sc26198_baudtable[] = {
  *      Define the driver info for a user level control device. Used mainly
  *      to get at port stats - only not using the port device itself.
  */
-static struct file_operations   stl_fsiomem = {
+static const struct file_operations     stl_fsiomem = {
         .owner          = THIS_MODULE,
         .ioctl          = stl_memioctl,
 };
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 45c193aa11db..e1cd2bc4b1e4 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -410,7 +410,7 @@ static struct real_driver sx_real_driver = {
  *
  */
 
-static struct file_operations sx_fw_fops = {
+static const struct file_operations sx_fw_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = sx_fw_ioctl,
 };
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index df782dd1098c..78b1b1a2732b 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1344,8 +1344,12 @@ static void mgsl_isr_io_pin( struct mgsl_struct *info )
                         } else
                                 info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-                        if (info->netcount)
-                                hdlc_set_carrier(status & MISCSTATUS_DCD, info->netdev);
+                        if (info->netcount) {
+                                if (status & MISCSTATUS_DCD)
+                                        netif_carrier_on(info->netdev);
+                                else
+                                        netif_carrier_off(info->netdev);
+                        }
 #endif
                 }
                 if (status & MISCSTATUS_CTS_LATCHED)
@@ -7844,8 +7848,10 @@ static int hdlcdev_open(struct net_device *dev)
         spin_lock_irqsave(&info->irq_spinlock, flags);
         usc_get_serial_signals(info);
         spin_unlock_irqrestore(&info->irq_spinlock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
-
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
         return 0;
 }
 
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index e829594195c1..2f07b085536b 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -391,8 +391,8 @@ static MGSL_PARAMS default_params = {
 #define DESC_LIST_SIZE 4096
 
 #define MASK_PARITY  BIT1
-#define MASK_FRAMING BIT2
-#define MASK_BREAK   BIT3
+#define MASK_FRAMING BIT0
+#define MASK_BREAK   BIT14
 #define MASK_OVERRUN BIT4
 
 #define GSR   0x00 /* global status */
@@ -1497,8 +1497,10 @@ static int hdlcdev_open(struct net_device *dev)
         spin_lock_irqsave(&info->lock, flags);
         get_signals(info);
         spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->signals & SerialSignal_DCD, dev);
-
+        if (info->signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
         return 0;
 }
 
@@ -1798,17 +1800,17 @@ static void rx_async(struct slgt_info *info)
 
                         stat = 0;
 
-                        if ((status = *(p+1) & (BIT9 + BIT8))) {
-                                if (status & BIT9)
+                        if ((status = *(p+1) & (BIT1 + BIT0))) {
+                                if (status & BIT1)
                                         icount->parity++;
-                                else if (status & BIT8)
+                                else if (status & BIT0)
                                         icount->frame++;
                                 /* discard char if tty control flags say so */
                                 if (status & info->ignore_status_mask)
                                         continue;
-                                if (status & BIT9)
+                                if (status & BIT1)
                                         stat = TTY_PARITY;
-                                else if (status & BIT8)
+                                else if (status & BIT0)
                                         stat = TTY_FRAME;
                         }
                         if (tty) {
@@ -1997,8 +1999,12 @@ static void dcd_change(struct slgt_info *info)
                 info->input_signal_events.dcd_down++;
         }
 #ifdef CONFIG_HDLC
-        if (info->netcount)
-                hdlc_set_carrier(info->signals & SerialSignal_DCD, info->netdev);
+        if (info->netcount) {
+                if (info->signals & SerialSignal_DCD)
+                        netif_carrier_on(info->netdev);
+                else
+                        netif_carrier_off(info->netdev);
+        }
 #endif
         wake_up_interruptible(&info->status_event_wait_q);
         wake_up_interruptible(&info->event_wait_q);
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 1e443a233f51..66f3754fbbdf 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -1752,8 +1752,10 @@ static int hdlcdev_open(struct net_device *dev)
         spin_lock_irqsave(&info->lock, flags);
         get_signals(info);
         spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
-
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
         return 0;
 }
 
@@ -2522,8 +2524,12 @@ void isr_io_pin( SLMP_INFO *info, u16 status )
                         } else
                                 info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-                        if (info->netcount)
-                                hdlc_set_carrier(status & SerialSignal_DCD, info->netdev);
+                        if (info->netcount) {
+                                if (status & SerialSignal_DCD)
+                                        netif_carrier_on(info->netdev);
+                                else
+                                        netif_carrier_off(info->netdev);
+                        }
 #endif
                 }
                 if (status & MISCSTATUS_CTS_LATCHED)
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index a064ee9181c0..ee3ca8f1768e 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -147,12 +147,13 @@ static struct sysrq_key_op sysrq_mountro_op = {
         .enable_mask    = SYSRQ_ENABLE_REMOUNT,
 };
 
-#ifdef CONFIG_DEBUG_MUTEXES
+#ifdef CONFIG_LOCKDEP
 static void sysrq_handle_showlocks(int key, struct pt_regs *pt_regs,
                                 struct tty_struct *tty)
 {
-        mutex_debug_show_all_locks();
+        debug_show_all_locks();
 }
+
 static struct sysrq_key_op sysrq_showlocks_op = {
         .handler        = sysrq_handle_showlocks,
         .help_msg       = "show-all-locks(D)",
diff --git a/drivers/char/tb0219.c b/drivers/char/tb0219.c
index a80c83210872..bb1bad4c18f9 100644
--- a/drivers/char/tb0219.c
+++ b/drivers/char/tb0219.c
@@ -255,7 +255,7 @@ static int tanbac_tb0219_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations tb0219_fops = {
+static const struct file_operations tb0219_fops = {
         .owner          = THIS_MODULE,
         .read           = tanbac_tb0219_read,
         .write          = tanbac_tb0219_write,
diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
index e0633a119d29..d30dc09dbbc9 100644
--- a/drivers/char/tipar.c
+++ b/drivers/char/tipar.c
@@ -381,7 +381,7 @@ tipar_ioctl(struct inode *inode, struct file *file,
 
 /* ----- kernel module registering ------------------------------------ */
 
-static struct file_operations tipar_fops = {
+static const struct file_operations tipar_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .read = tipar_read,
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 952b829e2cb4..d2c5ba4e83b8 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -247,7 +247,7 @@ static ssize_t tlclk_write(struct file *filp, const char __user *buf, size_t cou
         return 0;
 }
 
-static struct file_operations tlclk_fops = {
+static const struct file_operations tlclk_fops = {
         .read = tlclk_read,
         .write = tlclk_write,
         .open = tlclk_open,
diff --git a/drivers/char/toshiba.c b/drivers/char/toshiba.c
index e2fb234dee40..dd36fd04a842 100644
--- a/drivers/char/toshiba.c
+++ b/drivers/char/toshiba.c
@@ -92,7 +92,7 @@ static int tosh_ioctl(struct inode *, struct file *, unsigned int,
         unsigned long);
 
 
-static struct file_operations tosh_fops = {
+static const struct file_operations tosh_fops = {
         .owner          = THIS_MODULE,
         .ioctl          = tosh_ioctl,
 };
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 6889e7db3aff..a082a2e34252 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1141,6 +1141,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vend
                 put_device(dev);
                 clear_bit(chip->dev_num, dev_mask);
                 kfree(chip);
+                kfree(devname);
                 return NULL;
         }
 
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index 58a258cec153..ad8ffe49256f 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -116,7 +116,7 @@ static u8 tpm_atml_status(struct tpm_chip *chip)
         return ioread8(chip->vendor.iobase + 1);
 }
 
-static struct file_operations atmel_ops = {
+static const struct file_operations atmel_ops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .open = tpm_open,
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index adfff21beb21..1353b5a6bae8 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -338,7 +338,7 @@ static struct attribute *inf_attrs[] = {
 
 static struct attribute_group inf_attr_grp = {.attrs = inf_attrs };
 
-static struct file_operations inf_ops = {
+static const struct file_operations inf_ops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .open = tpm_open,
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 4c8bc06c7d95..26287aace87d 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -226,7 +226,7 @@ static u8 tpm_nsc_status(struct tpm_chip *chip)
         return inb(chip->vendor.base + NSC_STATUS);
 }
 
-static struct file_operations nsc_ops = {
+static const struct file_operations nsc_ops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .open = tpm_open,
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index abb0f2aeae66..ee7ac6f43c65 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -330,7 +330,7 @@ out_err:
         return rc;
 }
 
-static struct file_operations tis_ops = {
+static const struct file_operations tis_ops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .open = tpm_open,
@@ -424,6 +424,7 @@ static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
         iowrite32(interrupt,
                   chip->vendor.iobase +
                   TPM_INT_STATUS(chip->vendor.locality));
+        ioread32(chip->vendor.iobase + TPM_INT_STATUS(chip->vendor.locality));
         return IRQ_HANDLED;
 }
 
@@ -431,23 +432,19 @@ static int interrupts = 1;
 module_param(interrupts, bool, 0444);
 MODULE_PARM_DESC(interrupts, "Enable interrupts");
 
-static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
-                                      const struct pnp_device_id *pnp_id)
+static int tpm_tis_init(struct device *dev, resource_size_t start,
+                        resource_size_t len)
 {
         u32 vendor, intfcaps, intmask;
         int rc, i;
-        unsigned long start, len;
         struct tpm_chip *chip;
 
-        start = pnp_mem_start(pnp_dev, 0);
-        len = pnp_mem_len(pnp_dev, 0);
-
         if (!start)
                 start = TIS_MEM_BASE;
         if (!len)
                 len = TIS_MEM_LEN;
 
-        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+        if (!(chip = tpm_register_hardware(dev, &tpm_tis)))
                 return -ENODEV;
 
         chip->vendor.iobase = ioremap(start, len);
@@ -464,7 +461,7 @@ static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
         chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
         chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
 
-        dev_info(&pnp_dev->dev,
+        dev_info(dev,
                  "1.2 TPM (device-id 0x%X, rev-id %d)\n",
                  vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
 
@@ -472,26 +469,26 @@ static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
         intfcaps =
             ioread32(chip->vendor.iobase +
                      TPM_INTF_CAPS(chip->vendor.locality));
-        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+        dev_dbg(dev, "TPM interface capabilities (0x%x):\n",
                 intfcaps);
         if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
-                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+                dev_dbg(dev, "\tBurst Count Static\n");
         if (intfcaps & TPM_INTF_CMD_READY_INT)
-                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+                dev_dbg(dev, "\tCommand Ready Int Support\n");
         if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
-                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+                dev_dbg(dev, "\tInterrupt Edge Falling\n");
         if (intfcaps & TPM_INTF_INT_EDGE_RISING)
-                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+                dev_dbg(dev, "\tInterrupt Edge Rising\n");
         if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
-                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+                dev_dbg(dev, "\tInterrupt Level Low\n");
         if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
-                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+                dev_dbg(dev, "\tInterrupt Level High\n");
         if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
-                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+                dev_dbg(dev, "\tLocality Change Int Support\n");
         if (intfcaps & TPM_INTF_STS_VALID_INT)
-                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+                dev_dbg(dev, "\tSts Valid Int Support\n");
         if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
-                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+                dev_dbg(dev, "\tData Avail Int Support\n");
 
         if (request_locality(chip, 0) != 0) {
                 rc = -ENODEV;
@@ -594,6 +591,16 @@ out_err:
         return rc;
 }
 
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        resource_size_t start, len;
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+
+        return tpm_tis_init(&pnp_dev->dev, start, len);
+}
+
 static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
 {
         return tpm_pm_suspend(&dev->dev, msg);
@@ -628,8 +635,36 @@ module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
                     sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
 MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
 
+static struct device_driver tis_drv = {
+        .name = "tpm_tis",
+        .bus = &platform_bus_type,
+        .owner = THIS_MODULE,
+        .suspend = tpm_pm_suspend,
+        .resume = tpm_pm_resume,
+};
+
+static struct platform_device *pdev;
+
+static int force;
+module_param(force, bool, 0444);
+MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
 static int __init init_tis(void)
 {
+        int rc;
+
+        if (force) {
+                rc = driver_register(&tis_drv);
+                if (rc < 0)
+                        return rc;
+                if (IS_ERR(pdev=platform_device_register_simple("tpm_tis", -1, NULL, 0)))
+                        return PTR_ERR(pdev);
+                if((rc=tpm_tis_init(&pdev->dev, 0, 0)) != 0) {
+                        platform_device_unregister(pdev);
+                        driver_unregister(&tis_drv);
+                }
+                return rc;
+        }
+
         return pnp_register_driver(&tis_pnp_driver);
 }
 
@@ -654,7 +689,11 @@ static void __exit cleanup_tis(void)
                 tpm_remove_hardware(chip->dev);
         }
         spin_unlock(&tis_lock);
-        pnp_unregister_driver(&tis_pnp_driver);
+        if (force) {
+                platform_device_unregister(pdev);
+                driver_unregister(&tis_drv);
+        } else
+                pnp_unregister_driver(&tis_pnp_driver);
 }
 
 module_init(init_tis);
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 615e934da05f..bb0d9199e994 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -153,6 +153,15 @@ int tty_ioctl(struct inode * inode, struct file * file,
 static int tty_fasync(int fd, struct file * filp, int on);
 static void release_mem(struct tty_struct *tty, int idx);
 
+/**
+ *      alloc_tty_struct        -       allocate a tty object
+ *
+ *      Return a new empty tty structure. The data fields have not
+ *      been initialized in any way but has been zeroed
+ *
+ *      Locking: none
+ *      FIXME: use kzalloc
+ */
 
 static struct tty_struct *alloc_tty_struct(void)
 {
@@ -166,6 +175,15 @@ static struct tty_struct *alloc_tty_struct(void)
 
 static void tty_buffer_free_all(struct tty_struct *);
 
+/**
+ *      free_tty_struct         -       free a disused tty
+ *      @tty: tty struct to free
+ *
+ *      Free the write buffers, tty queue and tty memory itself.
+ *
+ *      Locking: none. Must be called after tty is definitely unused
+ */
+
 static inline void free_tty_struct(struct tty_struct *tty)
 {
         kfree(tty->write_buf);
@@ -175,6 +193,17 @@ static inline void free_tty_struct(struct tty_struct *tty)
 
 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
 
+/**
+ *      tty_name        -       return tty naming
+ *      @tty: tty structure
+ *      @buf: buffer for output
+ *
+ *      Convert a tty structure into a name. The name reflects the kernel
+ *      naming policy and if udev is in use may not reflect user space
+ *
+ *      Locking: none
+ */
+
 char *tty_name(struct tty_struct *tty, char *buf)
 {
         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
@@ -235,6 +264,28 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
  * Tty buffer allocation management
  */
 
+
+/**
+ *      tty_buffer_free_all             -       free buffers used by a tty
+ *      @tty: tty to free from
+ *
+ *      Remove all the buffers pending on a tty whether queued with data
+ *      or in the free ring. Must be called when the tty is no longer in use
+ *
+ *      Locking: none
+ */
+
+
+/**
+ *      tty_buffer_free_all             -       free buffers used by a tty
+ *      @tty: tty to free from
+ *
+ *      Remove all the buffers pending on a tty whether queued with data
+ *      or in the free ring. Must be called when the tty is no longer in use
+ *
+ *      Locking: none
+ */
+
 static void tty_buffer_free_all(struct tty_struct *tty)
 {
         struct tty_buffer *thead;
@@ -247,19 +298,47 @@ static void tty_buffer_free_all(struct tty_struct *tty)
                 kfree(thead);
         }
         tty->buf.tail = NULL;
+        tty->buf.memory_used = 0;
 }
 
+/**
+ *      tty_buffer_init         -       prepare a tty buffer structure
+ *      @tty: tty to initialise
+ *
+ *      Set up the initial state of the buffer management for a tty device.
+ *      Must be called before the other tty buffer functions are used.
+ *
+ *      Locking: none
+ */
+
 static void tty_buffer_init(struct tty_struct *tty)
 {
         spin_lock_init(&tty->buf.lock);
         tty->buf.head = NULL;
         tty->buf.tail = NULL;
         tty->buf.free = NULL;
+        tty->buf.memory_used = 0;
 }
 
-static struct tty_buffer *tty_buffer_alloc(size_t size)
+/**
+ *      tty_buffer_alloc        -       allocate a tty buffer
+ *      @tty: tty device
+ *      @size: desired size (characters)
+ *
+ *      Allocate a new tty buffer to hold the desired number of characters.
+ *      Return NULL if out of memory or the allocation would exceed the
+ *      per device queue
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
+
+static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
 {
-        struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
+        struct tty_buffer *p;
+
+        if (tty->buf.memory_used + size > 65536)
+                return NULL;
+        p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
         if(p == NULL)
                 return NULL;
         p->used = 0;
@@ -269,17 +348,27 @@ static struct tty_buffer *tty_buffer_alloc(size_t size)
         p->read = 0;
         p->char_buf_ptr = (char *)(p->data);
         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
-/*      printk("Flip create %p\n", p); */
+        tty->buf.memory_used += size;
         return p;
 }
 
-/* Must be called with the tty_read lock held. This needs to acquire strategy
-   code to decide if we should kfree or relink a given expired buffer */
+/**
+ *      tty_buffer_free         -       free a tty buffer
+ *      @tty: tty owning the buffer
+ *      @b: the buffer to free
+ *
+ *      Free a tty buffer, or add it to the free list according to our
+ *      internal strategy
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
 
 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
 {
         /* Dumb strategy for now - should keep some stats */
-/*      printk("Flip dispose %p\n", b); */
+        tty->buf.memory_used -= b->size;
+        WARN_ON(tty->buf.memory_used < 0);
+
         if(b->size >= 512)
                 kfree(b);
         else {
@@ -288,6 +377,18 @@ static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
         }
 }
 
+/**
+ *      tty_buffer_find         -       find a free tty buffer
+ *      @tty: tty owning the buffer
+ *      @size: characters wanted
+ *
+ *      Locate an existing suitable tty buffer or if we are lacking one then
+ *      allocate a new one. We round our buffers off in 256 character chunks
+ *      to get better allocation behaviour.
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
+
 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
 {
         struct tty_buffer **tbh = &tty->buf.free;
@@ -299,20 +400,28 @@ static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
                         t->used = 0;
                         t->commit = 0;
                         t->read = 0;
-                        /* DEBUG ONLY */
-/*                      memset(t->data, '*', size); */
-/*                      printk("Flip recycle %p\n", t); */
+                        tty->buf.memory_used += t->size;
                         return t;
                 }
                 tbh = &((*tbh)->next);
         }
         /* Round the buffer size out */
         size = (size + 0xFF) & ~ 0xFF;
-        return tty_buffer_alloc(size);
+        return tty_buffer_alloc(tty, size);
         /* Should possibly check if this fails for the largest buffer we
            have queued and recycle that ? */
 }
 
+/**
+ *      tty_buffer_request_room         -       grow tty buffer if needed
+ *      @tty: tty structure
+ *      @size: size desired
+ *
+ *      Make at least size bytes of linear space available for the tty
+ *      buffer. If we fail return the size we managed to find.
+ *
+ *      Locking: Takes tty->buf.lock
+ */
 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
 {
         struct tty_buffer *b, *n;
@@ -347,6 +456,18 @@ int tty_buffer_request_room(struct tty_struct *tty, size_t size)
 }
 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
 
+/**
+ *      tty_insert_flip_string  -       Add characters to the tty buffer
+ *      @tty: tty structure
+ *      @chars: characters
+ *      @size: size
+ *
+ *      Queue a series of bytes to the tty buffering. All the characters
+ *      passed are marked as without error. Returns the number added.
+ *
+ *      Locking: Called functions may take tty->buf.lock
+ */
+
 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
                                 size_t size)
 {
@@ -370,6 +491,20 @@ int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
 }
 EXPORT_SYMBOL(tty_insert_flip_string);
 
+/**
+ *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
+ *      @tty: tty structure
+ *      @chars: characters
+ *      @flags: flag bytes
+ *      @size: size
+ *
+ *      Queue a series of bytes to the tty buffering. For each character
+ *      the flags array indicates the status of the character. Returns the
+ *      number added.
+ *
+ *      Locking: Called functions may take tty->buf.lock
+ */
+
 int tty_insert_flip_string_flags(struct tty_struct *tty,
                 const unsigned char *chars, const char *flags, size_t size)
 {
@@ -394,6 +529,17 @@ int tty_insert_flip_string_flags(struct tty_struct *tty,
 }
 EXPORT_SYMBOL(tty_insert_flip_string_flags);
 
+/**
+ *      tty_schedule_flip       -       push characters to ldisc
+ *      @tty: tty to push from
+ *
+ *      Takes any pending buffers and transfers their ownership to the
+ *      ldisc side of the queue. It then schedules those characters for
+ *      processing by the line discipline.
+ *
+ *      Locking: Takes tty->buf.lock
+ */
+
 void tty_schedule_flip(struct tty_struct *tty)
 {
         unsigned long flags;
@@ -405,12 +551,19 @@ void tty_schedule_flip(struct tty_struct *tty)
 }
 EXPORT_SYMBOL(tty_schedule_flip);
 
-/*
+/**
+ *      tty_prepare_flip_string         -       make room for characters
+ *      @tty: tty
+ *      @chars: return pointer for character write area
+ *      @size: desired size
+ *
  *      Prepare a block of space in the buffer for data. Returns the length
  *      available and buffer pointer to the space which is now allocated and
  *      accounted for as ready for normal characters. This is used for drivers
  *      that need their own block copy routines into the buffer. There is no
  *      guarantee the buffer is a DMA target!
+ *
+ *      Locking: May call functions taking tty->buf.lock
  */
 
 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
@@ -427,12 +580,20 @@ int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_
 
 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
 
-/*
+/**
+ *      tty_prepare_flip_string_flags   -       make room for characters
+ *      @tty: tty
+ *      @chars: return pointer for character write area
+ *      @flags: return pointer for status flag write area
+ *      @size: desired size
+ *
  *      Prepare a block of space in the buffer for data. Returns the length
  *      available and buffer pointer to the space which is now allocated and
  *      accounted for as ready for characters. This is used for drivers
  *      that need their own block copy routines into the buffer. There is no
  *      guarantee the buffer is a DMA target!
+ *
+ *      Locking: May call functions taking tty->buf.lock
  */
 
 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
@@ -451,10 +612,16 @@ EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
 
 
 
-/*
+/**
+ *      tty_set_termios_ldisc           -       set ldisc field
+ *      @tty: tty structure
+ *      @num: line discipline number
+ *
  *      This is probably overkill for real world processors but
  *      they are not on hot paths so a little discipline won't do 
  *      any harm.
+ *
+ *      Locking: takes termios_sem
  */
  
 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
@@ -474,6 +641,19 @@ static DEFINE_SPINLOCK(tty_ldisc_lock);
 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
 
+/**
+ *      tty_register_ldisc      -       install a line discipline
+ *      @disc: ldisc number
+ *      @new_ldisc: pointer to the ldisc object
+ *
+ *      Installs a new line discipline into the kernel. The discipline
+ *      is set up as unreferenced and then made available to the kernel
+ *      from this point onwards.
+ *
+ *      Locking:
+ *              takes tty_ldisc_lock to guard against ldisc races
+ */
+
 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
 {
         unsigned long flags;
@@ -493,6 +673,18 @@ int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
 }
 EXPORT_SYMBOL(tty_register_ldisc);
 
+/**
+ *      tty_unregister_ldisc    -       unload a line discipline
+ *      @disc: ldisc number
+ *      @new_ldisc: pointer to the ldisc object
+ *
+ *      Remove a line discipline from the kernel providing it is not
+ *      currently in use.
+ *
+ *      Locking:
+ *              takes tty_ldisc_lock to guard against ldisc races
+ */
+
 int tty_unregister_ldisc(int disc)
 {
         unsigned long flags;
@@ -512,6 +704,19 @@ int tty_unregister_ldisc(int disc)
 }
 EXPORT_SYMBOL(tty_unregister_ldisc);
 
+/**
+ *      tty_ldisc_get           -       take a reference to an ldisc
+ *      @disc: ldisc number
+ *
+ *      Takes a reference to a line discipline. Deals with refcounts and
+ *      module locking counts. Returns NULL if the discipline is not available.
+ *      Returns a pointer to the discipline and bumps the ref count if it is
+ *      available
+ *
+ *      Locking:
+ *              takes tty_ldisc_lock to guard against ldisc races
+ */
+
 struct tty_ldisc *tty_ldisc_get(int disc)
 {
         unsigned long flags;
@@ -540,6 +745,17 @@ struct tty_ldisc *tty_ldisc_get(int disc)
 
 EXPORT_SYMBOL_GPL(tty_ldisc_get);
 
+/**
+ *      tty_ldisc_put           -       drop ldisc reference
+ *      @disc: ldisc number
+ *
+ *      Drop a reference to a line discipline. Manage refcounts and
+ *      module usage counts
+ *
+ *      Locking:
+ *              takes tty_ldisc_lock to guard against ldisc races
+ */
+
 void tty_ldisc_put(int disc)
 {
         struct tty_ldisc *ld;
@@ -557,6 +773,19 @@ void tty_ldisc_put(int disc)
         
 EXPORT_SYMBOL_GPL(tty_ldisc_put);
 
+/**
+ *      tty_ldisc_assign        -       set ldisc on a tty
+ *      @tty: tty to assign
+ *      @ld: line discipline
+ *
+ *      Install an instance of a line discipline into a tty structure. The
+ *      ldisc must have a reference count above zero to ensure it remains/
+ *      The tty instance refcount starts at zero.
+ *
+ *      Locking:
+ *              Caller must hold references
+ */
+
 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
 {
         tty->ldisc = *ld;
@@ -571,6 +800,8 @@ static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
  *      the tty ldisc. Return 0 on failure or 1 on success. This is
  *      used to implement both the waiting and non waiting versions
  *      of tty_ldisc_ref
+ *
+ *      Locking: takes tty_ldisc_lock
  */
 
 static int tty_ldisc_try(struct tty_struct *tty)
@@ -602,6 +833,8 @@ static int tty_ldisc_try(struct tty_struct *tty)
  *      must also be careful not to hold other locks that will deadlock
  *      against a discipline change, such as an existing ldisc reference
  *      (which we check for)
+ *
+ *      Locking: call functions take tty_ldisc_lock
  */
  
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
@@ -622,6 +855,8 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
  *      Dereference the line discipline for the terminal and take a 
  *      reference to it. If the line discipline is in flux then 
  *      return NULL. Can be called from IRQ and timer functions.
+ *
+ *      Locking: called functions take tty_ldisc_lock
  */
  
 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
@@ -639,6 +874,8 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref);
  *
  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
  *      be called in IRQ context.
+ *
+ *      Locking: takes tty_ldisc_lock
  */
  
 void tty_ldisc_deref(struct tty_ldisc *ld)
@@ -683,6 +920,9 @@ static void tty_ldisc_enable(struct tty_struct *tty)
  *
  *      Set the discipline of a tty line. Must be called from a process
  *      context.
+ *
+ *      Locking: takes tty_ldisc_lock.
+ *              called functions take termios_sem
  */
  
 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
@@ -846,9 +1086,17 @@ restart:
         return retval;
 }
 
-/*
- * This routine returns a tty driver structure, given a device number
+/**
+ *      get_tty_driver          -       find device of a tty
+ *      @dev_t: device identifier
+ *      @index: returns the index of the tty
+ *
+ *      This routine returns a tty driver structure, given a device number
+ *      and also passes back the index number.
+ *
+ *      Locking: caller must hold tty_mutex
  */
+
 static struct tty_driver *get_tty_driver(dev_t device, int *index)
 {
         struct tty_driver *p;
@@ -863,11 +1111,17 @@ static struct tty_driver *get_tty_driver(dev_t device, int *index)
         return NULL;
 }
 
-/*
- * If we try to write to, or set the state of, a terminal and we're
- * not in the foreground, send a SIGTTOU.  If the signal is blocked or
- * ignored, go ahead and perform the operation.  (POSIX 7.2)
+/**
+ *      tty_check_change        -       check for POSIX terminal changes
+ *      @tty: tty to check
+ *
+ *      If we try to write to, or set the state of, a terminal and we're
+ *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
+ *      ignored, go ahead and perform the operation.  (POSIX 7.2)
+ *
+ *      Locking: none
  */
+
 int tty_check_change(struct tty_struct * tty)
 {
         if (current->signal->tty != tty)
@@ -912,7 +1166,7 @@ static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
 }
 
-static struct file_operations tty_fops = {
+static const struct file_operations tty_fops = {
         .llseek         = no_llseek,
         .read           = tty_read,
         .write          = tty_write,
@@ -924,7 +1178,7 @@ static struct file_operations tty_fops = {
 };
 
 #ifdef CONFIG_UNIX98_PTYS
-static struct file_operations ptmx_fops = {
+static const struct file_operations ptmx_fops = {
         .llseek         = no_llseek,
         .read           = tty_read,
         .write          = tty_write,
@@ -936,7 +1190,7 @@ static struct file_operations ptmx_fops = {
 };
 #endif
 
-static struct file_operations console_fops = {
+static const struct file_operations console_fops = {
         .llseek         = no_llseek,
         .read           = tty_read,
         .write          = redirected_tty_write,
@@ -947,7 +1201,7 @@ static struct file_operations console_fops = {
         .fasync         = tty_fasync,
 };
 
-static struct file_operations hung_up_tty_fops = {
+static const struct file_operations hung_up_tty_fops = {
         .llseek         = no_llseek,
         .read           = hung_up_tty_read,
         .write          = hung_up_tty_write,
@@ -1005,10 +1259,27 @@ void tty_ldisc_flush(struct tty_struct *tty)
 
 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
         
-/*
- * This can be called by the "eventd" kernel thread.  That is process synchronous,
- * but doesn't hold any locks, so we need to make sure we have the appropriate
- * locks for what we're doing..
+/**
+ *      do_tty_hangup           -       actual handler for hangup events
+ *      @data: tty device
+ *
+ *      This can be called by the "eventd" kernel thread.  That is process
+ *      synchronous but doesn't hold any locks, so we need to make sure we
+ *      have the appropriate locks for what we're doing.
+ *
+ *      The hangup event clears any pending redirections onto the hung up
+ *      device. It ensures future writes will error and it does the needed
+ *      line discipline hangup and signal delivery. The tty object itself
+ *      remains intact.
+ *
+ *      Locking:
+ *              BKL
+ *              redirect lock for undoing redirection
+ *              file list lock for manipulating list of ttys
+ *              tty_ldisc_lock from called functions
+ *              termios_sem resetting termios data
+ *              tasklist_lock to walk task list for hangup event
+ *
  */
 static void do_tty_hangup(void *data)
 {
@@ -1133,6 +1404,14 @@ static void do_tty_hangup(void *data)
                 fput(f);
 }
 
+/**
+ *      tty_hangup              -       trigger a hangup event
+ *      @tty: tty to hangup
+ *
+ *      A carrier loss (virtual or otherwise) has occurred on this like
+ *      schedule a hangup sequence to run after this event.
+ */
+
 void tty_hangup(struct tty_struct * tty)
 {
 #ifdef TTY_DEBUG_HANGUP
@@ -1145,6 +1424,15 @@ void tty_hangup(struct tty_struct * tty)
 
 EXPORT_SYMBOL(tty_hangup);
 
+/**
+ *      tty_vhangup             -       process vhangup
+ *      @tty: tty to hangup
+ *
+ *      The user has asked via system call for the terminal to be hung up.
+ *      We do this synchronously so that when the syscall returns the process
+ *      is complete. That guarantee is neccessary for security reasons.
+ */
+
 void tty_vhangup(struct tty_struct * tty)
 {
 #ifdef TTY_DEBUG_HANGUP
@@ -1156,6 +1444,14 @@ void tty_vhangup(struct tty_struct * tty)
 }
 EXPORT_SYMBOL(tty_vhangup);
 
+/**
+ *      tty_hung_up_p           -       was tty hung up
+ *      @filp: file pointer of tty
+ *
+ *      Return true if the tty has been subject to a vhangup or a carrier
+ *      loss
+ */
+
 int tty_hung_up_p(struct file * filp)
 {
         return (filp->f_op == &hung_up_tty_fops);
@@ -1163,19 +1459,28 @@ int tty_hung_up_p(struct file * filp)
 
 EXPORT_SYMBOL(tty_hung_up_p);
 
-/*
- * This function is typically called only by the session leader, when
- * it wants to disassociate itself from its controlling tty.
+/**
+ *      disassociate_ctty       -       disconnect controlling tty
+ *      @on_exit: true if exiting so need to "hang up" the session
+ *
+ *      This function is typically called only by the session leader, when
+ *      it wants to disassociate itself from its controlling tty.
  *
- * It performs the following functions:
+ *      It performs the following functions:
  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
  *      (2)  Clears the tty from being controlling the session
  *      (3)  Clears the controlling tty for all processes in the
  *              session group.
  *
- * The argument on_exit is set to 1 if called when a process is
- * exiting; it is 0 if called by the ioctl TIOCNOTTY.
+ *      The argument on_exit is set to 1 if called when a process is
+ *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
+ *
+ *      Locking: tty_mutex is taken to protect current->signal->tty
+ *              BKL is taken for hysterical raisins
+ *              Tasklist lock is taken (under tty_mutex) to walk process
+ *              lists for the session.
  */
+
 void disassociate_ctty(int on_exit)
 {
         struct tty_struct *tty;
@@ -1222,6 +1527,25 @@ void disassociate_ctty(int on_exit)
         unlock_kernel();
 }
 
+
+/**
+ *      stop_tty        -       propogate flow control
+ *      @tty: tty to stop
+ *
+ *      Perform flow control to the driver. For PTY/TTY pairs we
+ *      must also propogate the TIOCKPKT status. May be called
+ *      on an already stopped device and will not re-call the driver
+ *      method.
+ *
+ *      This functionality is used by both the line disciplines for
+ *      halting incoming flow and by the driver. It may therefore be
+ *      called from any context, may be under the tty atomic_write_lock
+ *      but not always.
+ *
+ *      Locking:
+ *              Broken. Relies on BKL which is unsafe here.
+ */
+
 void stop_tty(struct tty_struct *tty)
 {
         if (tty->stopped)
@@ -1238,6 +1562,19 @@ void stop_tty(struct tty_struct *tty)
 
 EXPORT_SYMBOL(stop_tty);
 
+/**
+ *      start_tty       -       propogate flow control
+ *      @tty: tty to start
+ *
+ *      Start a tty that has been stopped if at all possible. Perform
+ *      any neccessary wakeups and propogate the TIOCPKT status. If this
+ *      is the tty was previous stopped and is being started then the
+ *      driver start method is invoked and the line discipline woken.
+ *
+ *      Locking:
+ *              Broken. Relies on BKL which is unsafe here.
+ */
+
 void start_tty(struct tty_struct *tty)
 {
         if (!tty->stopped || tty->flow_stopped)
@@ -1258,6 +1595,23 @@ void start_tty(struct tty_struct *tty)
 
 EXPORT_SYMBOL(start_tty);
 
+/**
+ *      tty_read        -       read method for tty device files
+ *      @file: pointer to tty file
+ *      @buf: user buffer
+ *      @count: size of user buffer
+ *      @ppos: unused
+ *
+ *      Perform the read system call function on this terminal device. Checks
+ *      for hung up devices before calling the line discipline method.
+ *
+ *      Locking:
+ *              Locks the line discipline internally while needed
+ *              For historical reasons the line discipline read method is
+ *      invoked under the BKL. This will go away in time so do not rely on it
+ *      in new code. Multiple read calls may be outstanding in parallel.
+ */
+
 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
                         loff_t *ppos)
 {
@@ -1302,6 +1656,7 @@ static inline ssize_t do_tty_write(
         ssize_t ret = 0, written = 0;
         unsigned int chunk;
         
+        /* FIXME: O_NDELAY ... */
         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
                 return -ERESTARTSYS;
         }
@@ -1318,6 +1673,9 @@ static inline ssize_t do_tty_write(
          * layer has problems with bigger chunks. It will
          * claim to be able to handle more characters than
          * it actually does.
+         *
+         * FIXME: This can probably go away now except that 64K chunks
+         * are too likely to fail unless switched to vmalloc...
          */
         chunk = 2048;
         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
@@ -1375,6 +1733,24 @@ static inline ssize_t do_tty_write(
 }
 
 
+/**
+ *      tty_write               -       write method for tty device file
+ *      @file: tty file pointer
+ *      @buf: user data to write
+ *      @count: bytes to write
+ *      @ppos: unused
+ *
+ *      Write data to a tty device via the line discipline.
+ *
+ *      Locking:
+ *              Locks the line discipline as required
+ *              Writes to the tty driver are serialized by the atomic_write_lock
+ *      and are then processed in chunks to the device. The line discipline
+ *      write method will not be involked in parallel for each device
+ *              The line discipline write method is called under the big
+ *      kernel lock for historical reasons. New code should not rely on this.
+ */
+
 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
                          loff_t *ppos)
 {
@@ -1422,7 +1798,18 @@ ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t
 
 static char ptychar[] = "pqrstuvwxyzabcde";
 
-static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
+/**
+ *      pty_line_name   -       generate name for a pty
+ *      @driver: the tty driver in use
+ *      @index: the minor number
+ *      @p: output buffer of at least 6 bytes
+ *
+ *      Generate a name from a driver reference and write it to the output
+ *      buffer.
+ *
+ *      Locking: None
+ */
+static void pty_line_name(struct tty_driver *driver, int index, char *p)
 {
         int i = index + driver->name_base;
         /* ->name is initialized to "ttyp", but "tty" is expected */
@@ -1431,24 +1818,53 @@ static inline void pty_line_name(struct tty_driver *driver, int index, char *p)
                         ptychar[i >> 4 & 0xf], i & 0xf);
 }
 
-static inline void tty_line_name(struct tty_driver *driver, int index, char *p)
+/**
+ *      pty_line_name   -       generate name for a tty
+ *      @driver: the tty driver in use
+ *      @index: the minor number
+ *      @p: output buffer of at least 7 bytes
+ *
+ *      Generate a name from a driver reference and write it to the output
+ *      buffer.
+ *
+ *      Locking: None
+ */
+static void tty_line_name(struct tty_driver *driver, int index, char *p)
 {
         sprintf(p, "%s%d", driver->name, index + driver->name_base);
 }
 
-/*
+/**
+ *      init_dev                -       initialise a tty device
+ *      @driver: tty driver we are opening a device on
+ *      @idx: device index
+ *      @tty: returned tty structure
+ *
+ *      Prepare a tty device. This may not be a "new" clean device but
+ *      could also be an active device. The pty drivers require special
+ *      handling because of this.
+ *
+ *      Locking:
+ *              The function is called under the tty_mutex, which
+ *      protects us from the tty struct or driver itself going away.
+ *
+ *      On exit the tty device has the line discipline attached and
+ *      a reference count of 1. If a pair was created for pty/tty use
+ *      and the other was a pty master then it too has a reference count of 1.
+ *
  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
  * failed open.  The new code protects the open with a mutex, so it's
  * really quite straightforward.  The mutex locking can probably be
  * relaxed for the (most common) case of reopening a tty.
  */
+
 static int init_dev(struct tty_driver *driver, int idx,
         struct tty_struct **ret_tty)
 {
         struct tty_struct *tty, *o_tty;
         struct termios *tp, **tp_loc, *o_tp, **o_tp_loc;
         struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
-        int retval=0;
+        int retval = 0;
 
         /* check whether we're reopening an existing tty */
         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
@@ -1662,10 +2078,20 @@ release_mem_out:
         goto end_init;
 }
 
-/*
- * Releases memory associated with a tty structure, and clears out the
- * driver table slots.
+/**
+ *      release_mem             -       release tty structure memory
+ *
+ *      Releases memory associated with a tty structure, and clears out the
+ *      driver table slots. This function is called when a device is no longer
+ *      in use. It also gets called when setup of a device fails.
+ *
+ *      Locking:
+ *              tty_mutex - sometimes only
+ *              takes the file list lock internally when working on the list
+ *      of ttys that the driver keeps.
+ *              FIXME: should we require tty_mutex is held here ??
  */
+
 static void release_mem(struct tty_struct *tty, int idx)
 {
         struct tty_struct *o_tty;
@@ -2006,18 +2432,27 @@ static void release_dev(struct file * filp)
 
 }
 
-/*
- * tty_open and tty_release keep up the tty count that contains the
- * number of opens done on a tty. We cannot use the inode-count, as
- * different inodes might point to the same tty.
+/**
+ *      tty_open                -       open a tty device
+ *      @inode: inode of device file
+ *      @filp: file pointer to tty
+ *
+ *      tty_open and tty_release keep up the tty count that contains the
+ *      number of opens done on a tty. We cannot use the inode-count, as
+ *      different inodes might point to the same tty.
+ *
+ *      Open-counting is needed for pty masters, as well as for keeping
+ *      track of serial lines: DTR is dropped when the last close happens.
+ *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
  *
- * Open-counting is needed for pty masters, as well as for keeping
- * track of serial lines: DTR is dropped when the last close happens.
- * (This is not done solely through tty->count, now.  - Ted 1/27/92)
+ *      The termios state of a pty is reset on first open so that
+ *      settings don't persist across reuse.
  *
- * The termios state of a pty is reset on first open so that
- * settings don't persist across reuse.
+ *      Locking: tty_mutex protects current->signal->tty, get_tty_driver and
+ *              init_dev work. tty->count should protect the rest.
+ *              task_lock is held to update task details for sessions
  */
+
 static int tty_open(struct inode * inode, struct file * filp)
 {
         struct tty_struct *tty;
@@ -2132,6 +2567,18 @@ got_driver:
 }
 
 #ifdef CONFIG_UNIX98_PTYS
+/**
+ *      ptmx_open               -       open a unix 98 pty master
+ *      @inode: inode of device file
+ *      @filp: file pointer to tty
+ *
+ *      Allocate a unix98 pty master device from the ptmx driver.
+ *
+ *      Locking: tty_mutex protects theinit_dev work. tty->count should
+                protect the rest.
+ *              allocated_ptys_lock handles the list of free pty numbers
+ */
+
 static int ptmx_open(struct inode * inode, struct file * filp)
 {
         struct tty_struct *tty;
@@ -2191,6 +2638,18 @@ out:
 }
 #endif
 
+/**
+ *      tty_release             -       vfs callback for close
+ *      @inode: inode of tty
+ *      @filp: file pointer for handle to tty
+ *
+ *      Called the last time each file handle is closed that references
+ *      this tty. There may however be several such references.
+ *
+ *      Locking:
+ *              Takes bkl. See release_dev
+ */
+
 static int tty_release(struct inode * inode, struct file * filp)
 {
         lock_kernel();
@@ -2199,7 +2658,18 @@ static int tty_release(struct inode * inode, struct file * filp)
         return 0;
 }
 
-/* No kernel lock held - fine */
+/**
+ *      tty_poll        -       check tty status
+ *      @filp: file being polled
+ *      @wait: poll wait structures to update
+ *
+ *      Call the line discipline polling method to obtain the poll
+ *      status of the device.
+ *
+ *      Locking: locks called line discipline but ldisc poll method
+ *      may be re-entered freely by other callers.
+ */
+
 static unsigned int tty_poll(struct file * filp, poll_table * wait)
 {
         struct tty_struct * tty;
@@ -2243,6 +2713,21 @@ static int tty_fasync(int fd, struct file * filp, int on)
         return 0;
 }
 
+/**
+ *      tiocsti                 -       fake input character
+ *      @tty: tty to fake input into
+ *      @p: pointer to character
+ *
+ *      Fake input to a tty device. Does the neccessary locking and
+ *      input management.
+ *
+ *      FIXME: does not honour flow control ??
+ *
+ *      Locking:
+ *              Called functions take tty_ldisc_lock
+ *              current->signal->tty check is safe without locks
+ */
+
 static int tiocsti(struct tty_struct *tty, char __user *p)
 {
         char ch, mbz = 0;
@@ -2258,6 +2743,18 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
         return 0;
 }
 
+/**
+ *      tiocgwinsz              -       implement window query ioctl
+ *      @tty; tty
+ *      @arg: user buffer for result
+ *
+ *      Copies the kernel idea of the window size into the user buffer. No
+ *      locking is done.
+ *
+ *      FIXME: Returning random values racing a window size set is wrong
+ *      should lock here against that
+ */
+
 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
 {
         if (copy_to_user(arg, &tty->winsize, sizeof(*arg)))
@@ -2265,6 +2762,24 @@ static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
         return 0;
 }
 
+/**
+ *      tiocswinsz              -       implement window size set ioctl
+ *      @tty; tty
+ *      @arg: user buffer for result
+ *
+ *      Copies the user idea of the window size to the kernel. Traditionally
+ *      this is just advisory information but for the Linux console it
+ *      actually has driver level meaning and triggers a VC resize.
+ *
+ *      Locking:
+ *              The console_sem is used to ensure we do not try and resize
+ *      the console twice at once.
+ *      FIXME: Two racing size sets may leave the console and kernel
+ *              parameters disagreeing. Is this exploitable ?
+ *      FIXME: Random values racing a window size get is wrong
+ *      should lock here against that
+ */
+
 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
         struct winsize __user * arg)
 {
@@ -2294,6 +2809,15 @@ static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
         return 0;
 }
 
+/**
+ *      tioccons        -       allow admin to move logical console
+ *      @file: the file to become console
+ *
+ *      Allow the adminstrator to move the redirected console device
+ *
+ *      Locking: uses redirect_lock to guard the redirect information
+ */
+
 static int tioccons(struct file *file)
 {
         if (!capable(CAP_SYS_ADMIN))
@@ -2319,6 +2843,17 @@ static int tioccons(struct file *file)
         return 0;
 }
 
+/**
+ *      fionbio         -       non blocking ioctl
+ *      @file: file to set blocking value
+ *      @p: user parameter
+ *
+ *      Historical tty interfaces had a blocking control ioctl before
+ *      the generic functionality existed. This piece of history is preserved
+ *      in the expected tty API of posix OS's.
+ *
+ *      Locking: none, the open fle handle ensures it won't go away.
+ */
 
 static int fionbio(struct file *file, int __user *p)
 {
@@ -2334,9 +2869,26 @@ static int fionbio(struct file *file, int __user *p)
         return 0;
 }
 
+/**
+ *      tiocsctty       -       set controlling tty
+ *      @tty: tty structure
+ *      @arg: user argument
+ *
+ *      This ioctl is used to manage job control. It permits a session
+ *      leader to set this tty as the controlling tty for the session.
+ *
+ *      Locking:
+ *              Takes tasklist lock internally to walk sessions
+ *              Takes task_lock() when updating signal->tty
+ *
+ *      FIXME: tty_mutex is needed to protect signal->tty references.
+ *      FIXME: why task_lock on the signal->tty reference ??
+ *
+ */
+
 static int tiocsctty(struct tty_struct *tty, int arg)
 {
-        task_t *p;
+        struct task_struct *p;
 
         if (current->signal->leader &&
             (current->signal->session == tty->session))
@@ -2374,6 +2926,18 @@ static int tiocsctty(struct tty_struct *tty, int arg)
         return 0;
 }
 
+/**
+ *      tiocgpgrp               -       get process group
+ *      @tty: tty passed by user
+ *      @real_tty: tty side of the tty pased by the user if a pty else the tty
+ *      @p: returned pid
+ *
+ *      Obtain the process group of the tty. If there is no process group
+ *      return an error.
+ *
+ *      Locking: none. Reference to ->signal->tty is safe.
+ */
+
 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
 {
         /*
@@ -2385,6 +2949,20 @@ static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
         return put_user(real_tty->pgrp, p);
 }
 
+/**
+ *      tiocspgrp               -       attempt to set process group
+ *      @tty: tty passed by user
+ *      @real_tty: tty side device matching tty passed by user
+ *      @p: pid pointer
+ *
+ *      Set the process group of the tty to the session passed. Only
+ *      permitted where the tty session is our session.
+ *
+ *      Locking: None
+ *
+ *      FIXME: current->signal->tty referencing is unsafe.
+ */
+
 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
 {
         pid_t pgrp;
@@ -2408,6 +2986,18 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
         return 0;
 }
 
+/**
+ *      tiocgsid                -       get session id
+ *      @tty: tty passed by user
+ *      @real_tty: tty side of the tty pased by the user if a pty else the tty
+ *      @p: pointer to returned session id
+ *
+ *      Obtain the session id of the tty. If there is no session
+ *      return an error.
+ *
+ *      Locking: none. Reference to ->signal->tty is safe.
+ */
+
 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
 {
         /*
@@ -2421,6 +3011,16 @@ static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t _
         return put_user(real_tty->session, p);
 }
 
+/**
+ *      tiocsetd        -       set line discipline
+ *      @tty: tty device
+ *      @p: pointer to user data
+ *
+ *      Set the line discipline according to user request.
+ *
+ *      Locking: see tty_set_ldisc, this function is just a helper
+ */
+
 static int tiocsetd(struct tty_struct *tty, int __user *p)
 {
         int ldisc;
@@ -2430,6 +3030,21 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
         return tty_set_ldisc(tty, ldisc);
 }
 
+/**
+ *      send_break      -       performed time break
+ *      @tty: device to break on
+ *      @duration: timeout in mS
+ *
+ *      Perform a timed break on hardware that lacks its own driver level
+ *      timed break functionality.
+ *
+ *      Locking:
+ *              None
+ *
+ *      FIXME:
+ *              What if two overlap
+ */
+
 static int send_break(struct tty_struct *tty, unsigned int duration)
 {
         tty->driver->break_ctl(tty, -1);
@@ -2442,8 +3057,19 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
         return 0;
 }
 
-static int
-tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
+/**
+ *      tiocmget                -       get modem status
+ *      @tty: tty device
+ *      @file: user file pointer
+ *      @p: pointer to result
+ *
+ *      Obtain the modem status bits from the tty driver if the feature
+ *      is supported. Return -EINVAL if it is not available.
+ *
+ *      Locking: none (up to the driver)
+ */
+
+static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
 {
         int retval = -EINVAL;
 
@@ -2456,8 +3082,20 @@ tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
         return retval;
 }
 
-static int
-tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
+/**
+ *      tiocmset                -       set modem status
+ *      @tty: tty device
+ *      @file: user file pointer
+ *      @cmd: command - clear bits, set bits or set all
+ *      @p: pointer to desired bits
+ *
+ *      Set the modem status bits from the tty driver if the feature
+ *      is supported. Return -EINVAL if it is not available.
+ *
+ *      Locking: none (up to the driver)
+ */
+
+static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
              unsigned __user *p)
 {
         int retval = -EINVAL;
@@ -2573,6 +3211,7 @@ int tty_ioctl(struct inode * inode, struct file * file,
                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
                         return 0;
                 case TIOCNOTTY:
+                        /* FIXME: taks lock or tty_mutex ? */
                         if (current->signal->tty != tty)
                                 return -ENOTTY;
                         if (current->signal->leader)
@@ -2753,9 +3392,16 @@ void do_SAK(struct tty_struct *tty)
 
 EXPORT_SYMBOL(do_SAK);
 
-/*
- * This routine is called out of the software interrupt to flush data
- * from the buffer chain to the line discipline.
+/**
+ *      flush_to_ldisc
+ *      @private_: tty structure passed from work queue.
+ *
+ *      This routine is called out of the software interrupt to flush data
+ *      from the buffer chain to the line discipline.
+ *
+ *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
+ *      while invoking the line discipline receive_buf method. The
+ *      receive_buf method is single threaded for each tty instance.
  */
  
 static void flush_to_ldisc(void *private_)
@@ -2831,6 +3477,8 @@ static int n_baud_table = ARRAY_SIZE(baud_table);
  *      Convert termios baud rate data into a speed. This should be called
  *      with the termios lock held if this termios is a terminal termios
  *      structure. May change the termios data.
+ *
+ *      Locking: none
  */
  
 int tty_termios_baud_rate(struct termios *termios)
@@ -2859,6 +3507,8 @@ EXPORT_SYMBOL(tty_termios_baud_rate);
  *      Returns the baud rate as an integer for this terminal. The
  *      termios lock must be held by the caller and the terminal bit
  *      flags may be updated.
+ *
+ *      Locking: none
  */
  
 int tty_get_baud_rate(struct tty_struct *tty)
@@ -2888,6 +3538,8 @@ EXPORT_SYMBOL(tty_get_baud_rate);
  *
  *      In the event of the queue being busy for flipping the work will be
  *      held off and retried later.
+ *
+ *      Locking: tty buffer lock. Driver locks in low latency mode.
  */
 
 void tty_flip_buffer_push(struct tty_struct *tty)
@@ -2907,9 +3559,16 @@ void tty_flip_buffer_push(struct tty_struct *tty)
 EXPORT_SYMBOL(tty_flip_buffer_push);
 
 
-/*
- * This subroutine initializes a tty structure.
+/**
+ *      initialize_tty_struct
+ *      @tty: tty to initialize
+ *
+ *      This subroutine initializes a tty structure that has been newly
+ *      allocated.
+ *
+ *      Locking: none - tty in question must not be exposed at this point
  */
+
 static void initialize_tty_struct(struct tty_struct *tty)
 {
         memset(tty, 0, sizeof(struct tty_struct));
@@ -2935,6 +3594,7 @@ static void initialize_tty_struct(struct tty_struct *tty)
 /*
  * The default put_char routine if the driver did not define one.
  */
+
 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
 {
         tty->driver->write(tty, &ch, 1);
@@ -2943,19 +3603,23 @@ static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
 static struct class *tty_class;
 
 /**
- * tty_register_device - register a tty device
- * @driver: the tty driver that describes the tty device
- * @index: the index in the tty driver for this tty device
- * @device: a struct device that is associated with this tty device.
- *      This field is optional, if there is no known struct device for this
- *      tty device it can be set to NULL safely.
+ *      tty_register_device - register a tty device
+ *      @driver: the tty driver that describes the tty device
+ *      @index: the index in the tty driver for this tty device
+ *      @device: a struct device that is associated with this tty device.
+ *              This field is optional, if there is no known struct device
+ *              for this tty device it can be set to NULL safely.
  *
- * Returns a pointer to the class device (or ERR_PTR(-EFOO) on error).
+ *      Returns a pointer to the class device (or ERR_PTR(-EFOO) on error).
  *
- * This call is required to be made to register an individual tty device if
- * the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If that
- * bit is not set, this function should not be called by a tty driver.
+ *      This call is required to be made to register an individual tty device
+ *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
+ *      that bit is not set, this function should not be called by a tty
+ *      driver.
+ *
+ *      Locking: ??
  */
+
 struct class_device *tty_register_device(struct tty_driver *driver,
                                          unsigned index, struct device *device)
 {
@@ -2977,13 +3641,16 @@ struct class_device *tty_register_device(struct tty_driver *driver,
 }
 
 /**
- * tty_unregister_device - unregister a tty device
- * @driver: the tty driver that describes the tty device
- * @index: the index in the tty driver for this tty device
+ *      tty_unregister_device - unregister a tty device
+ *      @driver: the tty driver that describes the tty device
+ *      @index: the index in the tty driver for this tty device
  *
- * If a tty device is registered with a call to tty_register_device() then
- * this function must be made when the tty device is gone.
+ *      If a tty device is registered with a call to tty_register_device() then
+ *      this function must be called when the tty device is gone.
+ *
+ *      Locking: ??
  */
+
 void tty_unregister_device(struct tty_driver *driver, unsigned index)
 {
         class_device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
@@ -3094,7 +3761,6 @@ int tty_register_driver(struct tty_driver *driver)
         driver->cdev.owner = driver->owner;
         error = cdev_add(&driver->cdev, dev, driver->num);
         if (error) {
-                cdev_del(&driver->cdev);
                 unregister_chrdev_region(dev, driver->num);
                 driver->ttys = NULL;
                 driver->termios = driver->termios_locked = NULL;
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index f19cf9d7792d..4ad47d321bd4 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -36,6 +36,18 @@
 #define TERMIOS_WAIT    2
 #define TERMIOS_TERMIO  4
 
+
+/**
+ *      tty_wait_until_sent     -       wait for I/O to finish
+ *      @tty: tty we are waiting for
+ *      @timeout: how long we will wait
+ *
+ *      Wait for characters pending in a tty driver to hit the wire, or
+ *      for a timeout to occur (eg due to flow control)
+ *
+ *      Locking: none
+ */
+
 void tty_wait_until_sent(struct tty_struct * tty, long timeout)
 {
         DECLARE_WAITQUEUE(wait, current);
@@ -94,6 +106,18 @@ static void unset_locked_termios(struct termios *termios,
                         old->c_cc[i] : termios->c_cc[i];
 }
 
+/**
+ *      change_termios          -       update termios values
+ *      @tty: tty to update
+ *      @new_termios: desired new value
+ *
+ *      Perform updates to the termios values set on this terminal. There
+ *      is a bit of layering violation here with n_tty in terms of the
+ *      internal knowledge of this function.
+ *
+ *      Locking: termios_sem
+ */
+
 static void change_termios(struct tty_struct * tty, struct termios * new_termios)
 {
         int canon_change;
@@ -155,6 +179,19 @@ static void change_termios(struct tty_struct * tty, struct termios * new_termios
         up(&tty->termios_sem);
 }
 
+/**
+ *      set_termios             -       set termios values for a tty
+ *      @tty: terminal device
+ *      @arg: user data
+ *      @opt: option information
+ *
+ *      Helper function to prepare termios data and run neccessary other
+ *      functions before using change_termios to do the actual changes.
+ *
+ *      Locking:
+ *              Called functions take ldisc and termios_sem locks
+ */
+
 static int set_termios(struct tty_struct * tty, void __user *arg, int opt)
 {
         struct termios tmp_termios;
@@ -284,6 +321,17 @@ static void set_sgflags(struct termios * termios, int flags)
         }
 }
 
+/**
+ *      set_sgttyb              -       set legacy terminal values
+ *      @tty: tty structure
+ *      @sgttyb: pointer to old style terminal structure
+ *
+ *      Updates a terminal from the legacy BSD style terminal information
+ *      structure.
+ *
+ *      Locking: termios_sem
+ */
+
 static int set_sgttyb(struct tty_struct * tty, struct sgttyb __user * sgttyb)
 {
         int retval;
@@ -369,9 +417,16 @@ static int set_ltchars(struct tty_struct * tty, struct ltchars __user * ltchars)
 }
 #endif
 
-/*
- * Send a high priority character to the tty.
+/**
+ *      send_prio_char          -       send priority character
+ *
+ *      Send a high priority character to the tty even if stopped
+ *
+ *      Locking: none
+ *
+ *      FIXME: overlapping calls with start/stop tty lose state of tty
  */
+
 static void send_prio_char(struct tty_struct *tty, char ch)
 {
         int     was_stopped = tty->stopped;
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index 45e9bd81bc0e..a9247b5213d5 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -465,7 +465,7 @@ vcs_open(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static struct file_operations vcs_fops = {
+static const struct file_operations vcs_fops = {
         .llseek         = vcs_lseek,
         .read           = vcs_read,
         .write          = vcs_write,
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index 7d42c8ec8dbc..b72b2049aaae 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -292,7 +292,7 @@ static int proc_viotape_open(struct inode *inode, struct file *file)
         return single_open(file, proc_viotape_show, NULL);
 }
 
-static struct file_operations proc_viotape_operations = {
+static const struct file_operations proc_viotape_operations = {
         .open           = proc_viotape_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
index 073da48c092e..8116a47b80f4 100644
--- a/drivers/char/vr41xx_giu.c
+++ b/drivers/char/vr41xx_giu.c
@@ -33,6 +33,7 @@
 #include <asm/cpu.h>
 #include <asm/io.h>
 #include <asm/vr41xx/giu.h>
+#include <asm/vr41xx/irq.h>
 #include <asm/vr41xx/vr41xx.h>
 
 MODULE_AUTHOR("Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>");
@@ -605,7 +606,7 @@ static int gpio_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations gpio_fops = {
+static const struct file_operations gpio_fops = {
         .owner          = THIS_MODULE,
         .read           = gpio_read,
         .write          = gpio_write,
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 3ef823d7d255..da7e66a2a38b 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -886,6 +886,7 @@ void vc_disallocate(unsigned int currcons)
         if (vc_cons_allocated(currcons)) {
                 struct vc_data *vc = vc_cons[currcons].d;
                 vc->vc_sw->con_deinit(vc);
+                module_put(vc->vc_sw->owner);
                 if (vc->vc_kmalloced)
                         kfree(vc->vc_screenbuf);
                 if (currcons >= MIN_NR_CONSOLES)
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index eccffaf26faa..a5628a8b6620 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -1011,6 +1011,8 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                    return -EPERM;
                 vt_dont_switch = 0;
                 return 0;
+        case VT_GETHIFONTMASK:
+                return put_user(vc->vc_hi_font_mask, (unsigned short __user *)arg);
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index d53f664a4dd8..fff89c2d88fd 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -45,7 +45,7 @@ config WATCHDOG_NOWAYOUT
 comment "Watchdog Device Drivers"
         depends on WATCHDOG
 
-# Architecture Independant
+# Architecture Independent
 
 config SOFT_WATCHDOG
         tristate "Software watchdog"
@@ -127,7 +127,7 @@ config S3C2410_WATCHDOG
           enabled.
 
           The driver is limited by the speed of the system's PCLK
-          signal, so with reasonbaly fast systems (PCLK around 50-66MHz)
+          signal, so with reasonably fast systems (PCLK around 50-66MHz)
           then watchdog intervals of over approximately 20seconds are
           unavailable.
 
@@ -423,7 +423,7 @@ config SBC_EPX_C3_WATCHDOG
           is no way to know if writing to its IO address will corrupt
           your system or have any real effect.  The only way to be sure
           that this driver does what you want is to make sure you
-          are runnning it on an EPX-C3 from Winsystems with the watchdog
+          are running it on an EPX-C3 from Winsystems with the watchdog
           timer at IO address 0x1ee and 0x1ef.  It will write to both those
           IO ports.  Basically, the assumption is made that if you compile
           this driver into your kernel and/or load it as a module, that you
@@ -472,7 +472,7 @@ config INDYDOG
         tristate "Indy/I2 Hardware Watchdog"
         depends on WATCHDOG && SGI_IP22
         help
-          Hardwaredriver for the Indy's/I2's watchdog. This is a
+          Hardware driver for the Indy's/I2's watchdog. This is a
           watchdog timer that will reboot the machine after a 60 second
           timer expired and no process has written to /dev/watchdog during
           that time.
diff --git a/drivers/char/watchdog/acquirewdt.c b/drivers/char/watchdog/acquirewdt.c
index 7289f4af93d0..c77fe3cf2852 100644
--- a/drivers/char/watchdog/acquirewdt.c
+++ b/drivers/char/watchdog/acquirewdt.c
@@ -231,7 +231,7 @@ static int acq_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations acq_fops = {
+static const struct file_operations acq_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = acq_write,
diff --git a/drivers/char/watchdog/advantechwdt.c b/drivers/char/watchdog/advantechwdt.c
index 194a3fd36b91..8069be445edc 100644
--- a/drivers/char/watchdog/advantechwdt.c
+++ b/drivers/char/watchdog/advantechwdt.c
@@ -227,7 +227,7 @@ advwdt_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations advwdt_fops = {
+static const struct file_operations advwdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = advwdt_write,
diff --git a/drivers/char/watchdog/alim1535_wdt.c b/drivers/char/watchdog/alim1535_wdt.c
index 8338ca300e2e..c5c94e4c9495 100644
--- a/drivers/char/watchdog/alim1535_wdt.c
+++ b/drivers/char/watchdog/alim1535_wdt.c
@@ -362,7 +362,7 @@ static int __init ali_find_watchdog(void)
  *      Kernel Interfaces
  */
 
-static struct file_operations ali_fops = {
+static const struct file_operations ali_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .write =        ali_write,
diff --git a/drivers/char/watchdog/alim7101_wdt.c b/drivers/char/watchdog/alim7101_wdt.c
index c05ac188a4d7..ffd7684f999b 100644
--- a/drivers/char/watchdog/alim7101_wdt.c
+++ b/drivers/char/watchdog/alim7101_wdt.c
@@ -281,7 +281,7 @@ static int fop_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
         }
 }
 
-static struct file_operations wdt_fops = {
+static const struct file_operations wdt_fops = {
         .owner=         THIS_MODULE,
         .llseek=        no_llseek,
         .write=         fop_write,
diff --git a/drivers/char/watchdog/at91_wdt.c b/drivers/char/watchdog/at91_wdt.c
index f61dedc3c96c..cc266715ea32 100644
--- a/drivers/char/watchdog/at91_wdt.c
+++ b/drivers/char/watchdog/at91_wdt.c
@@ -183,7 +183,7 @@ static ssize_t at91_wdt_write(struct file *file, const char *data, size_t len, l
 
 /* ......................................................................... */
 
-static struct file_operations at91wdt_fops = {
+static const struct file_operations at91wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .ioctl          = at91_wdt_ioctl,
diff --git a/drivers/char/watchdog/booke_wdt.c b/drivers/char/watchdog/booke_wdt.c
index 537f5c6729bf..e3cefc538b40 100644
--- a/drivers/char/watchdog/booke_wdt.c
+++ b/drivers/char/watchdog/booke_wdt.c
@@ -145,7 +145,7 @@ static int booke_wdt_open (struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations booke_wdt_fops = {
+static const struct file_operations booke_wdt_fops = {
   .owner = THIS_MODULE,
   .llseek = no_llseek,
   .write = booke_wdt_write,
diff --git a/drivers/char/watchdog/cpu5wdt.c b/drivers/char/watchdog/cpu5wdt.c
index 3e8410b5a65e..04c7e49918db 100644
--- a/drivers/char/watchdog/cpu5wdt.c
+++ b/drivers/char/watchdog/cpu5wdt.c
@@ -198,7 +198,7 @@ static ssize_t cpu5wdt_write(struct file *file, const char __user *buf, size_t c
         return count;
 }
 
-static struct file_operations cpu5wdt_fops = {
+static const struct file_operations cpu5wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .ioctl          = cpu5wdt_ioctl,
diff --git a/drivers/char/watchdog/ep93xx_wdt.c b/drivers/char/watchdog/ep93xx_wdt.c
index 9021dbb78299..77c8a955ae9e 100644
--- a/drivers/char/watchdog/ep93xx_wdt.c
+++ b/drivers/char/watchdog/ep93xx_wdt.c
@@ -187,7 +187,7 @@ static int ep93xx_wdt_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations ep93xx_wdt_fops = {
+static const struct file_operations ep93xx_wdt_fops = {
         .owner          = THIS_MODULE,
         .write          = ep93xx_wdt_write,
         .ioctl          = ep93xx_wdt_ioctl,
diff --git a/drivers/char/watchdog/eurotechwdt.c b/drivers/char/watchdog/eurotechwdt.c
index ea670de4fab7..62dbccb2f6df 100644
--- a/drivers/char/watchdog/eurotechwdt.c
+++ b/drivers/char/watchdog/eurotechwdt.c
@@ -356,7 +356,7 @@ static int eurwdt_notify_sys(struct notifier_block *this, unsigned long code,
  */
 
 
-static struct file_operations eurwdt_fops = {
+static const struct file_operations eurwdt_fops = {
         .owner  = THIS_MODULE,
         .llseek = no_llseek,
         .write  = eurwdt_write,
diff --git a/drivers/char/watchdog/i6300esb.c b/drivers/char/watchdog/i6300esb.c
index 93785f13242e..870539eabbf3 100644
--- a/drivers/char/watchdog/i6300esb.c
+++ b/drivers/char/watchdog/i6300esb.c
@@ -337,7 +337,7 @@ static int esb_notify_sys (struct notifier_block *this, unsigned long code, void
  *      Kernel Interfaces
  */
 
-static struct file_operations esb_fops = {
+static const struct file_operations esb_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .write =        esb_write,
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index bfbdbbf3c2f2..8385dd36eefe 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -378,7 +378,7 @@ static int i8xx_tco_notify_sys (struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations i8xx_tco_fops = {
+static const struct file_operations i8xx_tco_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .write =        i8xx_tco_write,
diff --git a/drivers/char/watchdog/ib700wdt.c b/drivers/char/watchdog/ib700wdt.c
index a2e53c715b36..fd95f7327798 100644
--- a/drivers/char/watchdog/ib700wdt.c
+++ b/drivers/char/watchdog/ib700wdt.c
@@ -255,7 +255,7 @@ ibwdt_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations ibwdt_fops = {
+static const struct file_operations ibwdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = ibwdt_write,
diff --git a/drivers/char/watchdog/ibmasr.c b/drivers/char/watchdog/ibmasr.c
index b0741cbdc139..26ceee7a4df0 100644
--- a/drivers/char/watchdog/ibmasr.c
+++ b/drivers/char/watchdog/ibmasr.c
@@ -322,7 +322,7 @@ static int asr_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations asr_fops = {
+static const struct file_operations asr_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .write =        asr_write,
diff --git a/drivers/char/watchdog/indydog.c b/drivers/char/watchdog/indydog.c
index d387979b2434..dacc1c20a310 100644
--- a/drivers/char/watchdog/indydog.c
+++ b/drivers/char/watchdog/indydog.c
@@ -154,7 +154,7 @@ static int indydog_notify_sys(struct notifier_block *this, unsigned long code, v
         return NOTIFY_DONE;
 }
 
-static struct file_operations indydog_fops = {
+static const struct file_operations indydog_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = indydog_write,
diff --git a/drivers/char/watchdog/ixp2000_wdt.c b/drivers/char/watchdog/ixp2000_wdt.c
index aa29a7d68759..692908819e26 100644
--- a/drivers/char/watchdog/ixp2000_wdt.c
+++ b/drivers/char/watchdog/ixp2000_wdt.c
@@ -168,7 +168,7 @@ ixp2000_wdt_release(struct inode *inode, struct file *file)
 }
 
 
-static struct file_operations ixp2000_wdt_fops =
+static const struct file_operations ixp2000_wdt_fops =
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/ixp4xx_wdt.c b/drivers/char/watchdog/ixp4xx_wdt.c
index e6a3fe83fa01..9db5cf2c38c3 100644
--- a/drivers/char/watchdog/ixp4xx_wdt.c
+++ b/drivers/char/watchdog/ixp4xx_wdt.c
@@ -162,7 +162,7 @@ ixp4xx_wdt_release(struct inode *inode, struct file *file)
 }
 
 
-static struct file_operations ixp4xx_wdt_fops =
+static const struct file_operations ixp4xx_wdt_fops =
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/machzwd.c b/drivers/char/watchdog/machzwd.c
index b67b4878ae0f..23734e07fb22 100644
--- a/drivers/char/watchdog/machzwd.c
+++ b/drivers/char/watchdog/machzwd.c
@@ -388,7 +388,7 @@ static int zf_notify_sys(struct notifier_block *this, unsigned long code,
 
 
 
-static struct file_operations zf_fops = {
+static const struct file_operations zf_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = zf_write,
diff --git a/drivers/char/watchdog/mixcomwd.c b/drivers/char/watchdog/mixcomwd.c
index 433c27f98159..ae943324d251 100644
--- a/drivers/char/watchdog/mixcomwd.c
+++ b/drivers/char/watchdog/mixcomwd.c
@@ -190,7 +190,7 @@ static int mixcomwd_ioctl(struct inode *inode, struct file *file,
         return 0;
 }
 
-static struct file_operations mixcomwd_fops=
+static const struct file_operations mixcomwd_fops=
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/mpc83xx_wdt.c b/drivers/char/watchdog/mpc83xx_wdt.c
index dac1381af364..a480903ee1a5 100644
--- a/drivers/char/watchdog/mpc83xx_wdt.c
+++ b/drivers/char/watchdog/mpc83xx_wdt.c
@@ -129,7 +129,7 @@ static int mpc83xx_wdt_ioctl(struct inode *inode, struct file *file,
         }
 }
 
-static struct file_operations mpc83xx_wdt_fops = {
+static const struct file_operations mpc83xx_wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = mpc83xx_wdt_write,
diff --git a/drivers/char/watchdog/mpc8xx_wdt.c b/drivers/char/watchdog/mpc8xx_wdt.c
index 11f0ccd4c4d4..35dd9e6e1140 100644
--- a/drivers/char/watchdog/mpc8xx_wdt.c
+++ b/drivers/char/watchdog/mpc8xx_wdt.c
@@ -132,7 +132,7 @@ static int mpc8xx_wdt_ioctl(struct inode *inode, struct file *file,
         return 0;
 }
 
-static struct file_operations mpc8xx_wdt_fops = {
+static const struct file_operations mpc8xx_wdt_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .write = mpc8xx_wdt_write,
diff --git a/drivers/char/watchdog/mpcore_wdt.c b/drivers/char/watchdog/mpcore_wdt.c
index c2d492c852fc..54b3c56ead0d 100644
--- a/drivers/char/watchdog/mpcore_wdt.c
+++ b/drivers/char/watchdog/mpcore_wdt.c
@@ -297,7 +297,7 @@ static void mpcore_wdt_shutdown(struct platform_device *dev)
 /*
  *      Kernel Interfaces
  */
-static struct file_operations mpcore_wdt_fops = {
+static const struct file_operations mpcore_wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = mpcore_wdt_write,
diff --git a/drivers/char/watchdog/mv64x60_wdt.c b/drivers/char/watchdog/mv64x60_wdt.c
index 20a6cbb0fbb8..5c8fab345b40 100644
--- a/drivers/char/watchdog/mv64x60_wdt.c
+++ b/drivers/char/watchdog/mv64x60_wdt.c
@@ -166,7 +166,7 @@ static int mv64x60_wdt_ioctl(struct inode *inode, struct file *file,
         return 0;
 }
 
-static struct file_operations mv64x60_wdt_fops = {
+static const struct file_operations mv64x60_wdt_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .write = mv64x60_wdt_write,
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 6d44ca68312d..cd7d1b6a5d9f 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -740,7 +740,7 @@ static int pcwd_notify_sys(struct notifier_block *this, unsigned long code, void
  *      Kernel Interfaces
  */
 
-static struct file_operations pcwd_fops = {
+static const struct file_operations pcwd_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = pcwd_write,
@@ -755,7 +755,7 @@ static struct miscdevice pcwd_miscdev = {
         .fops =         &pcwd_fops,
 };
 
-static struct file_operations pcwd_temp_fops = {
+static const struct file_operations pcwd_temp_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .read           = pcwd_temp_read,
diff --git a/drivers/char/watchdog/pcwd_pci.c b/drivers/char/watchdog/pcwd_pci.c
index 1f40ecefbf72..c7cfd6dbfe1b 100644
--- a/drivers/char/watchdog/pcwd_pci.c
+++ b/drivers/char/watchdog/pcwd_pci.c
@@ -625,7 +625,7 @@ static int pcipcwd_notify_sys(struct notifier_block *this, unsigned long code, v
  *      Kernel Interfaces
  */
 
-static struct file_operations pcipcwd_fops = {
+static const struct file_operations pcipcwd_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .write =        pcipcwd_write,
@@ -640,7 +640,7 @@ static struct miscdevice pcipcwd_miscdev = {
         .fops =         &pcipcwd_fops,
 };
 
-static struct file_operations pcipcwd_temp_fops = {
+static const struct file_operations pcipcwd_temp_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .read =         pcipcwd_temp_read,
diff --git a/drivers/char/watchdog/pcwd_usb.c b/drivers/char/watchdog/pcwd_usb.c
index 92bf8c1a0f0d..b7ae73dcdd08 100644
--- a/drivers/char/watchdog/pcwd_usb.c
+++ b/drivers/char/watchdog/pcwd_usb.c
@@ -523,7 +523,7 @@ static int usb_pcwd_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations usb_pcwd_fops = {
+static const struct file_operations usb_pcwd_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .write =        usb_pcwd_write,
@@ -538,7 +538,7 @@ static struct miscdevice usb_pcwd_miscdev = {
         .fops =         &usb_pcwd_fops,
 };
 
-static struct file_operations usb_pcwd_temperature_fops = {
+static const struct file_operations usb_pcwd_temperature_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
         .read =         usb_pcwd_temperature_read,
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index f267dad26071..be978e8ed754 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -319,7 +319,7 @@ static int s3c2410wdt_ioctl(struct inode *inode, struct file *file,
 
 /* kernel interface */
 
-static struct file_operations s3c2410wdt_fops = {
+static const struct file_operations s3c2410wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = s3c2410wdt_write,
diff --git a/drivers/char/watchdog/sa1100_wdt.c b/drivers/char/watchdog/sa1100_wdt.c
index b22e95c5470c..1fc16d995788 100644
--- a/drivers/char/watchdog/sa1100_wdt.c
+++ b/drivers/char/watchdog/sa1100_wdt.c
@@ -135,7 +135,7 @@ static int sa1100dog_ioctl(struct inode *inode, struct file *file,
         return ret;
 }
 
-static struct file_operations sa1100dog_fops =
+static const struct file_operations sa1100dog_fops =
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/sbc60xxwdt.c b/drivers/char/watchdog/sbc60xxwdt.c
index ed0bd55fbfc1..4663c2fd53cd 100644
--- a/drivers/char/watchdog/sbc60xxwdt.c
+++ b/drivers/char/watchdog/sbc60xxwdt.c
@@ -282,7 +282,7 @@ static int fop_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         }
 }
 
-static struct file_operations wdt_fops = {
+static const struct file_operations wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = fop_write,
diff --git a/drivers/char/watchdog/sbc8360.c b/drivers/char/watchdog/sbc8360.c
index 6562aa910ace..41fc6f80c493 100644
--- a/drivers/char/watchdog/sbc8360.c
+++ b/drivers/char/watchdog/sbc8360.c
@@ -200,7 +200,7 @@ static int wd_margin = 0xB;
 static int wd_multiplier = 2;
 static int nowayout = WATCHDOG_NOWAYOUT;
 
-module_param(timeout, int, 27);
+module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Index into timeout table (0-63) (default=27 (60s))");
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout,
@@ -305,7 +305,7 @@ static int sbc8360_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations sbc8360_fops = {
+static const struct file_operations sbc8360_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .write = sbc8360_write,
@@ -407,7 +407,7 @@ module_exit(sbc8360_exit);
 MODULE_AUTHOR("Ian E. Morgan <imorgan@webcon.ca>");
 MODULE_DESCRIPTION("SBC8360 watchdog driver");
 MODULE_LICENSE("GPL");
-MODULE_VERSION("1.0");
+MODULE_VERSION("1.01");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
 
 /* end of sbc8360.c */
diff --git a/drivers/char/watchdog/sbc_epx_c3.c b/drivers/char/watchdog/sbc_epx_c3.c
index 09867fadc720..bfc475dabe6d 100644
--- a/drivers/char/watchdog/sbc_epx_c3.c
+++ b/drivers/char/watchdog/sbc_epx_c3.c
@@ -154,7 +154,7 @@ static int epx_c3_notify_sys(struct notifier_block *this, unsigned long code,
         return NOTIFY_DONE;
 }
 
-static struct file_operations epx_c3_fops = {
+static const struct file_operations epx_c3_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = epx_c3_write,
diff --git a/drivers/char/watchdog/sc1200wdt.c b/drivers/char/watchdog/sc1200wdt.c
index 78ef6333c181..7c3cf293a5af 100644
--- a/drivers/char/watchdog/sc1200wdt.c
+++ b/drivers/char/watchdog/sc1200wdt.c
@@ -292,7 +292,7 @@ static struct notifier_block sc1200wdt_notifier =
         .notifier_call =        sc1200wdt_notify_sys,
 };
 
-static struct file_operations sc1200wdt_fops =
+static const struct file_operations sc1200wdt_fops =
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/sc520_wdt.c b/drivers/char/watchdog/sc520_wdt.c
index 4ee9974ad8cb..2c7c9db71be8 100644
--- a/drivers/char/watchdog/sc520_wdt.c
+++ b/drivers/char/watchdog/sc520_wdt.c
@@ -336,7 +336,7 @@ static int fop_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         }
 }
 
-static struct file_operations wdt_fops = {
+static const struct file_operations wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = fop_write,
diff --git a/drivers/char/watchdog/scx200_wdt.c b/drivers/char/watchdog/scx200_wdt.c
index c0b4754e8de0..c561299a5537 100644
--- a/drivers/char/watchdog/scx200_wdt.c
+++ b/drivers/char/watchdog/scx200_wdt.c
@@ -194,7 +194,7 @@ static int scx200_wdt_ioctl(struct inode *inode, struct file *file,
         }
 }
 
-static struct file_operations scx200_wdt_fops = {
+static const struct file_operations scx200_wdt_fops = {
         .owner   = THIS_MODULE,
         .llseek  = no_llseek,
         .write   = scx200_wdt_write,
diff --git a/drivers/char/watchdog/shwdt.c b/drivers/char/watchdog/shwdt.c
index 803701b675c0..1355038f1044 100644
--- a/drivers/char/watchdog/shwdt.c
+++ b/drivers/char/watchdog/shwdt.c
@@ -344,7 +344,7 @@ static int sh_wdt_notify_sys(struct notifier_block *this,
         return NOTIFY_DONE;
 }
 
-static struct file_operations sh_wdt_fops = {
+static const struct file_operations sh_wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = sh_wdt_write,
diff --git a/drivers/char/watchdog/softdog.c b/drivers/char/watchdog/softdog.c
index 79ce5c655428..ef8da517545a 100644
--- a/drivers/char/watchdog/softdog.c
+++ b/drivers/char/watchdog/softdog.c
@@ -243,7 +243,7 @@ static int softdog_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations softdog_fops = {
+static const struct file_operations softdog_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = softdog_write,
diff --git a/drivers/char/watchdog/w83627hf_wdt.c b/drivers/char/watchdog/w83627hf_wdt.c
index d15ca9a3986f..13f16d41c2fd 100644
--- a/drivers/char/watchdog/w83627hf_wdt.c
+++ b/drivers/char/watchdog/w83627hf_wdt.c
@@ -274,7 +274,7 @@ wdt_notify_sys(struct notifier_block *this, unsigned long code,
  *      Kernel Interfaces
  */
 
-static struct file_operations wdt_fops = {
+static const struct file_operations wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = wdt_write,
diff --git a/drivers/char/watchdog/w83877f_wdt.c b/drivers/char/watchdog/w83877f_wdt.c
index 52a8bd0a5988..ccf6c0915945 100644
--- a/drivers/char/watchdog/w83877f_wdt.c
+++ b/drivers/char/watchdog/w83877f_wdt.c
@@ -299,7 +299,7 @@ static int fop_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         }
 }
 
-static struct file_operations wdt_fops = {
+static const struct file_operations wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = fop_write,
diff --git a/drivers/char/watchdog/w83977f_wdt.c b/drivers/char/watchdog/w83977f_wdt.c
index c31849e4c5c2..98f4e17db70a 100644
--- a/drivers/char/watchdog/w83977f_wdt.c
+++ b/drivers/char/watchdog/w83977f_wdt.c
@@ -449,7 +449,7 @@ static int wdt_notify_sys(struct notifier_block *this, unsigned long code,
         return NOTIFY_DONE;
 }
 
-static struct file_operations wdt_fops=
+static const struct file_operations wdt_fops=
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/wafer5823wdt.c b/drivers/char/watchdog/wafer5823wdt.c
index 7cf6c9bbf486..2bb6a9d6ad28 100644
--- a/drivers/char/watchdog/wafer5823wdt.c
+++ b/drivers/char/watchdog/wafer5823wdt.c
@@ -222,7 +222,7 @@ static int wafwdt_notify_sys(struct notifier_block *this, unsigned long code, vo
  *      Kernel Interfaces
  */
 
-static struct file_operations wafwdt_fops = {
+static const struct file_operations wafwdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = wafwdt_write,
diff --git a/drivers/char/watchdog/wdrtas.c b/drivers/char/watchdog/wdrtas.c
index 3a462c34b92a..5c38cdf41731 100644
--- a/drivers/char/watchdog/wdrtas.c
+++ b/drivers/char/watchdog/wdrtas.c
@@ -520,7 +520,7 @@ wdrtas_reboot(struct notifier_block *this, unsigned long code, void *ptr)
 
 /*** initialization stuff */
 
-static struct file_operations wdrtas_fops = {
+static const struct file_operations wdrtas_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = wdrtas_write,
@@ -535,7 +535,7 @@ static struct miscdevice wdrtas_miscdev = {
         .fops =         &wdrtas_fops,
 };
 
-static struct file_operations wdrtas_temp_fops = {
+static const struct file_operations wdrtas_temp_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .read           = wdrtas_temp_read,
diff --git a/drivers/char/watchdog/wdt.c b/drivers/char/watchdog/wdt.c
index a1d972c8f44c..70be81e39a61 100644
--- a/drivers/char/watchdog/wdt.c
+++ b/drivers/char/watchdog/wdt.c
@@ -494,7 +494,7 @@ static int wdt_notify_sys(struct notifier_block *this, unsigned long code,
  */
 
 
-static struct file_operations wdt_fops = {
+static const struct file_operations wdt_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = wdt_write,
@@ -510,7 +510,7 @@ static struct miscdevice wdt_miscdev = {
 };
 
 #ifdef CONFIG_WDT_501
-static struct file_operations wdt_temp_fops = {
+static const struct file_operations wdt_temp_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .read           = wdt_temp_read,
diff --git a/drivers/char/watchdog/wdt285.c b/drivers/char/watchdog/wdt285.c
index 52825a1f1779..6555fb844f23 100644
--- a/drivers/char/watchdog/wdt285.c
+++ b/drivers/char/watchdog/wdt285.c
@@ -178,7 +178,7 @@ watchdog_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         return ret;
 }
 
-static struct file_operations watchdog_fops = {
+static const struct file_operations watchdog_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = watchdog_write,
diff --git a/drivers/char/watchdog/wdt977.c b/drivers/char/watchdog/wdt977.c
index 3cde2b9bb763..a0935bc775f8 100644
--- a/drivers/char/watchdog/wdt977.c
+++ b/drivers/char/watchdog/wdt977.c
@@ -418,7 +418,7 @@ static int wdt977_notify_sys(struct notifier_block *this, unsigned long code,
         return NOTIFY_DONE;
 }
 
-static struct file_operations wdt977_fops=
+static const struct file_operations wdt977_fops=
 {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
diff --git a/drivers/char/watchdog/wdt_pci.c b/drivers/char/watchdog/wdt_pci.c
index 7529ecdbabae..5918ca2c9c35 100644
--- a/drivers/char/watchdog/wdt_pci.c
+++ b/drivers/char/watchdog/wdt_pci.c
@@ -543,7 +543,7 @@ static int wdtpci_notify_sys(struct notifier_block *this, unsigned long code,
  */
 
 
-static struct file_operations wdtpci_fops = {
+static const struct file_operations wdtpci_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .write          = wdtpci_write,
@@ -559,7 +559,7 @@ static struct miscdevice wdtpci_miscdev = {
 };
 
 #ifdef CONFIG_WDT_501_PCI
-static struct file_operations wdtpci_temp_fops = {
+static const struct file_operations wdtpci_temp_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
         .read           = wdtpci_temp_read,
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 498aa37bca22..3ece69231343 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -51,6 +51,7 @@ void proc_fork_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -58,7 +59,8 @@ void proc_fork_connector(struct task_struct *task)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp); /* get high res monotonic timestamp */
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_FORK;
         ev->event_data.fork.parent_pid = task->real_parent->pid;
         ev->event_data.fork.parent_tgid = task->real_parent->tgid;
@@ -76,6 +78,7 @@ void proc_exec_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
+        struct timespec ts;
         __u8 buffer[CN_PROC_MSG_SIZE];
 
         if (atomic_read(&proc_event_num_listeners) < 1)
@@ -84,7 +87,8 @@ void proc_exec_connector(struct task_struct *task)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_EXEC;
         ev->event_data.exec.process_pid = task->pid;
         ev->event_data.exec.process_tgid = task->tgid;
@@ -100,6 +104,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -118,7 +123,8 @@ void proc_id_connector(struct task_struct *task, int which_id)
         } else
                 return;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
@@ -131,6 +137,7 @@ void proc_exit_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -138,7 +145,8 @@ void proc_exit_connector(struct task_struct *task)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_EXIT;
         ev->event_data.exit.process_pid = task->pid;
         ev->event_data.exit.process_tgid = task->tgid;
@@ -164,6 +172,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -171,7 +180,8 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         msg->seq = rcvd_seq;
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->cpu = -1;
         ev->what = PROC_EVENT_NONE;
         ev->event_data.ack.err = err;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 1ba4039777e8..b3df613ae4ec 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -284,39 +284,69 @@ EXPORT_SYMBOL_GPL(cpufreq_notify_transition);
  *                          SYSFS INTERFACE                          *
  *********************************************************************/
 
+static struct cpufreq_governor *__find_governor(const char *str_governor)
+{
+        struct cpufreq_governor *t;
+
+        list_for_each_entry(t, &cpufreq_governor_list, governor_list)
+                if (!strnicmp(str_governor,t->name,CPUFREQ_NAME_LEN))
+                        return t;
+
+        return NULL;
+}
+
 /**
  * cpufreq_parse_governor - parse a governor string
  */
 static int cpufreq_parse_governor (char *str_governor, unsigned int *policy,
                                 struct cpufreq_governor **governor)
 {
+        int err = -EINVAL;
+
         if (!cpufreq_driver)
-                return -EINVAL;
+                goto out;
+
         if (cpufreq_driver->setpolicy) {
                 if (!strnicmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
                         *policy = CPUFREQ_POLICY_PERFORMANCE;
-                        return 0;
+                        err = 0;
                 } else if (!strnicmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
                         *policy = CPUFREQ_POLICY_POWERSAVE;
-                        return 0;
+                        err = 0;
                 }
-                return -EINVAL;
-        } else {
+        } else if (cpufreq_driver->target) {
                 struct cpufreq_governor *t;
+
                 mutex_lock(&cpufreq_governor_mutex);
-                if (!cpufreq_driver || !cpufreq_driver->target)
-                        goto out;
-                list_for_each_entry(t, &cpufreq_governor_list, governor_list) {
-                        if (!strnicmp(str_governor,t->name,CPUFREQ_NAME_LEN)) {
-                                *governor = t;
+
+                t = __find_governor(str_governor);
+
+                if (t == NULL) {
+                        char *name = kasprintf(GFP_KERNEL, "cpufreq_%s", str_governor);
+
+                        if (name) {
+                                int ret;
+
                                 mutex_unlock(&cpufreq_governor_mutex);
-                                return 0;
+                                ret = request_module(name);
+                                mutex_lock(&cpufreq_governor_mutex);
+
+                                if (ret == 0)
+                                        t = __find_governor(str_governor);
                         }
+
+                        kfree(name);
                 }
-out:
+
+                if (t != NULL) {
+                        *governor = t;
+                        err = 0;
+                }
+
                 mutex_unlock(&cpufreq_governor_mutex);
         }
-        return -EINVAL;
+  out:
+        return err;
 }
 
 
@@ -364,10 +394,12 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
+        lock_cpu_hotplug();                                             \
         mutex_lock(&policy->lock);                                      \
         ret = __cpufreq_set_policy(policy, &new_policy);                \
         policy->user_policy.object = policy->object;                    \
         mutex_unlock(&policy->lock);                                    \
+        unlock_cpu_hotplug();                                           \
                                                                         \
         return ret ? ret : count;                                       \
 }
@@ -423,6 +455,8 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
         if (cpufreq_parse_governor(str_governor, &new_policy.policy, &new_policy.governor))
                 return -EINVAL;
 
+        lock_cpu_hotplug();
+
         /* Do not use cpufreq_set_policy here or the user_policy.max
            will be wrongly overridden */
         mutex_lock(&policy->lock);
@@ -432,6 +466,8 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
         policy->user_policy.governor = policy->governor;
         mutex_unlock(&policy->lock);
 
+        unlock_cpu_hotplug();
+
         return ret ? ret : count;
 }
 
@@ -1193,20 +1229,18 @@ EXPORT_SYMBOL(cpufreq_unregister_notifier);
  *********************************************************************/
 
 
+/* Must be called with lock_cpu_hotplug held */
 int __cpufreq_driver_target(struct cpufreq_policy *policy,
                             unsigned int target_freq,
                             unsigned int relation)
 {
         int retval = -EINVAL;
 
-        lock_cpu_hotplug();
         dprintk("target for CPU %u: %u kHz, relation %u\n", policy->cpu,
                 target_freq, relation);
         if (cpu_online(policy->cpu) && cpufreq_driver->target)
                 retval = cpufreq_driver->target(policy, target_freq, relation);
 
-        unlock_cpu_hotplug();
-
         return retval;
 }
 EXPORT_SYMBOL_GPL(__cpufreq_driver_target);
@@ -1221,17 +1255,23 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
         if (!policy)
                 return -EINVAL;
 
+        lock_cpu_hotplug();
         mutex_lock(&policy->lock);
 
         ret = __cpufreq_driver_target(policy, target_freq, relation);
 
         mutex_unlock(&policy->lock);
+        unlock_cpu_hotplug();
 
         cpufreq_cpu_put(policy);
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
 
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ * when "event" is CPUFREQ_GOV_LIMITS
+ */
 
 static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 {
@@ -1253,43 +1293,23 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 }
 
 
-int cpufreq_governor(unsigned int cpu, unsigned int event)
-{
-        int ret = 0;
-        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-
-        if (!policy)
-                return -EINVAL;
-
-        mutex_lock(&policy->lock);
-        ret = __cpufreq_governor(policy, event);
-        mutex_unlock(&policy->lock);
-
-        cpufreq_cpu_put(policy);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cpufreq_governor);
-
-
 int cpufreq_register_governor(struct cpufreq_governor *governor)
 {
-        struct cpufreq_governor *t;
+        int err;
 
         if (!governor)
                 return -EINVAL;
 
         mutex_lock(&cpufreq_governor_mutex);
 
-        list_for_each_entry(t, &cpufreq_governor_list, governor_list) {
-                if (!strnicmp(governor->name,t->name,CPUFREQ_NAME_LEN)) {
-                        mutex_unlock(&cpufreq_governor_mutex);
-                        return -EBUSY;
-                }
+        err = -EBUSY;
+        if (__find_governor(governor->name) == NULL) {
+                err = 0;
+                list_add(&governor->governor_list, &cpufreq_governor_list);
         }
-        list_add(&governor->governor_list, &cpufreq_governor_list);
 
         mutex_unlock(&cpufreq_governor_mutex);
-        return 0;
+        return err;
 }
 EXPORT_SYMBOL_GPL(cpufreq_register_governor);
 
@@ -1338,6 +1358,9 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_get_policy);
 
 
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ */
 static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_policy *policy)
 {
         int ret = 0;
@@ -1348,6 +1371,11 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_poli
 
         memcpy(&policy->cpuinfo, &data->cpuinfo, sizeof(struct cpufreq_cpuinfo));
 
+        if (policy->min > data->min && policy->min > policy->max) {
+                ret = -EINVAL;
+                goto error_out;
+        }
+
         /* verify the cpu speed can be set within this limit */
         ret = cpufreq_driver->verify(policy);
         if (ret)
@@ -1432,6 +1460,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         if (!data)
                 return -EINVAL;
 
+        lock_cpu_hotplug();
+
         /* lock this CPU */
         mutex_lock(&data->lock);
 
@@ -1442,6 +1472,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         data->user_policy.governor = data->governor;
 
         mutex_unlock(&data->lock);
+
+        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
 
         return ret;
@@ -1465,6 +1497,7 @@ int cpufreq_update_policy(unsigned int cpu)
         if (!data)
                 return -ENODEV;
 
+        lock_cpu_hotplug();
         mutex_lock(&data->lock);
 
         dprintk("updating policy for CPU %u\n", cpu);
@@ -1490,7 +1523,7 @@ int cpufreq_update_policy(unsigned int cpu)
         ret = __cpufreq_set_policy(data, &policy);
 
         mutex_unlock(&data->lock);
-
+        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
         return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index b3ebc8f01975..c4c578defabf 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -525,7 +525,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 break;
 
         case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                 mutex_lock(&dbs_mutex);
                 if (policy->max < this_dbs_info->cur_policy->cur)
                         __cpufreq_driver_target(
@@ -536,7 +535,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                         this_dbs_info->cur_policy,
                                         policy->min, CPUFREQ_RELATION_L);
                 mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                 break;
         }
         return 0;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 693e540481b4..52cf1f021825 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -12,22 +12,11 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/smp.h>
 #include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/ctype.h>
 #include <linux/cpufreq.h>
-#include <linux/sysctl.h>
-#include <linux/types.h>
-#include <linux/fs.h>
-#include <linux/sysfs.h>
 #include <linux/cpu.h>
-#include <linux/sched.h>
-#include <linux/kmod.h>
-#include <linux/workqueue.h>
 #include <linux/jiffies.h>
 #include <linux/kernel_stat.h>
-#include <linux/percpu.h>
 #include <linux/mutex.h>
 
 /*
@@ -56,16 +45,15 @@ static unsigned int def_sampling_rate;
 #define MIN_SAMPLING_RATE                       (def_sampling_rate / MIN_SAMPLING_RATE_RATIO)
 #define MAX_SAMPLING_RATE                       (500 * def_sampling_rate)
 #define DEF_SAMPLING_RATE_LATENCY_MULTIPLIER    (1000)
-#define DEF_SAMPLING_DOWN_FACTOR                (1)
-#define MAX_SAMPLING_DOWN_FACTOR                (10)
 #define TRANSITION_LATENCY_LIMIT                (10 * 1000)
 
 static void do_dbs_timer(void *data);
 
 struct cpu_dbs_info_s {
+        cputime64_t prev_cpu_idle;
+        cputime64_t prev_cpu_wall;
         struct cpufreq_policy *cur_policy;
-        unsigned int prev_cpu_idle_up;
-        unsigned int prev_cpu_idle_down;
+        struct work_struct work;
         unsigned int enable;
 };
 static DEFINE_PER_CPU(struct cpu_dbs_info_s, cpu_dbs_info);
@@ -80,31 +68,32 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
  * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
  * is recursive for the same process. -Venki
  */
-static DEFINE_MUTEX (dbs_mutex);
-static DECLARE_WORK     (dbs_work, do_dbs_timer, NULL);
+static DEFINE_MUTEX(dbs_mutex);
 
-static struct workqueue_struct *dbs_workq;
+static struct workqueue_struct  *kondemand_wq;
 
 struct dbs_tuners {
         unsigned int sampling_rate;
-        unsigned int sampling_down_factor;
         unsigned int up_threshold;
         unsigned int ignore_nice;
 };
 
 static struct dbs_tuners dbs_tuners_ins = {
         .up_threshold = DEF_FREQUENCY_UP_THRESHOLD,
-        .sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR,
         .ignore_nice = 0,
 };
 
-static inline unsigned int get_cpu_idle_time(unsigned int cpu)
+static inline cputime64_t get_cpu_idle_time(unsigned int cpu)
 {
-        return  kstat_cpu(cpu).cpustat.idle +
-                kstat_cpu(cpu).cpustat.iowait +
-                ( dbs_tuners_ins.ignore_nice ?
-                  kstat_cpu(cpu).cpustat.nice :
-                  0);
+        cputime64_t retval;
+
+        retval = cputime64_add(kstat_cpu(cpu).cpustat.idle,
+                        kstat_cpu(cpu).cpustat.iowait);
+
+        if (dbs_tuners_ins.ignore_nice)
+                retval = cputime64_add(retval, kstat_cpu(cpu).cpustat.nice);
+
+        return retval;
 }
 
 /************************** sysfs interface ************************/
@@ -133,35 +122,15 @@ static ssize_t show_##file_name						\
         return sprintf(buf, "%u\n", dbs_tuners_ins.object);             \
 }
 show_one(sampling_rate, sampling_rate);
-show_one(sampling_down_factor, sampling_down_factor);
 show_one(up_threshold, up_threshold);
 show_one(ignore_nice_load, ignore_nice);
 
-static ssize_t store_sampling_down_factor(struct cpufreq_policy *unused,
-                const char *buf, size_t count)
-{
-        unsigned int input;
-        int ret;
-        ret = sscanf (buf, "%u", &input);
-        if (ret != 1 )
-                return -EINVAL;
-
-        if (input > MAX_SAMPLING_DOWN_FACTOR || input < 1)
-                return -EINVAL;
-
-        mutex_lock(&dbs_mutex);
-        dbs_tuners_ins.sampling_down_factor = input;
-        mutex_unlock(&dbs_mutex);
-
-        return count;
-}
-
 static ssize_t store_sampling_rate(struct cpufreq_policy *unused,
                 const char *buf, size_t count)
 {
         unsigned int input;
         int ret;
-        ret = sscanf (buf, "%u", &input);
+        ret = sscanf(buf, "%u", &input);
 
         mutex_lock(&dbs_mutex);
         if (ret != 1 || input > MAX_SAMPLING_RATE || input < MIN_SAMPLING_RATE) {
@@ -180,7 +149,7 @@ static ssize_t store_up_threshold(struct cpufreq_policy *unused,
 {
         unsigned int input;
         int ret;
-        ret = sscanf (buf, "%u", &input);
+        ret = sscanf(buf, "%u", &input);
 
         mutex_lock(&dbs_mutex);
         if (ret != 1 || input > MAX_FREQUENCY_UP_THRESHOLD ||
@@ -203,7 +172,7 @@ static ssize_t store_ignore_nice_load(struct cpufreq_policy *policy,
 
         unsigned int j;
 
-        ret = sscanf (buf, "%u", &input);
+        ret = sscanf(buf, "%u", &input);
         if ( ret != 1 )
                 return -EINVAL;
 
@@ -217,12 +186,12 @@ static ssize_t store_ignore_nice_load(struct cpufreq_policy *policy,
         }
         dbs_tuners_ins.ignore_nice = input;
 
-        /* we need to re-evaluate prev_cpu_idle_up and prev_cpu_idle_down */
+        /* we need to re-evaluate prev_cpu_idle */
         for_each_online_cpu(j) {
-                struct cpu_dbs_info_s *j_dbs_info;
-                j_dbs_info = &per_cpu(cpu_dbs_info, j);
-                j_dbs_info->prev_cpu_idle_up = get_cpu_idle_time(j);
-                j_dbs_info->prev_cpu_idle_down = j_dbs_info->prev_cpu_idle_up;
+                struct cpu_dbs_info_s *dbs_info;
+                dbs_info = &per_cpu(cpu_dbs_info, j);
+                dbs_info->prev_cpu_idle = get_cpu_idle_time(j);
+                dbs_info->prev_cpu_wall = get_jiffies_64();
         }
         mutex_unlock(&dbs_mutex);
 
@@ -234,7 +203,6 @@ static struct freq_attr _name = \
 __ATTR(_name, 0644, show_##_name, store_##_name)
 
 define_one_rw(sampling_rate);
-define_one_rw(sampling_down_factor);
 define_one_rw(up_threshold);
 define_one_rw(ignore_nice_load);
 
@@ -242,7 +210,6 @@ static struct attribute * dbs_attributes[] = {
         &sampling_rate_max.attr,
         &sampling_rate_min.attr,
         &sampling_rate.attr,
-        &sampling_down_factor.attr,
         &up_threshold.attr,
         &ignore_nice_load.attr,
         NULL
@@ -255,26 +222,29 @@ static struct attribute_group dbs_attr_group = {
 
 /************************** sysfs end ************************/
 
-static void dbs_check_cpu(int cpu)
+static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 {
-        unsigned int idle_ticks, up_idle_ticks, total_ticks;
-        unsigned int freq_next;
-        unsigned int freq_down_sampling_rate;
-        static int down_skip[NR_CPUS];
-        struct cpu_dbs_info_s *this_dbs_info;
+        unsigned int idle_ticks, total_ticks;
+        unsigned int load;
+        cputime64_t cur_jiffies;
 
         struct cpufreq_policy *policy;
         unsigned int j;
 
-        this_dbs_info = &per_cpu(cpu_dbs_info, cpu);
         if (!this_dbs_info->enable)
                 return;
 
         policy = this_dbs_info->cur_policy;
+        cur_jiffies = jiffies64_to_cputime64(get_jiffies_64());
+        total_ticks = (unsigned int) cputime64_sub(cur_jiffies,
+                        this_dbs_info->prev_cpu_wall);
+        this_dbs_info->prev_cpu_wall = cur_jiffies;
+        if (!total_ticks)
+                return;
         /*
          * Every sampling_rate, we check, if current idle time is less
          * than 20% (default), then we try to increase frequency
-         * Every sampling_rate*sampling_down_factor, we look for a the lowest
+         * Every sampling_rate, we look for a the lowest
          * frequency which can sustain the load while keeping idle time over
          * 30%. If such a frequency exist, we try to decrease to this frequency.
          *
@@ -283,36 +253,26 @@ static void dbs_check_cpu(int cpu)
          * 5% (default) of current frequency
          */
 
-        /* Check for frequency increase */
+        /* Get Idle Time */
         idle_ticks = UINT_MAX;
         for_each_cpu_mask(j, policy->cpus) {
-                unsigned int tmp_idle_ticks, total_idle_ticks;
+                cputime64_t total_idle_ticks;
+                unsigned int tmp_idle_ticks;
                 struct cpu_dbs_info_s *j_dbs_info;
 
                 j_dbs_info = &per_cpu(cpu_dbs_info, j);
                 total_idle_ticks = get_cpu_idle_time(j);
-                tmp_idle_ticks = total_idle_ticks -
-                        j_dbs_info->prev_cpu_idle_up;
-                j_dbs_info->prev_cpu_idle_up = total_idle_ticks;
+                tmp_idle_ticks = (unsigned int) cputime64_sub(total_idle_ticks,
+                                j_dbs_info->prev_cpu_idle);
+                j_dbs_info->prev_cpu_idle = total_idle_ticks;
 
                 if (tmp_idle_ticks < idle_ticks)
                         idle_ticks = tmp_idle_ticks;
         }
+        load = (100 * (total_ticks - idle_ticks)) / total_ticks;
 
-        /* Scale idle ticks by 100 and compare with up and down ticks */
-        idle_ticks *= 100;
-        up_idle_ticks = (100 - dbs_tuners_ins.up_threshold) *
-                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
-
-        if (idle_ticks < up_idle_ticks) {
-                down_skip[cpu] = 0;
-                for_each_cpu_mask(j, policy->cpus) {
-                        struct cpu_dbs_info_s *j_dbs_info;
-
-                        j_dbs_info = &per_cpu(cpu_dbs_info, j);
-                        j_dbs_info->prev_cpu_idle_down =
-                                        j_dbs_info->prev_cpu_idle_up;
-                }
+        /* Check for frequency increase */
+        if (load > dbs_tuners_ins.up_threshold) {
                 /* if we are already at full speed then break out early */
                 if (policy->cur == policy->max)
                         return;
@@ -323,83 +283,54 @@ static void dbs_check_cpu(int cpu)
         }
 
         /* Check for frequency decrease */
-        down_skip[cpu]++;
-        if (down_skip[cpu] < dbs_tuners_ins.sampling_down_factor)
-                return;
-
-        idle_ticks = UINT_MAX;
-        for_each_cpu_mask(j, policy->cpus) {
-                unsigned int tmp_idle_ticks, total_idle_ticks;
-                struct cpu_dbs_info_s *j_dbs_info;
-
-                j_dbs_info = &per_cpu(cpu_dbs_info, j);
-                /* Check for frequency decrease */
-                total_idle_ticks = j_dbs_info->prev_cpu_idle_up;
-                tmp_idle_ticks = total_idle_ticks -
-                        j_dbs_info->prev_cpu_idle_down;
-                j_dbs_info->prev_cpu_idle_down = total_idle_ticks;
-
-                if (tmp_idle_ticks < idle_ticks)
-                        idle_ticks = tmp_idle_ticks;
-        }
-
-        down_skip[cpu] = 0;
         /* if we cannot reduce the frequency anymore, break out early */
         if (policy->cur == policy->min)
                 return;
 
-        /* Compute how many ticks there are between two measurements */
-        freq_down_sampling_rate = dbs_tuners_ins.sampling_rate *
-                dbs_tuners_ins.sampling_down_factor;
-        total_ticks = usecs_to_jiffies(freq_down_sampling_rate);
-
         /*
          * The optimal frequency is the frequency that is the lowest that
          * can support the current CPU usage without triggering the up
          * policy. To be safe, we focus 10 points under the threshold.
          */
-        freq_next = ((total_ticks - idle_ticks) * 100) / total_ticks;
-        freq_next = (freq_next * policy->cur) /
+        if (load < (dbs_tuners_ins.up_threshold - 10)) {
+                unsigned int freq_next;
+                freq_next = (policy->cur * load) /
                         (dbs_tuners_ins.up_threshold - 10);
 
-        if (freq_next < policy->min)
-                freq_next = policy->min;
-
-        if (freq_next <= ((policy->cur * 95) / 100))
                 __cpufreq_driver_target(policy, freq_next, CPUFREQ_RELATION_L);
+        }
 }
 
 static void do_dbs_timer(void *data)
 {
-        int i;
+        unsigned int cpu = smp_processor_id();
+        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
+
+        if (!dbs_info->enable)
+                return;
+
         lock_cpu_hotplug();
-        mutex_lock(&dbs_mutex);
-        for_each_online_cpu(i)
-                dbs_check_cpu(i);
-        queue_delayed_work(dbs_workq, &dbs_work,
-                           usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
-        mutex_unlock(&dbs_mutex);
+        dbs_check_cpu(dbs_info);
         unlock_cpu_hotplug();
+        queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work,
+                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
 }
 
-static inline void dbs_timer_init(void)
+static inline void dbs_timer_init(unsigned int cpu)
 {
-        INIT_WORK(&dbs_work, do_dbs_timer, NULL);
-        if (!dbs_workq)
-                dbs_workq = create_singlethread_workqueue("ondemand");
-        if (!dbs_workq) {
-                printk(KERN_ERR "ondemand: Cannot initialize kernel thread\n");
-                return;
-        }
-        queue_delayed_work(dbs_workq, &dbs_work,
-                           usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
+        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
+
+        INIT_WORK(&dbs_info->work, do_dbs_timer, 0);
+        queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work,
+                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
         return;
 }
 
-static inline void dbs_timer_exit(void)
+static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
-        if (dbs_workq)
-                cancel_rearming_delayed_workqueue(dbs_workq, &dbs_work);
+        dbs_info->enable = 0;
+        cancel_delayed_work(&dbs_info->work);
+        flush_workqueue(kondemand_wq);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
@@ -413,8 +344,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
         switch (event) {
         case CPUFREQ_GOV_START:
-                if ((!cpu_online(cpu)) ||
-                    (!policy->cur))
+                if ((!cpu_online(cpu)) || (!policy->cur))
                         return -EINVAL;
 
                 if (policy->cpuinfo.transition_latency >
@@ -427,18 +357,26 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                         break;
 
                 mutex_lock(&dbs_mutex);
+                dbs_enable++;
+                if (dbs_enable == 1) {
+                        kondemand_wq = create_workqueue("kondemand");
+                        if (!kondemand_wq) {
+                                printk(KERN_ERR "Creation of kondemand failed\n");
+                                dbs_enable--;
+                                mutex_unlock(&dbs_mutex);
+                                return -ENOSPC;
+                        }
+                }
                 for_each_cpu_mask(j, policy->cpus) {
                         struct cpu_dbs_info_s *j_dbs_info;
                         j_dbs_info = &per_cpu(cpu_dbs_info, j);
                         j_dbs_info->cur_policy = policy;
 
-                        j_dbs_info->prev_cpu_idle_up = get_cpu_idle_time(j);
-                        j_dbs_info->prev_cpu_idle_down
-                                = j_dbs_info->prev_cpu_idle_up;
+                        j_dbs_info->prev_cpu_idle = get_cpu_idle_time(j);
+                        j_dbs_info->prev_cpu_wall = get_jiffies_64();
                 }
                 this_dbs_info->enable = 1;
                 sysfs_create_group(&policy->kobj, &dbs_attr_group);
-                dbs_enable++;
                 /*
                  * Start the timerschedule work, when this governor
                  * is used for first time
@@ -457,50 +395,44 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                 def_sampling_rate = MIN_STAT_SAMPLING_RATE;
 
                         dbs_tuners_ins.sampling_rate = def_sampling_rate;
-                        dbs_timer_init();
                 }
+                dbs_timer_init(policy->cpu);
 
                 mutex_unlock(&dbs_mutex);
                 break;
 
         case CPUFREQ_GOV_STOP:
                 mutex_lock(&dbs_mutex);
-                this_dbs_info->enable = 0;
+                dbs_timer_exit(this_dbs_info);
                 sysfs_remove_group(&policy->kobj, &dbs_attr_group);
                 dbs_enable--;
-                /*
-                 * Stop the timerschedule work, when this governor
-                 * is used for first time
-                 */
                 if (dbs_enable == 0)
-                        dbs_timer_exit();
+                        destroy_workqueue(kondemand_wq);
 
                 mutex_unlock(&dbs_mutex);
 
                 break;
 
         case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                 mutex_lock(&dbs_mutex);
                 if (policy->max < this_dbs_info->cur_policy->cur)
-                        __cpufreq_driver_target(
-                                        this_dbs_info->cur_policy,
-                                        policy->max, CPUFREQ_RELATION_H);
+                        __cpufreq_driver_target(this_dbs_info->cur_policy,
+                                                policy->max,
+                                                CPUFREQ_RELATION_H);
                 else if (policy->min > this_dbs_info->cur_policy->cur)
-                        __cpufreq_driver_target(
-                                        this_dbs_info->cur_policy,
-                                        policy->min, CPUFREQ_RELATION_L);
+                        __cpufreq_driver_target(this_dbs_info->cur_policy,
+                                                policy->min,
+                                                CPUFREQ_RELATION_L);
                 mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                 break;
         }
         return 0;
 }
 
 static struct cpufreq_governor cpufreq_gov_dbs = {
-        .name           = "ondemand",
-        .governor       = cpufreq_governor_dbs,
-        .owner          = THIS_MODULE,
+        .name = "ondemand",
+        .governor = cpufreq_governor_dbs,
+        .owner = THIS_MODULE,
 };
 
 static int __init cpufreq_gov_dbs_init(void)
@@ -510,21 +442,15 @@ static int __init cpufreq_gov_dbs_init(void)
 
 static void __exit cpufreq_gov_dbs_exit(void)
 {
-        /* Make sure that the scheduled work is indeed not running.
-           Assumes the timer has been cancelled first. */
-        if (dbs_workq) {
-                flush_workqueue(dbs_workq);
-                destroy_workqueue(dbs_workq);
-        }
-
         cpufreq_unregister_governor(&cpufreq_gov_dbs);
 }
 
 
-MODULE_AUTHOR ("Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>");
-MODULE_DESCRIPTION ("'cpufreq_ondemand' - A dynamic cpufreq governor for "
-                "Low Latency Frequency Transition capable processors");
-MODULE_LICENSE ("GPL");
+MODULE_AUTHOR("Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>");
+MODULE_AUTHOR("Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>");
+MODULE_DESCRIPTION("'cpufreq_ondemand' - A dynamic cpufreq governor for "
+                   "Low Latency Frequency Transition capable processors");
+MODULE_LICENSE("GPL");
 
 module_init(cpufreq_gov_dbs_init);
 module_exit(cpufreq_gov_dbs_exit);
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 44ae5e5b94cf..a06c204589cd 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -18,6 +18,7 @@
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/cpufreq.h>
+#include <linux/cpu.h>
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/sysfs.h>
@@ -70,6 +71,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
         dprintk("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
 
+        lock_cpu_hotplug();
         mutex_lock(&userspace_mutex);
         if (!cpu_is_managed[policy->cpu])
                 goto err;
@@ -92,6 +94,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
  err:
         mutex_unlock(&userspace_mutex);
+        unlock_cpu_hotplug();
         return ret;
 }
 
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 17ee684144f9..b643d71298a9 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -59,6 +59,9 @@
 #define AES_EXTENDED_KEY_SIZE   64      /* in uint32_t units */
 #define AES_EXTENDED_KEY_SIZE_B (AES_EXTENDED_KEY_SIZE * sizeof(uint32_t))
 
+/* Whenever making any changes to the following
+ * structure *make sure* you keep E, d_data
+ * and cword aligned on 16 Bytes boundaries!!! */
 struct aes_ctx {
         struct {
                 struct cword encrypt;
@@ -66,8 +69,10 @@ struct aes_ctx {
         } cword;
         u32 *D;
         int key_length;
-        u32 E[AES_EXTENDED_KEY_SIZE];
-        u32 d_data[AES_EXTENDED_KEY_SIZE];
+        u32 E[AES_EXTENDED_KEY_SIZE]
+                __attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
+        u32 d_data[AES_EXTENDED_KEY_SIZE]
+                __attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
 };
 
 /* ====== Key management routines ====== */
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 5829143558e1..15278044295c 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -166,8 +166,8 @@ static struct dma_chan *dma_client_chan_alloc(struct dma_client *client)
 }
 
 /**
- * dma_client_chan_free - release a DMA channel
- * @chan: &dma_chan
+ * dma_chan_cleanup - release a DMA channel's resources
+ * @kref: kernel reference structure that contains the DMA channel device
  */
 void dma_chan_cleanup(struct kref *kref)
 {
@@ -199,7 +199,7 @@ static void dma_client_chan_free(struct dma_chan *chan)
  * dma_chans_rebalance - reallocate channels to clients
  *
  * When the number of DMA channel in the system changes,
- * channels need to be rebalanced among clients
+ * channels need to be rebalanced among clients.
  */
 static void dma_chans_rebalance(void)
 {
@@ -264,7 +264,7 @@ struct dma_client *dma_async_client_register(dma_event_callback event_callback)
 
 /**
  * dma_async_client_unregister - unregister a client and free the &dma_client
- * @client:
+ * @client: &dma_client to free
  *
  * Force frees any allocated DMA channels, frees the &dma_client memory
  */
@@ -306,7 +306,7 @@ void dma_async_client_chan_request(struct dma_client *client,
 }
 
 /**
- * dma_async_device_register -
+ * dma_async_device_register - registers DMA devices found
  * @device: &dma_device
  */
 int dma_async_device_register(struct dma_device *device)
@@ -348,8 +348,8 @@ int dma_async_device_register(struct dma_device *device)
 }
 
 /**
- * dma_async_device_unregister -
- * @device: &dma_device
+ * dma_async_device_cleanup - function called when all references are released
+ * @kref: kernel reference object
  */
 static void dma_async_device_cleanup(struct kref *kref)
 {
@@ -359,7 +359,11 @@ static void dma_async_device_cleanup(struct kref *kref)
         complete(&device->done);
 }
 
-void dma_async_device_unregister(struct dma_device* device)
+/**
+ * dma_async_device_unregister - unregisters DMA devices
+ * @device: &dma_device
+ */
+void dma_async_device_unregister(struct dma_device *device)
 {
         struct dma_chan *chan;
         unsigned long flags;
diff --git a/drivers/dma/ioatdma.c b/drivers/dma/ioatdma.c
index ecad8f65d2d4..dbd4d6c3698e 100644
--- a/drivers/dma/ioatdma.c
+++ b/drivers/dma/ioatdma.c
@@ -217,7 +217,7 @@ static void ioat_dma_free_chan_resources(struct dma_chan *chan)
 
 /**
  * do_ioat_dma_memcpy - actual function that initiates a IOAT DMA transaction
- * @chan: IOAT DMA channel handle
+ * @ioat_chan: IOAT DMA channel handle
  * @dest: DMA destination address
  * @src: DMA source address
  * @len: transaction length in bytes
@@ -383,7 +383,7 @@ static dma_cookie_t ioat_dma_memcpy_buf_to_pg(struct dma_chan *chan,
  * @dest_off: offset into that page
  * @src_pg: pointer to the page to copy from
  * @src_off: offset into that page
- * @len: transaction length in bytes. This is guaranteed to not make a copy
+ * @len: transaction length in bytes. This is guaranteed not to make a copy
  *       across a page boundary.
  */
 
@@ -407,7 +407,7 @@ static dma_cookie_t ioat_dma_memcpy_pg_to_pg(struct dma_chan *chan,
 }
 
 /**
- * ioat_dma_memcpy_issue_pending - push potentially unrecognoized appended descriptors to hw
+ * ioat_dma_memcpy_issue_pending - push potentially unrecognized appended descriptors to hw
  * @chan: DMA channel handle
  */
 
@@ -510,6 +510,8 @@ static void ioat_dma_memcpy_cleanup(struct ioat_dma_chan *chan)
  * ioat_dma_is_complete - poll the status of a IOAT DMA transaction
  * @chan: IOAT DMA channel handle
  * @cookie: DMA transaction identifier
+ * @done: if not %NULL, updated with last completed transaction
+ * @used: if not %NULL, updated with last used transaction
  */
 
 static enum dma_status ioat_dma_is_complete(struct dma_chan *chan,
@@ -826,7 +828,7 @@ static int __init ioat_init_module(void)
         /* if forced, worst case is that rmmod hangs */
         __unsafe(THIS_MODULE);
 
-        pci_module_init(&ioat_pci_drv);
+        return pci_register_driver(&ioat_pci_drv);
 }
 
 module_init(ioat_init_module);
diff --git a/drivers/dma/ioatdma_registers.h b/drivers/dma/ioatdma_registers.h
index 41a21ab2b000..a30c7349075a 100644
--- a/drivers/dma/ioatdma_registers.h
+++ b/drivers/dma/ioatdma_registers.h
@@ -76,7 +76,7 @@
 #define IOAT_CHANSTS_OFFSET                     0x04    /* 64-bit Channel Status Register */
 #define IOAT_CHANSTS_OFFSET_LOW                 0x04
 #define IOAT_CHANSTS_OFFSET_HIGH                0x08
-#define IOAT_CHANSTS_COMPLETED_DESCRIPTOR_ADDR  0xFFFFFFFFFFFFFFC0
+#define IOAT_CHANSTS_COMPLETED_DESCRIPTOR_ADDR  0xFFFFFFFFFFFFFFC0UL
 #define IOAT_CHANSTS_SOFT_ERR                   0x0000000000000010
 #define IOAT_CHANSTS_DMA_TRANSFER_STATUS        0x0000000000000007
 #define IOAT_CHANSTS_DMA_TRANSFER_STATUS_ACTIVE 0x0
diff --git a/drivers/dma/iovlock.c b/drivers/dma/iovlock.c
index 5ed327e453a2..d637555a833b 100644
--- a/drivers/dma/iovlock.c
+++ b/drivers/dma/iovlock.c
@@ -31,7 +31,7 @@
 #include <asm/io.h>
 #include <asm/uaccess.h>
 
-int num_pages_spanned(struct iovec *iov)
+static int num_pages_spanned(struct iovec *iov)
 {
         return
         ((PAGE_ALIGN((unsigned long)iov->iov_base + iov->iov_len) -
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 3a7cfe88b169..4bde30bb3be7 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -1,6 +1,6 @@
 /*
  * edac_mc kernel module
- * (C) 2005 Linux Networx (http://lnxi.com)
+ * (C) 2005, 2006 Linux Networx (http://lnxi.com)
  * This file may be distributed under the terms of the
  * GNU General Public License.
  *
@@ -33,13 +33,8 @@
 #include <asm/edac.h>
 #include "edac_mc.h"
 
-#define EDAC_MC_VERSION "Ver: 2.0.0 " __DATE__
+#define EDAC_MC_VERSION "Ver: 2.0.1 " __DATE__
 
-/* For now, disable the EDAC sysfs code.  The sysfs interface that EDAC
- * presents to user space needs more thought, and is likely to change
- * substantially.
- */
-#define DISABLE_EDAC_SYSFS
 
 #ifdef CONFIG_EDAC_DEBUG
 /* Values of 0 to 4 will generate output */
@@ -64,31 +59,12 @@ static int check_pci_parity = 0;	/* default YES check PCI parity */
 static int panic_on_pci_parity;         /* default no panic on PCI Parity */
 static atomic_t pci_parity_count = ATOMIC_INIT(0);
 
-/* Structure of the whitelist and blacklist arrays */
-struct edac_pci_device_list {
-        unsigned int  vendor;           /* Vendor ID */
-        unsigned int  device;           /* Deviice ID */
-};
-
-#define MAX_LISTED_PCI_DEVICES          32
-
-/* List of PCI devices (vendor-id:device-id) that should be skipped */
-static struct edac_pci_device_list pci_blacklist[MAX_LISTED_PCI_DEVICES];
-static int pci_blacklist_count;
-
-/* List of PCI devices (vendor-id:device-id) that should be scanned */
-static struct edac_pci_device_list pci_whitelist[MAX_LISTED_PCI_DEVICES];
-static int pci_whitelist_count ;
-
-#ifndef DISABLE_EDAC_SYSFS
 static struct kobject edac_pci_kobj; /* /sys/devices/system/edac/pci */
 static struct completion edac_pci_kobj_complete;
-#endif  /* DISABLE_EDAC_SYSFS */
 #endif  /* CONFIG_PCI */
 
 /*  START sysfs data and methods */
 
-#ifndef DISABLE_EDAC_SYSFS
 
 static const char *mem_types[] = {
         [MEM_EMPTY] = "Empty",
@@ -147,18 +123,10 @@ static struct completion edac_memctrl_kobj_complete;
  * /sys/devices/system/edac/mc;
  *      data structures and methods
  */
-#if 0
-static ssize_t memctrl_string_show(void *ptr, char *buffer)
-{
-        char *value = (char*) ptr;
-        return sprintf(buffer, "%s\n", value);
-}
-#endif
-
 static ssize_t memctrl_int_show(void *ptr, char *buffer)
 {
         int *value = (int*) ptr;
-        return sprintf(buffer, "%d\n", *value);
+        return sprintf(buffer, "%u\n", *value);
 }
 
 static ssize_t memctrl_int_store(void *ptr, const char *buffer, size_t count)
@@ -224,11 +192,6 @@ struct memctrl_dev_attribute attr_##_name = {			\
         .store  = _store,                                       \
 };
 
-/* cwrow<id> attribute f*/
-#if 0
-MEMCTRL_STRING_ATTR(mc_version,EDAC_MC_VERSION,S_IRUGO,memctrl_string_show,NULL);
-#endif
-
 /* csrow<id> control files */
 MEMCTRL_ATTR(panic_on_ue,S_IRUGO|S_IWUSR,memctrl_int_show,memctrl_int_store);
 MEMCTRL_ATTR(log_ue,S_IRUGO|S_IWUSR,memctrl_int_show,memctrl_int_store);
@@ -257,8 +220,6 @@ static struct kobj_type ktype_memctrl = {
         .default_attrs = (struct attribute **) memctrl_attr,
 };
 
-#endif  /* DISABLE_EDAC_SYSFS */
-
 /* Initialize the main sysfs entries for edac:
  *   /sys/devices/system/edac
  *
@@ -268,11 +229,6 @@ static struct kobj_type ktype_memctrl = {
  *         !0 FAILURE
  */
 static int edac_sysfs_memctrl_setup(void)
-#ifdef DISABLE_EDAC_SYSFS
-{
-        return 0;
-}
-#else
 {
         int err=0;
 
@@ -304,7 +260,6 @@ static int edac_sysfs_memctrl_setup(void)
 
         return err;
 }
-#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * MC teardown:
@@ -312,7 +267,6 @@ static int edac_sysfs_memctrl_setup(void)
  */
 static void edac_sysfs_memctrl_teardown(void)
 {
-#ifndef DISABLE_EDAC_SYSFS
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
         /* Unregister the MC's kobject and wait for reference count to reach
@@ -324,144 +278,9 @@ static void edac_sysfs_memctrl_teardown(void)
 
         /* Unregister the 'edac' object */
         sysdev_class_unregister(&edac_class);
-#endif  /* DISABLE_EDAC_SYSFS */
 }
 
 #ifdef CONFIG_PCI
-
-#ifndef DISABLE_EDAC_SYSFS
-
-/*
- * /sys/devices/system/edac/pci;
- *      data structures and methods
- */
-
-struct list_control {
-        struct edac_pci_device_list *list;
-        int *count;
-};
-
-#if 0
-/* Output the list as:  vendor_id:device:id<,vendor_id:device_id> */
-static ssize_t edac_pci_list_string_show(void *ptr, char *buffer)
-{
-        struct list_control *listctl;
-        struct edac_pci_device_list *list;
-        char *p = buffer;
-        int len=0;
-        int i;
-
-        listctl = ptr;
-        list = listctl->list;
-
-        for (i = 0; i < *(listctl->count); i++, list++ ) {
-                if (len > 0)
-                        len += snprintf(p + len, (PAGE_SIZE-len), ",");
-
-                len += snprintf(p + len,
-                                (PAGE_SIZE-len),
-                                "%x:%x",
-                                list->vendor,list->device);
-        }
-
-        len += snprintf(p + len,(PAGE_SIZE-len), "\n");
-        return (ssize_t) len;
-}
-
-/**
- *
- * Scan string from **s to **e looking for one 'vendor:device' tuple
- * where each field is a hex value
- *
- * return 0 if an entry is NOT found
- * return 1 if an entry is found
- *      fill in *vendor_id and *device_id with values found
- *
- * In both cases, make sure *s has been moved forward toward *e
- */
-static int parse_one_device(const char **s,const char **e,
-        unsigned int *vendor_id, unsigned int *device_id)
-{
-        const char *runner, *p;
-
-        /* if null byte, we are done */
-        if (!**s) {
-                (*s)++;  /* keep *s moving */
-                return 0;
-        }
-
-        /* skip over newlines & whitespace */
-        if ((**s == '\n') || isspace(**s)) {
-                (*s)++;
-                return 0;
-        }
-
-        if (!isxdigit(**s)) {
-                (*s)++;
-                return 0;
-        }
-
-        /* parse vendor_id */
-        runner = *s;
-
-        while (runner < *e) {
-                /* scan for vendor:device delimiter */
-                if (*runner == ':') {
-                        *vendor_id = simple_strtol((char*) *s, (char**) &p, 16);
-                        runner = p + 1;
-                        break;
-                }
-
-                runner++;
-        }
-
-        if (!isxdigit(*runner)) {
-                *s = ++runner;
-                return 0;
-        }
-
-        /* parse device_id */
-        if (runner < *e) {
-                *device_id = simple_strtol((char*)runner, (char**)&p, 16);
-                runner = p;
-        }
-
-        *s = runner;
-        return 1;
-}
-
-static ssize_t edac_pci_list_string_store(void *ptr, const char *buffer,
-                size_t count)
-{
-        struct list_control *listctl;
-        struct edac_pci_device_list *list;
-        unsigned int vendor_id, device_id;
-        const char *s, *e;
-        int *index;
-
-        s = (char*)buffer;
-        e = s + count;
-        listctl = ptr;
-        list = listctl->list;
-        index = listctl->count;
-        *index = 0;
-
-        while (*index < MAX_LISTED_PCI_DEVICES) {
-                if (parse_one_device(&s,&e,&vendor_id,&device_id)) {
-                        list[ *index ].vendor = vendor_id;
-                        list[ *index ].device = device_id;
-                        (*index)++;
-                }
-
-                /* check for all data consume */
-                if (s >= e)
-                        break;
-        }
-
-        return count;
-}
-
-#endif
 static ssize_t edac_pci_int_show(void *ptr, char *buffer)
 {
         int *value = ptr;
@@ -529,31 +348,6 @@ struct edac_pci_dev_attribute edac_pci_attr_##_name = {		\
         .store  = _store,                                       \
 };
 
-#if 0
-static struct list_control pci_whitelist_control = {
-        .list = pci_whitelist,
-        .count = &pci_whitelist_count
-};
-
-static struct list_control pci_blacklist_control = {
-        .list = pci_blacklist,
-        .count = &pci_blacklist_count
-};
-
-/* whitelist attribute */
-EDAC_PCI_STRING_ATTR(pci_parity_whitelist,
-        &pci_whitelist_control,
-        S_IRUGO|S_IWUSR,
-        edac_pci_list_string_show,
-        edac_pci_list_string_store);
-
-EDAC_PCI_STRING_ATTR(pci_parity_blacklist,
-        &pci_blacklist_control,
-        S_IRUGO|S_IWUSR,
-        edac_pci_list_string_show,
-        edac_pci_list_string_store);
-#endif
-
 /* PCI Parity control files */
 EDAC_PCI_ATTR(check_pci_parity, S_IRUGO|S_IWUSR, edac_pci_int_show,
         edac_pci_int_store);
@@ -582,18 +376,11 @@ static struct kobj_type ktype_edac_pci = {
         .default_attrs = (struct attribute **) edac_pci_attr,
 };
 
-#endif  /* DISABLE_EDAC_SYSFS */
-
 /**
  * edac_sysfs_pci_setup()
  *
  */
 static int edac_sysfs_pci_setup(void)
-#ifdef DISABLE_EDAC_SYSFS
-{
-        return 0;
-}
-#else
 {
         int err;
 
@@ -617,16 +404,13 @@ static int edac_sysfs_pci_setup(void)
 
         return err;
 }
-#endif  /* DISABLE_EDAC_SYSFS */
 
 static void edac_sysfs_pci_teardown(void)
 {
-#ifndef DISABLE_EDAC_SYSFS
         debugf0("%s()\n", __func__);
         init_completion(&edac_pci_kobj_complete);
         kobject_unregister(&edac_pci_kobj);
         wait_for_completion(&edac_pci_kobj_complete);
-#endif
 }
 
 
@@ -756,36 +540,6 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
 }
 
 /*
- * check_dev_on_list: Scan for a PCI device on a white/black list
- * @list:       an EDAC  &edac_pci_device_list  white/black list pointer
- * @free_index: index of next free entry on the list
- * @pci_dev:    PCI Device pointer
- *
- * see if list contains the device.
- *
- * Returns:     0 not found
- *              1 found on list
- */
-static int check_dev_on_list(struct edac_pci_device_list *list,
-                int free_index, struct pci_dev *dev)
-{
-        int i;
-        int rc = 0;     /* Assume not found */
-        unsigned short vendor=dev->vendor;
-        unsigned short device=dev->device;
-
-        /* Scan the list, looking for a vendor/device match */
-        for (i = 0; i < free_index; i++, list++ ) {
-                if ((list->vendor == vendor ) && (list->device == device )) {
-                        rc = 1;
-                        break;
-                }
-        }
-
-        return rc;
-}
-
-/*
  * pci_dev parity list iterator
  *      Scan the PCI device list for one iteration, looking for SERRORs
  *      Master Parity ERRORS or Parity ERRORs on primary or secondary devices
@@ -799,22 +553,7 @@ static inline void edac_pci_dev_parity_iterator(pci_parity_check_fn_t fn)
          * bumped until we are done with it
          */
         while((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
-                /* if whitelist exists then it has priority, so only scan
-                 * those devices on the whitelist
-                 */
-                if (pci_whitelist_count > 0 ) {
-                        if (check_dev_on_list(pci_whitelist,
-                                        pci_whitelist_count, dev))
-                                fn(dev);
-                } else {
-                        /*
-                         * if no whitelist, then check if this devices is
-                         * blacklisted
-                         */
-                        if (!check_dev_on_list(pci_blacklist,
-                                        pci_blacklist_count, dev))
-                                fn(dev);
-                }
+                fn(dev);
         }
 }
 
@@ -855,154 +594,101 @@ static inline void clear_pci_parity_errors(void)
 
 #else   /* CONFIG_PCI */
 
-static inline void do_pci_parity_check(void)
-{
-        /* no-op */
-}
-
-static inline void clear_pci_parity_errors(void)
-{
-        /* no-op */
-}
-
-static void edac_sysfs_pci_teardown(void)
-{
-}
+/* pre-process these away */
+#define do_pci_parity_check()
+#define clear_pci_parity_errors()
+#define edac_sysfs_pci_teardown()
+#define edac_sysfs_pci_setup()  (0)
 
-static int edac_sysfs_pci_setup(void)
-{
-        return 0;
-}
 #endif  /* CONFIG_PCI */
 
-#ifndef DISABLE_EDAC_SYSFS
-
-/* EDAC sysfs CSROW data structures and methods */
-
-/* Set of more detailed csrow<id> attribute show/store functions */
-static ssize_t csrow_ch0_dimm_label_show(struct csrow_info *csrow, char *data)
-{
-        ssize_t size = 0;
-
-        if (csrow->nr_channels > 0) {
-                size = snprintf(data, EDAC_MC_LABEL_LEN,"%s\n",
-                        csrow->channels[0].label);
-        }
-
-        return size;
-}
+/* EDAC sysfs CSROW data structures and methods
+ */
 
-static ssize_t csrow_ch1_dimm_label_show(struct csrow_info *csrow, char *data)
+/* Set of more default csrow<id> attribute show/store functions */
+static ssize_t csrow_ue_count_show(struct csrow_info *csrow, char *data, int private)
 {
-        ssize_t size = 0;
-
-        if (csrow->nr_channels > 0) {
-                size = snprintf(data, EDAC_MC_LABEL_LEN, "%s\n",
-                        csrow->channels[1].label);
-        }
-
-        return size;
+        return sprintf(data,"%u\n", csrow->ue_count);
 }
 
-static ssize_t csrow_ch0_dimm_label_store(struct csrow_info *csrow,
-                const char *data, size_t size)
+static ssize_t csrow_ce_count_show(struct csrow_info *csrow, char *data, int private)
 {
-        ssize_t max_size = 0;
-
-        if (csrow->nr_channels > 0) {
-                max_size = min((ssize_t)size,(ssize_t)EDAC_MC_LABEL_LEN-1);
-                strncpy(csrow->channels[0].label, data, max_size);
-                csrow->channels[0].label[max_size] = '\0';
-        }
-
-        return size;
+        return sprintf(data,"%u\n", csrow->ce_count);
 }
 
-static ssize_t csrow_ch1_dimm_label_store(struct csrow_info *csrow,
-                const char *data, size_t size)
+static ssize_t csrow_size_show(struct csrow_info *csrow, char *data, int private)
 {
-        ssize_t max_size = 0;
-
-        if (csrow->nr_channels > 1) {
-                max_size = min((ssize_t)size,(ssize_t)EDAC_MC_LABEL_LEN-1);
-                strncpy(csrow->channels[1].label, data, max_size);
-                csrow->channels[1].label[max_size] = '\0';
-        }
-
-        return max_size;
+        return sprintf(data,"%u\n", PAGES_TO_MiB(csrow->nr_pages));
 }
 
-static ssize_t csrow_ue_count_show(struct csrow_info *csrow, char *data)
+static ssize_t csrow_mem_type_show(struct csrow_info *csrow, char *data, int private)
 {
-        return sprintf(data,"%u\n", csrow->ue_count);
+        return sprintf(data,"%s\n", mem_types[csrow->mtype]);
 }
 
-static ssize_t csrow_ce_count_show(struct csrow_info *csrow, char *data)
+static ssize_t csrow_dev_type_show(struct csrow_info *csrow, char *data, int private)
 {
-        return sprintf(data,"%u\n", csrow->ce_count);
+        return sprintf(data,"%s\n", dev_types[csrow->dtype]);
 }
 
-static ssize_t csrow_ch0_ce_count_show(struct csrow_info *csrow, char *data)
+static ssize_t csrow_edac_mode_show(struct csrow_info *csrow, char *data, int private)
 {
-        ssize_t size = 0;
-
-        if (csrow->nr_channels > 0) {
-                size = sprintf(data,"%u\n", csrow->channels[0].ce_count);
-        }
-
-        return size;
+        return sprintf(data,"%s\n", edac_caps[csrow->edac_mode]);
 }
 
-static ssize_t csrow_ch1_ce_count_show(struct csrow_info *csrow, char *data)
+/* show/store functions for DIMM Label attributes */
+static ssize_t channel_dimm_label_show(struct csrow_info *csrow,
+                char *data, int channel)
 {
-        ssize_t size = 0;
-
-        if (csrow->nr_channels > 1) {
-                size = sprintf(data,"%u\n", csrow->channels[1].ce_count);
-        }
-
-        return size;
+        return snprintf(data, EDAC_MC_LABEL_LEN,"%s",
+                        csrow->channels[channel].label);
 }
 
-static ssize_t csrow_size_show(struct csrow_info *csrow, char *data)
+static ssize_t channel_dimm_label_store(struct csrow_info *csrow,
+                                const char *data,
+                                size_t count,
+                                int channel)
 {
-        return sprintf(data,"%u\n", PAGES_TO_MiB(csrow->nr_pages));
-}
+        ssize_t max_size = 0;
 
-static ssize_t csrow_mem_type_show(struct csrow_info *csrow, char *data)
-{
-        return sprintf(data,"%s\n", mem_types[csrow->mtype]);
-}
+        max_size = min((ssize_t)count,(ssize_t)EDAC_MC_LABEL_LEN-1);
+        strncpy(csrow->channels[channel].label, data, max_size);
+        csrow->channels[channel].label[max_size] = '\0';
 
-static ssize_t csrow_dev_type_show(struct csrow_info *csrow, char *data)
-{
-        return sprintf(data,"%s\n", dev_types[csrow->dtype]);
+        return max_size;
 }
 
-static ssize_t csrow_edac_mode_show(struct csrow_info *csrow, char *data)
+/* show function for dynamic chX_ce_count attribute */
+static ssize_t channel_ce_count_show(struct csrow_info *csrow,
+                                char *data,
+                                int channel)
 {
-        return sprintf(data,"%s\n", edac_caps[csrow->edac_mode]);
+        return sprintf(data, "%u\n", csrow->channels[channel].ce_count);
 }
 
+/* csrow specific attribute structure */
 struct csrowdev_attribute {
         struct attribute attr;
-        ssize_t (*show)(struct csrow_info *,char *);
-        ssize_t (*store)(struct csrow_info *, const char *,size_t);
+        ssize_t (*show)(struct csrow_info *,char *,int);
+        ssize_t (*store)(struct csrow_info *, const char *,size_t,int);
+        int    private;
 };
 
 #define to_csrow(k) container_of(k, struct csrow_info, kobj)
 #define to_csrowdev_attr(a) container_of(a, struct csrowdev_attribute, attr)
 
-/* Set of show/store higher level functions for csrow objects */
-static ssize_t csrowdev_show(struct kobject *kobj, struct attribute *attr,
-                char *buffer)
+/* Set of show/store higher level functions for default csrow attributes */
+static ssize_t csrowdev_show(struct kobject *kobj,
+                        struct attribute *attr,
+                        char *buffer)
 {
         struct csrow_info *csrow = to_csrow(kobj);
         struct csrowdev_attribute *csrowdev_attr = to_csrowdev_attr(attr);
 
         if (csrowdev_attr->show)
-                return csrowdev_attr->show(csrow, buffer);
-
+                return csrowdev_attr->show(csrow,
+                                        buffer,
+                                        csrowdev_attr->private);
         return -EIO;
 }
 
@@ -1013,8 +699,10 @@ static ssize_t csrowdev_store(struct kobject *kobj, struct attribute *attr,
         struct csrowdev_attribute * csrowdev_attr = to_csrowdev_attr(attr);
 
         if (csrowdev_attr->store)
-                return csrowdev_attr->store(csrow, buffer, count);
-
+                return csrowdev_attr->store(csrow,
+                                        buffer,
+                                        count,
+                                        csrowdev_attr->private);
         return -EIO;
 }
 
@@ -1023,69 +711,157 @@ static struct sysfs_ops csrowfs_ops = {
         .store  = csrowdev_store
 };
 
-#define CSROWDEV_ATTR(_name,_mode,_show,_store)                 \
+#define CSROWDEV_ATTR(_name,_mode,_show,_store,_private)        \
 struct csrowdev_attribute attr_##_name = {                      \
         .attr = {.name = __stringify(_name), .mode = _mode },   \
         .show   = _show,                                        \
         .store  = _store,                                       \
+        .private = _private,                                    \
 };
 
-/* cwrow<id>/attribute files */
-CSROWDEV_ATTR(size_mb,S_IRUGO,csrow_size_show,NULL);
-CSROWDEV_ATTR(dev_type,S_IRUGO,csrow_dev_type_show,NULL);
-CSROWDEV_ATTR(mem_type,S_IRUGO,csrow_mem_type_show,NULL);
-CSROWDEV_ATTR(edac_mode,S_IRUGO,csrow_edac_mode_show,NULL);
-CSROWDEV_ATTR(ue_count,S_IRUGO,csrow_ue_count_show,NULL);
-CSROWDEV_ATTR(ce_count,S_IRUGO,csrow_ce_count_show,NULL);
-CSROWDEV_ATTR(ch0_ce_count,S_IRUGO,csrow_ch0_ce_count_show,NULL);
-CSROWDEV_ATTR(ch1_ce_count,S_IRUGO,csrow_ch1_ce_count_show,NULL);
-
-/* control/attribute files */
-CSROWDEV_ATTR(ch0_dimm_label,S_IRUGO|S_IWUSR,
-                csrow_ch0_dimm_label_show,
-                csrow_ch0_dimm_label_store);
-CSROWDEV_ATTR(ch1_dimm_label,S_IRUGO|S_IWUSR,
-                csrow_ch1_dimm_label_show,
-                csrow_ch1_dimm_label_store);
+/* default cwrow<id>/attribute files */
+CSROWDEV_ATTR(size_mb,S_IRUGO,csrow_size_show,NULL,0);
+CSROWDEV_ATTR(dev_type,S_IRUGO,csrow_dev_type_show,NULL,0);
+CSROWDEV_ATTR(mem_type,S_IRUGO,csrow_mem_type_show,NULL,0);
+CSROWDEV_ATTR(edac_mode,S_IRUGO,csrow_edac_mode_show,NULL,0);
+CSROWDEV_ATTR(ue_count,S_IRUGO,csrow_ue_count_show,NULL,0);
+CSROWDEV_ATTR(ce_count,S_IRUGO,csrow_ce_count_show,NULL,0);
 
-/* Attributes of the CSROW<id> object */
-static struct csrowdev_attribute *csrow_attr[] = {
+/* default attributes of the CSROW<id> object */
+static struct csrowdev_attribute *default_csrow_attr[] = {
         &attr_dev_type,
         &attr_mem_type,
         &attr_edac_mode,
         &attr_size_mb,
         &attr_ue_count,
         &attr_ce_count,
-        &attr_ch0_ce_count,
-        &attr_ch1_ce_count,
-        &attr_ch0_dimm_label,
-        &attr_ch1_dimm_label,
         NULL,
 };
 
-/* No memory to release */
+
+/* possible dynamic channel DIMM Label attribute files */
+CSROWDEV_ATTR(ch0_dimm_label,S_IRUGO|S_IWUSR,
+                channel_dimm_label_show,
+                channel_dimm_label_store,
+                0 );
+CSROWDEV_ATTR(ch1_dimm_label,S_IRUGO|S_IWUSR,
+                channel_dimm_label_show,
+                channel_dimm_label_store,
+                1 );
+CSROWDEV_ATTR(ch2_dimm_label,S_IRUGO|S_IWUSR,
+                channel_dimm_label_show,
+                channel_dimm_label_store,
+                2 );
+CSROWDEV_ATTR(ch3_dimm_label,S_IRUGO|S_IWUSR,
+                channel_dimm_label_show,
+                channel_dimm_label_store,
+                3 );
+CSROWDEV_ATTR(ch4_dimm_label,S_IRUGO|S_IWUSR,
+                channel_dimm_label_show,
+                channel_dimm_label_store,
+                4 );
+CSROWDEV_ATTR(ch5_dimm_label,S_IRUGO|S_IWUSR,
+                channel_dimm_label_show,
+                channel_dimm_label_store,
+                5 );
+
+/* Total possible dynamic DIMM Label attribute file table */
+static struct csrowdev_attribute *dynamic_csrow_dimm_attr[] = {
+                &attr_ch0_dimm_label,
+                &attr_ch1_dimm_label,
+                &attr_ch2_dimm_label,
+                &attr_ch3_dimm_label,
+                &attr_ch4_dimm_label,
+                &attr_ch5_dimm_label
+};
+
+/* possible dynamic channel ce_count attribute files */
+CSROWDEV_ATTR(ch0_ce_count,S_IRUGO|S_IWUSR,
+                channel_ce_count_show,
+                NULL,
+                0 );
+CSROWDEV_ATTR(ch1_ce_count,S_IRUGO|S_IWUSR,
+                channel_ce_count_show,
+                NULL,
+                1 );
+CSROWDEV_ATTR(ch2_ce_count,S_IRUGO|S_IWUSR,
+                channel_ce_count_show,
+                NULL,
+                2 );
+CSROWDEV_ATTR(ch3_ce_count,S_IRUGO|S_IWUSR,
+                channel_ce_count_show,
+                NULL,
+                3 );
+CSROWDEV_ATTR(ch4_ce_count,S_IRUGO|S_IWUSR,
+                channel_ce_count_show,
+                NULL,
+                4 );
+CSROWDEV_ATTR(ch5_ce_count,S_IRUGO|S_IWUSR,
+                channel_ce_count_show,
+                NULL,
+                5 );
+
+/* Total possible dynamic ce_count attribute file table */
+static struct csrowdev_attribute *dynamic_csrow_ce_count_attr[] = {
+                &attr_ch0_ce_count,
+                &attr_ch1_ce_count,
+                &attr_ch2_ce_count,
+                &attr_ch3_ce_count,
+                &attr_ch4_ce_count,
+                &attr_ch5_ce_count
+};
+
+
+#define EDAC_NR_CHANNELS        6
+
+/* Create dynamic CHANNEL files, indexed by 'chan',  under specifed CSROW */
+static int edac_create_channel_files(struct kobject *kobj, int chan)
+{
+        int err=-ENODEV;
+
+        if (chan >= EDAC_NR_CHANNELS)
+                return err;
+
+        /* create the DIMM label attribute file */
+        err = sysfs_create_file(kobj,
+                        (struct attribute *) dynamic_csrow_dimm_attr[chan]);
+
+        if (!err) {
+                /* create the CE Count attribute file */
+                err = sysfs_create_file(kobj,
+                        (struct attribute *) dynamic_csrow_ce_count_attr[chan]);
+        } else {
+                debugf1("%s()  dimm labels and ce_count files created", __func__);
+        }
+
+        return err;
+}
+
+/* No memory to release for this kobj */
 static void edac_csrow_instance_release(struct kobject *kobj)
 {
         struct csrow_info *cs;
 
-        debugf1("%s()\n", __func__);
         cs = container_of(kobj, struct csrow_info, kobj);
         complete(&cs->kobj_complete);
 }
 
+/* the kobj_type instance for a CSROW */
 static struct kobj_type ktype_csrow = {
         .release = edac_csrow_instance_release,
         .sysfs_ops = &csrowfs_ops,
-        .default_attrs = (struct attribute **) csrow_attr,
+        .default_attrs = (struct attribute **) default_csrow_attr,
 };
 
 /* Create a CSROW object under specifed edac_mc_device */
-static int edac_create_csrow_object(struct kobject *edac_mci_kobj,
-                struct csrow_info *csrow, int index)
+static int edac_create_csrow_object(
+                struct kobject *edac_mci_kobj,
+                struct csrow_info *csrow,
+                int index)
 {
         int err = 0;
+        int chan;
 
-        debugf0("%s()\n", __func__);
         memset(&csrow->kobj, 0, sizeof(csrow->kobj));
 
         /* generate ..../edac/mc/mc<id>/csrow<index>   */
@@ -1095,21 +871,27 @@ static int edac_create_csrow_object(struct kobject *edac_mci_kobj,
 
         /* name this instance of csrow<id> */
         err = kobject_set_name(&csrow->kobj,"csrow%d",index);
+        if (err)
+                goto error_exit;
 
+        /* Instanstiate the csrow object */
+        err = kobject_register(&csrow->kobj);
         if (!err) {
-                /* Instanstiate the csrow object */
-                err = kobject_register(&csrow->kobj);
-
-                if (err)
-                        debugf0("Failed to register CSROW%d\n",index);
-                else
-                        debugf0("Registered CSROW%d\n",index);
+                /* Create the dyanmic attribute files on this csrow,
+                 * namely, the DIMM labels and the channel ce_count
+                 */
+                for (chan = 0; chan < csrow->nr_channels; chan++) {
+                        err = edac_create_channel_files(&csrow->kobj,chan);
+                        if (err)
+                                break;
+                }
         }
 
+error_exit:
         return err;
 }
 
-/* sysfs data structures and methods for the MCI kobjects */
+/* default sysfs methods and data structures for the main MCI kobject */
 
 static ssize_t mci_reset_counters_store(struct mem_ctl_info *mci,
                 const char *data, size_t count)
@@ -1135,6 +917,7 @@ static ssize_t mci_reset_counters_store(struct mem_ctl_info *mci,
         return count;
 }
 
+/* default attribute files for the MCI object */
 static ssize_t mci_ue_count_show(struct mem_ctl_info *mci, char *data)
 {
         return sprintf(data,"%d\n", mci->ue_count);
@@ -1160,71 +943,11 @@ static ssize_t mci_seconds_show(struct mem_ctl_info *mci, char *data)
         return sprintf(data,"%ld\n", (jiffies - mci->start_time) / HZ);
 }
 
-static ssize_t mci_mod_name_show(struct mem_ctl_info *mci, char *data)
-{
-        return sprintf(data,"%s %s\n", mci->mod_name, mci->mod_ver);
-}
-
 static ssize_t mci_ctl_name_show(struct mem_ctl_info *mci, char *data)
 {
         return sprintf(data,"%s\n", mci->ctl_name);
 }
 
-static int mci_output_edac_cap(char *buf, unsigned long edac_cap)
-{
-        char *p = buf;
-        int bit_idx;
-
-        for (bit_idx = 0; bit_idx < 8 * sizeof(edac_cap); bit_idx++) {
-                if ((edac_cap >> bit_idx) & 0x1)
-                        p += sprintf(p, "%s ", edac_caps[bit_idx]);
-        }
-
-        return p - buf;
-}
-
-static ssize_t mci_edac_capability_show(struct mem_ctl_info *mci, char *data)
-{
-        char *p = data;
-
-        p += mci_output_edac_cap(p,mci->edac_ctl_cap);
-        p += sprintf(p, "\n");
-        return p - data;
-}
-
-static ssize_t mci_edac_current_capability_show(struct mem_ctl_info *mci,
-                char *data)
-{
-        char *p = data;
-
-        p += mci_output_edac_cap(p,mci->edac_cap);
-        p += sprintf(p, "\n");
-        return p - data;
-}
-
-static int mci_output_mtype_cap(char *buf, unsigned long mtype_cap)
-{
-        char *p = buf;
-        int bit_idx;
-
-        for (bit_idx = 0; bit_idx < 8 * sizeof(mtype_cap); bit_idx++) {
-                if ((mtype_cap >> bit_idx) & 0x1)
-                        p += sprintf(p, "%s ", mem_types[bit_idx]);
-        }
-
-        return p - buf;
-}
-
-static ssize_t mci_supported_mem_type_show(struct mem_ctl_info *mci,
-                char *data)
-{
-        char *p = data;
-
-        p += mci_output_mtype_cap(p,mci->mtype_cap);
-        p += sprintf(p, "\n");
-        return p - data;
-}
-
 static ssize_t mci_size_mb_show(struct mem_ctl_info *mci, char *data)
 {
         int total_pages, csrow_idx;
@@ -1251,6 +974,7 @@ struct mcidev_attribute {
 #define to_mci(k) container_of(k, struct mem_ctl_info, edac_mci_kobj)
 #define to_mcidev_attr(a) container_of(a, struct mcidev_attribute, attr)
 
+/* MCI show/store functions for top most object */
 static ssize_t mcidev_show(struct kobject *kobj, struct attribute *attr,
                 char *buffer)
 {
@@ -1287,31 +1011,21 @@ struct mcidev_attribute mci_attr_##_name = {			\
         .store  = _store,                                       \
 };
 
-/* Control file */
+/* default Control file */
 MCIDEV_ATTR(reset_counters,S_IWUSR,NULL,mci_reset_counters_store);
 
-/* Attribute files */
+/* default Attribute files */
 MCIDEV_ATTR(mc_name,S_IRUGO,mci_ctl_name_show,NULL);
-MCIDEV_ATTR(module_name,S_IRUGO,mci_mod_name_show,NULL);
-MCIDEV_ATTR(edac_capability,S_IRUGO,mci_edac_capability_show,NULL);
 MCIDEV_ATTR(size_mb,S_IRUGO,mci_size_mb_show,NULL);
 MCIDEV_ATTR(seconds_since_reset,S_IRUGO,mci_seconds_show,NULL);
 MCIDEV_ATTR(ue_noinfo_count,S_IRUGO,mci_ue_noinfo_show,NULL);
 MCIDEV_ATTR(ce_noinfo_count,S_IRUGO,mci_ce_noinfo_show,NULL);
 MCIDEV_ATTR(ue_count,S_IRUGO,mci_ue_count_show,NULL);
 MCIDEV_ATTR(ce_count,S_IRUGO,mci_ce_count_show,NULL);
-MCIDEV_ATTR(edac_current_capability,S_IRUGO,
-        mci_edac_current_capability_show,NULL);
-MCIDEV_ATTR(supported_mem_type,S_IRUGO,
-        mci_supported_mem_type_show,NULL);
 
 static struct mcidev_attribute *mci_attr[] = {
         &mci_attr_reset_counters,
-        &mci_attr_module_name,
         &mci_attr_mc_name,
-        &mci_attr_edac_capability,
-        &mci_attr_edac_current_capability,
-        &mci_attr_supported_mem_type,
         &mci_attr_size_mb,
         &mci_attr_seconds_since_reset,
         &mci_attr_ue_noinfo_count,
@@ -1339,7 +1053,6 @@ static struct kobj_type ktype_mci = {
         .default_attrs = (struct attribute **) mci_attr,
 };
 
-#endif  /* DISABLE_EDAC_SYSFS */
 
 #define EDAC_DEVICE_SYMLINK     "device"
 
@@ -1352,11 +1065,6 @@ static struct kobj_type ktype_mci = {
  *      !0      Failure
  */
 static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
-#ifdef DISABLE_EDAC_SYSFS
-{
-        return 0;
-}
-#else
 {
         int i;
         int err;
@@ -1368,7 +1076,6 @@ static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
 
         /* set the name of the mc<id> object */
         err = kobject_set_name(edac_mci_kobj,"mc%d",mci->mc_idx);
-
         if (err)
                 return err;
 
@@ -1378,14 +1085,12 @@ static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
 
         /* register the mc<id> kobject */
         err = kobject_register(edac_mci_kobj);
-
         if (err)
                 return err;
 
         /* create a symlink for the device */
         err = sysfs_create_link(edac_mci_kobj, &mci->dev->kobj,
                                 EDAC_DEVICE_SYMLINK);
-
         if (err)
                 goto fail0;
 
@@ -1398,7 +1103,6 @@ static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
                 /* Only expose populated CSROWs */
                 if (csrow->nr_pages > 0) {
                         err = edac_create_csrow_object(edac_mci_kobj,csrow,i);
-
                         if (err)
                                 goto fail1;
                 }
@@ -1422,14 +1126,12 @@ fail0:
         wait_for_completion(&mci->kobj_complete);
         return err;
 }
-#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * remove a Memory Controller instance
  */
 static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 {
-#ifndef DISABLE_EDAC_SYSFS
         int i;
 
         debugf0("%s()\n", __func__);
@@ -1447,7 +1149,6 @@ static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
         init_completion(&mci->kobj_complete);
         kobject_unregister(&mci->edac_mci_kobj);
         wait_for_completion(&mci->kobj_complete);
-#endif  /* DISABLE_EDAC_SYSFS */
 }
 
 /* END OF sysfs data and methods */
diff --git a/drivers/edac/edac_mc.h b/drivers/edac/edac_mc.h
index bf6ab8a8d5ed..a1cfd4e3c97d 100644
--- a/drivers/edac/edac_mc.h
+++ b/drivers/edac/edac_mc.h
@@ -29,6 +29,7 @@
 #include <linux/rcupdate.h>
 #include <linux/completion.h>
 #include <linux/kobject.h>
+#include <linux/platform_device.h>
 
 #define EDAC_MC_LABEL_LEN       31
 #define MC_PROC_NAME_MAX_LEN 7
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 66d03f242d3c..1a159e8843ca 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -429,7 +429,7 @@ static inline void fcp_scsi_receive(fc_channel *fc, int token, int status, fc_hd
                 
                 if (fcmd->data) {
                         if (SCpnt->use_sg)
-                                dma_unmap_sg(fc->dev, (struct scatterlist *)SCpnt->buffer,
+                                dma_unmap_sg(fc->dev, (struct scatterlist *)SCpnt->request_buffer,
                                                 SCpnt->use_sg,
                                                 SCpnt->sc_data_direction);
                         else
@@ -810,7 +810,7 @@ static int fcp_scsi_queue_it(fc_channel *fc, Scsi_Cmnd *SCpnt, fcp_cmnd *fcmd, i
                                                              SCpnt->request_bufflen,
                                                              SCpnt->sc_data_direction);
                         } else {
-                                struct scatterlist *sg = (struct scatterlist *)SCpnt->buffer;
+                                struct scatterlist *sg = (struct scatterlist *)SCpnt->request_buffer;
                                 int nents;
 
                                 FCD(("XXX: Use_sg %d %d\n", SCpnt->use_sg, sg->length))
diff --git a/drivers/hwmon/abituguru.c b/drivers/hwmon/abituguru.c
index 59122cc0a50a..35ad1b032726 100644
--- a/drivers/hwmon/abituguru.c
+++ b/drivers/hwmon/abituguru.c
@@ -26,6 +26,7 @@
 #include <linux/jiffies.h>
 #include <linux/mutex.h>
 #include <linux/err.h>
+#include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
@@ -64,17 +65,17 @@
 #define ABIT_UGURU_IN_SENSOR                    0
 #define ABIT_UGURU_TEMP_SENSOR                  1
 #define ABIT_UGURU_NC                           2
-/* Timeouts / Retries, if these turn out to need a lot of fiddling we could
-   convert them to params. */
-/* 250 was determined by trial and error, 200 works most of the time, but not
-   always. I assume this is cpu-speed independent, since the ISA-bus and not
-   the CPU should be the bottleneck. Note that 250 sometimes is still not
-   enough (only reported on AN7 mb) this is handled by a higher layer. */
-#define ABIT_UGURU_WAIT_TIMEOUT                 250
+/* In many cases we need to wait for the uGuru to reach a certain status, most
+   of the time it will reach this status within 30 - 90 ISA reads, and thus we
+   can best busy wait. This define gives the total amount of reads to try. */
+#define ABIT_UGURU_WAIT_TIMEOUT                 125
+/* However sometimes older versions of the uGuru seem to be distracted and they
+   do not respond for a long time. To handle this we sleep before each of the
+   last ABIT_UGURU_WAIT_TIMEOUT_SLEEP tries. */
+#define ABIT_UGURU_WAIT_TIMEOUT_SLEEP           5
 /* Normally all expected status in abituguru_ready, are reported after the
-   first read, but sometimes not and we need to poll, 5 polls was not enough
-   50 sofar is. */
-#define ABIT_UGURU_READY_TIMEOUT                50
+   first read, but sometimes not and we need to poll. */
+#define ABIT_UGURU_READY_TIMEOUT                5
 /* Maximum 3 retries on timedout reads/writes, delay 200 ms before retrying */
 #define ABIT_UGURU_MAX_RETRIES                  3
 #define ABIT_UGURU_RETRY_DELAY                  (HZ/5)
@@ -142,6 +143,14 @@ static const u8 abituguru_pwm_max[5] = { 0, 255, 255, 75, 75 };
 static int force;
 module_param(force, bool, 0);
 MODULE_PARM_DESC(force, "Set to one to force detection.");
+static int bank1_types[ABIT_UGURU_MAX_BANK1_SENSORS] = { -1, -1, -1, -1, -1,
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 };
+module_param_array(bank1_types, int, NULL, 0);
+MODULE_PARM_DESC(bank1_types, "Bank1 sensortype autodetection override:\n"
+        "   -1 autodetect\n"
+        "    0 volt sensor\n"
+        "    1 temp sensor\n"
+        "    2 not connected");
 static int fan_sensors;
 module_param(fan_sensors, int, 0);
 MODULE_PARM_DESC(fan_sensors, "Number of fan sensors on the uGuru "
@@ -218,6 +227,10 @@ static int abituguru_wait(struct abituguru_data *data, u8 state)
                 timeout--;
                 if (timeout == 0)
                         return -EBUSY;
+                /* sleep a bit before our last few tries, see the comment on
+                   this where ABIT_UGURU_WAIT_TIMEOUT_SLEEP is defined. */
+                if (timeout <= ABIT_UGURU_WAIT_TIMEOUT_SLEEP)
+                        msleep(0);
         }
         return 0;
 }
@@ -248,6 +261,7 @@ static int abituguru_ready(struct abituguru_data *data)
                            "CMD reg does not hold 0xAC after ready command\n");
                         return -EIO;
                 }
+                msleep(0);
         }
 
         /* After this the ABIT_UGURU_DATA port should contain
@@ -260,6 +274,7 @@ static int abituguru_ready(struct abituguru_data *data)
                                 "state != more input after ready command\n");
                         return -EIO;
                 }
+                msleep(0);
         }
 
         data->uguru_ready = 1;
@@ -323,7 +338,8 @@ static int abituguru_read(struct abituguru_data *data,
         /* And read the data */
         for (i = 0; i < count; i++) {
                 if (abituguru_wait(data, ABIT_UGURU_STATUS_READ)) {
-                        ABIT_UGURU_DEBUG(1, "timeout exceeded waiting for "
+                        ABIT_UGURU_DEBUG(retries ? 1 : 3,
+                                "timeout exceeded waiting for "
                                 "read state (bank: %d, sensor: %d)\n",
                                 (int)bank_addr, (int)sensor_addr);
                         break;
@@ -342,7 +358,9 @@ static int abituguru_read(struct abituguru_data *data,
 static int abituguru_write(struct abituguru_data *data,
         u8 bank_addr, u8 sensor_addr, u8 *buf, int count)
 {
-        int i;
+        /* We use the ready timeout as we have to wait for 0xAC just like the
+           ready function */
+        int i, timeout = ABIT_UGURU_READY_TIMEOUT;
 
         /* Send the address */
         i = abituguru_send_address(data, bank_addr, sensor_addr,
@@ -362,7 +380,8 @@ static int abituguru_write(struct abituguru_data *data,
         }
 
         /* Now we need to wait till the chip is ready to be read again,
-           don't ask why */
+           so that we can read 0xAC as confirmation that our write has
+           succeeded. */
         if (abituguru_wait(data, ABIT_UGURU_STATUS_READ)) {
                 ABIT_UGURU_DEBUG(1, "timeout exceeded waiting for read state "
                         "after write (bank: %d, sensor: %d)\n", (int)bank_addr,
@@ -371,11 +390,15 @@ static int abituguru_write(struct abituguru_data *data,
         }
 
         /* Cmd port MUST be read now and should contain 0xAC */
-        if (inb_p(data->addr + ABIT_UGURU_CMD) != 0xAC) {
-                ABIT_UGURU_DEBUG(1, "CMD reg does not hold 0xAC after write "
-                        "(bank: %d, sensor: %d)\n", (int)bank_addr,
-                        (int)sensor_addr);
-                return -EIO;
+        while (inb_p(data->addr + ABIT_UGURU_CMD) != 0xAC) {
+                timeout--;
+                if (timeout == 0) {
+                        ABIT_UGURU_DEBUG(1, "CMD reg does not hold 0xAC after "
+                                "write (bank: %d, sensor: %d)\n",
+                                (int)bank_addr, (int)sensor_addr);
+                        return -EIO;
+                }
+                msleep(0);
         }
 
         /* Last put the chip back in ready state */
@@ -395,7 +418,16 @@ abituguru_detect_bank1_sensor_type(struct abituguru_data *data,
                                    u8 sensor_addr)
 {
         u8 val, buf[3];
-        int ret = ABIT_UGURU_NC;
+        int i, ret = -ENODEV; /* error is the most common used retval :| */
+
+        /* If overriden by the user return the user selected type */
+        if (bank1_types[sensor_addr] >= ABIT_UGURU_IN_SENSOR &&
+                        bank1_types[sensor_addr] <= ABIT_UGURU_NC) {
+                ABIT_UGURU_DEBUG(2, "assuming sensor type %d for bank1 sensor "
+                        "%d because of \"bank1_types\" module param\n",
+                        bank1_types[sensor_addr], (int)sensor_addr);
+                return bank1_types[sensor_addr];
+        }
 
         /* First read the sensor and the current settings */
         if (abituguru_read(data, ABIT_UGURU_SENSOR_BANK1, sensor_addr, &val,
@@ -422,7 +454,7 @@ abituguru_detect_bank1_sensor_type(struct abituguru_data *data,
         buf[2] = 250;
         if (abituguru_write(data, ABIT_UGURU_SENSOR_BANK1 + 2, sensor_addr,
                         buf, 3) != 3)
-                return -ENODEV;
+                goto abituguru_detect_bank1_sensor_type_exit;
         /* Now we need 20 ms to give the uguru time to read the sensors
            and raise a voltage alarm */
         set_current_state(TASK_UNINTERRUPTIBLE);
@@ -430,21 +462,16 @@ abituguru_detect_bank1_sensor_type(struct abituguru_data *data,
         /* Check for alarm and check the alarm is a volt low alarm. */
         if (abituguru_read(data, ABIT_UGURU_ALARM_BANK, 0, buf, 3,
                         ABIT_UGURU_MAX_RETRIES) != 3)
-                return -ENODEV;
+                goto abituguru_detect_bank1_sensor_type_exit;
         if (buf[sensor_addr/8] & (0x01 << (sensor_addr % 8))) {
                 if (abituguru_read(data, ABIT_UGURU_SENSOR_BANK1 + 1,
                                 sensor_addr, buf, 3,
                                 ABIT_UGURU_MAX_RETRIES) != 3)
-                        return -ENODEV;
+                        goto abituguru_detect_bank1_sensor_type_exit;
                 if (buf[0] & ABIT_UGURU_VOLT_LOW_ALARM_FLAG) {
-                        /* Restore original settings */
-                        if (abituguru_write(data, ABIT_UGURU_SENSOR_BANK1 + 2,
-                                        sensor_addr,
-                                        data->bank1_settings[sensor_addr],
-                                        3) != 3)
-                                return -ENODEV;
                         ABIT_UGURU_DEBUG(2, "  found volt sensor\n");
-                        return ABIT_UGURU_IN_SENSOR;
+                        ret = ABIT_UGURU_IN_SENSOR;
+                        goto abituguru_detect_bank1_sensor_type_exit;
                 } else
                         ABIT_UGURU_DEBUG(2, "  alarm raised during volt "
                                 "sensor test, but volt low flag not set\n");
@@ -460,7 +487,7 @@ abituguru_detect_bank1_sensor_type(struct abituguru_data *data,
         buf[2] = 10;
         if (abituguru_write(data, ABIT_UGURU_SENSOR_BANK1 + 2, sensor_addr,
                         buf, 3) != 3)
-                return -ENODEV;
+                goto abituguru_detect_bank1_sensor_type_exit;
         /* Now we need 50 ms to give the uguru time to read the sensors
            and raise a temp alarm */
         set_current_state(TASK_UNINTERRUPTIBLE);
@@ -468,15 +495,16 @@ abituguru_detect_bank1_sensor_type(struct abituguru_data *data,
         /* Check for alarm and check the alarm is a temp high alarm. */
         if (abituguru_read(data, ABIT_UGURU_ALARM_BANK, 0, buf, 3,
                         ABIT_UGURU_MAX_RETRIES) != 3)
-                return -ENODEV;
+                goto abituguru_detect_bank1_sensor_type_exit;
         if (buf[sensor_addr/8] & (0x01 << (sensor_addr % 8))) {
                 if (abituguru_read(data, ABIT_UGURU_SENSOR_BANK1 + 1,
                                 sensor_addr, buf, 3,
                                 ABIT_UGURU_MAX_RETRIES) != 3)
-                        return -ENODEV;
+                        goto abituguru_detect_bank1_sensor_type_exit;
                 if (buf[0] & ABIT_UGURU_TEMP_HIGH_ALARM_FLAG) {
-                        ret = ABIT_UGURU_TEMP_SENSOR;
                         ABIT_UGURU_DEBUG(2, "  found temp sensor\n");
+                        ret = ABIT_UGURU_TEMP_SENSOR;
+                        goto abituguru_detect_bank1_sensor_type_exit;
                 } else
                         ABIT_UGURU_DEBUG(2, "  alarm raised during temp "
                                 "sensor test, but temp high flag not set\n");
@@ -484,11 +512,23 @@ abituguru_detect_bank1_sensor_type(struct abituguru_data *data,
                 ABIT_UGURU_DEBUG(2, "  alarm not raised during temp sensor "
                         "test\n");
 
-        /* Restore original settings */
-        if (abituguru_write(data, ABIT_UGURU_SENSOR_BANK1 + 2, sensor_addr,
-                        data->bank1_settings[sensor_addr], 3) != 3)
+        ret = ABIT_UGURU_NC;
+abituguru_detect_bank1_sensor_type_exit:
+        /* Restore original settings, failing here is really BAD, it has been
+           reported that some BIOS-es hang when entering the uGuru menu with
+           invalid settings present in the uGuru, so we try this 3 times. */
+        for (i = 0; i < 3; i++)
+                if (abituguru_write(data, ABIT_UGURU_SENSOR_BANK1 + 2,
+                                sensor_addr, data->bank1_settings[sensor_addr],
+                                3) == 3)
+                        break;
+        if (i == 3) {
+                printk(KERN_ERR ABIT_UGURU_NAME
+                        ": Fatal error could not restore original settings. "
+                        "This should never happen please report this to the "
+                        "abituguru maintainer (see MAINTAINERS)\n");
                 return -ENODEV;
-
+        }
         return ret;
 }
 
@@ -514,7 +554,7 @@ abituguru_detect_no_bank2_sensors(struct abituguru_data *data)
 {
         int i;
 
-        if (fan_sensors) {
+        if (fan_sensors > 0 && fan_sensors <= ABIT_UGURU_MAX_BANK2_SENSORS) {
                 data->bank2_sensors = fan_sensors;
                 ABIT_UGURU_DEBUG(2, "assuming %d fan sensors because of "
                         "\"fan_sensors\" module param\n",
@@ -568,7 +608,7 @@ abituguru_detect_no_pwms(struct abituguru_data *data)
 {
         int i, j;
 
-        if (pwms) {
+        if (pwms > 0 && pwms <= ABIT_UGURU_MAX_PWMS) {
                 data->pwms = pwms;
                 ABIT_UGURU_DEBUG(2, "assuming %d PWM outputs because of "
                         "\"pwms\" module param\n", (int)data->pwms);
@@ -1288,7 +1328,7 @@ static struct abituguru_data *abituguru_update_device(struct device *dev)
                 data->update_timeouts = 0;
 LEAVE_UPDATE:
                 /* handle timeout condition */
-                if (err == -EBUSY) {
+                if (!success && (err == -EBUSY || err >= 0)) {
                         /* No overflow please */
                         if (data->update_timeouts < 255u)
                                 data->update_timeouts++;
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index df05df1a0ef6..ab230c033f99 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -372,7 +372,6 @@ static inline int readbytes(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
 
         while (count > 0) {
                 inval = i2c_inb(i2c_adap);
-/*printk("%#02x ",inval); if ( ! (count % 16) ) printk("\n"); */
                 if (inval>=0) {
                         *temp = inval;
                         rdcount++;
@@ -544,8 +543,7 @@ int i2c_bit_add_bus(struct i2c_adapter *adap)
         adap->timeout = 100;    /* default values, should       */
         adap->retries = 3;      /* be replaced by defines       */
 
-        i2c_add_adapter(adap);
-        return 0;
+        return i2c_add_adapter(adap);
 }
 
 
diff --git a/drivers/i2c/algos/i2c-algo-ite.c b/drivers/i2c/algos/i2c-algo-ite.c
index 2db7bfc85225..70d8eefb5efc 100644
--- a/drivers/i2c/algos/i2c-algo-ite.c
+++ b/drivers/i2c/algos/i2c-algo-ite.c
@@ -742,10 +742,8 @@ int i2c_iic_add_bus(struct i2c_adapter *adap)
         adap->retries = 3;              /* be replaced by defines       */
         adap->flags = 0;
 
-        i2c_add_adapter(adap);
         iic_init(iic_adap);
-
-        return 0;
+        return i2c_add_adapter(adap);
 }
 
 
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 82946acab4c7..b88a6fcf7bd0 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -374,10 +374,10 @@ int i2c_pca_add_bus(struct i2c_adapter *adap)
         adap->timeout = 100;            /* default values, should       */
         adap->retries = 3;              /* be replaced by defines       */
 
-        rval = pca_init(pca_adap);
+        if ((rval = pca_init(pca_adap)))
+                return rval;
 
-        if (!rval)
-                i2c_add_adapter(adap);
+        rval = i2c_add_adapter(adap);
 
         return rval;
 }
diff --git a/drivers/i2c/algos/i2c-algo-pcf.c b/drivers/i2c/algos/i2c-algo-pcf.c
index 6e498df1f717..5b24930adb5a 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.c
+++ b/drivers/i2c/algos/i2c-algo-pcf.c
@@ -479,9 +479,11 @@ int i2c_pcf_add_bus(struct i2c_adapter *adap)
         adap->timeout = 100;            /* default values, should       */
         adap->retries = 3;              /* be replaced by defines       */
 
-        rval = pcf_init_8584(pcf_adap);
-        if (!rval)
-                i2c_add_adapter(adap);
+        if ((rval = pcf_init_8584(pcf_adap)))
+                return rval;
+
+        rval = i2c_add_adapter(adap);
+
         return rval;
 }
 
diff --git a/drivers/i2c/algos/i2c-algo-sibyte.c b/drivers/i2c/algos/i2c-algo-sibyte.c
index 3df3f09995c2..32d41c6fac0f 100644
--- a/drivers/i2c/algos/i2c-algo-sibyte.c
+++ b/drivers/i2c/algos/i2c-algo-sibyte.c
@@ -173,9 +173,7 @@ int i2c_sibyte_add_bus(struct i2c_adapter *i2c_adap, int speed)
                 printk("\n");
         }
 
-        i2c_add_adapter(i2c_adap);
-
-        return 0;
+        return i2c_add_adapter(i2c_adap);
 }
 
 
diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
index aca7e1668605..48c56939c861 100644
--- a/drivers/i2c/busses/i2c-iop3xx.c
+++ b/drivers/i2c/busses/i2c-iop3xx.c
@@ -21,6 +21,9 @@
  * - Make it work with IXP46x chips
  * - Cleanup function names, coding style, etc
  *
+ * - writing to slave address causes latchup on iop331.
+ *      fix: driver refuses to address self.
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation, version 2.
@@ -73,12 +76,6 @@ iop3xx_i2c_reset(struct i2c_algo_iop3xx_data *iop3xx_adap)
 } 
 
 static void 
-iop3xx_i2c_set_slave_addr(struct i2c_algo_iop3xx_data *iop3xx_adap)
-{
-        __raw_writel(MYSAR, iop3xx_adap->ioaddr + SAR_OFFSET);
-}
-
-static void 
 iop3xx_i2c_enable(struct i2c_algo_iop3xx_data *iop3xx_adap)
 {
         u32 cr = IOP3XX_ICR_GCD | IOP3XX_ICR_SCLEN | IOP3XX_ICR_UE;
@@ -248,6 +245,13 @@ iop3xx_i2c_send_target_addr(struct i2c_algo_iop3xx_data *iop3xx_adap,
         int status;
         int rc;
 
+        /* avoid writing to my slave address (hangs on 80331),
+         * forbidden in Intel developer manual
+         */
+        if (msg->addr == MYSAR) {
+                return -EBUSY;
+        }
+
         __raw_writel(iic_cook_addr(msg), iop3xx_adap->ioaddr + DBR_OFFSET);
         
         cr &= ~(IOP3XX_ICR_MSTOP | IOP3XX_ICR_NACK);
@@ -498,7 +502,6 @@ iop3xx_i2c_probe(struct platform_device *pdev)
         spin_lock_init(&adapter_data->lock);
 
         iop3xx_i2c_reset(adapter_data);
-        iop3xx_i2c_set_slave_addr(adapter_data);
         iop3xx_i2c_enable(adapter_data);
 
         platform_set_drvdata(pdev, new_adapter);
diff --git a/drivers/i2c/busses/i2c-iop3xx.h b/drivers/i2c/busses/i2c-iop3xx.h
index e46ebaea7b1e..8485861f6a36 100644
--- a/drivers/i2c/busses/i2c-iop3xx.h
+++ b/drivers/i2c/busses/i2c-iop3xx.h
@@ -80,7 +80,7 @@
 #define IOP3XX_GPOD_I2C0        0x00c0  /* clear these bits to enable ch0 */
 #define IOP3XX_GPOD_I2C1        0x0030  /* clear these bits to enable ch1 */
 
-#define MYSAR                   0x02    /* SWAG a suitable slave address */
+#define MYSAR                   0       /* default slave address */
 
 #define I2C_ERR                 321
 #define I2C_ERR_BERR            (I2C_ERR+0)
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 2a0b3be7cdd0..53bb43593863 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -148,8 +148,6 @@ static int i2c_powermac_master_xfer(	struct i2c_adapter *adap,
         int                     read;
         int                     addrdir;
 
-        if (num != 1)
-                return -EINVAL;
         if (msgs->flags & I2C_M_TEN)
                 return -EINVAL;
         read = (msgs->flags & I2C_M_RD) != 0;
@@ -166,7 +164,7 @@ static int i2c_powermac_master_xfer(	struct i2c_adapter *adap,
         rc = pmac_i2c_xfer(bus, addrdir, 0, 0, msgs->buf, msgs->len);
  bail:
         pmac_i2c_close(bus);
-        return rc < 0 ? rc : msgs->len;
+        return rc < 0 ? rc : 1;
 }
 
 static u32 i2c_powermac_func(struct i2c_adapter * adapter)
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index 22a3eda04166..eae9e81be375 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -184,21 +184,21 @@ static void scx200_acb_machine(struct scx200_acb_iface *iface, u8 status)
                 break;
 
         case state_read:
-                /* Set ACK if receiving the last byte */
-                if (iface->len == 1)
+                /* Set ACK if _next_ byte will be the last one */
+                if (iface->len == 2)
                         outb(inb(ACBCTL1) | ACBCTL1_ACK, ACBCTL1);
                 else
                         outb(inb(ACBCTL1) & ~ACBCTL1_ACK, ACBCTL1);
 
-                *iface->ptr++ = inb(ACBSDA);
-                --iface->len;
-
-                if (iface->len == 0) {
+                if (iface->len == 1) {
                         iface->result = 0;
                         iface->state = state_idle;
                         outb(inb(ACBCTL1) | ACBCTL1_STOP, ACBCTL1);
                 }
 
+                *iface->ptr++ = inb(ACBSDA);
+                --iface->len;
+
                 break;
 
         case state_write:
@@ -232,7 +232,7 @@ static void scx200_acb_poll(struct scx200_acb_iface *iface)
         unsigned long timeout;
 
         timeout = jiffies + POLL_TIMEOUT;
-        while (time_before(jiffies, timeout)) {
+        while (1) {
                 status = inb(ACBST);
 
                 /* Reset the status register to avoid the hang */
@@ -242,7 +242,10 @@ static void scx200_acb_poll(struct scx200_acb_iface *iface)
                         scx200_acb_machine(iface, status);
                         return;
                 }
-                yield();
+                if (time_after(jiffies, timeout))
+                        break;
+                cpu_relax();
+                cond_resched();
         }
 
         dev_err(&iface->adapter.dev, "timeout in state %s\n",
@@ -307,8 +310,12 @@ static s32 scx200_acb_smbus_xfer(struct i2c_adapter *adapter,
                 buffer = (u8 *)&cur_word;
                 break;
 
-        case I2C_SMBUS_BLOCK_DATA:
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                if (rw == I2C_SMBUS_READ)
+                        data->block[0] = I2C_SMBUS_BLOCK_MAX; /* For now */
                 len = data->block[0];
+                if (len == 0 || len > I2C_SMBUS_BLOCK_MAX)
+                        return -EINVAL;
                 buffer = &data->block[1];
                 break;
 
@@ -372,7 +379,7 @@ static u32 scx200_acb_func(struct i2c_adapter *adapter)
 {
         return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
                I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
-               I2C_FUNC_SMBUS_BLOCK_DATA;
+               I2C_FUNC_SMBUS_I2C_BLOCK;
 }
 
 /* For now, we only handle combined mode (smbus) */
diff --git a/drivers/i2c/chips/pca9539.c b/drivers/i2c/chips/pca9539.c
index 54b6e6a4beed..cb22280cdd27 100644
--- a/drivers/i2c/chips/pca9539.c
+++ b/drivers/i2c/chips/pca9539.c
@@ -134,11 +134,13 @@ static int pca9539_detect(struct i2c_adapter *adapter, int address, int kind)
         new_client->driver = &pca9539_driver;
         new_client->flags = 0;
 
-        /* Detection: the pca9539 only has 8 registers (0-7).
-           A read of 7 should succeed, but a read of 8 should fail. */
-        if ((i2c_smbus_read_byte_data(new_client, 7) < 0) ||
-            (i2c_smbus_read_byte_data(new_client, 8) >= 0))
-                goto exit_kfree;
+        if (kind < 0) {
+                /* Detection: the pca9539 only has 8 registers (0-7).
+                   A read of 7 should succeed, but a read of 8 should fail. */
+                if ((i2c_smbus_read_byte_data(new_client, 7) < 0) ||
+                    (i2c_smbus_read_byte_data(new_client, 8) >= 0))
+                        goto exit_kfree;
+        }
 
         strlcpy(new_client->name, "pca9539", I2C_NAME_SIZE);
 
diff --git a/drivers/i2c/chips/tps65010.c b/drivers/i2c/chips/tps65010.c
index e7e27049fbfa..0be6fd6a267d 100644
--- a/drivers/i2c/chips/tps65010.c
+++ b/drivers/i2c/chips/tps65010.c
@@ -43,13 +43,12 @@
 /*-------------------------------------------------------------------------*/
 
 #define DRIVER_VERSION  "2 May 2005"
-#define DRIVER_NAME     (tps65010_driver.name)
+#define DRIVER_NAME     (tps65010_driver.driver.name)
 
 MODULE_DESCRIPTION("TPS6501x Power Management Driver");
 MODULE_LICENSE("GPL");
 
 static unsigned short normal_i2c[] = { 0x48, /* 0x49, */ I2C_CLIENT_END };
-static unsigned short normal_i2c_range[] = { I2C_CLIENT_END };
 
 I2C_CLIENT_INSMOD;
 
@@ -100,7 +99,7 @@ struct tps65010 {
         /* not currently tracking GPIO state */
 };
 
-#define POWER_POLL_DELAY        msecs_to_jiffies(800)
+#define POWER_POLL_DELAY        msecs_to_jiffies(5000)
 
 /*-------------------------------------------------------------------------*/
 
@@ -520,8 +519,11 @@ tps65010_probe(struct i2c_adapter *bus, int address, int kind)
                 goto fail1;
         }
 
+        /* the IRQ is active low, but many gpio lines can't support that
+         * so this driver can use falling-edge triggers instead.
+         */
+        irqflags = IRQF_SAMPLE_RANDOM;
 #ifdef  CONFIG_ARM
-        irqflags = IRQF_SAMPLE_RANDOM | IRQF_TRIGGER_LOW;
         if (machine_is_omap_h2()) {
                 tps->model = TPS65010;
                 omap_cfg_reg(W4_GPIO58);
@@ -543,8 +545,6 @@ tps65010_probe(struct i2c_adapter *bus, int address, int kind)
 
                 // FIXME set up this board's IRQ ...
         }
-#else
-        irqflags = IRQF_SAMPLE_RANDOM;
 #endif
 
         if (tps->irq > 0) {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index a45155f799d4..9cb277d6aa48 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -756,9 +756,9 @@ int i2c_probe(struct i2c_adapter *adapter,
                                         "parameter for adapter %d, "
                                         "addr 0x%02x\n", adap_id,
                                         address_data->ignore[j + 1]);
+                                ignore = 1;
+                                break;
                         }
-                        ignore = 1;
-                        break;
                 }
                 if (ignore)
                         continue;
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index d1266fe2d1ab..b6fb167e20f6 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -682,6 +682,7 @@ config BLK_DEV_SVWKS
 config BLK_DEV_SGIIOC4
         tristate "Silicon Graphics IOC4 chipset ATA/ATAPI support"
         depends on (IA64_SGI_SN2 || IA64_GENERIC) && SGI_IOC4
+        select IDEPCI_SHARE_IRQ
         help
           This driver adds PIO & MultiMode DMA-2 support for the SGI IOC4
           chipset, which has one channel and can support two devices.
@@ -773,20 +774,6 @@ config BLK_DEV_IDEDMA_PMAC
           to transfer data to and from memory.  Saying Y is safe and improves
           performance.
 
-config BLK_DEV_IDE_PMAC_BLINK
-        bool "Blink laptop LED on drive activity (DEPRECATED)"
-        depends on BLK_DEV_IDE_PMAC && ADB_PMU
-        select ADB_PMU_LED
-        select LEDS_TRIGGERS
-        select LEDS_TRIGGER_IDE_DISK
-        help
-          This option enables the use of the sleep LED as a hard drive
-          activity LED.
-          This option is deprecated, it only selects ADB_PMU_LED and
-          LEDS_TRIGGER_IDE_DISK and changes the code in the new led class
-          device to default to the ide-disk trigger (which should be set
-          from userspace via sysfs).
-
 config BLK_DEV_IDE_SWARM
         tristate "IDE for Sibyte evaluation boards"
         depends on SIBYTE_SB1xxx_SOC
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index f712e4cfd9dc..7cf3eb023521 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -776,7 +776,7 @@ static void update_ordered(ide_drive_t *drive)
                  * not available so we don't need to recheck that.
                  */
                 capacity = idedisk_capacity(drive);
-                barrier = ide_id_has_flush_cache(id) &&
+                barrier = ide_id_has_flush_cache(id) && !drive->noflush &&
                         (drive->addressing == 0 || capacity <= (1ULL << 28) ||
                          ide_id_has_flush_cache_ext(id));
 
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index 98918fb6b2ce..7c3a13e1cf64 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -750,7 +750,7 @@ void ide_dma_verbose(ide_drive_t *drive)
                         goto bug_dma_off;
                 printk(", DMA");
         } else if (id->field_valid & 1) {
-                printk(", BUG");
+                goto bug_dma_off;
         }
         return;
 bug_dma_off:
diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index 6ca3476d02c7..adbe9f76a505 100644
--- a/drivers/ide/ide-floppy.c
+++ b/drivers/ide/ide-floppy.c
@@ -838,7 +838,7 @@ static ide_startstop_t idefloppy_pc_intr (ide_drive_t *drive)
                         "transferred\n", pc->actually_transferred);
                 clear_bit(PC_DMA_IN_PROGRESS, &pc->flags);
 
-                local_irq_enable();
+                local_irq_enable_in_hardirq();
 
                 if (status.b.check || test_bit(PC_DMA_ERROR, &pc->flags)) {
                         /* Error detected */
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 7dba9992ad30..fb6795236e76 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -693,7 +693,7 @@ static ide_startstop_t drive_cmd_intr (ide_drive_t *drive)
         u8 stat = hwif->INB(IDE_STATUS_REG);
         int retries = 10;
 
-        local_irq_enable();
+        local_irq_enable_in_hardirq();
         if ((stat & DRQ_STAT) && args && args[3]) {
                 u8 io_32bit = drive->io_32bit;
                 drive->io_32bit = 0;
@@ -1286,7 +1286,7 @@ static void ide_do_request (ide_hwgroup_t *hwgroup, int masked_irq)
                 if (masked_irq != IDE_NO_IRQ && hwif->irq != masked_irq)
                         disable_irq_nosync(hwif->irq);
                 spin_unlock(&ide_lock);
-                local_irq_enable();
+                local_irq_enable_in_hardirq();
                         /* allow other IRQs while we start this request */
                 startstop = start_request(drive, rq);
                 spin_lock_irq(&ide_lock);
@@ -1631,7 +1631,7 @@ irqreturn_t ide_intr (int irq, void *dev_id, struct pt_regs *regs)
         spin_unlock(&ide_lock);
 
         if (drive->unmask)
-                local_irq_enable();
+                local_irq_enable_in_hardirq();
         /* service this interrupt, may set handler for next interrupt */
         startstop = handler(drive);
         spin_lock_irq(&ide_lock);
@@ -1705,7 +1705,7 @@ int ide_do_drive_cmd (ide_drive_t *drive, struct request *rq, ide_action_t actio
 {
         unsigned long flags;
         ide_hwgroup_t *hwgroup = HWGROUP(drive);
-        DECLARE_COMPLETION(wait);
+        DECLARE_COMPLETION_ONSTACK(wait);
         int where = ELEVATOR_INSERT_BACK, err;
         int must_wait = (action == ide_wait || action == ide_head_wait);
 
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index 657165297dc7..77703acaec17 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -23,6 +23,7 @@
 #include <linux/hdreg.h>
 #include <linux/ide.h>
 #include <linux/bitops.h>
+#include <linux/nmi.h>
 
 #include <asm/byteorder.h>
 #include <asm/irq.h>
@@ -1243,6 +1244,7 @@ int ide_wait_not_busy(ide_hwif_t *hwif, unsigned long timeout)
                 if (stat == 0xff)
                         return -ENODEV;
                 touch_softlockup_watchdog();
+                touch_nmi_watchdog();
         }
         return -EBUSY;
 }
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index c12f1b71e934..41b74b13a00c 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -376,6 +376,8 @@ static int proc_ide_read_media
                                 break;
                 case ide_floppy:media = "floppy\n";
                                 break;
+                case ide_optical:media = "optical\n";
+                                break;
                 default:        media = "UNKNOWN\n";
                                 break;
         }
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 04547eb0833f..97a9244312fc 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -222,7 +222,7 @@ ide_startstop_t task_no_data_intr (ide_drive_t *drive)
         ide_hwif_t *hwif        = HWIF(drive);
         u8 stat;
 
-        local_irq_enable();
+        local_irq_enable_in_hardirq();
         if (!OK_STAT(stat = hwif->INB(IDE_STATUS_REG),READY_STAT,BAD_STAT)) {
                 return ide_error(drive, "task_no_data_intr", stat);
                 /* calls ide_end_drive_cmd */
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 05fbd9298db7..defd4b4bd374 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1539,7 +1539,7 @@ static int __init ide_setup(char *s)
                 const char *hd_words[] = {
                         "none", "noprobe", "nowerr", "cdrom", "serialize",
                         "autotune", "noautotune", "minus8", "swapdata", "bswap",
-                        "minus11", "remap", "remap63", "scsi", NULL };
+                        "noflush", "remap", "remap63", "scsi", NULL };
                 unit = s[2] - 'a';
                 hw   = unit / MAX_DRIVES;
                 unit = unit % MAX_DRIVES;
@@ -1578,6 +1578,9 @@ static int __init ide_setup(char *s)
                         case -10: /* "bswap" */
                                 drive->bswap = 1;
                                 goto done;
+                        case -11: /* noflush */
+                                drive->noflush = 1;
+                                goto done;
                         case -12: /* "remap" */
                                 drive->remap_0_to_1 = 1;
                                 goto done;
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index b7e459e4f284..602797a44208 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -146,16 +146,7 @@ static void ide_detach(struct pcmcia_device *link)
     kfree(link->priv);
 } /* ide_detach */
 
-static void idecs_mmio_fixup(ide_hwif_t *hwif)
-{
-        default_hwif_mmiops(hwif);
-        hwif->mmio = 2;
-
-        ide_undecoded_slave(hwif);
-}
-
-static int idecs_register(unsigned long io, unsigned long ctl,
-        unsigned long irq, struct pcmcia_device *handle, int is_mmio)
+static int idecs_register(unsigned long io, unsigned long ctl, unsigned long irq, struct pcmcia_device *handle)
 {
     hw_regs_t hw;
     memset(&hw, 0, sizeof(hw));
@@ -163,19 +154,7 @@ static int idecs_register(unsigned long io, unsigned long ctl,
     hw.irq = irq;
     hw.chipset = ide_pci;
     hw.dev = &handle->dev;
-
-    if(is_mmio)
-        return ide_register_hw_with_fixup(&hw, NULL, idecs_mmio_fixup);
-    else
-        return ide_register_hw_with_fixup(&hw, NULL, ide_undecoded_slave);
-}
-
-void outb_io(unsigned char value, unsigned long port) {
-        outb(value, port);
-}
-
-void outb_mem(unsigned char value, unsigned long port) {
-        writeb(value, (void __iomem *) port);
+    return ide_register_hw_with_fixup(&hw, NULL, ide_undecoded_slave);
 }
 
 /*======================================================================
@@ -201,8 +180,7 @@ static int ide_config(struct pcmcia_device *link)
     } *stk = NULL;
     cistpl_cftable_entry_t *cfg;
     int i, pass, last_ret = 0, last_fn = 0, hd, is_kme = 0;
-    unsigned long io_base, ctl_base, is_mmio, try_slave;
-    void (*my_outb)(unsigned char, unsigned long);
+    unsigned long io_base, ctl_base;
 
     DEBUG(0, "ide_config(0x%p)\n", link);
 
@@ -232,7 +210,7 @@ static int ide_config(struct pcmcia_device *link)
     /* Not sure if this is right... look up the current Vcc */
     CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(link, &stk->conf));
 
-    pass = io_base = ctl_base = is_mmio = try_slave = 0;
+    pass = io_base = ctl_base = 0;
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
     tuple.Attributes = 0;
     CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
@@ -280,45 +258,11 @@ static int ide_config(struct pcmcia_device *link)
                         goto next_entry;
                 io_base = link->io.BasePort1;
                 ctl_base = link->io.BasePort1 + 0x0e;
-
-                if (io->win[0].len >= 0x20)
-                        try_slave = 1;
-
             } else goto next_entry;
             /* If we've got this far, we're done */
             break;
         }
 
-        if ((cfg->mem.nwin > 0) || (stk->dflt.mem.nwin > 0)) {
-            win_req_t req;
-            memreq_t map;
-            cistpl_mem_t *mem = (cfg->mem.nwin) ? &cfg->mem : &stk->dflt.mem;
-
-            if (mem->win[0].len < 16)
-                goto next_entry;
-
-            req.Attributes = WIN_DATA_WIDTH_16|WIN_MEMORY_TYPE_CM;
-            req.Attributes |= WIN_ENABLE;
-            req.Base = mem->win[0].host_addr;
-            req.Size = 0;
-
-            req.AccessSpeed = 0;
-            if (pcmcia_request_window(&link, &req, &link->win) != 0)
-                goto next_entry;
-            map.Page = 0; map.CardOffset = mem->win[0].card_addr;
-            if (pcmcia_map_mem_page(link->win, &map) != 0)
-                goto next_entry;
-
-            io_base = (unsigned long) ioremap(req.Base, req.Size);
-            ctl_base = io_base + 0x0e;
-            is_mmio = 1;
-
-            if (mem->win[0].len >= 0x20)
-                try_slave = 1;
-
-            break;
-        }
-
     next_entry:
         if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
             memcpy(&stk->dflt, cfg, sizeof(stk->dflt));
@@ -334,26 +278,21 @@ static int ide_config(struct pcmcia_device *link)
     CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
     CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
-    if(is_mmio)
-        my_outb = outb_mem;
-    else
-        my_outb = outb_io;
-
     /* disable drive interrupts during IDE probe */
-    my_outb(0x02, ctl_base);
+    outb(0x02, ctl_base);
 
     /* special setup for KXLC005 card */
     if (is_kme)
-        my_outb(0x81, ctl_base+1);
+        outb(0x81, ctl_base+1);
 
     /* retry registration in case device is still spinning up */
     for (hd = -1, i = 0; i < 10; i++) {
-        hd = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, link, is_mmio);
+        hd = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, link);
         if (hd >= 0) break;
-        if (try_slave) {
-            my_outb(0x02, ctl_base + 0x10);
+        if (link->io.NumPorts1 == 0x20) {
+            outb(0x02, ctl_base + 0x10);
             hd = idecs_register(io_base + 0x10, ctl_base + 0x10,
-                                link->irq.AssignedIRQ, link, is_mmio);
+                                link->irq.AssignedIRQ, link);
             if (hd >= 0) {
                 io_base += 0x10;
                 ctl_base += 0x10;
diff --git a/drivers/ide/pci/aec62xx.c b/drivers/ide/pci/aec62xx.c
index a7c725f8bf64..f286079d233f 100644
--- a/drivers/ide/pci/aec62xx.c
+++ b/drivers/ide/pci/aec62xx.c
@@ -425,12 +425,12 @@ static int __devinit aec62xx_init_one(struct pci_dev *dev, const struct pci_devi
         return d->init_setup(dev, d);
 }
 
-static const struct pci_device_id aec62xx_pci_tbl[] = {
-        { PCI_DEVICE(PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP850UF), 0 },
-        { PCI_DEVICE(PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP860), 1 },
-        { PCI_DEVICE(PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP860R), 2 },
-        { PCI_DEVICE(PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP865), 3 },
-        { PCI_DEVICE(PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP865R), 4 },
+static struct pci_device_id aec62xx_pci_tbl[] = {
+        { PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP850UF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        { PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP860,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1 },
+        { PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP860R,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2 },
+        { PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP865,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3 },
+        { PCI_VENDOR_ID_ARTOP, PCI_DEVICE_ID_ARTOP_ATP865R,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, aec62xx_pci_tbl);
diff --git a/drivers/ide/pci/alim15x3.c b/drivers/ide/pci/alim15x3.c
index 351dab2fcacf..d419e4bb54f4 100644
--- a/drivers/ide/pci/alim15x3.c
+++ b/drivers/ide/pci/alim15x3.c
@@ -730,7 +730,7 @@ static unsigned int __devinit ata66_ali15x3 (ide_hwif_t *hwif)
         
         if(m5229_revision <= 0x20)
                 tmpbyte = (tmpbyte & (~0x02)) | 0x01;
-        else if (m5229_revision == 0xc7)
+        else if (m5229_revision == 0xc7 || m5229_revision == 0xc8)
                 tmpbyte |= 0x03;
         else
                 tmpbyte |= 0x01;
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index f82e82109728..78810ba982e9 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -180,6 +180,36 @@ static ide_pci_device_t generic_chipsets[] __devinitdata = {
                 .channels       = 2,
                 .autodma        = AUTODMA,
                 .bootable       = OFF_BOARD,
+        },{     /* 15 */
+                .name           = "JMB361",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 16 */
+                .name           = "JMB363",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 17 */
+                .name           = "JMB365",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 18 */
+                .name           = "JMB366",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 19 */
+                .name           = "JMB368",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
         }
 };
 
@@ -212,6 +242,9 @@ static int __devinit generic_init_one(struct pci_dev *dev, const struct pci_devi
             (!(PCI_FUNC(dev->devfn) & 1)))
                 goto out;
 
+        if (dev->vendor == PCI_VENDOR_ID_JMICRON && PCI_FUNC(dev->devfn) != 1)
+                goto out;
+
         pci_read_config_word(dev, PCI_COMMAND, &command);
         if (!(command & PCI_COMMAND_IO)) {
                 printk(KERN_INFO "Skipping disabled %s IDE controller.\n", d->name);
@@ -239,6 +272,11 @@ static struct pci_device_id generic_pci_tbl[] = {
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 12},
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 13},
         { PCI_VENDOR_ID_NETCELL,PCI_DEVICE_ID_REVOLUTION,          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 14},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 15},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 16},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 17},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 18},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 19},
         /* Must come last. If you add entries adjust this table appropriately and the init_one code */
         { PCI_ANY_ID,           PCI_ANY_ID,                        PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 0},
         { 0, },
diff --git a/drivers/ide/pci/it821x.c b/drivers/ide/pci/it821x.c
index 3cb04424d351..e9bad185968a 100644
--- a/drivers/ide/pci/it821x.c
+++ b/drivers/ide/pci/it821x.c
@@ -498,9 +498,14 @@ static int config_chipset_for_dma (ide_drive_t *drive)
 {
         u8 speed        = ide_dma_speed(drive, it821x_ratemask(drive));
 
-        config_it821x_chipset_for_pio(drive, !speed);
-        it821x_tune_chipset(drive, speed);
-        return ide_dma_enable(drive);
+        if (speed) {
+                config_it821x_chipset_for_pio(drive, 0);
+                it821x_tune_chipset(drive, speed);
+
+                return ide_dma_enable(drive);
+        }
+
+        return 0;
 }
 
 /**
diff --git a/drivers/ide/pci/serverworks.c b/drivers/ide/pci/serverworks.c
index 03677bff0d72..f063d954236c 100644
--- a/drivers/ide/pci/serverworks.c
+++ b/drivers/ide/pci/serverworks.c
@@ -649,11 +649,11 @@ static int __devinit svwks_init_one(struct pci_dev *dev, const struct pci_device
 }
 
 static struct pci_device_id svwks_pci_tbl[] = {
-        { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_OSB4IDE), 0},
-        { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB5IDE), 1},
-        { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB6IDE), 2},
-        { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB6IDE2), 3},
-        { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT1000IDE), 4},
+        { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_OSB4IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB5IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
+        { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB6IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
+        { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB6IDE2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
+        { PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT1000IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, svwks_pci_tbl);
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index e125032bb403..d8a0d87df734 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -367,12 +367,13 @@ sgiioc4_INB(unsigned long port)
 static void __devinit
 ide_dma_sgiioc4(ide_hwif_t * hwif, unsigned long dma_base)
 {
+        void __iomem *virt_dma_base;
         int num_ports = sizeof (ioc4_dma_regs_t);
 
         printk(KERN_INFO "%s: BM-DMA at 0x%04lx-0x%04lx\n", hwif->name,
                dma_base, dma_base + num_ports - 1);
 
-        if (!request_region(dma_base, num_ports, hwif->name)) {
+        if (!request_mem_region(dma_base, num_ports, hwif->name)) {
                 printk(KERN_ERR
                        "%s(%s) -- ERROR, Addresses 0x%p to 0x%p "
                        "ALREADY in use\n",
@@ -381,13 +382,21 @@ ide_dma_sgiioc4(ide_hwif_t * hwif, unsigned long dma_base)
                 goto dma_alloc_failure;
         }
 
-        hwif->dma_base = dma_base;
+        virt_dma_base = ioremap(dma_base, num_ports);
+        if (virt_dma_base == NULL) {
+                printk(KERN_ERR
+                       "%s(%s) -- ERROR, Unable to map addresses 0x%lx to 0x%lx\n",
+                       __FUNCTION__, hwif->name, dma_base, dma_base + num_ports - 1);
+                goto dma_remap_failure;
+        }
+        hwif->dma_base = (unsigned long) virt_dma_base;
+
         hwif->dmatable_cpu = pci_alloc_consistent(hwif->pci_dev,
                                           IOC4_PRD_ENTRIES * IOC4_PRD_BYTES,
                                           &hwif->dmatable_dma);
 
         if (!hwif->dmatable_cpu)
-                goto dma_alloc_failure;
+                goto dma_pci_alloc_failure;
 
         hwif->sg_max_nents = IOC4_PRD_ENTRIES;
 
@@ -411,6 +420,12 @@ dma_base2alloc_failure:
         printk(KERN_INFO
                "Changing from DMA to PIO mode for Drive %s\n", hwif->name);
 
+dma_pci_alloc_failure:
+        iounmap(virt_dma_base);
+
+dma_remap_failure:
+        release_mem_region(dma_base, num_ports);
+
 dma_alloc_failure:
         /* Disable DMA because we couldnot allocate any DMA maps */
         hwif->autodma = 0;
@@ -607,18 +622,15 @@ ide_init_sgiioc4(ide_hwif_t * hwif)
         hwif->ide_dma_lostirq = &sgiioc4_ide_dma_lostirq;
         hwif->ide_dma_timeout = &__ide_dma_timeout;
 
-        /*
-         * The IOC4 uses MMIO rather than Port IO.
-         * It also needs special workarounds for INB.
-         */
-        default_hwif_mmiops(hwif);
         hwif->INB = &sgiioc4_INB;
 }
 
 static int __devinit
 sgiioc4_ide_setup_pci_device(struct pci_dev *dev, ide_pci_device_t * d)
 {
-        unsigned long base, ctl, dma_base, irqport;
+        unsigned long cmd_base, dma_base, irqport;
+        unsigned long bar0, cmd_phys_base, ctl;
+        void __iomem *virt_base;
         ide_hwif_t *hwif;
         int h;
 
@@ -636,23 +648,32 @@ sgiioc4_ide_setup_pci_device(struct pci_dev *dev, ide_pci_device_t * d)
         }
 
         /*  Get the CmdBlk and CtrlBlk Base Registers */
-        base = pci_resource_start(dev, 0) + IOC4_CMD_OFFSET;
-        ctl = pci_resource_start(dev, 0) + IOC4_CTRL_OFFSET;
-        irqport = pci_resource_start(dev, 0) + IOC4_INTR_OFFSET;
+        bar0 = pci_resource_start(dev, 0);
+        virt_base = ioremap(bar0, pci_resource_len(dev, 0));
+        if (virt_base == NULL) {
+                printk(KERN_ERR "%s: Unable to remap BAR 0 address: 0x%lx\n",
+                        d->name, bar0);
+                return -ENOMEM;
+        }
+        cmd_base = (unsigned long) virt_base + IOC4_CMD_OFFSET;
+        ctl = (unsigned long) virt_base + IOC4_CTRL_OFFSET;
+        irqport = (unsigned long) virt_base + IOC4_INTR_OFFSET;
         dma_base = pci_resource_start(dev, 0) + IOC4_DMA_OFFSET;
 
-        if (!request_region(base, IOC4_CMD_CTL_BLK_SIZE, hwif->name)) {
+        cmd_phys_base = bar0 + IOC4_CMD_OFFSET;
+        if (!request_mem_region(cmd_phys_base, IOC4_CMD_CTL_BLK_SIZE,
+            hwif->name)) {
                 printk(KERN_ERR
-                        "%s : %s -- ERROR, Port Addresses "
+                        "%s : %s -- ERROR, Addresses "
                         "0x%p to 0x%p ALREADY in use\n",
-                       __FUNCTION__, hwif->name, (void *) base,
-                       (void *) base + IOC4_CMD_CTL_BLK_SIZE);
+                       __FUNCTION__, hwif->name, (void *) cmd_phys_base,
+                       (void *) cmd_phys_base + IOC4_CMD_CTL_BLK_SIZE);
                 return -ENOMEM;
         }
 
-        if (hwif->io_ports[IDE_DATA_OFFSET] != base) {
+        if (hwif->io_ports[IDE_DATA_OFFSET] != cmd_base) {
                 /* Initialize the IO registers */
-                sgiioc4_init_hwif_ports(&hwif->hw, base, ctl, irqport);
+                sgiioc4_init_hwif_ports(&hwif->hw, cmd_base, ctl, irqport);
                 memcpy(hwif->io_ports, hwif->hw.io_ports,
                        sizeof (hwif->io_ports));
                 hwif->noprobe = !hwif->io_ports[IDE_DATA_OFFSET];
@@ -665,6 +686,9 @@ sgiioc4_ide_setup_pci_device(struct pci_dev *dev, ide_pci_device_t * d)
         hwif->cds = (struct ide_pci_device_s *) d;
         hwif->gendev.parent = &dev->dev;/* setup proper ancestral information */
 
+        /* The IOC4 uses MMIO rather than Port IO. */
+        default_hwif_mmiops(hwif);
+
         /* Initializing chipset IRQ Registers */
         hwif->OUTL(0x03, irqport + IOC4_INTR_SET * 4);
 
diff --git a/drivers/ide/pci/siimage.c b/drivers/ide/pci/siimage.c
index 25ceb4a39ed2..20b392948f36 100644
--- a/drivers/ide/pci/siimage.c
+++ b/drivers/ide/pci/siimage.c
@@ -1082,10 +1082,10 @@ static int __devinit siimage_init_one(struct pci_dev *dev, const struct pci_devi
 }
 
 static struct pci_device_id siimage_pci_tbl[] = {
-        { PCI_DEVICE(PCI_VENDOR_ID_CMD, PCI_DEVICE_ID_SII_680), 0},
+        { PCI_VENDOR_ID_CMD, PCI_DEVICE_ID_SII_680,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
 #ifdef CONFIG_BLK_DEV_IDE_SATA
-        { PCI_DEVICE(PCI_VENDOR_ID_CMD, PCI_DEVICE_ID_SII_3112), 1},
-        { PCI_DEVICE(PCI_VENDOR_ID_CMD, PCI_DEVICE_ID_SII_1210SA), 2},
+        { PCI_VENDOR_ID_CMD, PCI_DEVICE_ID_SII_3112, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
+        { PCI_VENDOR_ID_CMD, PCI_DEVICE_ID_SII_1210SA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
 #endif
         { 0, },
 };
diff --git a/drivers/ide/pci/sis5513.c b/drivers/ide/pci/sis5513.c
index 8a6c23ac8cc1..f03196c5db37 100644
--- a/drivers/ide/pci/sis5513.c
+++ b/drivers/ide/pci/sis5513.c
@@ -86,6 +86,8 @@ static const struct {
         u8 chipset_family;
         u8 flags;
 } SiSHostChipInfo[] = {
+        { "SiS968",     PCI_DEVICE_ID_SI_968,   ATA_133  },
+        { "SiS966",     PCI_DEVICE_ID_SI_966,   ATA_133  },
         { "SiS965",     PCI_DEVICE_ID_SI_965,   ATA_133  },
         { "SiS745",     PCI_DEVICE_ID_SI_745,   ATA_100  },
         { "SiS735",     PCI_DEVICE_ID_SI_735,   ATA_100  },
diff --git a/drivers/ide/pci/via82cxxx.c b/drivers/ide/pci/via82cxxx.c
index afdaee3c15c9..9b7589e8e93e 100644
--- a/drivers/ide/pci/via82cxxx.c
+++ b/drivers/ide/pci/via82cxxx.c
@@ -6,7 +6,7 @@
  *
  *   vt82c576, vt82c586, vt82c586a, vt82c586b, vt82c596a, vt82c596b,
  *   vt82c686, vt82c686a, vt82c686b, vt8231, vt8233, vt8233c, vt8233a,
- *   vt8235, vt8237
+ *   vt8235, vt8237, vt8237a
  *
  * Copyright (c) 2000-2002 Vojtech Pavlik
  *
@@ -81,6 +81,7 @@ static struct via_isa_bridge {
         { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8237",     PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
+        { "vt8237a",    PCI_DEVICE_ID_VIA_8237A,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8235",     PCI_DEVICE_ID_VIA_8235,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8233a",    PCI_DEVICE_ID_VIA_8233A,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8233c",    PCI_DEVICE_ID_VIA_8233C_0,  0x00, 0x2f, VIA_UDMA_100 },
diff --git a/drivers/ieee1394/hosts.c b/drivers/ieee1394/hosts.c
index 3ed56be8706c..59e6f49545bf 100644
--- a/drivers/ieee1394/hosts.c
+++ b/drivers/ieee1394/hosts.c
@@ -90,6 +90,14 @@ static int alloc_hostnum_cb(struct hpsb_host *host, void *__data)
         return 0;
 }
 
+/*
+ * The pending_packet_queue is special in that it's processed
+ * from hardirq context too (such as hpsb_bus_reset()). Hence
+ * split the lock class from the usual networking skb-head
+ * lock class by using a separate key for it:
+ */
+static struct lock_class_key pending_packet_queue_key;
+
 static DEFINE_MUTEX(host_num_alloc);
 
 /**
@@ -128,6 +136,8 @@ struct hpsb_host *hpsb_alloc_host(struct hpsb_host_driver *drv, size_t extra,
         h->driver = drv;
 
         skb_queue_head_init(&h->pending_packet_queue);
+        lockdep_set_class(&h->pending_packet_queue.lock,
+                           &pending_packet_queue_key);
         INIT_LIST_HEAD(&h->addr_space);
 
         for (i = 2; i < 16; i++)
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index 2283005e3035..baa090d08d20 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -3553,6 +3553,8 @@ static int ohci1394_pci_resume (struct pci_dev *pdev)
 
 static int ohci1394_pci_suspend (struct pci_dev *pdev, pm_message_t state)
 {
+        pci_save_state(pdev);
+
 #ifdef CONFIG_PPC_PMAC
         if (machine_is(powermac)) {
                 struct device_node *of_node;
@@ -3564,8 +3566,6 @@ static int ohci1394_pci_suspend (struct pci_dev *pdev, pm_message_t state)
         }
 #endif
 
-        pci_save_state(pdev);
-
         return 0;
 }
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index d294bbc42f09..1205e8027829 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -35,6 +35,7 @@
 #include <net/arp.h>
 #include <net/neighbour.h>
 #include <net/route.h>
+#include <net/netevent.h>
 #include <rdma/ib_addr.h>
 
 MODULE_AUTHOR("Sean Hefty");
@@ -326,25 +327,22 @@ void rdma_addr_cancel(struct rdma_dev_addr *addr)
 }
 EXPORT_SYMBOL(rdma_addr_cancel);
 
-static int addr_arp_recv(struct sk_buff *skb, struct net_device *dev,
-                         struct packet_type *pkt, struct net_device *orig_dev)
+static int netevent_callback(struct notifier_block *self, unsigned long event, 
+        void *ctx)
 {
-        struct arphdr *arp_hdr;
+        if (event == NETEVENT_NEIGH_UPDATE) {  
+                struct neighbour *neigh = ctx;
 
-        arp_hdr = (struct arphdr *) skb->nh.raw;
-
-        if (arp_hdr->ar_op == htons(ARPOP_REQUEST) ||
-            arp_hdr->ar_op == htons(ARPOP_REPLY))
-                set_timeout(jiffies);
-
-        kfree_skb(skb);
+                if (neigh->dev->type == ARPHRD_INFINIBAND &&
+                    (neigh->nud_state & NUD_VALID)) {
+                        set_timeout(jiffies);
+                }
+        }
         return 0;
 }
 
-static struct packet_type addr_arp = {
-        .type           = __constant_htons(ETH_P_ARP),
-        .func           = addr_arp_recv,
-        .af_packet_priv = (void*) 1,
+static struct notifier_block nb = {
+        .notifier_call = netevent_callback
 };
 
 static int addr_init(void)
@@ -353,13 +351,13 @@ static int addr_init(void)
         if (!addr_wq)
                 return -ENOMEM;
 
-        dev_add_pack(&addr_arp);
+        register_netevent_notifier(&nb);
         return 0;
 }
 
 static void addr_cleanup(void)
 {
-        dev_remove_pack(&addr_arp);
+        unregister_netevent_notifier(&nb);
         destroy_workqueue(addr_wq);
 }
 
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index e05ca2cdc73f..75313ade2e0d 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -301,7 +301,8 @@ static void ib_cache_event(struct ib_event_handler *handler,
             event->event == IB_EVENT_PORT_ACTIVE ||
             event->event == IB_EVENT_LID_CHANGE  ||
             event->event == IB_EVENT_PKEY_CHANGE ||
-            event->event == IB_EVENT_SM_CHANGE) {
+            event->event == IB_EVENT_SM_CHANGE   ||
+            event->event == IB_EVENT_CLIENT_REREGISTER) {
                 work = kmalloc(sizeof *work, GFP_ATOMIC);
                 if (work) {
                         INIT_WORK(&work->work, ib_cache_task, work);
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 3f6705f3083a..0de335b7bfc2 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -701,7 +701,7 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
         }
 }
 
-void ib_destroy_cm_id(struct ib_cm_id *cm_id)
+static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
 {
         struct cm_id_private *cm_id_priv;
         struct cm_work *work;
@@ -735,12 +735,22 @@ retest:
                                sizeof cm_id_priv->av.port->cm_dev->ca_guid,
                                NULL, 0);
                 break;
+        case IB_CM_REQ_RCVD:
+                if (err == -ENOMEM) {
+                        /* Do not reject to allow future retries. */
+                        cm_reset_to_idle(cm_id_priv);
+                        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                } else {
+                        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                        ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
+                                       NULL, 0, NULL, 0);
+                }
+                break;
         case IB_CM_MRA_REQ_RCVD:
         case IB_CM_REP_SENT:
         case IB_CM_MRA_REP_RCVD:
                 ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
                 /* Fall through */
-        case IB_CM_REQ_RCVD:
         case IB_CM_MRA_REQ_SENT:
         case IB_CM_REP_RCVD:
         case IB_CM_MRA_REP_SENT:
@@ -775,6 +785,11 @@ retest:
         kfree(cm_id_priv->private_data);
         kfree(cm_id_priv);
 }
+
+void ib_destroy_cm_id(struct ib_cm_id *cm_id)
+{
+        cm_destroy_id(cm_id, 0);
+}
 EXPORT_SYMBOL(ib_destroy_cm_id);
 
 int ib_cm_listen(struct ib_cm_id *cm_id, __be64 service_id, __be64 service_mask,
@@ -960,8 +975,10 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 
         cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
                                                             id.local_id);
-        if (IS_ERR(cm_id_priv->timewait_info))
+        if (IS_ERR(cm_id_priv->timewait_info)) {
+                ret = PTR_ERR(cm_id_priv->timewait_info);
                 goto out;
+        }
 
         ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
         if (ret)
@@ -1163,7 +1180,7 @@ static void cm_process_work(struct cm_id_private *cm_id_priv,
         }
         cm_deref_id(cm_id_priv);
         if (ret)
-                ib_destroy_cm_id(&cm_id_priv->id);
+                cm_destroy_id(&cm_id_priv->id, ret);
 }
 
 static void cm_format_mra(struct cm_mra_msg *mra_msg,
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 863f64befc7c..5d625a81193f 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -49,7 +49,7 @@ MODULE_DESCRIPTION("Generic RDMA CM Agent");
 MODULE_LICENSE("Dual BSD/GPL");
 
 #define CMA_CM_RESPONSE_TIMEOUT 20
-#define CMA_MAX_CM_RETRIES 3
+#define CMA_MAX_CM_RETRIES 15
 
 static void cma_add_one(struct ib_device *device);
 static void cma_remove_one(struct ib_device *device);
@@ -262,14 +262,14 @@ static void cma_detach_from_dev(struct rdma_id_private *id_priv)
 static int cma_acquire_ib_dev(struct rdma_id_private *id_priv)
 {
         struct cma_device *cma_dev;
-        union ib_gid *gid;
+        union ib_gid gid;
         int ret = -ENODEV;
 
-        gid = ib_addr_get_sgid(&id_priv->id.route.addr.dev_addr);
+        ib_addr_get_sgid(&id_priv->id.route.addr.dev_addr, &gid),
 
         mutex_lock(&lock);
         list_for_each_entry(cma_dev, &dev_list, list) {
-                ret = ib_find_cached_gid(cma_dev->device, gid,
+                ret = ib_find_cached_gid(cma_dev->device, &gid,
                                          &id_priv->id.port_num, NULL);
                 if (!ret) {
                         cma_attach_to_dev(id_priv, cma_dev);
@@ -812,6 +812,7 @@ static int cma_ib_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
                 cma_modify_qp_err(&id_priv->id);
                 status = ib_event->param.rej_rcvd.reason;
                 event = RDMA_CM_EVENT_REJECTED;
+                private_data_len = IB_CM_REJ_PRIVATE_DATA_SIZE;
                 break;
         default:
                 printk(KERN_ERR "RDMA CMA: unexpected IB CM event: %d",
@@ -1134,8 +1135,8 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv, int timeout_ms,
         struct ib_sa_path_rec path_rec;
 
         memset(&path_rec, 0, sizeof path_rec);
-        path_rec.sgid = *ib_addr_get_sgid(addr);
-        path_rec.dgid = *ib_addr_get_dgid(addr);
+        ib_addr_get_sgid(addr, &path_rec.sgid);
+        ib_addr_get_dgid(addr, &path_rec.dgid);
         path_rec.pkey = cpu_to_be16(ib_addr_get_pkey(addr));
         path_rec.numb_path = 1;
 
@@ -1263,7 +1264,7 @@ static int cma_bind_loopback(struct rdma_id_private *id_priv)
 {
         struct cma_device *cma_dev;
         struct ib_port_attr port_attr;
-        union ib_gid *gid;
+        union ib_gid gid;
         u16 pkey;
         int ret;
         u8 p;
@@ -1284,8 +1285,7 @@ static int cma_bind_loopback(struct rdma_id_private *id_priv)
         }
 
 port_found:
-        gid = ib_addr_get_sgid(&id_priv->id.route.addr.dev_addr);
-        ret = ib_get_cached_gid(cma_dev->device, p, 0, gid);
+        ret = ib_get_cached_gid(cma_dev->device, p, 0, &gid);
         if (ret)
                 goto out;
 
@@ -1293,6 +1293,7 @@ port_found:
         if (ret)
                 goto out;
 
+        ib_addr_set_sgid(&id_priv->id.route.addr.dev_addr, &gid);
         ib_addr_set_pkey(&id_priv->id.route.addr.dev_addr, pkey);
         id_priv->id.port_num = p;
         cma_attach_to_dev(id_priv, cma_dev);
@@ -1339,6 +1340,7 @@ static int cma_resolve_loopback(struct rdma_id_private *id_priv)
 {
         struct cma_work *work;
         struct sockaddr_in *src_in, *dst_in;
+        union ib_gid gid;
         int ret;
 
         work = kzalloc(sizeof *work, GFP_KERNEL);
@@ -1351,8 +1353,8 @@ static int cma_resolve_loopback(struct rdma_id_private *id_priv)
                         goto err;
         }
 
-        ib_addr_set_dgid(&id_priv->id.route.addr.dev_addr,
-                         ib_addr_get_sgid(&id_priv->id.route.addr.dev_addr));
+        ib_addr_get_sgid(&id_priv->id.route.addr.dev_addr, &gid);
+        ib_addr_set_dgid(&id_priv->id.route.addr.dev_addr, &gid);
 
         if (cma_zero_addr(&id_priv->id.route.addr.src_addr)) {
                 src_in = (struct sockaddr_in *)&id_priv->id.route.addr.src_addr;
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 615fe9cc6c56..86a3b2d401db 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -426,7 +426,7 @@ EXPORT_SYMBOL(ib_flush_fmr_pool);
 struct ib_pool_fmr *ib_fmr_pool_map_phys(struct ib_fmr_pool *pool_handle,
                                          u64                *page_list,
                                          int                 list_len,
-                                         u64                *io_virtual_address)
+                                         u64                 io_virtual_address)
 {
         struct ib_fmr_pool *pool = pool_handle;
         struct ib_pool_fmr *fmr;
@@ -440,7 +440,7 @@ struct ib_pool_fmr *ib_fmr_pool_map_phys(struct ib_fmr_pool *pool_handle,
         fmr = ib_fmr_cache_lookup(pool,
                                   page_list,
                                   list_len,
-                                  *io_virtual_address);
+                                  io_virtual_address);
         if (fmr) {
                 /* found in cache */
                 ++fmr->ref_count;
@@ -464,7 +464,7 @@ struct ib_pool_fmr *ib_fmr_pool_map_phys(struct ib_fmr_pool *pool_handle,
         spin_unlock_irqrestore(&pool->pool_lock, flags);
 
         result = ib_map_phys_fmr(fmr->fmr, page_list, list_len,
-                                 *io_virtual_address);
+                                 io_virtual_address);
 
         if (result) {
                 spin_lock_irqsave(&pool->pool_lock, flags);
@@ -481,7 +481,7 @@ struct ib_pool_fmr *ib_fmr_pool_map_phys(struct ib_fmr_pool *pool_handle,
         fmr->ref_count = 1;
 
         if (pool->cache_bucket) {
-                fmr->io_virtual_address = *io_virtual_address;
+                fmr->io_virtual_address = io_virtual_address;
                 fmr->page_list_len      = list_len;
                 memcpy(fmr->page_list, page_list, list_len * sizeof(*page_list));
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 5ed4dab52a6f..1c3cfbbe6a97 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -167,6 +167,15 @@ static int is_vendor_method_in_use(
         return 0;
 }
 
+int ib_response_mad(struct ib_mad *mad)
+{
+        return ((mad->mad_hdr.method & IB_MGMT_METHOD_RESP) ||
+                (mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
+                ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_BM) &&
+                 (mad->mad_hdr.attr_mod & IB_BM_ATTR_MOD_RESP)));
+}
+EXPORT_SYMBOL(ib_response_mad);
+
 /*
  * ib_register_mad_agent - Register to send/receive MADs
  */
@@ -570,13 +579,6 @@ int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
 }
 EXPORT_SYMBOL(ib_unregister_mad_agent);
 
-static inline int response_mad(struct ib_mad *mad)
-{
-        /* Trap represses are responses although response bit is reset */
-        return ((mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
-                (mad->mad_hdr.method & IB_MGMT_METHOD_RESP));
-}
-
 static void dequeue_mad(struct ib_mad_list_head *mad_list)
 {
         struct ib_mad_queue *mad_queue;
@@ -723,7 +725,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         switch (ret)
         {
         case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
-                if (response_mad(&mad_priv->mad.mad) &&
+                if (ib_response_mad(&mad_priv->mad.mad) &&
                     mad_agent_priv->agent.recv_handler) {
                         local->mad_priv = mad_priv;
                         local->recv_mad_agent = mad_agent_priv;
@@ -1551,7 +1553,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
         unsigned long flags;
 
         spin_lock_irqsave(&port_priv->reg_lock, flags);
-        if (response_mad(mad)) {
+        if (ib_response_mad(mad)) {
                 u32 hi_tid;
                 struct ib_mad_agent_private *entry;
 
@@ -1799,7 +1801,7 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
         }
 
         /* Complete corresponding request */
-        if (response_mad(mad_recv_wc->recv_buf.mad)) {
+        if (ib_response_mad(mad_recv_wc->recv_buf.mad)) {
                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
                 mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
                 if (!mad_send_wr) {
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index e911c99ff843..d6b84226bba7 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -405,7 +405,8 @@ static void ib_sa_event(struct ib_event_handler *handler, struct ib_event *event
             event->event == IB_EVENT_PORT_ACTIVE ||
             event->event == IB_EVENT_LID_CHANGE  ||
             event->event == IB_EVENT_PKEY_CHANGE ||
-            event->event == IB_EVENT_SM_CHANGE) {
+            event->event == IB_EVENT_SM_CHANGE   ||
+            event->event == IB_EVENT_CLIENT_REREGISTER) {
                 struct ib_sa_device *sa_dev;
                 sa_dev = container_of(handler, typeof(*sa_dev), event_handler);
 
@@ -488,13 +489,13 @@ static void init_mad(struct ib_sa_mad *mad, struct ib_mad_agent *agent)
         spin_unlock_irqrestore(&tid_lock, flags);
 }
 
-static int send_mad(struct ib_sa_query *query, int timeout_ms)
+static int send_mad(struct ib_sa_query *query, int timeout_ms, gfp_t gfp_mask)
 {
         unsigned long flags;
         int ret, id;
 
 retry:
-        if (!idr_pre_get(&query_idr, GFP_ATOMIC))
+        if (!idr_pre_get(&query_idr, gfp_mask))
                 return -ENOMEM;
         spin_lock_irqsave(&idr_lock, flags);
         ret = idr_get_new(&query_idr, query, &id);
@@ -630,7 +631,7 @@ int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
 
         *sa_query = &query->sa_query;
 
-        ret = send_mad(&query->sa_query, timeout_ms);
+        ret = send_mad(&query->sa_query, timeout_ms, gfp_mask);
         if (ret < 0)
                 goto err2;
 
@@ -752,7 +753,7 @@ int ib_sa_service_rec_query(struct ib_device *device, u8 port_num, u8 method,
 
         *sa_query = &query->sa_query;
 
-        ret = send_mad(&query->sa_query, timeout_ms);
+        ret = send_mad(&query->sa_query, timeout_ms, gfp_mask);
         if (ret < 0)
                 goto err2;
 
@@ -844,7 +845,7 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
 
         *sa_query = &query->sa_query;
 
-        ret = send_mad(&query->sa_query, timeout_ms);
+        ret = send_mad(&query->sa_query, timeout_ms, gfp_mask);
         if (ret < 0)
                 goto err2;
 
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index afe70a549c2f..1273f8807e84 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -112,8 +112,10 @@ struct ib_umad_device {
 struct ib_umad_file {
         struct ib_umad_port    *port;
         struct list_head        recv_list;
+        struct list_head        send_list;
         struct list_head        port_list;
         spinlock_t              recv_lock;
+        spinlock_t              send_lock;
         wait_queue_head_t       recv_wait;
         struct ib_mad_agent    *agent[IB_UMAD_MAX_AGENTS];
         int                     agents_dead;
@@ -177,12 +179,21 @@ static int queue_packet(struct ib_umad_file *file,
         return ret;
 }
 
+static void dequeue_send(struct ib_umad_file *file,
+                         struct ib_umad_packet *packet)
+ {
+        spin_lock_irq(&file->send_lock);
+        list_del(&packet->list);
+        spin_unlock_irq(&file->send_lock);
+ }
+
 static void send_handler(struct ib_mad_agent *agent,
                          struct ib_mad_send_wc *send_wc)
 {
         struct ib_umad_file *file = agent->context;
         struct ib_umad_packet *packet = send_wc->send_buf->context[0];
 
+        dequeue_send(file, packet);
         ib_destroy_ah(packet->msg->ah);
         ib_free_send_mad(packet->msg);
 
@@ -370,6 +381,51 @@ static int copy_rmpp_mad(struct ib_mad_send_buf *msg, const char __user *buf)
         return 0;
 }
 
+static int same_destination(struct ib_user_mad_hdr *hdr1,
+                            struct ib_user_mad_hdr *hdr2)
+{
+        if (!hdr1->grh_present && !hdr2->grh_present)
+           return (hdr1->lid == hdr2->lid);
+
+        if (hdr1->grh_present && hdr2->grh_present)
+           return !memcmp(hdr1->gid, hdr2->gid, 16);
+
+        return 0;
+}
+
+static int is_duplicate(struct ib_umad_file *file,
+                        struct ib_umad_packet *packet)
+{
+        struct ib_umad_packet *sent_packet;
+        struct ib_mad_hdr *sent_hdr, *hdr;
+
+        hdr = (struct ib_mad_hdr *) packet->mad.data;
+        list_for_each_entry(sent_packet, &file->send_list, list) {
+                sent_hdr = (struct ib_mad_hdr *) sent_packet->mad.data;
+
+                if ((hdr->tid != sent_hdr->tid) ||
+                    (hdr->mgmt_class != sent_hdr->mgmt_class))
+                        continue;
+
+                /*
+                 * No need to be overly clever here.  If two new operations have
+                 * the same TID, reject the second as a duplicate.  This is more
+                 * restrictive than required by the spec.
+                 */
+                if (!ib_response_mad((struct ib_mad *) hdr)) {
+                        if (!ib_response_mad((struct ib_mad *) sent_hdr))
+                                return 1;
+                        continue;
+                } else if (!ib_response_mad((struct ib_mad *) sent_hdr))
+                        continue;
+
+                if (same_destination(&packet->mad.hdr, &sent_packet->mad.hdr))
+                        return 1;
+        }
+
+        return 0;
+}
+
 static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                              size_t count, loff_t *pos)
 {
@@ -379,7 +435,6 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
         struct ib_ah_attr ah_attr;
         struct ib_ah *ah;
         struct ib_rmpp_mad *rmpp_mad;
-        u8 method;
         __be64 *tid;
         int ret, data_len, hdr_len, copy_offset, rmpp_active;
 
@@ -473,28 +528,36 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
         }
 
         /*
-         * If userspace is generating a request that will generate a
-         * response, we need to make sure the high-order part of the
-         * transaction ID matches the agent being used to send the
-         * MAD.
+         * Set the high-order part of the transaction ID to make MADs from
+         * different agents unique, and allow routing responses back to the
+         * original requestor.
          */
-        method = ((struct ib_mad_hdr *) packet->msg->mad)->method;
-
-        if (!(method & IB_MGMT_METHOD_RESP)       &&
-            method != IB_MGMT_METHOD_TRAP_REPRESS &&
-            method != IB_MGMT_METHOD_SEND) {
+        if (!ib_response_mad(packet->msg->mad)) {
                 tid = &((struct ib_mad_hdr *) packet->msg->mad)->tid;
                 *tid = cpu_to_be64(((u64) agent->hi_tid) << 32 |
                                    (be64_to_cpup(tid) & 0xffffffff));
+                rmpp_mad->mad_hdr.tid = *tid;
+        }
+
+        spin_lock_irq(&file->send_lock);
+        ret = is_duplicate(file, packet);
+        if (!ret)
+                list_add_tail(&packet->list, &file->send_list);
+        spin_unlock_irq(&file->send_lock);
+        if (ret) {
+                ret = -EINVAL;
+                goto err_msg;
         }
 
         ret = ib_post_send_mad(packet->msg, NULL);
         if (ret)
-                goto err_msg;
+                goto err_send;
 
         up_read(&file->port->mutex);
         return count;
 
+err_send:
+        dequeue_send(file, packet);
 err_msg:
         ib_free_send_mad(packet->msg);
 err_ah:
@@ -657,7 +720,9 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
         }
 
         spin_lock_init(&file->recv_lock);
+        spin_lock_init(&file->send_lock);
         INIT_LIST_HEAD(&file->recv_list);
+        INIT_LIST_HEAD(&file->send_list);
         init_waitqueue_head(&file->recv_wait);
 
         file->port = port;
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bb9bee56a824..102a59c033ff 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -42,6 +42,7 @@
 #include <linux/kref.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
+#include <linux/completion.h>
 
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
@@ -69,6 +70,7 @@
 
 struct ib_uverbs_device {
         struct kref                             ref;
+        struct completion                       comp;
         int                                     devnum;
         struct cdev                            *dev;
         struct class_device                    *class_dev;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index bdf5d5098190..30923eb68ec7 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -42,6 +42,13 @@
 
 #include "uverbs.h"
 
+static struct lock_class_key pd_lock_key;
+static struct lock_class_key mr_lock_key;
+static struct lock_class_key cq_lock_key;
+static struct lock_class_key qp_lock_key;
+static struct lock_class_key ah_lock_key;
+static struct lock_class_key srq_lock_key;
+
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
         do {                                                            \
                 (udata)->inbuf  = (void __user *) (ibuf);               \
@@ -76,12 +83,13 @@
  */
 
 static void init_uobj(struct ib_uobject *uobj, u64 user_handle,
-                      struct ib_ucontext *context)
+                      struct ib_ucontext *context, struct lock_class_key *key)
 {
         uobj->user_handle = user_handle;
         uobj->context     = context;
         kref_init(&uobj->ref);
         init_rwsem(&uobj->mutex);
+        lockdep_set_class(&uobj->mutex, key);
         uobj->live        = 0;
 }
 
@@ -470,7 +478,7 @@ ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
         if (!uobj)
                 return -ENOMEM;
 
-        init_uobj(uobj, 0, file->ucontext);
+        init_uobj(uobj, 0, file->ucontext, &pd_lock_key);
         down_write(&uobj->mutex);
 
         pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
@@ -591,7 +599,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
         if (!obj)
                 return -ENOMEM;
 
-        init_uobj(&obj->uobject, 0, file->ucontext);
+        init_uobj(&obj->uobject, 0, file->ucontext, &mr_lock_key);
         down_write(&obj->uobject.mutex);
 
         /*
@@ -770,7 +778,7 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
         if (!obj)
                 return -ENOMEM;
 
-        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext);
+        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext, &cq_lock_key);
         down_write(&obj->uobject.mutex);
 
         if (cmd.comp_channel >= 0) {
@@ -1051,13 +1059,14 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
         if (!obj)
                 return -ENOMEM;
 
-        init_uobj(&obj->uevent.uobject, cmd.user_handle, file->ucontext);
+        init_uobj(&obj->uevent.uobject, cmd.user_handle, file->ucontext, &qp_lock_key);
         down_write(&obj->uevent.uobject.mutex);
 
+        srq = cmd.is_srq ? idr_read_srq(cmd.srq_handle, file->ucontext) : NULL;
         pd  = idr_read_pd(cmd.pd_handle, file->ucontext);
         scq = idr_read_cq(cmd.send_cq_handle, file->ucontext);
-        rcq = idr_read_cq(cmd.recv_cq_handle, file->ucontext);
-        srq = cmd.is_srq ? idr_read_srq(cmd.srq_handle, file->ucontext) : NULL;
+        rcq = cmd.recv_cq_handle == cmd.send_cq_handle ?
+                scq : idr_read_cq(cmd.recv_cq_handle, file->ucontext);
 
         if (!pd || !scq || !rcq || (cmd.is_srq && !srq)) {
                 ret = -EINVAL;
@@ -1125,7 +1134,8 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
 
         put_pd_read(pd);
         put_cq_read(scq);
-        put_cq_read(rcq);
+        if (rcq != scq)
+                put_cq_read(rcq);
         if (srq)
                 put_srq_read(srq);
 
@@ -1150,7 +1160,7 @@ err_put:
                 put_pd_read(pd);
         if (scq)
                 put_cq_read(scq);
-        if (rcq)
+        if (rcq && rcq != scq)
                 put_cq_read(rcq);
         if (srq)
                 put_srq_read(srq);
@@ -1751,7 +1761,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
         if (!uobj)
                 return -ENOMEM;
 
-        init_uobj(uobj, cmd.user_handle, file->ucontext);
+        init_uobj(uobj, cmd.user_handle, file->ucontext, &ah_lock_key);
         down_write(&uobj->mutex);
 
         pd = idr_read_pd(cmd.pd_handle, file->ucontext);
@@ -1775,7 +1785,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
         ah = ib_create_ah(pd, &attr);
         if (IS_ERR(ah)) {
                 ret = PTR_ERR(ah);
-                goto err;
+                goto err_put;
         }
 
         ah->uobject  = uobj;
@@ -1811,6 +1821,9 @@ err_copy:
 err_destroy:
         ib_destroy_ah(ah);
 
+err_put:
+        put_pd_read(pd);
+
 err:
         put_uobj_write(uobj);
         return ret;
@@ -1963,7 +1976,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
         if (!obj)
                 return -ENOMEM;
 
-        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext);
+        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext, &srq_lock_key);
         down_write(&obj->uobject.mutex);
 
         pd  = idr_read_pd(cmd.pd_handle, file->ucontext);
@@ -1984,7 +1997,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
         srq = pd->device->create_srq(pd, &attr, &udata);
         if (IS_ERR(srq)) {
                 ret = PTR_ERR(srq);
-                goto err;
+                goto err_put;
         }
 
         srq->device        = pd->device;
@@ -2029,6 +2042,9 @@ err_copy:
 err_destroy:
         ib_destroy_srq(srq);
 
+err_put:
+        put_pd_read(pd);
+
 err:
         put_uobj_write(&obj->uobject);
         return ret;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index e725cccc7cde..4e16314e8e6d 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -122,7 +122,7 @@ static void ib_uverbs_release_dev(struct kref *ref)
         struct ib_uverbs_device *dev =
                 container_of(ref, struct ib_uverbs_device, ref);
 
-        kfree(dev);
+        complete(&dev->comp);
 }
 
 void ib_uverbs_release_ucq(struct ib_uverbs_file *file,
@@ -740,6 +740,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
                 return;
 
         kref_init(&uverbs_dev->ref);
+        init_completion(&uverbs_dev->comp);
 
         spin_lock(&map_lock);
         uverbs_dev->devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -793,6 +794,8 @@ err_cdev:
 
 err:
         kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+        wait_for_completion(&uverbs_dev->comp);
+        kfree(uverbs_dev);
         return;
 }
 
@@ -812,7 +815,10 @@ static void ib_uverbs_remove_one(struct ib_device *device)
         spin_unlock(&map_lock);
 
         clear_bit(uverbs_dev->devnum, dev_map);
+
         kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+        wait_for_completion(&uverbs_dev->comp);
+        kfree(uverbs_dev);
 }
 
 static int uverbs_event_get_sb(struct file_system_type *fs_type, int flags,
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 823131d58b34..f98518d912b5 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -859,6 +859,38 @@ static void ipath_rcv_layer(struct ipath_devdata *dd, u32 etail,
                 __ipath_layer_rcv_lid(dd, hdr);
 }
 
+static void ipath_rcv_hdrerr(struct ipath_devdata *dd,
+                             u32 eflags,
+                             u32 l,
+                             u32 etail,
+                             u64 *rc)
+{
+        char emsg[128];
+        struct ipath_message_header *hdr;
+
+        get_rhf_errstring(eflags, emsg, sizeof emsg);
+        hdr = (struct ipath_message_header *)&rc[1];
+        ipath_cdbg(PKT, "RHFerrs %x hdrqtail=%x typ=%u "
+                   "tlen=%x opcode=%x egridx=%x: %s\n",
+                   eflags, l,
+                   ipath_hdrget_rcv_type((__le32 *) rc),
+                   ipath_hdrget_length_in_bytes((__le32 *) rc),
+                   be32_to_cpu(hdr->bth[0]) >> 24,
+                   etail, emsg);
+
+        /* Count local link integrity errors. */
+        if (eflags & (INFINIPATH_RHF_H_ICRCERR | INFINIPATH_RHF_H_VCRCERR)) {
+                u8 n = (dd->ipath_ibcctrl >>
+                        INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT) &
+                        INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK;
+
+                if (++dd->ipath_lli_counter > n) {
+                        dd->ipath_lli_counter = 0;
+                        dd->ipath_lli_errors++;
+                }
+        }
+}
+
 /*
  * ipath_kreceive - receive a packet
  * @dd: the infinipath device
@@ -875,7 +907,6 @@ void ipath_kreceive(struct ipath_devdata *dd)
         struct ipath_message_header *hdr;
         u32 eflags, i, etype, tlen, pkttot = 0, updegr=0, reloop=0;
         static u64 totcalls;    /* stats, may eventually remove */
-        char emsg[128];
 
         if (!dd->ipath_hdrqtailptr) {
                 ipath_dev_err(dd,
@@ -938,26 +969,9 @@ reloop:
                                    "%x\n", etype);
                 }
 
-                if (eflags & ~(INFINIPATH_RHF_H_TIDERR |
-                               INFINIPATH_RHF_H_IHDRERR)) {
-                        get_rhf_errstring(eflags, emsg, sizeof emsg);
-                        ipath_cdbg(PKT, "RHFerrs %x hdrqtail=%x typ=%u "
-                                   "tlen=%x opcode=%x egridx=%x: %s\n",
-                                   eflags, l, etype, tlen, bthbytes[0],
-                                   ipath_hdrget_index((__le32 *) rc), emsg);
-                        /* Count local link integrity errors. */
-                        if (eflags & (INFINIPATH_RHF_H_ICRCERR |
-                                      INFINIPATH_RHF_H_VCRCERR)) {
-                                u8 n = (dd->ipath_ibcctrl >>
-                                        INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT) &
-                                        INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK;
-
-                                if (++dd->ipath_lli_counter > n) {
-                                        dd->ipath_lli_counter = 0;
-                                        dd->ipath_lli_errors++;
-                                }
-                        }
-                } else if (etype == RCVHQ_RCV_TYPE_NON_KD) {
+                if (unlikely(eflags))
+                        ipath_rcv_hdrerr(dd, eflags, l, etail, rc);
+                else if (etype == RCVHQ_RCV_TYPE_NON_KD) {
                                 int ret = __ipath_verbs_rcv(dd, rc + 1,
                                                             ebuf, tlen);
                                 if (ret == -ENODEV)
@@ -981,25 +995,7 @@ reloop:
                 else if (etype == RCVHQ_RCV_TYPE_EXPECTED)
                         ipath_dbg("Bug: Expected TID, opcode %x; ignored\n",
                                   be32_to_cpu(hdr->bth[0]) & 0xff);
-                else if (eflags & (INFINIPATH_RHF_H_TIDERR |
-                                   INFINIPATH_RHF_H_IHDRERR)) {
-                        /*
-                         * This is a type 3 packet, only the LRH is in the
-                         * rcvhdrq, the rest of the header is in the eager
-                         * buffer.
-                         */
-                        u8 opcode;
-                        if (ebuf) {
-                                bthbytes = (u8 *) ebuf;
-                                opcode = *bthbytes;
-                        }
-                        else
-                                opcode = 0;
-                        get_rhf_errstring(eflags, emsg, sizeof emsg);
-                        ipath_dbg("Err %x (%s), opcode %x, egrbuf %x, "
-                                  "len %x\n", eflags, emsg, opcode, etail,
-                                  tlen);
-                } else {
+                else {
                         /*
                          * error packet, type of error  unknown.
                          * Probably type 3, but we don't know, so don't
diff --git a/drivers/infiniband/hw/ipath/ipath_keys.c b/drivers/infiniband/hw/ipath/ipath_keys.c
index 46773c673a1a..a5ca279370aa 100644
--- a/drivers/infiniband/hw/ipath/ipath_keys.c
+++ b/drivers/infiniband/hw/ipath/ipath_keys.c
@@ -197,6 +197,21 @@ int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss,
         size_t off;
         int ret;
 
+        /*
+         * We use RKEY == zero for physical addresses
+         * (see ipath_get_dma_mr).
+         */
+        if (rkey == 0) {
+                sge->mr = NULL;
+                sge->vaddr = phys_to_virt(vaddr);
+                sge->length = len;
+                sge->sge_length = len;
+                ss->sg_list = NULL;
+                ss->num_sge = 1;
+                ret = 1;
+                goto bail;
+        }
+
         mr = rkt->table[(rkey >> (32 - ib_ipath_lkey_table_size))];
         if (unlikely(mr == NULL || mr->lkey != rkey)) {
                 ret = 0;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 56ac336dd1ec..d70a9b6b5239 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -191,10 +191,6 @@ void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
 {
         struct ipath_sge *sge = &ss->sge;
 
-        while (length > sge->sge_length) {
-                length -= sge->sge_length;
-                ss->sge = *ss->sg_list++;
-        }
         while (length) {
                 u32 len = sge->length;
 
@@ -627,6 +623,7 @@ static int ipath_query_device(struct ib_device *ibdev,
         props->device_cap_flags = IB_DEVICE_BAD_PKEY_CNTR |
                 IB_DEVICE_BAD_QKEY_CNTR | IB_DEVICE_SHUTDOWN_PORT |
                 IB_DEVICE_SYS_IMAGE_GUID;
+        props->page_size_cap = PAGE_SIZE;
         props->vendor_id = ipath_layer_get_vendorid(dev->dd);
         props->vendor_part_id = ipath_layer_get_deviceid(dev->dd);
         props->hw_ver = ipath_layer_get_pcirev(dev->dd);
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index 9ba3211cef7c..f930e55b58fc 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -41,9 +41,11 @@
 /* Trivial bitmap-based allocator */
 u32 mthca_alloc(struct mthca_alloc *alloc)
 {
+        unsigned long flags;
         u32 obj;
 
-        spin_lock(&alloc->lock);
+        spin_lock_irqsave(&alloc->lock, flags);
+
         obj = find_next_zero_bit(alloc->table, alloc->max, alloc->last);
         if (obj >= alloc->max) {
                 alloc->top = (alloc->top + alloc->max) & alloc->mask;
@@ -56,19 +58,24 @@ u32 mthca_alloc(struct mthca_alloc *alloc)
         } else
                 obj = -1;
 
-        spin_unlock(&alloc->lock);
+        spin_unlock_irqrestore(&alloc->lock, flags);
 
         return obj;
 }
 
 void mthca_free(struct mthca_alloc *alloc, u32 obj)
 {
+        unsigned long flags;
+
         obj &= alloc->max - 1;
-        spin_lock(&alloc->lock);
+
+        spin_lock_irqsave(&alloc->lock, flags);
+
         clear_bit(obj, alloc->table);
         alloc->last = min(alloc->last, obj);
         alloc->top = (alloc->top + alloc->max) & alloc->mask;
-        spin_unlock(&alloc->lock);
+
+        spin_unlock_irqrestore(&alloc->lock, flags);
 }
 
 int mthca_alloc_init(struct mthca_alloc *alloc, u32 num, u32 mask,
@@ -108,14 +115,15 @@ void mthca_alloc_cleanup(struct mthca_alloc *alloc)
  * serialize access to the array.
  */
 
+#define MTHCA_ARRAY_MASK (PAGE_SIZE / sizeof (void *) - 1)
+
 void *mthca_array_get(struct mthca_array *array, int index)
 {
         int p = (index * sizeof (void *)) >> PAGE_SHIFT;
 
-        if (array->page_list[p].page) {
-                int i = index & (PAGE_SIZE / sizeof (void *) - 1);
-                return array->page_list[p].page[i];
-        } else
+        if (array->page_list[p].page)
+                return array->page_list[p].page[index & MTHCA_ARRAY_MASK];
+        else
                 return NULL;
 }
 
@@ -130,8 +138,7 @@ int mthca_array_set(struct mthca_array *array, int index, void *value)
         if (!array->page_list[p].page)
                 return -ENOMEM;
 
-        array->page_list[p].page[index & (PAGE_SIZE / sizeof (void *) - 1)] =
-                value;
+        array->page_list[p].page[index & MTHCA_ARRAY_MASK] = value;
         ++array->page_list[p].used;
 
         return 0;
@@ -144,7 +151,8 @@ void mthca_array_clear(struct mthca_array *array, int index)
         if (--array->page_list[p].used == 0) {
                 free_page((unsigned long) array->page_list[p].page);
                 array->page_list[p].page = NULL;
-        }
+        } else
+                array->page_list[p].page[index & MTHCA_ARRAY_MASK] = NULL;
 
         if (array->page_list[p].used < 0)
                 pr_debug("Array %p index %d page %d with ref count %d < 0\n",
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index b12aa03be251..e215041b2db9 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -303,9 +303,10 @@ int mthca_ah_query(struct ib_ah *ibah, struct ib_ah_attr *attr)
         memset(attr, 0, sizeof *attr);
         attr->dlid          = be16_to_cpu(ah->av->dlid);
         attr->sl            = be32_to_cpu(ah->av->sl_tclass_flowlabel) >> 28;
-        attr->static_rate   = ah->av->msg_sr & 0x7;
-        attr->src_path_bits = ah->av->g_slid & 0x7F;
         attr->port_num      = be32_to_cpu(ah->av->port_pd) >> 24;
+        attr->static_rate   = mthca_rate_to_ib(dev, ah->av->msg_sr & 0x7,
+                                               attr->port_num);
+        attr->src_path_bits = ah->av->g_slid & 0x7F;
         attr->ah_flags      = mthca_ah_grh_present(ah) ? IB_AH_GRH : 0;
 
         if (attr->ah_flags) {
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index d0f7731802c9..deabc14b4ea4 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -778,11 +778,12 @@ int mthca_QUERY_FW(struct mthca_dev *dev, u8 *status)
                 ((dev->fw_ver & 0xffff0000ull) >> 16) |
                 ((dev->fw_ver & 0x0000ffffull) << 16);
 
+        MTHCA_GET(lg, outbox, QUERY_FW_MAX_CMD_OFFSET);
+        dev->cmd.max_cmds = 1 << lg;
+
         mthca_dbg(dev, "FW version %012llx, max commands %d\n",
                   (unsigned long long) dev->fw_ver, dev->cmd.max_cmds);
 
-        MTHCA_GET(lg, outbox, QUERY_FW_MAX_CMD_OFFSET);
-        dev->cmd.max_cmds = 1 << lg;
         MTHCA_GET(dev->catas_err.addr, outbox, QUERY_FW_ERR_START_OFFSET);
         MTHCA_GET(dev->catas_err.size, outbox, QUERY_FW_ERR_SIZE_OFFSET);
 
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 557cde3a4563..7b82c1907f04 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -967,12 +967,12 @@ static struct {
 } mthca_hca_table[] = {
         [TAVOR]        = { .latest_fw = MTHCA_FW_VER(3, 4, 0),
                            .flags     = 0 },
-        [ARBEL_COMPAT] = { .latest_fw = MTHCA_FW_VER(4, 7, 400),
+        [ARBEL_COMPAT] = { .latest_fw = MTHCA_FW_VER(4, 7, 600),
                            .flags     = MTHCA_FLAG_PCIE },
-        [ARBEL_NATIVE] = { .latest_fw = MTHCA_FW_VER(5, 1, 0),
+        [ARBEL_NATIVE] = { .latest_fw = MTHCA_FW_VER(5, 1, 400),
                            .flags     = MTHCA_FLAG_MEMFREE |
                                         MTHCA_FLAG_PCIE },
-        [SINAI]        = { .latest_fw = MTHCA_FW_VER(1, 0, 800),
+        [SINAI]        = { .latest_fw = MTHCA_FW_VER(1, 1, 0),
                            .flags     = MTHCA_FLAG_MEMFREE |
                                         MTHCA_FLAG_PCIE    |
                                         MTHCA_FLAG_SINAI_OPT }
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 230ae21db8fd..265b1d1c4a62 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -1287,11 +1287,7 @@ int mthca_register_device(struct mthca_dev *dev)
                 (1ull << IB_USER_VERBS_CMD_MODIFY_QP)           |
                 (1ull << IB_USER_VERBS_CMD_DESTROY_QP)          |
                 (1ull << IB_USER_VERBS_CMD_ATTACH_MCAST)        |
-                (1ull << IB_USER_VERBS_CMD_DETACH_MCAST)        |
-                (1ull << IB_USER_VERBS_CMD_CREATE_SRQ)          |
-                (1ull << IB_USER_VERBS_CMD_MODIFY_SRQ)          |
-                (1ull << IB_USER_VERBS_CMD_QUERY_SRQ)           |
-                (1ull << IB_USER_VERBS_CMD_DESTROY_SRQ);
+                (1ull << IB_USER_VERBS_CMD_DETACH_MCAST);
         dev->ib_dev.node_type            = IB_NODE_CA;
         dev->ib_dev.phys_port_cnt        = dev->limits.num_ports;
         dev->ib_dev.dma_device           = &dev->pdev->dev;
@@ -1316,6 +1312,11 @@ int mthca_register_device(struct mthca_dev *dev)
                 dev->ib_dev.modify_srq           = mthca_modify_srq;
                 dev->ib_dev.query_srq            = mthca_query_srq;
                 dev->ib_dev.destroy_srq          = mthca_destroy_srq;
+                dev->ib_dev.uverbs_cmd_mask     |=
+                        (1ull << IB_USER_VERBS_CMD_CREATE_SRQ)          |
+                        (1ull << IB_USER_VERBS_CMD_MODIFY_SRQ)          |
+                        (1ull << IB_USER_VERBS_CMD_QUERY_SRQ)           |
+                        (1ull << IB_USER_VERBS_CMD_DESTROY_SRQ);
 
                 if (mthca_is_memfree(dev))
                         dev->ib_dev.post_srq_recv = mthca_arbel_post_srq_recv;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 8de2887ba15c..9a5bece3fa5c 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -136,8 +136,8 @@ struct mthca_ah {
  * We have one global lock that protects dev->cq/qp_table.  Each
  * struct mthca_cq/qp also has its own lock.  An individual qp lock
  * may be taken inside of an individual cq lock.  Both cqs attached to
- * a qp may be locked, with the send cq locked first.  No other
- * nesting should be done.
+ * a qp may be locked, with the cq with the lower cqn locked first.
+ * No other nesting should be done.
  *
  * Each struct mthca_cq/qp also has an ref count, protected by the
  * corresponding table lock.  The pointer from the cq/qp_table to the
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 16c387d8170c..2e8f6f36e0a5 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -99,6 +99,10 @@ enum {
         MTHCA_QP_BIT_RSC = 1 <<  3
 };
 
+enum {
+        MTHCA_SEND_DOORBELL_FENCE = 1 << 5
+};
+
 struct mthca_qp_path {
         __be32 port_pkey;
         u8     rnr_retry;
@@ -222,9 +226,8 @@ static void *get_send_wqe(struct mthca_qp *qp, int n)
                          (PAGE_SIZE - 1));
 }
 
-static void mthca_wq_init(struct mthca_wq *wq)
+static void mthca_wq_reset(struct mthca_wq *wq)
 {
-        spin_lock_init(&wq->lock);
         wq->next_ind  = 0;
         wq->last_comp = wq->max - 1;
         wq->head      = 0;
@@ -845,10 +848,10 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
                         mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq), qp->qpn,
                                        qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
 
-                mthca_wq_init(&qp->sq);
+                mthca_wq_reset(&qp->sq);
                 qp->sq.last = get_send_wqe(qp, qp->sq.max - 1);
 
-                mthca_wq_init(&qp->rq);
+                mthca_wq_reset(&qp->rq);
                 qp->rq.last = get_recv_wqe(qp, qp->rq.max - 1);
 
                 if (mthca_is_memfree(dev)) {
@@ -1112,8 +1115,11 @@ static int mthca_alloc_qp_common(struct mthca_dev *dev,
         qp->atomic_rd_en = 0;
         qp->resp_depth   = 0;
         qp->sq_policy    = send_policy;
-        mthca_wq_init(&qp->sq);
-        mthca_wq_init(&qp->rq);
+        mthca_wq_reset(&qp->sq);
+        mthca_wq_reset(&qp->rq);
+
+        spin_lock_init(&qp->sq.lock);
+        spin_lock_init(&qp->rq.lock);
 
         ret = mthca_map_memfree(dev, qp);
         if (ret)
@@ -1257,6 +1263,32 @@ int mthca_alloc_qp(struct mthca_dev *dev,
         return 0;
 }
 
+static void mthca_lock_cqs(struct mthca_cq *send_cq, struct mthca_cq *recv_cq)
+{
+        if (send_cq == recv_cq)
+                spin_lock_irq(&send_cq->lock);
+        else if (send_cq->cqn < recv_cq->cqn) {
+                spin_lock_irq(&send_cq->lock);
+                spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING);
+        } else {
+                spin_lock_irq(&recv_cq->lock);
+                spin_lock_nested(&send_cq->lock, SINGLE_DEPTH_NESTING);
+        }
+}
+
+static void mthca_unlock_cqs(struct mthca_cq *send_cq, struct mthca_cq *recv_cq)
+{
+        if (send_cq == recv_cq)
+                spin_unlock_irq(&send_cq->lock);
+        else if (send_cq->cqn < recv_cq->cqn) {
+                spin_unlock(&recv_cq->lock);
+                spin_unlock_irq(&send_cq->lock);
+        } else {
+                spin_unlock(&send_cq->lock);
+                spin_unlock_irq(&recv_cq->lock);
+        }
+}
+
 int mthca_alloc_sqp(struct mthca_dev *dev,
                     struct mthca_pd *pd,
                     struct mthca_cq *send_cq,
@@ -1309,17 +1341,13 @@ int mthca_alloc_sqp(struct mthca_dev *dev,
          * Lock CQs here, so that CQ polling code can do QP lookup
          * without taking a lock.
          */
-        spin_lock_irq(&send_cq->lock);
-        if (send_cq != recv_cq)
-                spin_lock(&recv_cq->lock);
+        mthca_lock_cqs(send_cq, recv_cq);
 
         spin_lock(&dev->qp_table.lock);
         mthca_array_clear(&dev->qp_table.qp, mqpn);
         spin_unlock(&dev->qp_table.lock);
 
-        if (send_cq != recv_cq)
-                spin_unlock(&recv_cq->lock);
-        spin_unlock_irq(&send_cq->lock);
+        mthca_unlock_cqs(send_cq, recv_cq);
 
  err_out:
         dma_free_coherent(&dev->pdev->dev, sqp->header_buf_size,
@@ -1353,9 +1381,7 @@ void mthca_free_qp(struct mthca_dev *dev,
          * Lock CQs here, so that CQ polling code can do QP lookup
          * without taking a lock.
          */
-        spin_lock_irq(&send_cq->lock);
-        if (send_cq != recv_cq)
-                spin_lock(&recv_cq->lock);
+        mthca_lock_cqs(send_cq, recv_cq);
 
         spin_lock(&dev->qp_table.lock);
         mthca_array_clear(&dev->qp_table.qp,
@@ -1363,9 +1389,7 @@ void mthca_free_qp(struct mthca_dev *dev,
         --qp->refcount;
         spin_unlock(&dev->qp_table.lock);
 
-        if (send_cq != recv_cq)
-                spin_unlock(&recv_cq->lock);
-        spin_unlock_irq(&send_cq->lock);
+        mthca_unlock_cqs(send_cq, recv_cq);
 
         wait_event(qp->wait, !get_qp_refcount(dev, qp));
 
@@ -1500,7 +1524,7 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         int i;
         int size;
         int size0 = 0;
-        u32 f0 = 0;
+        u32 f0;
         int ind;
         u8 op0 = 0;
 
@@ -1684,6 +1708,8 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 if (!size0) {
                         size0 = size;
                         op0   = mthca_opcode[wr->opcode];
+                        f0    = wr->send_flags & IB_SEND_FENCE ?
+                                MTHCA_SEND_DOORBELL_FENCE : 0;
                 }
 
                 ++ind;
@@ -1841,7 +1867,7 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         int i;
         int size;
         int size0 = 0;
-        u32 f0 = 0;
+        u32 f0;
         int ind;
         u8 op0 = 0;
 
@@ -2049,6 +2075,8 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 if (!size0) {
                         size0 = size;
                         op0   = mthca_opcode[wr->opcode];
+                        f0    = wr->send_flags & IB_SEND_FENCE ?
+                                MTHCA_SEND_DOORBELL_FENCE : 0;
                 }
 
                 ++ind;
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index fab417c5cf43..b60a9d79ae54 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -370,7 +370,8 @@ int mthca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                 return -EINVAL;
 
         if (attr_mask & IB_SRQ_LIMIT) {
-                if (attr->srq_limit > srq->max)
+                u32 max_wr = mthca_is_memfree(dev) ? srq->max - 1 : srq->max;
+                if (attr->srq_limit > max_wr)
                         return -EINVAL;
 
                 mutex_lock(&srq->mutex);
diff --git a/drivers/infiniband/ulp/ipoib/Kconfig b/drivers/infiniband/ulp/ipoib/Kconfig
index 13d6d01c72c0..d74653d7de1c 100644
--- a/drivers/infiniband/ulp/ipoib/Kconfig
+++ b/drivers/infiniband/ulp/ipoib/Kconfig
@@ -6,8 +6,7 @@ config INFINIBAND_IPOIB
           transports IP packets over InfiniBand so you can use your IB
           device as a fancy NIC.
 
-          The IPoIB protocol is defined by the IETF ipoib working
-          group: <http://www.ietf.org/html.charters/ipoib-charter.html>.
+          See Documentation/infiniband/ipoib.txt for more information
 
 config INFINIBAND_IPOIB_DEBUG
         bool "IP-over-InfiniBand debugging" if EMBEDDED
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 3f89f5e19036..474aa214ab57 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -212,6 +212,7 @@ struct ipoib_path {
 
 struct ipoib_neigh {
         struct ipoib_ah    *ah;
+        union ib_gid        dgid;
         struct sk_buff_head queue;
 
         struct neighbour   *neighbour;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1c6ea1c682a5..cf71d2a5515c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -404,6 +404,8 @@ static void path_rec_completion(int status,
                 list_for_each_entry(neigh, &path->neigh_list, list) {
                         kref_get(&path->ah->ref);
                         neigh->ah = path->ah;
+                        memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                               sizeof(union ib_gid));
 
                         while ((skb = __skb_dequeue(&neigh->queue)))
                                 __skb_queue_tail(&skqueue, skb);
@@ -510,6 +512,8 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
         if (path->ah) {
                 kref_get(&path->ah->ref);
                 neigh->ah = path->ah;
+                memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                       sizeof(union ib_gid));
 
                 ipoib_send(dev, skb, path->ah,
                            be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
@@ -633,6 +637,25 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 neigh = *to_ipoib_neigh(skb->dst->neighbour);
 
                 if (likely(neigh->ah)) {
+                        if (unlikely(memcmp(&neigh->dgid.raw,
+                                            skb->dst->neighbour->ha + 4,
+                                            sizeof(union ib_gid)))) {
+                                spin_lock(&priv->lock);
+                                /*
+                                 * It's safe to call ipoib_put_ah() inside
+                                 * priv->lock here, because we know that
+                                 * path->ah will always hold one more reference,
+                                 * so ipoib_put_ah() will never do more than
+                                 * decrement the ref count.
+                                 */
+                                ipoib_put_ah(neigh->ah);
+                                list_del(&neigh->list);
+                                ipoib_neigh_free(neigh);
+                                spin_unlock(&priv->lock);
+                                ipoib_path_lookup(skb, dev);
+                                goto out;
+                        }
+
                         ipoib_send(dev, skb, neigh->ah,
                                    be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
                         goto out;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ab40488182b3..ec356ce7cdcd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -264,6 +264,10 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                 if (!ah) {
                         ipoib_warn(priv, "ib_address_create failed\n");
                 } else {
+                        spin_lock_irq(&priv->lock);
+                        mcast->ah = ah;
+                        spin_unlock_irq(&priv->lock);
+
                         ipoib_dbg_mcast(priv, "MGID " IPOIB_GID_FMT
                                         " AV %p, LID 0x%04x, SL %d\n",
                                         IPOIB_GID_ARG(mcast->mcmember.mgid),
@@ -271,10 +275,6 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                                         be16_to_cpu(mcast->mcmember.mlid),
                                         mcast->mcmember.sl);
                 }
-
-                spin_lock_irq(&priv->lock);
-                mcast->ah = ah;
-                spin_unlock_irq(&priv->lock);
         }
 
         /* actually send any queued packets */
@@ -326,6 +326,7 @@ ipoib_mcast_sendonly_join_complete(int status,
 
                 /* Clear the busy flag so we try again */
                 clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+                mcast->query = NULL;
         }
 
         complete(&mcast->done);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index b2c033edb03c..1437d7ee3b19 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -378,21 +378,6 @@ iscsi_iser_conn_start(struct iscsi_cls_conn *cls_conn)
         return iser_conn_set_full_featured_mode(conn);
 }
 
-static void
-iscsi_iser_conn_terminate(struct iscsi_conn *conn)
-{
-        struct iscsi_iser_conn *iser_conn = conn->dd_data;
-        struct iser_conn *ib_conn = iser_conn->ib_conn;
-
-        BUG_ON(!ib_conn);
-        /* starts conn teardown process, waits until all previously   *
-         * posted buffers get flushed, deallocates all conn resources */
-        iser_conn_terminate(ib_conn);
-        iser_conn->ib_conn = NULL;
-        conn->recv_lock = NULL;
-}
-
-
 static struct iscsi_transport iscsi_iser_transport;
 
 static struct iscsi_cls_session *
@@ -437,159 +422,50 @@ iscsi_iser_session_create(struct iscsi_transport *iscsit,
 }
 
 static int
-iscsi_iser_conn_set_param(struct iscsi_cls_conn *cls_conn,
-                          enum iscsi_param param, uint32_t value)
+iscsi_iser_set_param(struct iscsi_cls_conn *cls_conn,
+                     enum iscsi_param param, char *buf, int buflen)
 {
-        struct iscsi_conn *conn = cls_conn->dd_data;
-        struct iscsi_session *session = conn->session;
-
-        spin_lock_bh(&session->lock);
-        if (conn->c_stage != ISCSI_CONN_INITIAL_STAGE &&
-            conn->stop_stage != STOP_CONN_RECOVER) {
-                printk(KERN_ERR "iscsi_iser: can not change parameter [%d]\n",
-                       param);
-                spin_unlock_bh(&session->lock);
-                return 0;
-        }
-        spin_unlock_bh(&session->lock);
+        int value;
 
         switch (param) {
         case ISCSI_PARAM_MAX_RECV_DLENGTH:
                 /* TBD */
                 break;
-        case ISCSI_PARAM_MAX_XMIT_DLENGTH:
-                conn->max_xmit_dlength =  value;
-                break;
         case ISCSI_PARAM_HDRDGST_EN:
+                sscanf(buf, "%d", &value);
                 if (value) {
                         printk(KERN_ERR "DataDigest wasn't negotiated to None");
                         return -EPROTO;
                 }
                 break;
         case ISCSI_PARAM_DATADGST_EN:
+                sscanf(buf, "%d", &value);
                 if (value) {
                         printk(KERN_ERR "DataDigest wasn't negotiated to None");
                         return -EPROTO;
                 }
                 break;
-        case ISCSI_PARAM_INITIAL_R2T_EN:
-                session->initial_r2t_en = value;
-                break;
-        case ISCSI_PARAM_IMM_DATA_EN:
-                session->imm_data_en = value;
-                break;
-        case ISCSI_PARAM_FIRST_BURST:
-                session->first_burst = value;
-                break;
-        case ISCSI_PARAM_MAX_BURST:
-                session->max_burst = value;
-                break;
-        case ISCSI_PARAM_PDU_INORDER_EN:
-                session->pdu_inorder_en = value;
-                break;
-        case ISCSI_PARAM_DATASEQ_INORDER_EN:
-                session->dataseq_inorder_en = value;
-                break;
-        case ISCSI_PARAM_ERL:
-                session->erl = value;
-                break;
         case ISCSI_PARAM_IFMARKER_EN:
+                sscanf(buf, "%d", &value);
                 if (value) {
                         printk(KERN_ERR "IFMarker wasn't negotiated to No");
                         return -EPROTO;
                 }
                 break;
         case ISCSI_PARAM_OFMARKER_EN:
+                sscanf(buf, "%d", &value);
                 if (value) {
                         printk(KERN_ERR "OFMarker wasn't negotiated to No");
                         return -EPROTO;
                 }
                 break;
         default:
-                break;
+                return iscsi_set_param(cls_conn, param, buf, buflen);
         }
 
         return 0;
 }
 
-static int
-iscsi_iser_session_get_param(struct iscsi_cls_session *cls_session,
-                             enum iscsi_param param, uint32_t *value)
-{
-        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
-        struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
-
-        switch (param) {
-        case ISCSI_PARAM_INITIAL_R2T_EN:
-                *value = session->initial_r2t_en;
-                break;
-        case ISCSI_PARAM_MAX_R2T:
-                *value = session->max_r2t;
-                break;
-        case ISCSI_PARAM_IMM_DATA_EN:
-                *value = session->imm_data_en;
-                break;
-        case ISCSI_PARAM_FIRST_BURST:
-                *value = session->first_burst;
-                break;
-        case ISCSI_PARAM_MAX_BURST:
-                *value = session->max_burst;
-                break;
-        case ISCSI_PARAM_PDU_INORDER_EN:
-                *value = session->pdu_inorder_en;
-                break;
-        case ISCSI_PARAM_DATASEQ_INORDER_EN:
-                *value = session->dataseq_inorder_en;
-                break;
-        case ISCSI_PARAM_ERL:
-                *value = session->erl;
-                break;
-        case ISCSI_PARAM_IFMARKER_EN:
-                *value = 0;
-                break;
-        case ISCSI_PARAM_OFMARKER_EN:
-                *value = 0;
-                break;
-        default:
-                return ISCSI_ERR_PARAM_NOT_FOUND;
-        }
-
-        return 0;
-}
-
-static int
-iscsi_iser_conn_get_param(struct iscsi_cls_conn *cls_conn,
-                          enum iscsi_param param, uint32_t *value)
-{
-        struct iscsi_conn *conn = cls_conn->dd_data;
-
-        switch(param) {
-        case ISCSI_PARAM_MAX_RECV_DLENGTH:
-                *value = conn->max_recv_dlength;
-                break;
-        case ISCSI_PARAM_MAX_XMIT_DLENGTH:
-                *value = conn->max_xmit_dlength;
-                break;
-        case ISCSI_PARAM_HDRDGST_EN:
-                *value = 0;
-                break;
-        case ISCSI_PARAM_DATADGST_EN:
-                *value = 0;
-                break;
-        /*case ISCSI_PARAM_TARGET_RECV_DLENGTH:
-                *value = conn->target_recv_dlength;
-                break;
-        case ISCSI_PARAM_INITIATOR_RECV_DLENGTH:
-                *value = conn->initiator_recv_dlength;
-                break;*/
-        default:
-                return ISCSI_ERR_PARAM_NOT_FOUND;
-        }
-
-        return 0;
-}
-
-
 static void
 iscsi_iser_conn_get_stats(struct iscsi_cls_conn *cls_conn, struct iscsi_stats *stats)
 {
@@ -664,13 +540,13 @@ iscsi_iser_ep_poll(__u64 ep_handle, int timeout_ms)
 static void
 iscsi_iser_ep_disconnect(__u64 ep_handle)
 {
-        struct iser_conn *ib_conn = iscsi_iser_ib_conn_lookup(ep_handle);
+        struct iser_conn *ib_conn;
 
+        ib_conn = iscsi_iser_ib_conn_lookup(ep_handle);
         if (!ib_conn)
                 return;
 
         iser_err("ib conn %p state %d\n",ib_conn, ib_conn->state);
-
         iser_conn_terminate(ib_conn);
 }
 
@@ -701,7 +577,12 @@ static struct iscsi_transport iscsi_iser_transport = {
                                   ISCSI_FIRST_BURST |
                                   ISCSI_MAX_BURST |
                                   ISCSI_PDU_INORDER_EN |
-                                  ISCSI_DATASEQ_INORDER_EN,
+                                  ISCSI_DATASEQ_INORDER_EN |
+                                  ISCSI_EXP_STATSN |
+                                  ISCSI_PERSISTENT_PORT |
+                                  ISCSI_PERSISTENT_ADDRESS |
+                                  ISCSI_TARGET_NAME |
+                                  ISCSI_TPGT,
         .host_template          = &iscsi_iser_sht,
         .conndata_size          = sizeof(struct iscsi_conn),
         .max_lun                = ISCSI_ISER_MAX_LUN,
@@ -713,14 +594,11 @@ static struct iscsi_transport iscsi_iser_transport = {
         .create_conn            = iscsi_iser_conn_create,
         .bind_conn              = iscsi_iser_conn_bind,
         .destroy_conn           = iscsi_iser_conn_destroy,
-        .set_param              = iscsi_iser_conn_set_param,
-        .get_conn_param         = iscsi_iser_conn_get_param,
-        .get_session_param      = iscsi_iser_session_get_param,
+        .set_param              = iscsi_iser_set_param,
+        .get_conn_param         = iscsi_conn_get_param,
+        .get_session_param      = iscsi_session_get_param,
         .start_conn             = iscsi_iser_conn_start,
         .stop_conn              = iscsi_conn_stop,
-        /* these are called as part of conn recovery */
-        .suspend_conn_recv      = NULL, /* FIXME is/how this relvant to iser? */
-        .terminate_conn         = iscsi_iser_conn_terminate,
         /* IO */
         .send_pdu               = iscsi_conn_send_pdu,
         .get_stats              = iscsi_iser_conn_get_stats,
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index ff117bbf81b4..72febf1f8ff8 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -594,7 +594,7 @@ int iser_reg_page_vec(struct iser_conn     *ib_conn,
         mem  = ib_fmr_pool_map_phys(ib_conn->fmr_pool,
                                     page_list,
                                     page_vec->length,
-                                    &io_addr);
+                                    io_addr);
 
         if (IS_ERR(mem)) {
                 status = (int)PTR_ERR(mem);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 4e22afef7206..fd8344cdc0db 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -77,6 +77,14 @@ MODULE_PARM_DESC(topspin_workarounds,
 
 static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
 
+static int mellanox_workarounds = 1;
+
+module_param(mellanox_workarounds, int, 0444);
+MODULE_PARM_DESC(mellanox_workarounds,
+                 "Enable workarounds for Mellanox SRP target bugs if != 0");
+
+static const u8 mellanox_oui[3] = { 0x00, 0x02, 0xc9 };
+
 static void srp_add_one(struct ib_device *device);
 static void srp_remove_one(struct ib_device *device);
 static void srp_completion(struct ib_cq *cq, void *target_ptr);
@@ -526,8 +534,10 @@ static int srp_reconnect_target(struct srp_target_port *target)
         while (ib_poll_cq(target->cq, 1, &wc) > 0)
                 ; /* nothing */
 
+        spin_lock_irq(target->scsi_host->host_lock);
         list_for_each_entry_safe(req, tmp, &target->req_queue, list)
                 srp_reset_req(target, req);
+        spin_unlock_irq(target->scsi_host->host_lock);
 
         target->rx_head  = 0;
         target->tx_head  = 0;
@@ -567,7 +577,7 @@ err:
         return ret;
 }
 
-static int srp_map_fmr(struct srp_device *dev, struct scatterlist *scat,
+static int srp_map_fmr(struct srp_target_port *target, struct scatterlist *scat,
                        int sg_cnt, struct srp_request *req,
                        struct srp_direct_buf *buf)
 {
@@ -577,10 +587,15 @@ static int srp_map_fmr(struct srp_device *dev, struct scatterlist *scat,
         int page_cnt;
         int i, j;
         int ret;
+        struct srp_device *dev = target->srp_host->dev;
 
         if (!dev->fmr_pool)
                 return -ENODEV;
 
+        if ((sg_dma_address(&scat[0]) & ~dev->fmr_page_mask) &&
+            mellanox_workarounds && !memcmp(&target->ioc_guid, mellanox_oui, 3))
+                return -EINVAL;
+
         len = page_cnt = 0;
         for (i = 0; i < sg_cnt; ++i) {
                 if (sg_dma_address(&scat[i]) & ~dev->fmr_page_mask) {
@@ -615,9 +630,10 @@ static int srp_map_fmr(struct srp_device *dev, struct scatterlist *scat,
                                 (sg_dma_address(&scat[i]) & dev->fmr_page_mask) + j;
 
         req->fmr = ib_fmr_pool_map_phys(dev->fmr_pool,
-                                        dma_pages, page_cnt, &io_addr);
+                                        dma_pages, page_cnt, io_addr);
         if (IS_ERR(req->fmr)) {
                 ret = PTR_ERR(req->fmr);
+                req->fmr = NULL;
                 goto out;
         }
 
@@ -682,7 +698,7 @@ static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_target_port *target,
                 buf->va  = cpu_to_be64(sg_dma_address(scat));
                 buf->key = cpu_to_be32(target->srp_host->dev->mr->rkey);
                 buf->len = cpu_to_be32(sg_dma_len(scat));
-        } else if (srp_map_fmr(target->srp_host->dev, scat, count, req,
+        } else if (srp_map_fmr(target, scat, count, req,
                                (void *) cmd->add_data)) {
                 /*
                  * FMR mapping failed, and the scatterlist has more
@@ -783,13 +799,6 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
         spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
 }
 
-static void srp_reconnect_work(void *target_ptr)
-{
-        struct srp_target_port *target = target_ptr;
-
-        srp_reconnect_target(target);
-}
-
 static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
 {
         struct srp_iu *iu;
@@ -842,7 +851,6 @@ static void srp_completion(struct ib_cq *cq, void *target_ptr)
 {
         struct srp_target_port *target = target_ptr;
         struct ib_wc wc;
-        unsigned long flags;
 
         ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
         while (ib_poll_cq(cq, 1, &wc) > 0) {
@@ -850,10 +858,6 @@ static void srp_completion(struct ib_cq *cq, void *target_ptr)
                         printk(KERN_ERR PFX "failed %s status %d\n",
                                wc.wr_id & SRP_OP_RECV ? "receive" : "send",
                                wc.status);
-                        spin_lock_irqsave(target->scsi_host->host_lock, flags);
-                        if (target->state == SRP_TARGET_LIVE)
-                                schedule_work(&target->work);
-                        spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
                         break;
                 }
 
@@ -1689,8 +1693,6 @@ static ssize_t srp_create_target(struct class_device *class_dev,
         target->scsi_host  = target_host;
         target->srp_host   = host;
 
-        INIT_WORK(&target->work, srp_reconnect_work, target);
-
         INIT_LIST_HEAD(&target->free_reqs);
         INIT_LIST_HEAD(&target->req_queue);
         for (i = 0; i < SRP_SQ_SIZE; ++i) {
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index a29d5ceb00cf..4bf48188cc91 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -127,14 +127,10 @@ static int evdev_open(struct inode * inode, struct file * file)
 {
         struct evdev_list *list;
         int i = iminor(inode) - EVDEV_MINOR_BASE;
-        int accept_err;
 
         if (i >= EVDEV_MINORS || !evdev_table[i] || !evdev_table[i]->exist)
                 return -ENODEV;
 
-        if ((accept_err = input_accept_process(&(evdev_table[i]->handle), file)))
-                return accept_err;
-
         if (!(list = kzalloc(sizeof(struct evdev_list), GFP_KERNEL)))
                 return -ENOMEM;
 
@@ -260,7 +256,7 @@ static ssize_t evdev_write(struct file * file, const char __user * buffer, size_
 
                 if (evdev_event_from_user(buffer + retval, &event))
                         return -EFAULT;
-                input_event(list->evdev->handle.dev, event.type, event.code, event.value);
+                input_inject_event(&list->evdev->handle, event.type, event.code, event.value);
                 retval += evdev_event_size();
         }
 
@@ -428,8 +424,8 @@ static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
                         if (get_user(v, ip + 1))
                                 return -EFAULT;
 
-                        input_event(dev, EV_REP, REP_DELAY, u);
-                        input_event(dev, EV_REP, REP_PERIOD, v);
+                        input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
+                        input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
 
                         return 0;
 
diff --git a/drivers/input/gameport/fm801-gp.c b/drivers/input/gameport/fm801-gp.c
index 47e93daa0fa7..90de5afe03c2 100644
--- a/drivers/input/gameport/fm801-gp.c
+++ b/drivers/input/gameport/fm801-gp.c
@@ -106,10 +106,10 @@ static int __devinit fm801_gp_probe(struct pci_dev *pci, const struct pci_device
         gp->gameport = port;
         gp->res_port = request_region(port->io, 0x10, "FM801 GP");
         if (!gp->res_port) {
-                kfree(gp);
-                gameport_free_port(port);
                 printk(KERN_DEBUG "fm801-gp: unable to grab region 0x%x-0x%x\n",
                         port->io, port->io + 0x0f);
+                gameport_free_port(port);
+                kfree(gp);
                 return -EBUSY;
         }
 
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index 36644bff379d..3f47ae55c6f3 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -53,6 +53,7 @@ static LIST_HEAD(gameport_list);
 
 static struct bus_type gameport_bus;
 
+static void gameport_add_driver(struct gameport_driver *drv);
 static void gameport_add_port(struct gameport *gameport);
 static void gameport_destroy_port(struct gameport *gameport);
 static void gameport_reconnect_port(struct gameport *gameport);
@@ -211,8 +212,14 @@ static void gameport_release_driver(struct gameport *gameport)
 
 static void gameport_find_driver(struct gameport *gameport)
 {
+        int error;
+
         down_write(&gameport_bus.subsys.rwsem);
-        device_attach(&gameport->dev);
+        error = device_attach(&gameport->dev);
+        if (error < 0)
+                printk(KERN_WARNING
+                        "gameport: device_attach() failed for %s (%s), error: %d\n",
+                        gameport->phys, gameport->name, error);
         up_write(&gameport_bus.subsys.rwsem);
 }
 
@@ -316,7 +323,6 @@ static void gameport_remove_duplicate_events(struct gameport_event *event)
         spin_unlock_irqrestore(&gameport_event_lock, flags);
 }
 
-
 static struct gameport_event *gameport_get_event(void)
 {
         struct gameport_event *event;
@@ -342,7 +348,6 @@ static struct gameport_event *gameport_get_event(void)
 static void gameport_handle_event(void)
 {
         struct gameport_event *event;
-        struct gameport_driver *gameport_drv;
 
         mutex_lock(&gameport_mutex);
 
@@ -369,8 +374,7 @@ static void gameport_handle_event(void)
                                 break;
 
                         case GAMEPORT_REGISTER_DRIVER:
-                                gameport_drv = event->object;
-                                driver_register(&gameport_drv->driver);
+                                gameport_add_driver(event->object);
                                 break;
 
                         default:
@@ -532,6 +536,7 @@ static void gameport_init_port(struct gameport *gameport)
         if (gameport->parent)
                 gameport->dev.parent = &gameport->parent->dev;
 
+        INIT_LIST_HEAD(&gameport->node);
         spin_lock_init(&gameport->timer_lock);
         init_timer(&gameport->poll_timer);
         gameport->poll_timer.function = gameport_run_poll_handler;
@@ -544,6 +549,8 @@ static void gameport_init_port(struct gameport *gameport)
  */
 static void gameport_add_port(struct gameport *gameport)
 {
+        int error;
+
         if (gameport->parent)
                 gameport->parent->child = gameport;
 
@@ -558,8 +565,13 @@ static void gameport_add_port(struct gameport *gameport)
                 printk(KERN_INFO "gameport: %s is %s, speed %dkHz\n",
                         gameport->name, gameport->phys, gameport->speed);
 
-        device_add(&gameport->dev);
-        gameport->registered = 1;
+        error = device_add(&gameport->dev);
+        if (error)
+                printk(KERN_ERR
+                        "gameport: device_add() failed for %s (%s), error: %d\n",
+                        gameport->phys, gameport->name, error);
+        else
+                gameport->registered = 1;
 }
 
 /*
@@ -583,10 +595,11 @@ static void gameport_destroy_port(struct gameport *gameport)
 
         if (gameport->registered) {
                 device_del(&gameport->dev);
-                list_del_init(&gameport->node);
                 gameport->registered = 0;
         }
 
+        list_del_init(&gameport->node);
+
         gameport_remove_pending_events(gameport);
         put_device(&gameport->dev);
 }
@@ -704,11 +717,22 @@ static int gameport_driver_remove(struct device *dev)
 }
 
 static struct bus_type gameport_bus = {
-        .name = "gameport",
-        .probe = gameport_driver_probe,
-        .remove = gameport_driver_remove,
+        .name   = "gameport",
+        .probe  = gameport_driver_probe,
+        .remove = gameport_driver_remove,
 };
 
+static void gameport_add_driver(struct gameport_driver *drv)
+{
+        int error;
+
+        error = driver_register(&drv->driver);
+        if (error)
+                printk(KERN_ERR
+                        "gameport: driver_register() failed for %s, error: %d\n",
+                        drv->driver.name, error);
+}
+
 void __gameport_register_driver(struct gameport_driver *drv, struct module *owner)
 {
         drv->driver.bus = &gameport_bus;
@@ -778,16 +802,24 @@ void gameport_close(struct gameport *gameport)
 
 static int __init gameport_init(void)
 {
-        gameport_task = kthread_run(gameport_thread, NULL, "kgameportd");
-        if (IS_ERR(gameport_task)) {
-                printk(KERN_ERR "gameport: Failed to start kgameportd\n");
-                return PTR_ERR(gameport_task);
-        }
+        int error;
 
         gameport_bus.dev_attrs = gameport_device_attrs;
         gameport_bus.drv_attrs = gameport_driver_attrs;
         gameport_bus.match = gameport_bus_match;
-        bus_register(&gameport_bus);
+        error = bus_register(&gameport_bus);
+        if (error) {
+                printk(KERN_ERR "gameport: failed to register gameport bus, error: %d\n", error);
+                return error;
+        }
+
+        gameport_task = kthread_run(gameport_thread, NULL, "kgameportd");
+        if (IS_ERR(gameport_task)) {
+                bus_unregister(&gameport_bus);
+                error = PTR_ERR(gameport_task);
+                printk(KERN_ERR "gameport: Failed to start kgameportd, error: %d\n", error);
+                return error;
+        }
 
         return 0;
 }
diff --git a/drivers/input/input.c b/drivers/input/input.c
index a90486f5e491..9cb4b9a54f01 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -35,6 +35,16 @@ static LIST_HEAD(input_handler_list);
 
 static struct input_handler *input_table[8];
 
+/**
+ * input_event() - report new input event
+ * @handle: device that generated the event
+ * @type: type of the event
+ * @code: event code
+ * @value: value of the event
+ *
+ * This function should be used by drivers implementing various input devices
+ * See also input_inject_event()
+ */
 void input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 {
         struct input_handle *handle;
@@ -183,6 +193,23 @@ void input_event(struct input_dev *dev, unsigned int type, unsigned int code, in
 }
 EXPORT_SYMBOL(input_event);
 
+/**
+ * input_inject_event() - send input event from input handler
+ * @handle: input handle to send event through
+ * @type: type of the event
+ * @code: event code
+ * @value: value of the event
+ *
+ * Similar to input_event() but will ignore event if device is "grabbed" and handle
+ * injecting event is not the one that owns the device.
+ */
+void input_inject_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
+{
+        if (!handle->dev->grab || handle->dev->grab == handle)
+                input_event(handle->dev, type, code, value);
+}
+EXPORT_SYMBOL(input_inject_event);
+
 static void input_repeat_key(unsigned long data)
 {
         struct input_dev *dev = (void *) data;
@@ -197,15 +224,6 @@ static void input_repeat_key(unsigned long data)
                 mod_timer(&dev->timer, jiffies + msecs_to_jiffies(dev->rep[REP_PERIOD]));
 }
 
-int input_accept_process(struct input_handle *handle, struct file *file)
-{
-        if (handle->dev->accept)
-                return handle->dev->accept(handle->dev, file);
-
-        return 0;
-}
-EXPORT_SYMBOL(input_accept_process);
-
 int input_grab_device(struct input_handle *handle)
 {
         if (handle->dev->grab)
@@ -218,8 +236,15 @@ EXPORT_SYMBOL(input_grab_device);
 
 void input_release_device(struct input_handle *handle)
 {
-        if (handle->dev->grab == handle)
-                handle->dev->grab = NULL;
+        struct input_dev *dev = handle->dev;
+
+        if (dev->grab == handle) {
+                dev->grab = NULL;
+
+                list_for_each_entry(handle, &dev->h_list, d_node)
+                        if (handle->handler->start)
+                                handle->handler->start(handle);
+        }
 }
 EXPORT_SYMBOL(input_release_device);
 
@@ -963,8 +988,11 @@ int input_register_device(struct input_dev *dev)
         list_for_each_entry(handler, &input_handler_list, node)
                 if (!handler->blacklist || !input_match_device(handler->blacklist, dev))
                         if ((id = input_match_device(handler->id_table, dev)))
-                                if ((handle = handler->connect(handler, dev, id)))
+                                if ((handle = handler->connect(handler, dev, id))) {
                                         input_link_handle(handle);
+                                        if (handler->start)
+                                                handler->start(handle);
+                                }
 
         input_wakeup_procfs_readers();
 
@@ -1028,8 +1056,11 @@ void input_register_handler(struct input_handler *handler)
         list_for_each_entry(dev, &input_dev_list, node)
                 if (!handler->blacklist || !input_match_device(handler->blacklist, dev))
                         if ((id = input_match_device(handler->id_table, dev)))
-                                if ((handle = handler->connect(handler, dev, id)))
+                                if ((handle = handler->connect(handler, dev, id))) {
                                         input_link_handle(handle);
+                                        if (handler->start)
+                                                handler->start(handle);
+                                }
 
         input_wakeup_procfs_readers();
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index 6d99e3c37884..b4914e7231f8 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -79,6 +79,7 @@ static struct iforce_device iforce_device[] = {
         { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
+        { 0x06d6, 0x29bc, "Trust Force Feedback Race Master",           btn_wheel, abs_wheel, ff_iforce },
         { 0x0000, 0x0000, "Unknown I-Force Device [%04x:%04x]",         btn_joystick, abs_joystick, ff_iforce }
 };
 
@@ -222,22 +223,22 @@ static int iforce_erase_effect(struct input_dev *dev, int effect_id)
         int err = 0;
         struct iforce_core_effect* core_effect;
 
-        /* Check who is trying to erase this effect */
-        if (iforce->core_effects[effect_id].owner != current->pid) {
-                printk(KERN_WARNING "iforce-main.c: %d tried to erase an effect belonging to %d\n", current->pid, iforce->core_effects[effect_id].owner);
-                return -EACCES;
-        }
-
         if (effect_id < 0 || effect_id >= FF_EFFECTS_MAX)
                 return -EINVAL;
 
-        core_effect = iforce->core_effects + effect_id;
+        core_effect = &iforce->core_effects[effect_id];
+
+        /* Check who is trying to erase this effect */
+        if (core_effect->owner != current->pid) {
+                printk(KERN_WARNING "iforce-main.c: %d tried to erase an effect belonging to %d\n", current->pid, core_effect->owner);
+                return -EACCES;
+        }
 
         if (test_bit(FF_MOD1_IS_USED, core_effect->flags))
-                err = release_resource(&(iforce->core_effects[effect_id].mod1_chunk));
+                err = release_resource(&core_effect->mod1_chunk);
 
         if (!err && test_bit(FF_MOD2_IS_USED, core_effect->flags))
-                err = release_resource(&(iforce->core_effects[effect_id].mod2_chunk));
+                err = release_resource(&core_effect->mod2_chunk);
 
         /*TODO: remember to change that if more FF_MOD* bits are added */
         core_effect->flags[0] = 0;
diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
index 75eb5ca59992..7a19ee052972 100644
--- a/drivers/input/joystick/spaceball.c
+++ b/drivers/input/joystick/spaceball.c
@@ -50,7 +50,7 @@ MODULE_LICENSE("GPL");
  */
 
 #define SPACEBALL_MAX_LENGTH    128
-#define SPACEBALL_MAX_ID        8
+#define SPACEBALL_MAX_ID        9
 
 #define SPACEBALL_1003      1
 #define SPACEBALL_2003B     3
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index ce1f10e8984b..a86afd0a5ef1 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -482,13 +482,7 @@ out:
         return IRQ_HANDLED;
 }
 
-/*
- * atkbd_event_work() is used to complete processing of events that
- * can not be processed by input_event() which is often called from
- * interrupt context.
- */
-
-static void atkbd_event_work(void *data)
+static int atkbd_set_repeat_rate(struct atkbd *atkbd)
 {
         const short period[32] =
                 { 33,  37,  42,  46,  50,  54,  58,  63,  67,  75,  83,  92, 100, 109, 116, 125,
@@ -496,41 +490,64 @@ static void atkbd_event_work(void *data)
         const short delay[4] =
                 { 250, 500, 750, 1000 };
 
-        struct atkbd *atkbd = data;
+        struct input_dev *dev = atkbd->dev;
+        unsigned char param;
+        int i = 0, j = 0;
+
+        while (i < ARRAY_SIZE(period) - 1 && period[i] < dev->rep[REP_PERIOD])
+                i++;
+        dev->rep[REP_PERIOD] = period[i];
+
+        while (j < ARRAY_SIZE(delay) - 1 && delay[j] < dev->rep[REP_DELAY])
+                j++;
+        dev->rep[REP_DELAY] = delay[j];
+
+        param = i | (j << 5);
+        return ps2_command(&atkbd->ps2dev, &param, ATKBD_CMD_SETREP);
+}
+
+static int atkbd_set_leds(struct atkbd *atkbd)
+{
         struct input_dev *dev = atkbd->dev;
         unsigned char param[2];
-        int i, j;
 
-        mutex_lock(&atkbd->event_mutex);
+        param[0] = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
+                 | (test_bit(LED_NUML,    dev->led) ? 2 : 0)
+                 | (test_bit(LED_CAPSL,   dev->led) ? 4 : 0);
+        if (ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETLEDS))
+                return -1;
 
-        if (test_and_clear_bit(ATKBD_LED_EVENT_BIT, &atkbd->event_mask)) {
-                param[0] = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
-                         | (test_bit(LED_NUML,    dev->led) ? 2 : 0)
-                         | (test_bit(LED_CAPSL,   dev->led) ? 4 : 0);
-                ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETLEDS);
-
-                if (atkbd->extra) {
-                        param[0] = 0;
-                        param[1] = (test_bit(LED_COMPOSE, dev->led) ? 0x01 : 0)
-                                 | (test_bit(LED_SLEEP,   dev->led) ? 0x02 : 0)
-                                 | (test_bit(LED_SUSPEND, dev->led) ? 0x04 : 0)
-                                 | (test_bit(LED_MISC,    dev->led) ? 0x10 : 0)
-                                 | (test_bit(LED_MUTE,    dev->led) ? 0x20 : 0);
-                        ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_EX_SETLEDS);
-                }
+        if (atkbd->extra) {
+                param[0] = 0;
+                param[1] = (test_bit(LED_COMPOSE, dev->led) ? 0x01 : 0)
+                         | (test_bit(LED_SLEEP,   dev->led) ? 0x02 : 0)
+                         | (test_bit(LED_SUSPEND, dev->led) ? 0x04 : 0)
+                         | (test_bit(LED_MISC,    dev->led) ? 0x10 : 0)
+                         | (test_bit(LED_MUTE,    dev->led) ? 0x20 : 0);
+                if (ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_EX_SETLEDS))
+                        return -1;
         }
 
-        if (test_and_clear_bit(ATKBD_REP_EVENT_BIT, &atkbd->event_mask)) {
-                i = j = 0;
-                while (i < 31 && period[i] < dev->rep[REP_PERIOD])
-                        i++;
-                while (j < 3 && delay[j] < dev->rep[REP_DELAY])
-                        j++;
-                dev->rep[REP_PERIOD] = period[i];
-                dev->rep[REP_DELAY] = delay[j];
-                param[0] = i | (j << 5);
-                ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETREP);
-        }
+        return 0;
+}
+
+/*
+ * atkbd_event_work() is used to complete processing of events that
+ * can not be processed by input_event() which is often called from
+ * interrupt context.
+ */
+
+static void atkbd_event_work(void *data)
+{
+        struct atkbd *atkbd = data;
+
+        mutex_lock(&atkbd->event_mutex);
+
+        if (test_and_clear_bit(ATKBD_LED_EVENT_BIT, &atkbd->event_mask))
+                atkbd_set_leds(atkbd);
+
+        if (test_and_clear_bit(ATKBD_REP_EVENT_BIT, &atkbd->event_mask))
+                atkbd_set_repeat_rate(atkbd);
 
         mutex_unlock(&atkbd->event_mutex);
 }
@@ -975,7 +992,6 @@ static int atkbd_reconnect(struct serio *serio)
 {
         struct atkbd *atkbd = serio_get_drvdata(serio);
         struct serio_driver *drv = serio->drv;
-        unsigned char param[1];
 
         if (!atkbd || !drv) {
                 printk(KERN_DEBUG "atkbd: reconnect request, but serio is disconnected, ignoring...\n");
@@ -985,10 +1001,6 @@ static int atkbd_reconnect(struct serio *serio)
         atkbd_disable(atkbd);
 
         if (atkbd->write) {
-                param[0] = (test_bit(LED_SCROLLL, atkbd->dev->led) ? 1 : 0)
-                         | (test_bit(LED_NUML,    atkbd->dev->led) ? 2 : 0)
-                         | (test_bit(LED_CAPSL,   atkbd->dev->led) ? 4 : 0);
-
                 if (atkbd_probe(atkbd))
                         return -1;
                 if (atkbd->set != atkbd_select_set(atkbd, atkbd->set, atkbd->extra))
@@ -996,8 +1008,13 @@ static int atkbd_reconnect(struct serio *serio)
 
                 atkbd_activate(atkbd);
 
-                if (ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETLEDS))
-                        return -1;
+/*
+ * Restore repeat rate and LEDs (that were reset by atkbd_activate)
+ * to pre-resume state
+ */
+                if (!atkbd->softrepeat)
+                        atkbd_set_repeat_rate(atkbd);
+                atkbd_set_leds(atkbd);
         }
 
         atkbd_enable(atkbd);
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index ccf0faeee5c1..de0f46dd9692 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -94,7 +94,7 @@ static void call_bios(struct regs *regs)
 
 static ssize_t __init locate_wistron_bios(void __iomem *base)
 {
-        static const unsigned char __initdata signature[] =
+        static unsigned char __initdata signature[] =
                 { 0x42, 0x21, 0x55, 0x30 };
         ssize_t offset;
 
@@ -343,7 +343,7 @@ static struct key_entry keymap_aopen_1559as[] = {
  * a list of buttons and their key codes (reported when loading this module
  * with force=1) and the output of dmidecode to $MODULE_AUTHOR.
  */
-static struct dmi_system_id dmi_ids[] = {
+static struct dmi_system_id dmi_ids[] __initdata = {
         {
                 .callback = dmi_matched,
                 .ident = "Fujitsu-Siemens Amilo Pro V2000",
diff --git a/drivers/input/mouse/logips2pp.c b/drivers/input/mouse/logips2pp.c
index 2f0d28840810..54b696cfe1e3 100644
--- a/drivers/input/mouse/logips2pp.c
+++ b/drivers/input/mouse/logips2pp.c
@@ -238,8 +238,7 @@ static struct ps2pp_info *get_model_info(unsigned char model)
                 { 100,  PS2PP_KIND_MX,                                  /* MX510 */
                                 PS2PP_WHEEL | PS2PP_SIDE_BTN | PS2PP_TASK_BTN |
                                 PS2PP_EXTRA_BTN | PS2PP_NAV_BTN },
-                { 111,  PS2PP_KIND_MX,                                  /* MX300 */
-                                PS2PP_WHEEL | PS2PP_EXTRA_BTN | PS2PP_TASK_BTN },
+                { 111,  PS2PP_KIND_MX,  PS2PP_WHEEL | PS2PP_SIDE_BTN }, /* MX300 reports task button as side */
                 { 112,  PS2PP_KIND_MX,                                  /* MX500 */
                                 PS2PP_WHEEL | PS2PP_SIDE_BTN | PS2PP_TASK_BTN |
                                 PS2PP_EXTRA_BTN | PS2PP_NAV_BTN },
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 8bc9f51ae6c2..343afa38f4c2 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -485,13 +485,6 @@ static int im_explorer_detect(struct psmouse *psmouse, int set_properties)
         param[0] =  40;
         ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
 
-        param[0] = 200;
-        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
-        param[0] = 200;
-        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
-        param[0] =  60;
-        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
-
         if (set_properties) {
                 set_bit(BTN_MIDDLE, psmouse->dev->keybit);
                 set_bit(REL_WHEEL, psmouse->dev->relbit);
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 6d9ec9ab1b90..ae5871a0e060 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -183,21 +183,26 @@ static struct attribute_group trackpoint_attr_group = {
         .attrs = trackpoint_attrs,
 };
 
-static void trackpoint_disconnect(struct psmouse *psmouse)
+static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *firmware_id)
 {
-        sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj, &trackpoint_attr_group);
+        unsigned char param[2] = { 0 };
 
-        kfree(psmouse->private);
-        psmouse->private = NULL;
+        if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
+                return -1;
+
+        if (param[0] != TP_MAGIC_IDENT)
+                return -1;
+
+        if (firmware_id)
+                *firmware_id = param[1];
+
+        return 0;
 }
 
 static int trackpoint_sync(struct psmouse *psmouse)
 {
-        unsigned char toggle;
         struct trackpoint_data *tp = psmouse->private;
-
-        if (!tp)
-                return -1;
+        unsigned char toggle;
 
         /* Disable features that may make device unusable with this driver */
         trackpoint_read(&psmouse->ps2dev, TP_TOGGLE_TWOHAND, &toggle);
@@ -263,27 +268,38 @@ static void trackpoint_defaults(struct trackpoint_data *tp)
         tp->ext_dev = TP_DEF_EXT_DEV;
 }
 
+static void trackpoint_disconnect(struct psmouse *psmouse)
+{
+        sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj, &trackpoint_attr_group);
+
+        kfree(psmouse->private);
+        psmouse->private = NULL;
+}
+
+static int trackpoint_reconnect(struct psmouse *psmouse)
+{
+        if (trackpoint_start_protocol(psmouse, NULL))
+                return -1;
+
+        if (trackpoint_sync(psmouse))
+                return -1;
+
+        return 0;
+}
+
 int trackpoint_detect(struct psmouse *psmouse, int set_properties)
 {
         struct trackpoint_data *priv;
         struct ps2dev *ps2dev = &psmouse->ps2dev;
         unsigned char firmware_id;
         unsigned char button_info;
-        unsigned char param[2];
-
-        param[0] = param[1] = 0;
 
-        if (ps2_command(ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
-                return -1;
-
-        if (param[0] != TP_MAGIC_IDENT)
+        if (trackpoint_start_protocol(psmouse, &firmware_id))
                 return -1;
 
         if (!set_properties)
                 return 0;
 
-        firmware_id = param[1];
-
         if (trackpoint_read(&psmouse->ps2dev, TP_EXT_BTN, &button_info)) {
                 printk(KERN_WARNING "trackpoint.c: failed to get extended button data\n");
                 button_info = 0;
@@ -296,7 +312,7 @@ int trackpoint_detect(struct psmouse *psmouse, int set_properties)
         psmouse->vendor = "IBM";
         psmouse->name = "TrackPoint";
 
-        psmouse->reconnect = trackpoint_sync;
+        psmouse->reconnect = trackpoint_reconnect;
         psmouse->disconnect = trackpoint_disconnect;
 
         trackpoint_defaults(priv);
diff --git a/drivers/input/serio/i8042-sparcio.h b/drivers/input/serio/i8042-sparcio.h
index 7d9fafea9615..54adba2d8ed5 100644
--- a/drivers/input/serio/i8042-sparcio.h
+++ b/drivers/input/serio/i8042-sparcio.h
@@ -88,7 +88,7 @@ static struct of_device_id sparc_i8042_match[] = {
         },
         {},
 };
-MODULE_DEVICE_TABLE(of, i8042_match);
+MODULE_DEVICE_TABLE(of, sparc_i8042_match);
 
 static struct of_platform_driver sparc_i8042_driver = {
         .name           = "i8042",
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index 79c97f94bcbd..ed202f2f251a 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -177,7 +177,12 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
                 return -1;
         }
 
-        mutex_lock(&ps2dev->cmd_mutex);
+        if (send && !param) {
+                WARN_ON(1);
+                return -1;
+        }
+
+        mutex_lock_nested(&ps2dev->cmd_mutex, SINGLE_DEPTH_NESTING);
 
         serio_pause_rx(ps2dev->serio);
         ps2dev->flags = command == PS2_CMD_GETID ? PS2_FLAG_WAITID : 0;
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 6521034bc933..3e76ad71c9a0 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -62,6 +62,7 @@ static LIST_HEAD(serio_list);
 
 static struct bus_type serio_bus;
 
+static void serio_add_driver(struct serio_driver *drv);
 static void serio_add_port(struct serio *serio);
 static void serio_destroy_port(struct serio *serio);
 static void serio_reconnect_port(struct serio *serio);
@@ -140,8 +141,14 @@ static void serio_release_driver(struct serio *serio)
 
 static void serio_find_driver(struct serio *serio)
 {
+        int error;
+
         down_write(&serio_bus.subsys.rwsem);
-        device_attach(&serio->dev);
+        error = device_attach(&serio->dev);
+        if (error < 0)
+                printk(KERN_WARNING
+                        "serio: device_attach() failed for %s (%s), error: %d\n",
+                        serio->phys, serio->name, error);
         up_write(&serio_bus.subsys.rwsem);
 }
 
@@ -272,7 +279,6 @@ static struct serio_event *serio_get_event(void)
 static void serio_handle_event(void)
 {
         struct serio_event *event;
-        struct serio_driver *serio_drv;
 
         mutex_lock(&serio_mutex);
 
@@ -304,8 +310,7 @@ static void serio_handle_event(void)
                                 break;
 
                         case SERIO_REGISTER_DRIVER:
-                                serio_drv = event->object;
-                                driver_register(&serio_drv->driver);
+                                serio_add_driver(event->object);
                                 break;
 
                         default:
@@ -525,6 +530,7 @@ static void serio_init_port(struct serio *serio)
 
         __module_get(THIS_MODULE);
 
+        INIT_LIST_HEAD(&serio->node);
         spin_lock_init(&serio->lock);
         mutex_init(&serio->drv_mutex);
         device_initialize(&serio->dev);
@@ -542,6 +548,8 @@ static void serio_init_port(struct serio *serio)
  */
 static void serio_add_port(struct serio *serio)
 {
+        int error;
+
         if (serio->parent) {
                 serio_pause_rx(serio->parent);
                 serio->parent->child = serio;
@@ -551,9 +559,19 @@ static void serio_add_port(struct serio *serio)
         list_add_tail(&serio->node, &serio_list);
         if (serio->start)
                 serio->start(serio);
-        device_add(&serio->dev);
-        sysfs_create_group(&serio->dev.kobj, &serio_id_attr_group);
-        serio->registered = 1;
+        error = device_add(&serio->dev);
+        if (error)
+                printk(KERN_ERR
+                        "serio: device_add() failed for %s (%s), error: %d\n",
+                        serio->phys, serio->name, error);
+        else {
+                serio->registered = 1;
+                error = sysfs_create_group(&serio->dev.kobj, &serio_id_attr_group);
+                if (error)
+                        printk(KERN_ERR
+                                "serio: sysfs_create_group() failed for %s (%s), error: %d\n",
+                                serio->phys, serio->name, error);
+        }
 }
 
 /*
@@ -583,10 +601,10 @@ static void serio_destroy_port(struct serio *serio)
         if (serio->registered) {
                 sysfs_remove_group(&serio->dev.kobj, &serio_id_attr_group);
                 device_del(&serio->dev);
-                list_del_init(&serio->node);
                 serio->registered = 0;
         }
 
+        list_del_init(&serio->node);
         serio_remove_pending_events(serio);
         put_device(&serio->dev);
 }
@@ -756,6 +774,17 @@ static struct bus_type serio_bus = {
         .remove = serio_driver_remove,
 };
 
+static void serio_add_driver(struct serio_driver *drv)
+{
+        int error;
+
+        error = driver_register(&drv->driver);
+        if (error)
+                printk(KERN_ERR
+                        "serio: driver_register() failed for %s, error: %d\n",
+                        drv->driver.name, error);
+}
+
 void __serio_register_driver(struct serio_driver *drv, struct module *owner)
 {
         drv->driver.bus = &serio_bus;
@@ -903,18 +932,26 @@ irqreturn_t serio_interrupt(struct serio *serio,
 
 static int __init serio_init(void)
 {
-        serio_task = kthread_run(serio_thread, NULL, "kseriod");
-        if (IS_ERR(serio_task)) {
-                printk(KERN_ERR "serio: Failed to start kseriod\n");
-                return PTR_ERR(serio_task);
-        }
+        int error;
 
         serio_bus.dev_attrs = serio_device_attrs;
         serio_bus.drv_attrs = serio_driver_attrs;
         serio_bus.match = serio_bus_match;
         serio_bus.uevent = serio_uevent;
         serio_bus.resume = serio_resume;
-        bus_register(&serio_bus);
+        error = bus_register(&serio_bus);
+        if (error) {
+                printk(KERN_ERR "serio: failed to register serio bus, error: %d\n", error);
+                return error;
+        }
+
+        serio_task = kthread_run(serio_thread, NULL, "kseriod");
+        if (IS_ERR(serio_task)) {
+                bus_unregister(&serio_bus);
+                error = PTR_ERR(serio_task);
+                printk(KERN_ERR "serio: Failed to start kseriod, error: %d\n", error);
+                return error;
+        }
 
         return 0;
 }
diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
index 0a5be7f969f2..af3eb9e795b5 100644
--- a/drivers/isdn/hardware/eicon/divasync.h
+++ b/drivers/isdn/hardware/eicon/divasync.h
@@ -256,7 +256,6 @@ typedef struct
 #define NO_ORDER_CHECK_MASK 0x00000010
 #define LOW_CHANNEL_MASK 0x00000020
 #define NO_HSCX30_MASK  0x00000040
-#define MODE_MASK   0x00000080
 #define SET_BOARD   0x00001000
 #define SET_CRC4   0x00030000
 #define SET_L1_TRISTATE  0x00040000
diff --git a/drivers/isdn/hisax/asuscom.c b/drivers/isdn/hisax/asuscom.c
index a98c5e38bbbc..93ff941c48f1 100644
--- a/drivers/isdn/hisax/asuscom.c
+++ b/drivers/isdn/hisax/asuscom.c
@@ -297,7 +297,7 @@ Asus_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 }
 
 #ifdef __ISAPNP__
-static struct isapnp_device_id asus_ids[] __initdata = {
+static struct isapnp_device_id asus_ids[] __devinitdata = {
         { ISAPNP_VENDOR('A', 'S', 'U'), ISAPNP_FUNCTION(0x1688),
           ISAPNP_VENDOR('A', 'S', 'U'), ISAPNP_FUNCTION(0x1688), 
           (unsigned long) "Asus1688 PnP" },
@@ -313,11 +313,11 @@ static struct isapnp_device_id asus_ids[] __initdata = {
         { 0, }
 };
 
-static struct isapnp_device_id *ipid __initdata = &asus_ids[0];
+static struct isapnp_device_id *ipid __devinitdata = &asus_ids[0];
 static struct pnp_card *pnp_c __devinitdata = NULL;
 #endif
 
-int __init
+int __devinit
 setup_asuscom(struct IsdnCard *card)
 {
         int bytecnt;
diff --git a/drivers/isdn/hisax/avm_a1.c b/drivers/isdn/hisax/avm_a1.c
index 9a8b02557ff9..729e906bdc61 100644
--- a/drivers/isdn/hisax/avm_a1.c
+++ b/drivers/isdn/hisax/avm_a1.c
@@ -178,7 +178,7 @@ AVM_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-int __init
+int __devinit
 setup_avm_a1(struct IsdnCard *card)
 {
         u_char val;
diff --git a/drivers/isdn/hisax/avm_pci.c b/drivers/isdn/hisax/avm_pci.c
index 04f5917bf5a1..369afd3a3a4b 100644
--- a/drivers/isdn/hisax/avm_pci.c
+++ b/drivers/isdn/hisax/avm_pci.c
@@ -639,7 +639,7 @@ clear_pending_hdlc_ints(struct IsdnCardState *cs)
 }
 #endif  /*  0  */
 
-static void __init
+static void
 inithdlc(struct IsdnCardState *cs)
 {
         cs->bcs[0].BC_SetStack = setstack_hdlc;
@@ -727,13 +727,13 @@ AVM_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 }
 
 #ifdef CONFIG_PCI
-static struct pci_dev *dev_avm __initdata = NULL;
+static struct pci_dev *dev_avm __devinitdata = NULL;
 #endif
 #ifdef __ISAPNP__
-static struct pnp_card *pnp_avm_c __initdata = NULL;
+static struct pnp_card *pnp_avm_c __devinitdata = NULL;
 #endif
 
-int __init
+int __devinit
 setup_avm_pcipnp(struct IsdnCard *card)
 {
         u_int val, ver;
diff --git a/drivers/isdn/hisax/bkm_a4t.c b/drivers/isdn/hisax/bkm_a4t.c
index 3cf1f2421789..87a630128a6c 100644
--- a/drivers/isdn/hisax/bkm_a4t.c
+++ b/drivers/isdn/hisax/bkm_a4t.c
@@ -255,9 +255,9 @@ BKM_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return (0);
 }
 
-static struct pci_dev *dev_a4t __initdata = NULL;
+static struct pci_dev *dev_a4t __devinitdata = NULL;
 
-int __init
+int __devinit
 setup_bkm_a4t(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/bkm_a8.c b/drivers/isdn/hisax/bkm_a8.c
index 15681f3e73b8..dae090a9a489 100644
--- a/drivers/isdn/hisax/bkm_a8.c
+++ b/drivers/isdn/hisax/bkm_a8.c
@@ -260,7 +260,7 @@ BKM_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return (0);
 }
 
-static int __init
+static int __devinit
 sct_alloc_io(u_int adr, u_int len)
 {
         if (!request_region(adr, len, "scitel")) {
@@ -272,16 +272,16 @@ sct_alloc_io(u_int adr, u_int len)
         return(0);
 }
 
-static struct pci_dev *dev_a8 __initdata = NULL;
-static u16  sub_vendor_id __initdata = 0;
-static u16  sub_sys_id __initdata = 0;
-static u_char pci_bus __initdata = 0;
-static u_char pci_device_fn __initdata = 0;
-static u_char pci_irq __initdata = 0;
+static struct pci_dev *dev_a8 __devinitdata = NULL;
+static u16  sub_vendor_id __devinitdata = 0;
+static u16  sub_sys_id __devinitdata = 0;
+static u_char pci_bus __devinitdata = 0;
+static u_char pci_device_fn __devinitdata = 0;
+static u_char pci_irq __devinitdata = 0;
 
 #endif /* CONFIG_PCI */
 
-int __init
+int __devinit
 setup_sct_quadro(struct IsdnCard *card)
 {
 #ifdef CONFIG_PCI
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index 5333be5d2c47..e10350360f2f 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1875,7 +1875,7 @@ static void EChannel_proc_rcv(struct hisax_d_if *d_if)
 #ifdef CONFIG_PCI
 #include <linux/pci.h>
 
-static struct pci_device_id hisax_pci_tbl[] __initdata = {
+static struct pci_device_id hisax_pci_tbl[] __devinitdata = {
 #ifdef CONFIG_HISAX_FRITZPCI
         {PCI_VENDOR_ID_AVM,      PCI_DEVICE_ID_AVM_A1,           PCI_ANY_ID, PCI_ANY_ID},
 #endif
diff --git a/drivers/isdn/hisax/diva.c b/drivers/isdn/hisax/diva.c
index 323a02ef3844..e294fa3918f3 100644
--- a/drivers/isdn/hisax/diva.c
+++ b/drivers/isdn/hisax/diva.c
@@ -887,13 +887,13 @@ Diva_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-static struct pci_dev *dev_diva __initdata = NULL;
-static struct pci_dev *dev_diva_u __initdata = NULL;
-static struct pci_dev *dev_diva201 __initdata = NULL;
-static struct pci_dev *dev_diva202 __initdata = NULL;
+static struct pci_dev *dev_diva __devinitdata = NULL;
+static struct pci_dev *dev_diva_u __devinitdata = NULL;
+static struct pci_dev *dev_diva201 __devinitdata = NULL;
+static struct pci_dev *dev_diva202 __devinitdata = NULL;
 
 #ifdef __ISAPNP__
-static struct isapnp_device_id diva_ids[] __initdata = {
+static struct isapnp_device_id diva_ids[] __devinitdata = {
         { ISAPNP_VENDOR('G', 'D', 'I'), ISAPNP_FUNCTION(0x51),
           ISAPNP_VENDOR('G', 'D', 'I'), ISAPNP_FUNCTION(0x51), 
           (unsigned long) "Diva picola" },
@@ -915,12 +915,12 @@ static struct isapnp_device_id diva_ids[] __initdata = {
         { 0, }
 };
 
-static struct isapnp_device_id *ipid __initdata = &diva_ids[0];
+static struct isapnp_device_id *ipid __devinitdata = &diva_ids[0];
 static struct pnp_card *pnp_c __devinitdata = NULL;
 #endif
 
 
-int __init
+int __devinit
 setup_diva(struct IsdnCard *card)
 {
         int bytecnt = 8;
diff --git a/drivers/isdn/hisax/enternow_pci.c b/drivers/isdn/hisax/enternow_pci.c
index 8fcbe2e7d765..76c7d29d1b2f 100644
--- a/drivers/isdn/hisax/enternow_pci.c
+++ b/drivers/isdn/hisax/enternow_pci.c
@@ -301,10 +301,10 @@ enpci_interrupt(int intno, void *dev_id, struct pt_regs *regs)
 }
 
 
-static struct pci_dev *dev_netjet __initdata = NULL;
+static struct pci_dev *dev_netjet __devinitdata = NULL;
 
 /* called by config.c */
-int __init
+int __devinit
 setup_enternow_pci(struct IsdnCard *card)
 {
         int bytecnt;
diff --git a/drivers/isdn/hisax/gazel.c b/drivers/isdn/hisax/gazel.c
index 3e7d92303582..fe2937267777 100644
--- a/drivers/isdn/hisax/gazel.c
+++ b/drivers/isdn/hisax/gazel.c
@@ -484,7 +484,7 @@ reserve_regions(struct IsdnCard *card, struct IsdnCardState *cs)
         return 1;
 }
 
-static int __init
+static int __devinit
 setup_gazelisa(struct IsdnCard *card, struct IsdnCardState *cs)
 {
         printk(KERN_INFO "Gazel: ISA PnP card automatic recognition\n");
@@ -532,9 +532,9 @@ setup_gazelisa(struct IsdnCard *card, struct IsdnCardState *cs)
         return (0);
 }
 
-static struct pci_dev *dev_tel __initdata = NULL;
+static struct pci_dev *dev_tel __devinitdata = NULL;
 
-static int __init
+static int __devinit
 setup_gazelpci(struct IsdnCardState *cs)
 {
         u_int pci_ioaddr0 = 0, pci_ioaddr1 = 0;
@@ -621,7 +621,7 @@ setup_gazelpci(struct IsdnCardState *cs)
         return (0);
 }
 
-int __init
+int __devinit
 setup_gazel(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/hfc4s8s_l1.c b/drivers/isdn/hisax/hfc4s8s_l1.c
index 0f967b3df79d..3a5ca8a68fc4 100644
--- a/drivers/isdn/hisax/hfc4s8s_l1.c
+++ b/drivers/isdn/hisax/hfc4s8s_l1.c
@@ -1703,7 +1703,7 @@ hfc4s8s_module_init(void)
 /* driver module exit :              */
 /* release the HFC-4s/8s hardware    */
 /*************************************/
-static void
+static void __exit
 hfc4s8s_module_exit(void)
 {
         pci_unregister_driver(&hfc4s8s_driver);
diff --git a/drivers/isdn/hisax/hfc_2bds0.c b/drivers/isdn/hisax/hfc_2bds0.c
index 637a261c9312..6360e8214720 100644
--- a/drivers/isdn/hisax/hfc_2bds0.c
+++ b/drivers/isdn/hisax/hfc_2bds0.c
@@ -1015,7 +1015,7 @@ hfc_dbusy_timer(struct IsdnCardState *cs)
 {
 }
 
-static unsigned int __init
+static unsigned int
 *init_send_hfcd(int cnt)
 {
         int i, *send;
@@ -1030,7 +1030,7 @@ static unsigned int __init
         return(send);
 }
 
-void __init
+void
 init2bds0(struct IsdnCardState *cs)
 {
         cs->setstack_d = setstack_hfcd;
diff --git a/drivers/isdn/hisax/hfc_2bs0.c b/drivers/isdn/hisax/hfc_2bs0.c
index c964539cc43e..d0520ad30677 100644
--- a/drivers/isdn/hisax/hfc_2bs0.c
+++ b/drivers/isdn/hisax/hfc_2bs0.c
@@ -551,7 +551,7 @@ setstack_hfc(struct PStack *st, struct BCState *bcs)
         return (0);
 }
 
-static void __init
+static void
 init_send(struct BCState *bcs)
 {
         int i;
@@ -565,7 +565,7 @@ init_send(struct BCState *bcs)
                 bcs->hw.hfc.send[i] = 0x1fff;
 }
 
-void __init
+void
 inithfc(struct IsdnCardState *cs)
 {
         init_send(&cs->bcs[0]);
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 7241e73879ba..1df60ca9481f 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1581,7 +1581,7 @@ hfcpci_bh(struct IsdnCardState *cs)
 /********************************/
 /* called for card init message */
 /********************************/
-static void __init
+static void
 inithfcpci(struct IsdnCardState *cs)
 {
         cs->bcs[0].BC_SetStack = setstack_2b;
@@ -1638,11 +1638,11 @@ hfcpci_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 
 
 /* this variable is used as card index when more than one cards are present */
-static struct pci_dev *dev_hfcpci __initdata = NULL;
+static struct pci_dev *dev_hfcpci __devinitdata = NULL;
 
 #endif                          /* CONFIG_PCI */
 
-int __init
+int __devinit
 setup_hfcpci(struct IsdnCard *card)
 {
         u_long flags;
diff --git a/drivers/isdn/hisax/hfcscard.c b/drivers/isdn/hisax/hfcscard.c
index 86ab1c13f6b1..4e7f472877e9 100644
--- a/drivers/isdn/hisax/hfcscard.c
+++ b/drivers/isdn/hisax/hfcscard.c
@@ -139,7 +139,7 @@ hfcs_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 }
 
 #ifdef __ISAPNP__
-static struct isapnp_device_id hfc_ids[] __initdata = {
+static struct isapnp_device_id hfc_ids[] __devinitdata = {
         { ISAPNP_VENDOR('A', 'N', 'X'), ISAPNP_FUNCTION(0x1114),
           ISAPNP_VENDOR('A', 'N', 'X'), ISAPNP_FUNCTION(0x1114), 
           (unsigned long) "Acer P10" },
@@ -164,11 +164,11 @@ static struct isapnp_device_id hfc_ids[] __initdata = {
         { 0, }
 };
 
-static struct isapnp_device_id *ipid __initdata = &hfc_ids[0];
+static struct isapnp_device_id *ipid __devinitdata = &hfc_ids[0];
 static struct pnp_card *pnp_c __devinitdata = NULL;
 #endif
 
-int __init
+int __devinit
 setup_hfcs(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/icc.c b/drivers/isdn/hisax/icc.c
index c615752b96aa..2cf7b665609e 100644
--- a/drivers/isdn/hisax/icc.c
+++ b/drivers/isdn/hisax/icc.c
@@ -24,10 +24,10 @@
 #define DBUSY_TIMER_VALUE 80
 #define ARCOFI_USE 0
 
-static char *ICCVer[] __initdata =
+static char *ICCVer[] =
 {"2070 A1/A3", "2070 B1", "2070 B2/B3", "2070 V2.4"};
 
-void __init
+void
 ICCVersion(struct IsdnCardState *cs, char *s)
 {
         int val;
@@ -613,7 +613,7 @@ dbusy_timer_handler(struct IsdnCardState *cs)
         }
 }
 
-void __init
+void
 initicc(struct IsdnCardState *cs)
 {
         cs->setstack_d = setstack_icc;
@@ -646,7 +646,7 @@ initicc(struct IsdnCardState *cs)
         ph_command(cs, ICC_CMD_DI);
 }
 
-void __init
+void
 clear_pending_icc_ints(struct IsdnCardState *cs)
 {
         int val, eval;
diff --git a/drivers/isdn/hisax/icc.h b/drivers/isdn/hisax/icc.h
index b3bb3d5de532..e7f593967e43 100644
--- a/drivers/isdn/hisax/icc.h
+++ b/drivers/isdn/hisax/icc.h
@@ -65,7 +65,7 @@
 #define ICC_IND_AIL    0xE
 #define ICC_IND_DC     0xF
 
-extern void __init ICCVersion(struct IsdnCardState *cs, char *s);
+extern void ICCVersion(struct IsdnCardState *cs, char *s);
 extern void initicc(struct IsdnCardState *cs);
 extern void icc_interrupt(struct IsdnCardState *cs, u_char val);
 extern void clear_pending_icc_ints(struct IsdnCardState *cs);
diff --git a/drivers/isdn/hisax/ipacx.c b/drivers/isdn/hisax/ipacx.c
index df5fc92a89b2..00afd5538909 100644
--- a/drivers/isdn/hisax/ipacx.c
+++ b/drivers/isdn/hisax/ipacx.c
@@ -38,8 +38,8 @@ static void dbusy_timer_handler(struct IsdnCardState *cs);
 static void dch_empty_fifo(struct IsdnCardState *cs, int count);
 static void dch_fill_fifo(struct IsdnCardState *cs);
 static inline void dch_int(struct IsdnCardState *cs);
-static void __devinit dch_setstack(struct PStack *st, struct IsdnCardState *cs);
-static void __devinit dch_init(struct IsdnCardState *cs);
+static void dch_setstack(struct PStack *st, struct IsdnCardState *cs);
+static void dch_init(struct IsdnCardState *cs);
 static void bch_l2l1(struct PStack *st, int pr, void *arg);
 static void bch_empty_fifo(struct BCState *bcs, int count);
 static void bch_fill_fifo(struct BCState *bcs);
@@ -48,8 +48,8 @@ static void bch_mode(struct BCState *bcs, int mode, int bc);
 static void bch_close_state(struct BCState *bcs);
 static int bch_open_state(struct IsdnCardState *cs, struct BCState *bcs);
 static int bch_setstack(struct PStack *st, struct BCState *bcs);
-static void __devinit bch_init(struct IsdnCardState *cs, int hscx);
-static void __init clear_pending_ints(struct IsdnCardState *cs);
+static void bch_init(struct IsdnCardState *cs, int hscx);
+static void clear_pending_ints(struct IsdnCardState *cs);
 
 //----------------------------------------------------------
 // Issue Layer 1 command to chip
@@ -408,7 +408,7 @@ dch_int(struct IsdnCardState *cs)
 
 //----------------------------------------------------------
 //----------------------------------------------------------
-static void __devinit
+static void
 dch_setstack(struct PStack *st, struct IsdnCardState *cs)
 {
         st->l1.l1hw = dch_l2l1;
@@ -416,7 +416,7 @@ dch_setstack(struct PStack *st, struct IsdnCardState *cs)
 
 //----------------------------------------------------------
 //----------------------------------------------------------
-static void __devinit
+static void
 dch_init(struct IsdnCardState *cs)
 {
         printk(KERN_INFO "HiSax: IPACX ISDN driver v0.1.0\n");
@@ -823,7 +823,7 @@ bch_setstack(struct PStack *st, struct BCState *bcs)
 
 //----------------------------------------------------------
 //----------------------------------------------------------
-static void __devinit
+static void
 bch_init(struct IsdnCardState *cs, int hscx)
 {
         cs->bcs[hscx].BC_SetStack   = bch_setstack;
@@ -861,7 +861,7 @@ interrupt_ipacx(struct IsdnCardState *cs)
 //----------------------------------------------------------
 // Clears chip interrupt status
 //----------------------------------------------------------
-static void __init
+static void
 clear_pending_ints(struct IsdnCardState *cs)
 {
         int ista;
@@ -883,7 +883,7 @@ clear_pending_ints(struct IsdnCardState *cs)
 // Does chip configuration work
 // Work to do depends on bit mask in part
 //----------------------------------------------------------
-void __init
+void
 init_ipacx(struct IsdnCardState *cs, int part)
 {
         if (part &1) {  // initialise chip
diff --git a/drivers/isdn/hisax/isurf.c b/drivers/isdn/hisax/isurf.c
index 33747afc984d..715a1a8cd694 100644
--- a/drivers/isdn/hisax/isurf.c
+++ b/drivers/isdn/hisax/isurf.c
@@ -196,10 +196,10 @@ isurf_auxcmd(struct IsdnCardState *cs, isdn_ctrl *ic) {
 }
 
 #ifdef __ISAPNP__
-static struct pnp_card *pnp_c __initdata = NULL;
+static struct pnp_card *pnp_c __devinitdata = NULL;
 #endif
 
-int __init
+int __devinit
 setup_isurf(struct IsdnCard *card)
 {
         int ver;
diff --git a/drivers/isdn/hisax/ix1_micro.c b/drivers/isdn/hisax/ix1_micro.c
index 908a7e144421..39717506c678 100644
--- a/drivers/isdn/hisax/ix1_micro.c
+++ b/drivers/isdn/hisax/ix1_micro.c
@@ -210,7 +210,7 @@ ix1_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 }
 
 #ifdef __ISAPNP__
-static struct isapnp_device_id itk_ids[] __initdata = {
+static struct isapnp_device_id itk_ids[] __devinitdata = {
         { ISAPNP_VENDOR('I', 'T', 'K'), ISAPNP_FUNCTION(0x25),
           ISAPNP_VENDOR('I', 'T', 'K'), ISAPNP_FUNCTION(0x25), 
           (unsigned long) "ITK micro 2" },
@@ -220,12 +220,12 @@ static struct isapnp_device_id itk_ids[] __initdata = {
         { 0, }
 };
 
-static struct isapnp_device_id *ipid __initdata = &itk_ids[0];
+static struct isapnp_device_id *ipid __devinitdata = &itk_ids[0];
 static struct pnp_card *pnp_c __devinitdata = NULL;
 #endif
 
 
-int __init
+int __devinit
 setup_ix1micro(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/jade.c b/drivers/isdn/hisax/jade.c
index 2659fecc2674..43d61d1bc5b6 100644
--- a/drivers/isdn/hisax/jade.c
+++ b/drivers/isdn/hisax/jade.c
@@ -19,7 +19,7 @@
 #include <linux/interrupt.h>
 
 
-int __init
+int
 JadeVersion(struct IsdnCardState *cs, char *s)
 {
     int ver,i;
@@ -253,7 +253,7 @@ setstack_jade(struct PStack *st, struct BCState *bcs)
         return (0);
 }
 
-void __init
+void
 clear_pending_jade_ints(struct IsdnCardState *cs)
 {
         int val;
@@ -279,7 +279,7 @@ clear_pending_jade_ints(struct IsdnCardState *cs)
         cs->BC_Write_Reg(cs, 1, jade_HDLC_IMR, 0xF8);
 }
 
-void __init
+void
 initjade(struct IsdnCardState *cs)
 {
         cs->bcs[0].BC_SetStack = setstack_jade;
diff --git a/drivers/isdn/hisax/mic.c b/drivers/isdn/hisax/mic.c
index fe11f226b285..8c82519593a8 100644
--- a/drivers/isdn/hisax/mic.c
+++ b/drivers/isdn/hisax/mic.c
@@ -189,7 +189,7 @@ mic_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-int __init
+int __devinit
 setup_mic(struct IsdnCard *card)
 {
         int bytecnt;
diff --git a/drivers/isdn/hisax/netjet.c b/drivers/isdn/hisax/netjet.c
index 47a47ef0968b..38f648f9b0ed 100644
--- a/drivers/isdn/hisax/netjet.c
+++ b/drivers/isdn/hisax/netjet.c
@@ -909,7 +909,7 @@ setstack_tiger(struct PStack *st, struct BCState *bcs)
 }
 
  
-void __init
+void
 inittiger(struct IsdnCardState *cs)
 {
         if (!(cs->bcs[0].hw.tiger.send = kmalloc(NETJET_DMA_TXSIZE * sizeof(unsigned int),
diff --git a/drivers/isdn/hisax/niccy.c b/drivers/isdn/hisax/niccy.c
index 79a97b1c3812..489022bdef7b 100644
--- a/drivers/isdn/hisax/niccy.c
+++ b/drivers/isdn/hisax/niccy.c
@@ -232,12 +232,12 @@ niccy_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-static struct pci_dev *niccy_dev __initdata = NULL;
+static struct pci_dev *niccy_dev __devinitdata = NULL;
 #ifdef __ISAPNP__
 static struct pnp_card *pnp_c __devinitdata = NULL;
 #endif
 
-int __init
+int __devinit
 setup_niccy(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/nj_s.c b/drivers/isdn/hisax/nj_s.c
index e5b900a6fa0b..80025fd890f4 100644
--- a/drivers/isdn/hisax/nj_s.c
+++ b/drivers/isdn/hisax/nj_s.c
@@ -148,9 +148,9 @@ NETjet_S_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-static struct pci_dev *dev_netjet __initdata = NULL;
+static struct pci_dev *dev_netjet __devinitdata = NULL;
 
-int __init
+int __devinit
 setup_netjet_s(struct IsdnCard *card)
 {
         int bytecnt,cfg;
diff --git a/drivers/isdn/hisax/nj_u.c b/drivers/isdn/hisax/nj_u.c
index 7002b09936d4..37497162d539 100644
--- a/drivers/isdn/hisax/nj_u.c
+++ b/drivers/isdn/hisax/nj_u.c
@@ -128,9 +128,9 @@ NETjet_U_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-static struct pci_dev *dev_netjet __initdata = NULL;
+static struct pci_dev *dev_netjet __devinitdata = NULL;
 
-int __init
+int __devinit
 setup_netjet_u(struct IsdnCard *card)
 {
         int bytecnt;
diff --git a/drivers/isdn/hisax/s0box.c b/drivers/isdn/hisax/s0box.c
index 7b63085ea6e5..e76042d323ea 100644
--- a/drivers/isdn/hisax/s0box.c
+++ b/drivers/isdn/hisax/s0box.c
@@ -211,7 +211,7 @@ S0Box_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-int __init
+int __devinit
 setup_s0box(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/saphir.c b/drivers/isdn/hisax/saphir.c
index 821776e1561a..d943d365890b 100644
--- a/drivers/isdn/hisax/saphir.c
+++ b/drivers/isdn/hisax/saphir.c
@@ -241,7 +241,7 @@ saphir_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 }
 
 
-int __init
+int __devinit
 setup_saphir(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/sportster.c b/drivers/isdn/hisax/sportster.c
index cdf35dc564c4..a49b694eb730 100644
--- a/drivers/isdn/hisax/sportster.c
+++ b/drivers/isdn/hisax/sportster.c
@@ -184,7 +184,7 @@ Sportster_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-static int __init
+static int __devinit
 get_io_range(struct IsdnCardState *cs)
 {
         int i, j, adr;
@@ -209,7 +209,7 @@ get_io_range(struct IsdnCardState *cs)
         }
 }
 
-int __init
+int __devinit
 setup_sportster(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/teleint.c b/drivers/isdn/hisax/teleint.c
index a2b1816af37a..e94dc6f5bd62 100644
--- a/drivers/isdn/hisax/teleint.c
+++ b/drivers/isdn/hisax/teleint.c
@@ -261,7 +261,7 @@ TeleInt_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-int __init
+int __devinit
 setup_TeleInt(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/teles0.c b/drivers/isdn/hisax/teles0.c
index 2b7df8f98233..f94af0930a17 100644
--- a/drivers/isdn/hisax/teles0.c
+++ b/drivers/isdn/hisax/teles0.c
@@ -265,7 +265,7 @@ Teles_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-int __init
+int __devinit
 setup_teles0(struct IsdnCard *card)
 {
         u_char val;
diff --git a/drivers/isdn/hisax/telespci.c b/drivers/isdn/hisax/telespci.c
index 9382cdf04d8d..dca446865f24 100644
--- a/drivers/isdn/hisax/telespci.c
+++ b/drivers/isdn/hisax/telespci.c
@@ -284,9 +284,9 @@ TelesPCI_card_msg(struct IsdnCardState *cs, int mt, void *arg)
         return(0);
 }
 
-static struct pci_dev *dev_tel __initdata = NULL;
+static struct pci_dev *dev_tel __devinitdata = NULL;
 
-int __init
+int __devinit
 setup_telespci(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/hisax/w6692.c b/drivers/isdn/hisax/w6692.c
index 6c68419c05ff..0595293b8659 100644
--- a/drivers/isdn/hisax/w6692.c
+++ b/drivers/isdn/hisax/w6692.c
@@ -44,11 +44,11 @@ static const char *w6692_revision = "$Revision: 1.18.2.4 $";
 
 #define DBUSY_TIMER_VALUE 80
 
-static char *W6692Ver[] __initdata =
+static char *W6692Ver[] =
 {"W6692 V00", "W6692 V01", "W6692 V10",
  "W6692 V11"};
 
-static void __init
+static void
 W6692Version(struct IsdnCardState *cs, char *s)
 {
         int val;
@@ -897,7 +897,7 @@ static void resetW6692(struct IsdnCardState *cs)
         }
 }
 
-static void __init initW6692(struct IsdnCardState *cs, int part)
+static void initW6692(struct IsdnCardState *cs, int part)
 {
         if (part & 1) {
                 cs->setstack_d = setstack_W6692;
@@ -992,9 +992,9 @@ w6692_card_msg(struct IsdnCardState *cs, int mt, void *arg)
 
 static int id_idx ;
 
-static struct pci_dev *dev_w6692 __initdata = NULL;
+static struct pci_dev *dev_w6692 __devinitdata = NULL;
 
-int __init 
+int __devinit
 setup_w6692(struct IsdnCard *card)
 {
         struct IsdnCardState *cs = card->cs;
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 9f6c6375ff75..c3d79eef9e32 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1059,7 +1059,7 @@ isdn_info_update(void)
 static ssize_t
 isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 {
-        uint minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        uint minor = iminor(file->f_dentry->d_inode);
         int len = 0;
         int drvidx;
         int chidx;
@@ -1163,7 +1163,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 static ssize_t
 isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off)
 {
-        uint minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        uint minor = iminor(file->f_dentry->d_inode);
         int drvidx;
         int chidx;
         int retval;
@@ -1225,7 +1225,7 @@ static unsigned int
 isdn_poll(struct file *file, poll_table * wait)
 {
         unsigned int mask = 0;
-        unsigned int minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        unsigned int minor = iminor(file->f_dentry->d_inode);
         int drvidx = isdn_minor2drv(minor - ISDN_MINOR_CTRL);
 
         lock_kernel();
@@ -1266,7 +1266,7 @@ isdn_poll(struct file *file, poll_table * wait)
 static int
 isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
 {
-        uint minor = MINOR(inode->i_rdev);
+        uint minor = iminor(inode);
         isdn_ctrl c;
         int drvidx;
         int chidx;
@@ -1717,7 +1717,7 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
 static int
 isdn_open(struct inode *ino, struct file *filep)
 {
-        uint minor = MINOR(ino->i_rdev);
+        uint minor = iminor(ino);
         int drvidx;
         int chidx;
         int retval = -ENODEV;
@@ -1779,7 +1779,7 @@ isdn_open(struct inode *ino, struct file *filep)
 static int
 isdn_close(struct inode *ino, struct file *filep)
 {
-        uint minor = MINOR(ino->i_rdev);
+        uint minor = iminor(ino);
 
         lock_kernel();
         if (minor == ISDN_MINOR_STATUS) {
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 29e7667ec962..119412d6bd15 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -667,7 +667,7 @@ isdn_ppp_poll(struct file *file, poll_table * wait)
 
         if (is->debug & 0x2)
                 printk(KERN_DEBUG "isdn_ppp_poll: minor: %d\n",
-                                MINOR(file->f_dentry->d_inode->i_rdev));
+                                iminor(file->f_dentry->d_inode));
 
         /* just registers wait_queue hook. This doesn't really wait. */
         poll_wait(file, &is->wq, wait);
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 96509989e921..9c39b98d5a5b 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -69,6 +69,13 @@ config LEDS_AMS_DELTA
         help
           This option enables support for the LEDs on Amstrad Delta (E3).
 
+config LEDS_NET48XX
+        tristate "LED Support for Soekris net48xx series Error LED"
+        depends on LEDS_CLASS && SCx200_GPIO
+        help
+          This option enables support for the Soekris net4801 and net4826 error
+          LED.
+
 comment "LED Triggers"
 
 config LEDS_TRIGGERS
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index 88d3b6eaa6a2..6aa2aed7539d 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_LEDS_IXP4XX)		+= leds-ixp4xx-gpio.o
 obj-$(CONFIG_LEDS_TOSA)                 += leds-tosa.o
 obj-$(CONFIG_LEDS_S3C24XX)              += leds-s3c24xx.o
 obj-$(CONFIG_LEDS_AMS_DELTA)            += leds-ams-delta.o
+obj-$(CONFIG_LEDS_NET48XX)              += leds-net48xx.o
 
 # LED Triggers
 obj-$(CONFIG_LEDS_TRIGGER_TIMER)        += ledtrig-timer.o
diff --git a/drivers/leds/leds-net48xx.c b/drivers/leds/leds-net48xx.c
new file mode 100644
index 000000000000..713c4a8aa77d
--- /dev/null
+++ b/drivers/leds/leds-net48xx.c
@@ -0,0 +1,116 @@
+/*
+ * LEDs driver for Soekris net48xx
+ *
+ * Copyright (C) 2006 Chris Boot <bootc@bootc.net>
+ *
+ * Based on leds-ams-delta.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <linux/err.h>
+#include <asm/io.h>
+#include <linux/scx200_gpio.h>
+
+#define DRVNAME "net48xx-led"
+#define NET48XX_ERROR_LED_GPIO  20
+
+static struct platform_device *pdev;
+
+static void net48xx_error_led_set(struct led_classdev *led_cdev,
+                enum led_brightness value)
+{
+        if (value)
+                scx200_gpio_set_high(NET48XX_ERROR_LED_GPIO);
+        else
+                scx200_gpio_set_low(NET48XX_ERROR_LED_GPIO);
+}
+
+static struct led_classdev net48xx_error_led = {
+        .name           = "net48xx:error",
+        .brightness_set = net48xx_error_led_set,
+};
+
+#ifdef CONFIG_PM
+static int net48xx_led_suspend(struct platform_device *dev,
+                pm_message_t state)
+{
+        led_classdev_suspend(&net48xx_error_led);
+        return 0;
+}
+
+static int net48xx_led_resume(struct platform_device *dev)
+{
+        led_classdev_resume(&net48xx_error_led);
+        return 0;
+}
+#else
+#define net48xx_led_suspend NULL
+#define net48xx_led_resume NULL
+#endif
+
+static int net48xx_led_probe(struct platform_device *pdev)
+{
+        return led_classdev_register(&pdev->dev, &net48xx_error_led);
+}
+
+static int net48xx_led_remove(struct platform_device *pdev)
+{
+        led_classdev_unregister(&net48xx_error_led);
+        return 0;
+}
+
+static struct platform_driver net48xx_led_driver = {
+        .probe          = net48xx_led_probe,
+        .remove         = net48xx_led_remove,
+        .suspend        = net48xx_led_suspend,
+        .resume         = net48xx_led_resume,
+        .driver         = {
+                .name           = DRVNAME,
+                .owner          = THIS_MODULE,
+        },
+};
+
+static int __init net48xx_led_init(void)
+{
+        int ret;
+
+        if (!scx200_gpio_present()) {
+                ret = -ENODEV;
+                goto out;
+        }
+
+        ret = platform_driver_register(&net48xx_led_driver);
+        if (ret < 0)
+                goto out;
+
+        pdev = platform_device_register_simple(DRVNAME, -1, NULL, 0);
+        if (IS_ERR(pdev)) {
+                ret = PTR_ERR(pdev);
+                platform_driver_unregister(&net48xx_led_driver);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit net48xx_led_exit(void)
+{
+        platform_device_unregister(pdev);
+        platform_driver_unregister(&net48xx_led_driver);
+}
+
+module_init(net48xx_led_init);
+module_exit(net48xx_led_exit);
+
+MODULE_AUTHOR("Chris Boot <bootc@bootc.net>");
+MODULE_DESCRIPTION("Soekris net48xx LED driver");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 54f3f6b94efc..d5d649f5ccdb 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -90,6 +90,15 @@ config ADB_PMU_LED
           and the ide-disk LED trigger and configure appropriately through
           sysfs.
 
+config ADB_PMU_LED_IDE
+        bool "Use front LED as IDE LED by default"
+        depends on ADB_PMU_LED
+        select LEDS_TRIGGERS
+        select LEDS_TRIGGER_IDE_DISK
+        help
+          This option makes the front LED default to the IDE trigger
+          so that it blinks on IDE activity.
+
 config PMAC_SMU
         bool "Support for SMU  based PowerMacs"
         depends on PPC_PMAC64
@@ -100,7 +109,7 @@ config PMAC_SMU
 
 config PMAC_APM_EMU
         tristate "APM emulation"
-        depends on PPC_PMAC && PPC32 && PM
+        depends on PPC_PMAC && PPC32 && PM && ADB_PMU
 
 config PMAC_MEDIABAY
         bool "Support PowerBook hotswap media bay"
@@ -113,7 +122,8 @@ config PMAC_MEDIABAY
 
 config PMAC_BACKLIGHT
         bool "Backlight control for LCD screens"
-        depends on ADB_PMU && (BROKEN || !PPC64)
+        depends on ADB_PMU && FB = y && (BROKEN || !PPC64)
+        select FB_BACKLIGHT
         help
           Say Y here to enable Macintosh specific extensions of the generic
           backlight code. With this enabled, the brightness keys on older
diff --git a/drivers/macintosh/adbhid.c b/drivers/macintosh/adbhid.c
index 545be1ed6927..c69d23bb255e 100644
--- a/drivers/macintosh/adbhid.c
+++ b/drivers/macintosh/adbhid.c
@@ -45,14 +45,11 @@
 #include <linux/pmu.h>
 
 #include <asm/machdep.h>
+#include <asm/backlight.h>
 #ifdef CONFIG_PPC_PMAC
 #include <asm/pmac_feature.h>
 #endif
 
-#ifdef CONFIG_PMAC_BACKLIGHT
-#include <asm/backlight.h>
-#endif
-
 MODULE_AUTHOR("Franz Sirl <Franz.Sirl-kernel@lauterbach.com>");
 
 #define KEYB_KEYREG     0       /* register # for key up/down data */
@@ -237,11 +234,6 @@ static struct adb_ids keyboard_ids;
 static struct adb_ids mouse_ids;
 static struct adb_ids buttons_ids;
 
-#ifdef CONFIG_PMAC_BACKLIGHT
-/* Exported to via-pmu.c */
-int disable_kernel_backlight = 0;
-#endif /* CONFIG_PMAC_BACKLIGHT */
-
 /* Kind of keyboard, see Apple technote 1152  */
 #define ADB_KEYBOARD_UNKNOWN    0
 #define ADB_KEYBOARD_ANSI       0x0100
@@ -527,7 +519,7 @@ adbhid_buttons_input(unsigned char *data, int nb, struct pt_regs *regs, int auto
 
                 case 0xa:       /* brightness decrease */
 #ifdef CONFIG_PMAC_BACKLIGHT
-                        if (!disable_kernel_backlight && down)
+                        if (down)
                                 pmac_backlight_key_down();
 #endif
                         input_report_key(adbhid[id]->input, KEY_BRIGHTNESSDOWN, down);
@@ -535,7 +527,7 @@ adbhid_buttons_input(unsigned char *data, int nb, struct pt_regs *regs, int auto
 
                 case 0x9:       /* brightness increase */
 #ifdef CONFIG_PMAC_BACKLIGHT
-                        if (!disable_kernel_backlight && down)
+                        if (down)
                                 pmac_backlight_key_up();
 #endif
                         input_report_key(adbhid[id]->input, KEY_BRIGHTNESSUP, down);
diff --git a/drivers/macintosh/macio-adb.c b/drivers/macintosh/macio-adb.c
index 314fc0830d90..4b08852c35ee 100644
--- a/drivers/macintosh/macio-adb.c
+++ b/drivers/macintosh/macio-adb.c
@@ -90,22 +90,12 @@ int macio_init(void)
 {
         struct device_node *adbs;
         struct resource r;
+        unsigned int irq;
 
         adbs = find_compatible_devices("adb", "chrp,adb0");
         if (adbs == 0)
                 return -ENXIO;
 
-#if 0
-        { int i = 0;
-
-        printk("macio_adb_init: node = %p, addrs =", adbs->node);
-        while(!of_address_to_resource(adbs, i, &r))
-                printk(" %x(%x)", r.start, r.end - r.start);
-        printk(", intrs =");
-        for (i = 0; i < adbs->n_intrs; ++i)
-                printk(" %x", adbs->intrs[i].line);
-        printk("\n"); }
-#endif
         if (of_address_to_resource(adbs, 0, &r))
                 return -ENXIO;
         adb = ioremap(r.start, sizeof(struct adb_regs));
@@ -117,10 +107,9 @@ int macio_init(void)
         out_8(&adb->active_lo.r, 0xff);
         out_8(&adb->autopoll.r, APE);
 
-        if (request_irq(adbs->intrs[0].line, macio_adb_interrupt,
-                        0, "ADB", (void *)0)) {
-                printk(KERN_ERR "ADB: can't get irq %d\n",
-                       adbs->intrs[0].line);
+        irq = irq_of_parse_and_map(adbs, 0);
+        if (request_irq(irq, macio_adb_interrupt, 0, "ADB", (void *)0)) {
+                printk(KERN_ERR "ADB: can't get irq %d\n", irq);
                 return -EAGAIN;
         }
         out_8(&adb->intr_enb.r, DFB | TAG);
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 40ae7b6a939d..82657bc86d19 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -280,75 +280,128 @@ static void macio_release_dev(struct device *dev)
 static int macio_resource_quirks(struct device_node *np, struct resource *res,
                                  int index)
 {
-        if (res->flags & IORESOURCE_MEM) {
-                /* Grand Central has too large resource 0 on some machines */
-                if (index == 0 && !strcmp(np->name, "gc"))
-                        res->end = res->start + 0x1ffff;
+        /* Only quirks for memory resources for now */
+        if ((res->flags & IORESOURCE_MEM) == 0)
+                return 0;
+
+        /* Grand Central has too large resource 0 on some machines */
+        if (index == 0 && !strcmp(np->name, "gc"))
+                res->end = res->start + 0x1ffff;
 
-                /* Airport has bogus resource 2 */
-                if (index >= 2 && !strcmp(np->name, "radio"))
-                        return 1;
+        /* Airport has bogus resource 2 */
+        if (index >= 2 && !strcmp(np->name, "radio"))
+                return 1;
 
 #ifndef CONFIG_PPC64
-                /* DBDMAs may have bogus sizes */
-                if ((res->start & 0x0001f000) == 0x00008000)
-                        res->end = res->start + 0xff;
+        /* DBDMAs may have bogus sizes */
+        if ((res->start & 0x0001f000) == 0x00008000)
+                res->end = res->start + 0xff;
 #endif /* CONFIG_PPC64 */
 
-                /* ESCC parent eats child resources. We could have added a
-                 * level of hierarchy, but I don't really feel the need
-                 * for it
-                 */
-                if (!strcmp(np->name, "escc"))
-                        return 1;
-
-                /* ESCC has bogus resources >= 3 */
-                if (index >= 3 && !(strcmp(np->name, "ch-a") &&
-                                    strcmp(np->name, "ch-b")))
-                        return 1;
-
-                /* Media bay has too many resources, keep only first one */
-                if (index > 0 && !strcmp(np->name, "media-bay"))
-                        return 1;
-
-                /* Some older IDE resources have bogus sizes */
-                if (!(strcmp(np->name, "IDE") && strcmp(np->name, "ATA") &&
-                      strcmp(np->type, "ide") && strcmp(np->type, "ata"))) {
-                        if (index == 0 && (res->end - res->start) > 0xfff)
-                                res->end = res->start + 0xfff;
-                        if (index == 1 && (res->end - res->start) > 0xff)
-                                res->end = res->start + 0xff;
-                }
+        /* ESCC parent eats child resources. We could have added a
+         * level of hierarchy, but I don't really feel the need
+         * for it
+         */
+        if (!strcmp(np->name, "escc"))
+                return 1;
+
+        /* ESCC has bogus resources >= 3 */
+        if (index >= 3 && !(strcmp(np->name, "ch-a") &&
+                            strcmp(np->name, "ch-b")))
+                return 1;
+
+        /* Media bay has too many resources, keep only first one */
+        if (index > 0 && !strcmp(np->name, "media-bay"))
+                return 1;
+
+        /* Some older IDE resources have bogus sizes */
+        if (!(strcmp(np->name, "IDE") && strcmp(np->name, "ATA") &&
+              strcmp(np->type, "ide") && strcmp(np->type, "ata"))) {
+                if (index == 0 && (res->end - res->start) > 0xfff)
+                        res->end = res->start + 0xfff;
+                if (index == 1 && (res->end - res->start) > 0xff)
+                        res->end = res->start + 0xff;
         }
         return 0;
 }
 
+static void macio_create_fixup_irq(struct macio_dev *dev, int index,
+                                   unsigned int line)
+{
+        unsigned int irq;
 
-static void macio_setup_interrupts(struct macio_dev *dev)
+        irq = irq_create_mapping(NULL, line);
+        if (irq != NO_IRQ) {
+                dev->interrupt[index].start = irq;
+                dev->interrupt[index].flags = IORESOURCE_IRQ;
+                dev->interrupt[index].name = dev->ofdev.dev.bus_id;
+        }
+        if (dev->n_interrupts <= index)
+                dev->n_interrupts = index + 1;
+}
+
+static void macio_add_missing_resources(struct macio_dev *dev)
 {
         struct device_node *np = dev->ofdev.node;
-        int i,j;
+        unsigned int irq_base;
+
+        /* Gatwick has some missing interrupts on child nodes */
+        if (dev->bus->chip->type != macio_gatwick)
+                return;
 
-        /* For now, we use pre-parsed entries in the device-tree for
-         * interrupt routing and addresses, but we should change that
-         * to dynamically parsed entries and so get rid of most of the
-         * clutter in struct device_node
+        /* irq_base is always 64 on gatwick. I have no cleaner way to get
+         * that value from here at this point
          */
-        for (i = j = 0; i < np->n_intrs; i++) {
+        irq_base = 64;
+
+        /* Fix SCC */
+        if (strcmp(np->name, "ch-a") == 0) {
+                macio_create_fixup_irq(dev, 0, 15 + irq_base);
+                macio_create_fixup_irq(dev, 1,  4 + irq_base);
+                macio_create_fixup_irq(dev, 2,  5 + irq_base);
+                printk(KERN_INFO "macio: fixed SCC irqs on gatwick\n");
+        }
+
+        /* Fix media-bay */
+        if (strcmp(np->name, "media-bay") == 0) {
+                macio_create_fixup_irq(dev, 0, 29 + irq_base);
+                printk(KERN_INFO "macio: fixed media-bay irq on gatwick\n");
+        }
+
+        /* Fix left media bay childs */
+        if (dev->media_bay != NULL && strcmp(np->name, "floppy") == 0) {
+                macio_create_fixup_irq(dev, 0, 19 + irq_base);
+                macio_create_fixup_irq(dev, 1,  1 + irq_base);
+                printk(KERN_INFO "macio: fixed left floppy irqs\n");
+        }
+        if (dev->media_bay != NULL && strcasecmp(np->name, "ata4") == 0) {
+                macio_create_fixup_irq(dev, 0, 14 + irq_base);
+                macio_create_fixup_irq(dev, 0,  3 + irq_base);
+                printk(KERN_INFO "macio: fixed left ide irqs\n");
+        }
+}
+
+static void macio_setup_interrupts(struct macio_dev *dev)
+{
+        struct device_node *np = dev->ofdev.node;
+        unsigned int irq;
+        int i = 0, j = 0;
+
+        for (;;) {
                 struct resource *res = &dev->interrupt[j];
 
                 if (j >= MACIO_DEV_COUNT_IRQS)
                         break;
-                res->start = np->intrs[i].line;
-                res->flags = IORESOURCE_IO;
-                if (np->intrs[j].sense)
-                        res->flags |= IORESOURCE_IRQ_LOWLEVEL;
-                else
-                        res->flags |= IORESOURCE_IRQ_HIGHEDGE;
+                irq = irq_of_parse_and_map(np, i++);
+                if (irq == NO_IRQ)
+                        break;
+                res->start = irq;
+                res->flags = IORESOURCE_IRQ;
                 res->name = dev->ofdev.dev.bus_id;
-                if (macio_resource_quirks(np, res, i))
+                if (macio_resource_quirks(np, res, i - 1)) {
                         memset(res, 0, sizeof(struct resource));
-                else
+                        continue;
+                } else
                         j++;
         }
         dev->n_interrupts = j;
@@ -445,6 +498,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
         /* Setup interrupts & resources */
         macio_setup_interrupts(dev);
         macio_setup_resources(dev, parent_res);
+        macio_add_missing_resources(dev);
 
         /* Register with core */
         if (of_device_register(&dev->ofdev) != 0) {
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index ff6d9bfdc3d2..00ef46898147 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -75,9 +75,11 @@ struct smu_device {
         struct of_device        *of_dev;
         int                     doorbell;       /* doorbell gpio */
         u32 __iomem             *db_buf;        /* doorbell buffer */
-        int                     db_irq;
+        struct device_node      *db_node;
+        unsigned int            db_irq;
         int                     msg;
-        int                     msg_irq;
+        struct device_node      *msg_node;
+        unsigned int            msg_irq;
         struct smu_cmd_buf      *cmd_buf;       /* command buffer virtual */
         u32                     cmd_buf_abs;    /* command buffer absolute */
         struct list_head        cmd_list;
@@ -93,6 +95,7 @@ struct smu_device {
  */
 static struct smu_device        *smu;
 static DEFINE_MUTEX(smu_part_access);
+static int smu_irq_inited;
 
 static void smu_i2c_retry(unsigned long data);
 
@@ -257,6 +260,10 @@ int smu_queue_cmd(struct smu_cmd *cmd)
                 smu_start_cmd();
         spin_unlock_irqrestore(&smu->lock, flags);
 
+        /* Workaround for early calls when irq isn't available */
+        if (!smu_irq_inited || smu->db_irq == NO_IRQ)
+                smu_spinwait_cmd(cmd);
+
         return 0;
 }
 EXPORT_SYMBOL(smu_queue_cmd);
@@ -478,14 +485,15 @@ int __init smu_init (void)
         smu->cmd_buf_abs = (u32)smu_cmdbuf_abs;
         smu->cmd_buf = (struct smu_cmd_buf *)abs_to_virt(smu_cmdbuf_abs);
 
-        np = of_find_node_by_name(NULL, "smu-doorbell");
-        if (np == NULL) {
+        smu->db_node = of_find_node_by_name(NULL, "smu-doorbell");
+        if (smu->db_node == NULL) {
                 printk(KERN_ERR "SMU: Can't find doorbell GPIO !\n");
                 goto fail;
         }
-        data = (u32 *)get_property(np, "reg", NULL);
+        data = (u32 *)get_property(smu->db_node, "reg", NULL);
         if (data == NULL) {
-                of_node_put(np);
+                of_node_put(smu->db_node);
+                smu->db_node = NULL;
                 printk(KERN_ERR "SMU: Can't find doorbell GPIO address !\n");
                 goto fail;
         }
@@ -497,27 +505,21 @@ int __init smu_init (void)
         smu->doorbell = *data;
         if (smu->doorbell < 0x50)
                 smu->doorbell += 0x50;
-        if (np->n_intrs > 0)
-                smu->db_irq = np->intrs[0].line;
-
-        of_node_put(np);
 
         /* Now look for the smu-interrupt GPIO */
         do {
-                np = of_find_node_by_name(NULL, "smu-interrupt");
-                if (np == NULL)
+                smu->msg_node = of_find_node_by_name(NULL, "smu-interrupt");
+                if (smu->msg_node == NULL)
                         break;
-                data = (u32 *)get_property(np, "reg", NULL);
+                data = (u32 *)get_property(smu->msg_node, "reg", NULL);
                 if (data == NULL) {
-                        of_node_put(np);
+                        of_node_put(smu->msg_node);
+                        smu->msg_node = NULL;
                         break;
                 }
                 smu->msg = *data;
                 if (smu->msg < 0x50)
                         smu->msg += 0x50;
-                if (np->n_intrs > 0)
-                        smu->msg_irq = np->intrs[0].line;
-                of_node_put(np);
         } while(0);
 
         /* Doorbell buffer is currently hard-coded, I didn't find a proper
@@ -549,6 +551,19 @@ static int smu_late_init(void)
         smu->i2c_timer.function = smu_i2c_retry;
         smu->i2c_timer.data = (unsigned long)smu;
 
+        if (smu->db_node) {
+                smu->db_irq = irq_of_parse_and_map(smu->db_node, 0);
+                if (smu->db_irq == NO_IRQ)
+                        printk(KERN_ERR "smu: failed to map irq for node %s\n",
+                               smu->db_node->full_name);
+        }
+        if (smu->msg_node) {
+                smu->msg_irq = irq_of_parse_and_map(smu->msg_node, 0);
+                if (smu->msg_irq == NO_IRQ)
+                        printk(KERN_ERR "smu: failed to map irq for node %s\n",
+                               smu->msg_node->full_name);
+        }
+
         /*
          * Try to request the interrupts
          */
@@ -573,6 +588,7 @@ static int smu_late_init(void)
                 }
         }
 
+        smu_irq_inited = 1;
         return 0;
 }
 /* This has to be before arch_initcall as the low i2c stuff relies on the
@@ -744,6 +760,11 @@ static void smu_i2c_low_completion(struct smu_cmd *scmd, void *misc)
         if (fail && --cmd->retries > 0) {
                 DPRINTK("SMU: i2c failure, starting timer...\n");
                 BUG_ON(cmd != smu->cmd_i2c_cur);
+                if (!smu_irq_inited) {
+                        mdelay(5);
+                        smu_i2c_retry(0);
+                        return;
+                }
                 mod_timer(&smu->i2c_timer, jiffies + msecs_to_jiffies(5));
                 return;
         }
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index c1fe0b368f76..20bf67244e2c 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -95,6 +95,17 @@
  *      - Use min/max macros here or there
  *      - Latest darwin updated U3H min fan speed to 20% PWM
  *
+ *  July. 06, 2006 : 1.3
+ *      - Fix setting of RPM fans on Xserve G5 (they were going too fast)
+ *      - Add missing slots fan control loop for Xserve G5
+ *      - Lower fixed slots fan speed from 50% to 40% on desktop G5s. We
+ *        still can't properly implement the control loop for these, so let's
+ *        reduce the noise a little bit, it appears that 40% still gives us
+ *        a pretty good air flow
+ *      - Add code to "tickle" the FCU regulary so it doesn't think that
+ *        we are gone while in fact, the machine just didn't need any fan
+ *        speed change lately
+ *
  */
 
 #include <linux/types.h>
@@ -121,7 +132,7 @@
 
 #include "therm_pm72.h"
 
-#define VERSION "1.2b2"
+#define VERSION "1.3"
 
 #undef DEBUG
 
@@ -146,6 +157,7 @@ static struct basckside_pid_params	backside_params;
 static struct backside_pid_state        backside_state;
 static struct drives_pid_state          drives_state;
 static struct dimm_pid_state            dimms_state;
+static struct slots_pid_state           slots_state;
 static int                              state;
 static int                              cpu_count;
 static int                              cpu_pid_type;
@@ -154,7 +166,8 @@ static struct completion		ctrl_complete;
 static int                              critical_state;
 static int                              rackmac;
 static s32                              dimm_output_clamp;
-
+static int                              fcu_rpm_shift;
+static int                              fcu_tickle_ticks;
 static DECLARE_MUTEX(driver_lock);
 
 /*
@@ -495,13 +508,20 @@ static int start_fcu(void)
         rc = fan_write_reg(0x2e, &buf, 1);
         if (rc < 0)
                 return -EIO;
+        rc = fan_read_reg(0, &buf, 1);
+        if (rc < 0)
+                return -EIO;
+        fcu_rpm_shift = (buf == 1) ? 2 : 3;
+        printk(KERN_DEBUG "FCU Initialized, RPM fan shift is %d\n",
+               fcu_rpm_shift);
+
         return 0;
 }
 
 static int set_rpm_fan(int fan_index, int rpm)
 {
         unsigned char buf[2];
-        int rc, id;
+        int rc, id, min, max;
 
         if (fcu_fans[fan_index].type != FCU_FAN_RPM)
                 return -EINVAL;
@@ -509,12 +529,15 @@ static int set_rpm_fan(int fan_index, int rpm)
         if (id == FCU_FAN_ABSENT_ID)
                 return -EINVAL;
 
-        if (rpm < 300)
-                rpm = 300;
-        else if (rpm > 8191)
-                rpm = 8191;
-        buf[0] = rpm >> 5;
-        buf[1] = rpm << 3;
+        min = 2400 >> fcu_rpm_shift;
+        max = 56000 >> fcu_rpm_shift;
+
+        if (rpm < min)
+                rpm = min;
+        else if (rpm > max)
+                rpm = max;
+        buf[0] = rpm >> (8 - fcu_rpm_shift);
+        buf[1] = rpm << fcu_rpm_shift;
         rc = fan_write_reg(0x10 + (id * 2), buf, 2);
         if (rc < 0)
                 return -EIO;
@@ -551,7 +574,7 @@ static int get_rpm_fan(int fan_index, int programmed)
         if (rc != 2)
                 return -EIO;
 
-        return (buf[0] << 5) | buf[1] >> 3;
+        return (buf[0] << (8 - fcu_rpm_shift)) | buf[1] >> fcu_rpm_shift;
 }
 
 static int set_pwm_fan(int fan_index, int pwm)
@@ -609,6 +632,26 @@ static int get_pwm_fan(int fan_index)
         return (buf[0] * 1000) / 2559;
 }
 
+static void tickle_fcu(void)
+{
+        int pwm;
+
+        pwm = get_pwm_fan(SLOTS_FAN_PWM_INDEX);
+
+        DBG("FCU Tickle, slots fan is: %d\n", pwm);
+        if (pwm < 0)
+                pwm = 100;
+
+        if (!rackmac) {
+                pwm = SLOTS_FAN_DEFAULT_PWM;
+        } else if (pwm < SLOTS_PID_OUTPUT_MIN)
+                pwm = SLOTS_PID_OUTPUT_MIN;
+
+        /* That is hopefully enough to make the FCU happy */
+        set_pwm_fan(SLOTS_FAN_PWM_INDEX, pwm);
+}
+
+
 /*
  * Utility routine to read the CPU calibration EEPROM data
  * from the device-tree
@@ -715,6 +758,9 @@ BUILD_SHOW_FUNC_INT(backside_fan_pwm, backside_state.pwm)
 BUILD_SHOW_FUNC_FIX(drives_temperature, drives_state.last_temp)
 BUILD_SHOW_FUNC_INT(drives_fan_rpm, drives_state.rpm)
 
+BUILD_SHOW_FUNC_FIX(slots_temperature, slots_state.last_temp)
+BUILD_SHOW_FUNC_INT(slots_fan_pwm, slots_state.pwm)
+
 BUILD_SHOW_FUNC_FIX(dimms_temperature, dimms_state.last_temp)
 
 static DEVICE_ATTR(cpu0_temperature,S_IRUGO,show_cpu0_temperature,NULL);
@@ -735,6 +781,9 @@ static DEVICE_ATTR(backside_fan_pwm,S_IRUGO,show_backside_fan_pwm,NULL);
 static DEVICE_ATTR(drives_temperature,S_IRUGO,show_drives_temperature,NULL);
 static DEVICE_ATTR(drives_fan_rpm,S_IRUGO,show_drives_fan_rpm,NULL);
 
+static DEVICE_ATTR(slots_temperature,S_IRUGO,show_slots_temperature,NULL);
+static DEVICE_ATTR(slots_fan_pwm,S_IRUGO,show_slots_fan_pwm,NULL);
+
 static DEVICE_ATTR(dimms_temperature,S_IRUGO,show_dimms_temperature,NULL);
 
 /*
@@ -1076,6 +1125,9 @@ static void do_monitor_cpu_rack(struct cpu_pid_state *state)
         fan_min = dimm_output_clamp;
         fan_min = max(fan_min, (int)state->mpu.rminn_intake_fan);
 
+        DBG(" CPU min mpu = %d, min dimm = %d\n",
+            state->mpu.rminn_intake_fan, dimm_output_clamp);
+
         state->rpm = max(state->rpm, (int)fan_min);
         state->rpm = min(state->rpm, (int)state->mpu.rmaxn_intake_fan);
         state->intake_rpm = state->rpm;
@@ -1374,7 +1426,8 @@ static void do_monitor_drives(struct drives_pid_state *state)
         DBG("  current rpm: %d\n", state->rpm);
 
         /* Get some sensor readings */
-        temp = le16_to_cpu(i2c_smbus_read_word_data(state->monitor, DS1775_TEMP)) << 8;
+        temp = le16_to_cpu(i2c_smbus_read_word_data(state->monitor,
+                                                    DS1775_TEMP)) << 8;
         state->last_temp = temp;
         DBG("  temp: %d.%03d, target: %d.%03d\n", FIX32TOPRINT(temp),
             FIX32TOPRINT(DRIVES_PID_INPUT_TARGET));
@@ -1575,7 +1628,7 @@ static int init_dimms_state(struct dimm_pid_state *state)
 }
 
 /*
- * Dispose of the state data for the drives control loop
+ * Dispose of the state data for the DIMM control loop
  */
 static void dispose_dimms_state(struct dimm_pid_state *state)
 {
@@ -1588,6 +1641,127 @@ static void dispose_dimms_state(struct dimm_pid_state *state)
         state->monitor = NULL;
 }
 
+/*
+ * Slots fan control loop
+ */
+static void do_monitor_slots(struct slots_pid_state *state)
+{
+        s32 temp, integral, derivative;
+        s64 integ_p, deriv_p, prop_p, sum;
+        int i, rc;
+
+        if (--state->ticks != 0)
+                return;
+        state->ticks = SLOTS_PID_INTERVAL;
+
+        DBG("slots:\n");
+
+        /* Check fan status */
+        rc = get_pwm_fan(SLOTS_FAN_PWM_INDEX);
+        if (rc < 0) {
+                printk(KERN_WARNING "Error %d reading slots fan !\n", rc);
+                /* XXX What do we do now ? */
+        } else
+                state->pwm = rc;
+        DBG("  current pwm: %d\n", state->pwm);
+
+        /* Get some sensor readings */
+        temp = le16_to_cpu(i2c_smbus_read_word_data(state->monitor,
+                                                    DS1775_TEMP)) << 8;
+        state->last_temp = temp;
+        DBG("  temp: %d.%03d, target: %d.%03d\n", FIX32TOPRINT(temp),
+            FIX32TOPRINT(SLOTS_PID_INPUT_TARGET));
+
+        /* Store temperature and error in history array */
+        state->cur_sample = (state->cur_sample + 1) % SLOTS_PID_HISTORY_SIZE;
+        state->sample_history[state->cur_sample] = temp;
+        state->error_history[state->cur_sample] = temp - SLOTS_PID_INPUT_TARGET;
+
+        /* If first loop, fill the history table */
+        if (state->first) {
+                for (i = 0; i < (SLOTS_PID_HISTORY_SIZE - 1); i++) {
+                        state->cur_sample = (state->cur_sample + 1) %
+                                SLOTS_PID_HISTORY_SIZE;
+                        state->sample_history[state->cur_sample] = temp;
+                        state->error_history[state->cur_sample] =
+                                temp - SLOTS_PID_INPUT_TARGET;
+                }
+                state->first = 0;
+        }
+
+        /* Calculate the integral term */
+        sum = 0;
+        integral = 0;
+        for (i = 0; i < SLOTS_PID_HISTORY_SIZE; i++)
+                integral += state->error_history[i];
+        integral *= SLOTS_PID_INTERVAL;
+        DBG("  integral: %08x\n", integral);
+        integ_p = ((s64)SLOTS_PID_G_r) * (s64)integral;
+        DBG("   integ_p: %d\n", (int)(integ_p >> 36));
+        sum += integ_p;
+
+        /* Calculate the derivative term */
+        derivative = state->error_history[state->cur_sample] -
+                state->error_history[(state->cur_sample + SLOTS_PID_HISTORY_SIZE - 1)
+                                    % SLOTS_PID_HISTORY_SIZE];
+        derivative /= SLOTS_PID_INTERVAL;
+        deriv_p = ((s64)SLOTS_PID_G_d) * (s64)derivative;
+        DBG("   deriv_p: %d\n", (int)(deriv_p >> 36));
+        sum += deriv_p;
+
+        /* Calculate the proportional term */
+        prop_p = ((s64)SLOTS_PID_G_p) * (s64)(state->error_history[state->cur_sample]);
+        DBG("   prop_p: %d\n", (int)(prop_p >> 36));
+        sum += prop_p;
+
+        /* Scale sum */
+        sum >>= 36;
+
+        DBG("   sum: %d\n", (int)sum);
+        state->pwm = (s32)sum;
+
+        state->pwm = max(state->pwm, SLOTS_PID_OUTPUT_MIN);
+        state->pwm = min(state->pwm, SLOTS_PID_OUTPUT_MAX);
+
+        DBG("** DRIVES PWM: %d\n", (int)state->pwm);
+        set_pwm_fan(SLOTS_FAN_PWM_INDEX, state->pwm);
+}
+
+/*
+ * Initialize the state structure for the slots bay fan control loop
+ */
+static int init_slots_state(struct slots_pid_state *state)
+{
+        state->ticks = 1;
+        state->first = 1;
+        state->pwm = 50;
+
+        state->monitor = attach_i2c_chip(XSERVE_SLOTS_LM75, "slots_temp");
+        if (state->monitor == NULL)
+                return -ENODEV;
+
+        device_create_file(&of_dev->dev, &dev_attr_slots_temperature);
+        device_create_file(&of_dev->dev, &dev_attr_slots_fan_pwm);
+
+        return 0;
+}
+
+/*
+ * Dispose of the state data for the slots control loop
+ */
+static void dispose_slots_state(struct slots_pid_state *state)
+{
+        if (state->monitor == NULL)
+                return;
+
+        device_remove_file(&of_dev->dev, &dev_attr_slots_temperature);
+        device_remove_file(&of_dev->dev, &dev_attr_slots_fan_pwm);
+
+        detach_i2c_chip(state->monitor);
+        state->monitor = NULL;
+}
+
+
 static int call_critical_overtemp(void)
 {
         char *argv[] = { critical_overtemp_path, NULL };
@@ -1617,14 +1791,17 @@ static int main_control_loop(void *x)
                 goto out;
         }
 
-        /* Set the PCI fan once for now */
-        set_pwm_fan(SLOTS_FAN_PWM_INDEX, SLOTS_FAN_DEFAULT_PWM);
+        /* Set the PCI fan once for now on non-RackMac */
+        if (!rackmac)
+                set_pwm_fan(SLOTS_FAN_PWM_INDEX, SLOTS_FAN_DEFAULT_PWM);
 
         /* Initialize ADCs */
         initialize_adc(&cpu_state[0]);
         if (cpu_state[1].monitor != NULL)
                 initialize_adc(&cpu_state[1]);
 
+        fcu_tickle_ticks = FCU_TICKLE_TICKS;
+
         up(&driver_lock);
 
         while (state == state_attached) {
@@ -1634,6 +1811,12 @@ static int main_control_loop(void *x)
 
                 down(&driver_lock);
 
+                /* Tickle the FCU just in case */
+                if (--fcu_tickle_ticks < 0) {
+                        fcu_tickle_ticks = FCU_TICKLE_TICKS;
+                        tickle_fcu();
+                }
+
                 /* First, we always calculate the new DIMMs state on an Xserve */
                 if (rackmac)
                         do_monitor_dimms(&dimms_state);
@@ -1654,7 +1837,9 @@ static int main_control_loop(void *x)
                 }
                 /* Then, the rest */
                 do_monitor_backside(&backside_state);
-                if (!rackmac)
+                if (rackmac)
+                        do_monitor_slots(&slots_state);
+                else
                         do_monitor_drives(&drives_state);
                 up(&driver_lock);
 
@@ -1696,6 +1881,7 @@ static void dispose_control_loops(void)
         dispose_cpu_state(&cpu_state[1]);
         dispose_backside_state(&backside_state);
         dispose_drives_state(&drives_state);
+        dispose_slots_state(&slots_state);
         dispose_dimms_state(&dimms_state);
 }
 
@@ -1745,6 +1931,8 @@ static int create_control_loops(void)
                 goto fail;
         if (rackmac && init_dimms_state(&dimms_state))
                 goto fail;
+        if (rackmac && init_slots_state(&slots_state))
+                goto fail;
         if (!rackmac && init_drives_state(&drives_state))
                 goto fail;
 
diff --git a/drivers/macintosh/therm_pm72.h b/drivers/macintosh/therm_pm72.h
index fc7e9b7ecaf2..393cc9df94e1 100644
--- a/drivers/macintosh/therm_pm72.h
+++ b/drivers/macintosh/therm_pm72.h
@@ -105,6 +105,7 @@ static char * critical_overtemp_path = "/sbin/critical_overtemp";
 #define DRIVES_DALLAS_ID        0x94
 #define BACKSIDE_MAX_ID         0x98
 #define XSERVE_DIMMS_LM87       0x25a
+#define XSERVE_SLOTS_LM75       0x290
 
 /*
  * Some MAX6690, DS1775, LM87 register definitions
@@ -198,7 +199,7 @@ struct drives_pid_state
 
 #define SLOTS_FAN_PWM_DEFAULT_ID        2
 #define SLOTS_FAN_PWM_INDEX             2
-#define SLOTS_FAN_DEFAULT_PWM           50 /* Do better here ! */
+#define SLOTS_FAN_DEFAULT_PWM           40 /* Do better here ! */
 
 
 /*
@@ -206,7 +207,7 @@ struct drives_pid_state
  */
 #define DIMM_PID_G_d                    0
 #define DIMM_PID_G_p                    0
-#define DIMM_PID_G_r                    0x6553600
+#define DIMM_PID_G_r                    0x06553600
 #define DIMM_PID_INPUT_TARGET           3276800
 #define DIMM_PID_INTERVAL               1
 #define DIMM_PID_OUTPUT_MAX             14000
@@ -226,6 +227,31 @@ struct dimm_pid_state
 };
 
 
+/*
+ * PID factors for the Xserve Slots control loop
+ */
+#define SLOTS_PID_G_d                   0
+#define SLOTS_PID_G_p                   0
+#define SLOTS_PID_G_r                   0x00100000
+#define SLOTS_PID_INPUT_TARGET          3200000
+#define SLOTS_PID_INTERVAL              1
+#define SLOTS_PID_OUTPUT_MAX            100
+#define SLOTS_PID_OUTPUT_MIN            20
+#define SLOTS_PID_HISTORY_SIZE          20
+
+struct slots_pid_state
+{
+        int                     ticks;
+        struct i2c_client *     monitor;
+        s32                     sample_history[SLOTS_PID_HISTORY_SIZE];
+        s32                     error_history[SLOTS_PID_HISTORY_SIZE];
+        int                     cur_sample;
+        s32                     last_temp;
+        int                     first;
+        int                     pwm;
+};
+
+
 
 /* Desktops */
 
@@ -283,6 +309,9 @@ struct cpu_pid_state
         s32                     pump_max;
 };
 
+/* Tickle FCU every 10 seconds */
+#define FCU_TICKLE_TICKS        10
+
 /*
  * Driver state
  */
diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c
index 6501db50fb83..69d5452fd22f 100644
--- a/drivers/macintosh/via-cuda.c
+++ b/drivers/macintosh/via-cuda.c
@@ -34,13 +34,6 @@
 static volatile unsigned char __iomem *via;
 static DEFINE_SPINLOCK(cuda_lock);
 
-#ifdef CONFIG_MAC
-#define CUDA_IRQ IRQ_MAC_ADB
-#define eieio()
-#else
-#define CUDA_IRQ vias->intrs[0].line
-#endif
-
 /* VIA registers - spaced 0x200 bytes apart */
 #define RS              0x200           /* skip between registers */
 #define B               0               /* B-side data */
@@ -189,11 +182,24 @@ int __init find_via_cuda(void)
 
 static int __init via_cuda_start(void)
 {
+    unsigned int irq;
+
     if (via == NULL)
         return -ENODEV;
 
-    if (request_irq(CUDA_IRQ, cuda_interrupt, 0, "ADB", cuda_interrupt)) {
-        printk(KERN_ERR "cuda_init: can't get irq %d\n", CUDA_IRQ);
+#ifdef CONFIG_MAC
+    irq = IRQ_MAC_ADB;
+#else /* CONFIG_MAC */
+    irq = irq_of_parse_and_map(vias, 0);
+    if (irq == NO_IRQ) {
+        printk(KERN_ERR "via-cuda: can't map interrupts for %s\n",
+               vias->full_name);
+        return -ENODEV;
+    }
+#endif /* CONFIG_MAP */
+
+    if (request_irq(irq, cuda_interrupt, 0, "ADB", cuda_interrupt)) {
+        printk(KERN_ERR "via-cuda: can't request irq %d\n", irq);
         return -EAGAIN;
     }
 
diff --git a/drivers/macintosh/via-pmu-backlight.c b/drivers/macintosh/via-pmu-backlight.c
index b42d05f2aaff..a82f313d9dc9 100644
--- a/drivers/macintosh/via-pmu-backlight.c
+++ b/drivers/macintosh/via-pmu-backlight.c
@@ -15,19 +15,51 @@
 
 #define MAX_PMU_LEVEL 0xFF
 
-static struct device_node *vias;
 static struct backlight_properties pmu_backlight_data;
+static spinlock_t pmu_backlight_lock;
+static int sleeping;
+static u8 bl_curve[FB_BACKLIGHT_LEVELS];
 
-static int pmu_backlight_get_level_brightness(struct fb_info *info,
-                int level)
+static void pmu_backlight_init_curve(u8 off, u8 min, u8 max)
+{
+        unsigned int i, flat, count, range = (max - min);
+
+        bl_curve[0] = off;
+
+        for (flat = 1; flat < (FB_BACKLIGHT_LEVELS / 16); ++flat)
+                bl_curve[flat] = min;
+
+        count = FB_BACKLIGHT_LEVELS * 15 / 16;
+        for (i = 0; i < count; ++i)
+                bl_curve[flat + i] = min + (range * (i + 1) / count);
+}
+
+static int pmu_backlight_curve_lookup(int value)
+{
+        int level = (FB_BACKLIGHT_LEVELS - 1);
+        int i, max = 0;
+
+        /* Look for biggest value */
+        for (i = 0; i < FB_BACKLIGHT_LEVELS; i++)
+                max = max((int)bl_curve[i], max);
+
+        /* Look for nearest value */
+        for (i = 0; i < FB_BACKLIGHT_LEVELS; i++) {
+                int diff = abs(bl_curve[i] - value);
+                if (diff < max) {
+                        max = diff;
+                        level = i;
+                }
+        }
+        return level;
+}
+
+static int pmu_backlight_get_level_brightness(int level)
 {
         int pmulevel;
 
         /* Get and convert the value */
-        mutex_lock(&info->bl_mutex);
-        pmulevel = info->bl_curve[level] * FB_BACKLIGHT_MAX / MAX_PMU_LEVEL;
-        mutex_unlock(&info->bl_mutex);
-
+        pmulevel = bl_curve[level] * FB_BACKLIGHT_MAX / MAX_PMU_LEVEL;
         if (pmulevel < 0)
                 pmulevel = 0;
         else if (pmulevel > MAX_PMU_LEVEL)
@@ -38,25 +70,37 @@ static int pmu_backlight_get_level_brightness(struct fb_info *info,
 
 static int pmu_backlight_update_status(struct backlight_device *bd)
 {
-        struct fb_info *info = class_get_devdata(&bd->class_dev);
         struct adb_request req;
-        int pmulevel, level = bd->props->brightness;
+        unsigned long flags;
+        int level = bd->props->brightness;
+
+        spin_lock_irqsave(&pmu_backlight_lock, flags);
 
-        if (vias == NULL)
-                return -ENODEV;
+        /* Don't update brightness when sleeping */
+        if (sleeping)
+                goto out;
 
         if (bd->props->power != FB_BLANK_UNBLANK ||
             bd->props->fb_blank != FB_BLANK_UNBLANK)
                 level = 0;
 
-        pmulevel = pmu_backlight_get_level_brightness(info, level);
+        if (level > 0) {
+                int pmulevel = pmu_backlight_get_level_brightness(level);
 
-        pmu_request(&req, NULL, 2, PMU_BACKLIGHT_BRIGHT, pmulevel);
-        pmu_wait_complete(&req);
+                pmu_request(&req, NULL, 2, PMU_BACKLIGHT_BRIGHT, pmulevel);
+                pmu_wait_complete(&req);
+
+                pmu_request(&req, NULL, 2, PMU_POWER_CTRL,
+                        PMU_POW_BACKLIGHT | PMU_POW_ON);
+                pmu_wait_complete(&req);
+        } else {
+                pmu_request(&req, NULL, 2, PMU_POWER_CTRL,
+                        PMU_POW_BACKLIGHT | PMU_POW_OFF);
+                pmu_wait_complete(&req);
+        }
 
-        pmu_request(&req, NULL, 2, PMU_POWER_CTRL,
-                PMU_POW_BACKLIGHT | (level > 0 ? PMU_POW_ON : PMU_POW_OFF));
-        pmu_wait_complete(&req);
+out:
+        spin_unlock_irqrestore(&pmu_backlight_lock, flags);
 
         return 0;
 }
@@ -73,15 +117,23 @@ static struct backlight_properties pmu_backlight_data = {
         .max_brightness = (FB_BACKLIGHT_LEVELS - 1),
 };
 
-void __init pmu_backlight_init(struct device_node *in_vias)
+#ifdef CONFIG_PM
+void pmu_backlight_set_sleep(int sleep)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&pmu_backlight_lock, flags);
+        sleeping = sleep;
+        spin_unlock_irqrestore(&pmu_backlight_lock, flags);
+}
+#endif /* CONFIG_PM */
+
+void __init pmu_backlight_init()
 {
         struct backlight_device *bd;
-        struct fb_info *info;
         char name[10];
         int level, autosave;
 
-        vias = in_vias;
-
         /* Special case for the old PowerBook since I can't test on it */
         autosave =
                 machine_is_compatible("AAPL,3400/2400") ||
@@ -93,27 +145,14 @@ void __init pmu_backlight_init(struct device_node *in_vias)
             !machine_is_compatible("PowerBook1,1"))
                 return;
 
-        /* Actually, this is a hack, but I don't know of a better way
-         * to get the first framebuffer device.
-         */
-        info = registered_fb[0];
-        if (!info) {
-                printk("pmubl: No framebuffer found\n");
-                goto error;
-        }
-
-        snprintf(name, sizeof(name), "pmubl%d", info->node);
+        snprintf(name, sizeof(name), "pmubl");
 
-        bd = backlight_device_register(name, info, &pmu_backlight_data);
+        bd = backlight_device_register(name, NULL, &pmu_backlight_data);
         if (IS_ERR(bd)) {
                 printk("pmubl: Backlight registration failed\n");
                 goto error;
         }
-
-        mutex_lock(&info->bl_mutex);
-        info->bl_dev = bd;
-        fb_bl_default_curve(info, 0x7F, 0x46, 0x0E);
-        mutex_unlock(&info->bl_mutex);
+        pmu_backlight_init_curve(0x7F, 0x46, 0x0E);
 
         level = pmu_backlight_data.max_brightness;
 
@@ -123,18 +162,16 @@ void __init pmu_backlight_init(struct device_node *in_vias)
                 pmu_request(&req, NULL, 2, 0xd9, 0);
                 pmu_wait_complete(&req);
 
-                mutex_lock(&info->bl_mutex);
-                level = pmac_backlight_curve_lookup(info,
+                level = pmu_backlight_curve_lookup(
                                 (req.reply[0] >> 4) *
                                 pmu_backlight_data.max_brightness / 15);
-                mutex_unlock(&info->bl_mutex);
         }
 
-        up(&bd->sem);
+        down(&bd->sem);
         bd->props->brightness = level;
         bd->props->power = FB_BLANK_UNBLANK;
         bd->props->update_status(bd);
-        down(&bd->sem);
+        up(&bd->sem);
 
         mutex_lock(&pmac_backlight_mutex);
         if (!pmac_backlight)
diff --git a/drivers/macintosh/via-pmu-led.c b/drivers/macintosh/via-pmu-led.c
index af8375ed0f5e..5189d5454b1f 100644
--- a/drivers/macintosh/via-pmu-led.c
+++ b/drivers/macintosh/via-pmu-led.c
@@ -74,7 +74,7 @@ static void pmu_led_set(struct led_classdev *led_cdev,
 
 static struct led_classdev pmu_led = {
         .name = "pmu-front-led",
-#ifdef CONFIG_BLK_DEV_IDE_PMAC_BLINK
+#ifdef CONFIG_ADB_PMU_LED_IDE
         .default_trigger = "ide-disk",
 #endif
         .brightness_set = pmu_led_set,
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index c1193d34ec9e..14610a63f580 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -16,7 +16,6 @@
  *    a sleep or a freq. switch
  *  - Move sleep code out of here to pmac_pm, merge into new
  *    common PM infrastructure
- *  - Move backlight code out as well
  *  - Save/Restore PCI space properly
  *
  */
@@ -60,13 +59,7 @@
 #include <asm/mmu_context.h>
 #include <asm/cputable.h>
 #include <asm/time.h>
-#ifdef CONFIG_PMAC_BACKLIGHT
 #include <asm/backlight.h>
-#endif
-
-#ifdef CONFIG_PPC32
-#include <asm/open_pic.h>
-#endif
 
 #include "via-pmu-event.h"
 
@@ -151,7 +144,7 @@ static int pmu_fully_inited = 0;
 static int pmu_has_adb;
 static struct device_node *gpio_node;
 static unsigned char __iomem *gpio_reg = NULL;
-static int gpio_irq = -1;
+static int gpio_irq = NO_IRQ;
 static int gpio_irq_enabled = -1;
 static volatile int pmu_suspended = 0;
 static spinlock_t pmu_lock;
@@ -181,10 +174,6 @@ static int query_batt_timer = BATTERY_POLLING_COUNT;
 static struct adb_request batt_req;
 static struct proc_dir_entry *proc_pmu_batt[PMU_MAX_BATTERIES];
 
-#if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
-extern int disable_kernel_backlight;
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */
-
 int __fake_sleep;
 int asleep;
 BLOCKING_NOTIFIER_HEAD(sleep_notifier_list);
@@ -403,22 +392,21 @@ static int __init pmu_init(void)
  */
 static int __init via_pmu_start(void)
 {
+        unsigned int irq;
+
         if (vias == NULL)
                 return -ENODEV;
 
         batt_req.complete = 1;
 
-#ifndef CONFIG_PPC_MERGE
-        if (pmu_kind == PMU_KEYLARGO_BASED)
-                openpic_set_irq_priority(vias->intrs[0].line,
-                                         OPENPIC_PRIORITY_DEFAULT + 1);
-#endif
-
-        if (request_irq(vias->intrs[0].line, via_pmu_interrupt, 0, "VIA-PMU",
-                        (void *)0)) {
-                printk(KERN_ERR "VIA-PMU: can't get irq %d\n",
-                       vias->intrs[0].line);
-                return -EAGAIN;
+        irq = irq_of_parse_and_map(vias, 0);
+        if (irq == NO_IRQ) {
+                printk(KERN_ERR "via-pmu: can't map interruptn");
+                return -ENODEV;
+        }
+        if (request_irq(irq, via_pmu_interrupt, 0, "VIA-PMU", (void *)0)) {
+                printk(KERN_ERR "via-pmu: can't request irq %d\n", irq);
+                return -ENODEV;
         }
 
         if (pmu_kind == PMU_KEYLARGO_BASED) {
@@ -426,10 +414,10 @@ static int __init via_pmu_start(void)
                 if (gpio_node == NULL)
                         gpio_node = of_find_node_by_name(NULL,
                                                          "pmu-interrupt");
-                if (gpio_node && gpio_node->n_intrs > 0)
-                        gpio_irq = gpio_node->intrs[0].line;
+                if (gpio_node)
+                        gpio_irq = irq_of_parse_and_map(gpio_node, 0);
 
-                if (gpio_irq != -1) {
+                if (gpio_irq != NO_IRQ) {
                         if (request_irq(gpio_irq, gpio1_interrupt, 0,
                                         "GPIO1 ADB", (void *)0))
                                 printk(KERN_ERR "pmu: can't get irq %d"
@@ -471,7 +459,7 @@ static int __init via_pmu_dev_init(void)
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         /* Initialize backlight */
-        pmu_backlight_init(vias);
+        pmu_backlight_init();
 #endif
 
 #ifdef CONFIG_PPC32
@@ -1408,11 +1396,8 @@ next:
         else if ((1 << pirq) & PMU_INT_SNDBRT) {
 #ifdef CONFIG_PMAC_BACKLIGHT
                 if (len == 3)
-#ifdef CONFIG_INPUT_ADBHID
-                        if (!disable_kernel_backlight)
-#endif /* CONFIG_INPUT_ADBHID */
-                                pmac_backlight_set_legacy_brightness(data[1] >> 4);
-#endif /* CONFIG_PMAC_BACKLIGHT */
+                        pmac_backlight_set_legacy_brightness_pmu(data[1] >> 4);
+#endif
         }
         /* Tick interrupt */
         else if ((1 << pirq) & PMU_INT_TICK) {
@@ -2010,6 +1995,8 @@ restore_via_state(void)
         out_8(&via[IER], IER_SET | SR_INT | CB1_INT);
 }
 
+extern void pmu_backlight_set_sleep(int sleep);
+
 static int
 pmac_suspend_devices(void)
 {
@@ -2047,6 +2034,11 @@ pmac_suspend_devices(void)
                 return -EBUSY;
         }
 
+#ifdef CONFIG_PMAC_BACKLIGHT
+        /* Tell backlight code not to muck around with the chip anymore */
+        pmu_backlight_set_sleep(1);
+#endif
+
         /* Call platform functions marked "on sleep" */
         pmac_pfunc_i2c_suspend();
         pmac_pfunc_base_suspend();
@@ -2105,6 +2097,11 @@ pmac_wakeup_devices(void)
 {
         mdelay(100);
 
+#ifdef CONFIG_PMAC_BACKLIGHT
+        /* Tell backlight code it can use the chip again */
+        pmu_backlight_set_sleep(0);
+#endif
+
         /* Power back up system devices (including the PIC) */
         device_power_up();
 
@@ -2419,7 +2416,7 @@ struct pmu_private {
         spinlock_t lock;
 #if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
         int     backlight_locker;
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */     
+#endif
 };
 
 static LIST_HEAD(all_pmu_pvt);
@@ -2469,7 +2466,7 @@ pmu_open(struct inode *inode, struct file *file)
         spin_lock_irqsave(&all_pvt_lock, flags);
 #if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
         pp->backlight_locker = 0;
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */     
+#endif
         list_add(&pp->list, &all_pmu_pvt);
         spin_unlock_irqrestore(&all_pvt_lock, flags);
         file->private_data = pp;
@@ -2564,13 +2561,12 @@ pmu_release(struct inode *inode, struct file *file)
                 spin_lock_irqsave(&all_pvt_lock, flags);
                 list_del(&pp->list);
                 spin_unlock_irqrestore(&all_pvt_lock, flags);
+
 #if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
-                if (pp->backlight_locker) {
-                        spin_lock_irqsave(&pmu_lock, flags);
-                        disable_kernel_backlight--;
-                        spin_unlock_irqrestore(&pmu_lock, flags);
-                }
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */
+                if (pp->backlight_locker)
+                        pmac_backlight_enable();
+#endif
+
                 kfree(pp);
         }
         unlock_kernel();
@@ -2647,18 +2643,18 @@ pmu_ioctl(struct inode * inode, struct file *filp,
 #ifdef CONFIG_INPUT_ADBHID
         case PMU_IOC_GRAB_BACKLIGHT: {
                 struct pmu_private *pp = filp->private_data;
-                unsigned long flags;
 
                 if (pp->backlight_locker)
                         return 0;
+
                 pp->backlight_locker = 1;
-                spin_lock_irqsave(&pmu_lock, flags);
-                disable_kernel_backlight++;
-                spin_unlock_irqrestore(&pmu_lock, flags);
+                pmac_backlight_disable();
+
                 return 0;
         }
 #endif /* CONFIG_INPUT_ADBHID */
 #endif /* CONFIG_PMAC_BACKLIGHT_LEGACY */
+
         case PMU_IOC_GET_MODEL:
                 return put_user(pmu_kind, argp);
         case PMU_IOC_HAS_ADB:
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 217615b33223..93f701ea87bc 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -710,6 +710,8 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
                 return -EINVAL;
         }
 
+        m->ti = ti;
+
         r = parse_features(&as, m, ti);
         if (r)
                 goto bad;
@@ -751,7 +753,6 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
         }
 
         ti->private = m;
-        m->ti = ti;
 
         return 0;
 
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index be48cedf986b..c54de989eb00 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -255,7 +255,9 @@ static struct region *__rh_alloc(struct region_hash *rh, region_t region)
         struct region *reg, *nreg;
 
         read_unlock(&rh->hash_lock);
-        nreg = mempool_alloc(rh->region_pool, GFP_NOIO);
+        nreg = mempool_alloc(rh->region_pool, GFP_ATOMIC);
+        if (unlikely(!nreg))
+                nreg = kmalloc(sizeof(struct region), GFP_NOIO);
         nreg->state = rh->log->type->in_sync(rh->log, region, 1) ?
                 RH_CLEAN : RH_NOSYNC;
         nreg->rh = rh;
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index ff83c9b5979e..b99c19c7eb22 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -162,7 +162,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
                 goto out;
         }
 
-        min_spacing = mddev->array_size;
+        min_spacing = conf->array_size;
         sector_div(min_spacing, PAGE_SIZE/sizeof(struct dev_info *));
 
         /* min_spacing is the minimum spacing that will fit the hash
@@ -171,7 +171,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
          * that is larger than min_spacing as use the size of that as
          * the actual spacing
          */
-        conf->hash_spacing = mddev->array_size;
+        conf->hash_spacing = conf->array_size;
         for (i=0; i < cnt-1 ; i++) {
                 sector_t sz = 0;
                 int j;
@@ -228,7 +228,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
         curr_offset = 0;
         i = 0;
         for (curr_offset = 0;
-             curr_offset < mddev->array_size;
+             curr_offset < conf->array_size;
              curr_offset += conf->hash_spacing) {
 
                 while (i < mddev->raid_disks-1 &&
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 2fe32c261922..8dbab2ef3885 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -110,7 +110,7 @@ static ctl_table raid_table[] = {
                 .procname       = "speed_limit_min",
                 .data           = &sysctl_speed_limit_min,
                 .maxlen         = sizeof(int),
-                .mode           = 0644,
+                .mode           = S_IRUGO|S_IWUSR,
                 .proc_handler   = &proc_dointvec,
         },
         {
@@ -118,7 +118,7 @@ static ctl_table raid_table[] = {
                 .procname       = "speed_limit_max",
                 .data           = &sysctl_speed_limit_max,
                 .maxlen         = sizeof(int),
-                .mode           = 0644,
+                .mode           = S_IRUGO|S_IWUSR,
                 .proc_handler   = &proc_dointvec,
         },
         { .ctl_name = 0 }
@@ -129,7 +129,7 @@ static ctl_table raid_dir_table[] = {
                 .ctl_name       = DEV_RAID,
                 .procname       = "raid",
                 .maxlen         = 0,
-                .mode           = 0555,
+                .mode           = S_IRUGO|S_IXUGO,
                 .child          = raid_table,
         },
         { .ctl_name = 0 }
@@ -1062,6 +1062,11 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
         if (rdev->sb_size & bmask)
                 rdev-> sb_size = (rdev->sb_size | bmask)+1;
 
+        if (sb->level == cpu_to_le32(LEVEL_MULTIPATH))
+                rdev->desc_nr = -1;
+        else
+                rdev->desc_nr = le32_to_cpu(sb->dev_number);
+
         if (refdev == 0)
                 ret = 1;
         else {
@@ -1171,7 +1176,6 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
         }
         if (mddev->level != LEVEL_MULTIPATH) {
                 int role;
-                rdev->desc_nr = le32_to_cpu(sb->dev_number);
                 role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
                 switch(role) {
                 case 0xffff: /* spare */
@@ -1404,7 +1408,7 @@ static int lock_rdev(mdk_rdev_t *rdev, dev_t dev)
         struct block_device *bdev;
         char b[BDEVNAME_SIZE];
 
-        bdev = open_by_devnum(dev, FMODE_READ|FMODE_WRITE);
+        bdev = open_partition_by_devnum(dev, FMODE_READ|FMODE_WRITE);
         if (IS_ERR(bdev)) {
                 printk(KERN_ERR "md: could not open %s.\n",
                         __bdevname(dev, b));
@@ -1414,7 +1418,7 @@ static int lock_rdev(mdk_rdev_t *rdev, dev_t dev)
         if (err) {
                 printk(KERN_ERR "md: could not bd_claim %s.\n",
                         bdevname(bdev, b));
-                blkdev_put(bdev);
+                blkdev_put_partition(bdev);
                 return err;
         }
         rdev->bdev = bdev;
@@ -1428,7 +1432,7 @@ static void unlock_rdev(mdk_rdev_t *rdev)
         if (!bdev)
                 MD_BUG();
         bd_release(bdev);
-        blkdev_put(bdev);
+        blkdev_put_partition(bdev);
 }
 
 void md_autodetect_dev(dev_t dev);
@@ -1593,6 +1597,19 @@ void md_update_sb(mddev_t * mddev)
 
 repeat:
         spin_lock_irq(&mddev->write_lock);
+
+        if (mddev->degraded && mddev->sb_dirty == 3)
+                /* If the array is degraded, then skipping spares is both
+                 * dangerous and fairly pointless.
+                 * Dangerous because a device that was removed from the array
+                 * might have a event_count that still looks up-to-date,
+                 * so it can be re-added without a resync.
+                 * Pointless because if there are any spares to skip,
+                 * then a recovery will happen and soon that array won't
+                 * be degraded any more and the spare can go back to sleep then.
+                 */
+                mddev->sb_dirty = 1;
+
         sync_req = mddev->in_sync;
         mddev->utime = get_seconds();
         if (mddev->sb_dirty == 3)
@@ -1779,8 +1796,8 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
         }
         return err ? err : len;
 }
-static struct rdev_sysfs_entry
-rdev_state = __ATTR(state, 0644, state_show, state_store);
+static struct rdev_sysfs_entry rdev_state =
+__ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
 
 static ssize_t
 super_show(mdk_rdev_t *rdev, char *page)
@@ -1811,7 +1828,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
         return -EINVAL;
 }
 static struct rdev_sysfs_entry rdev_errors =
-__ATTR(errors, 0644, errors_show, errors_store);
+__ATTR(errors, S_IRUGO|S_IWUSR, errors_show, errors_store);
 
 static ssize_t
 slot_show(mdk_rdev_t *rdev, char *page)
@@ -1845,7 +1862,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len)
 
 
 static struct rdev_sysfs_entry rdev_slot =
-__ATTR(slot, 0644, slot_show, slot_store);
+__ATTR(slot, S_IRUGO|S_IWUSR, slot_show, slot_store);
 
 static ssize_t
 offset_show(mdk_rdev_t *rdev, char *page)
@@ -1867,7 +1884,7 @@ offset_store(mdk_rdev_t *rdev, const char *buf, size_t len)
 }
 
 static struct rdev_sysfs_entry rdev_offset =
-__ATTR(offset, 0644, offset_show, offset_store);
+__ATTR(offset, S_IRUGO|S_IWUSR, offset_show, offset_store);
 
 static ssize_t
 rdev_size_show(mdk_rdev_t *rdev, char *page)
@@ -1891,7 +1908,7 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
 }
 
 static struct rdev_sysfs_entry rdev_size =
-__ATTR(size, 0644, rdev_size_show, rdev_size_store);
+__ATTR(size, S_IRUGO|S_IWUSR, rdev_size_show, rdev_size_store);
 
 static struct attribute *rdev_default_attrs[] = {
         &rdev_state.attr,
@@ -1922,6 +1939,8 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
 
         if (!entry->store)
                 return -EIO;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
         return entry->store(rdev, page, length);
 }
 
@@ -2128,7 +2147,7 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
         return len;
 }
 static struct md_sysfs_entry md_safe_delay =
-__ATTR(safe_mode_delay, 0644,safe_delay_show, safe_delay_store);
+__ATTR(safe_mode_delay, S_IRUGO|S_IWUSR,safe_delay_show, safe_delay_store);
 
 static ssize_t
 level_show(mddev_t *mddev, char *page)
@@ -2163,7 +2182,7 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
 }
 
 static struct md_sysfs_entry md_level =
-__ATTR(level, 0644, level_show, level_store);
+__ATTR(level, S_IRUGO|S_IWUSR, level_show, level_store);
 
 
 static ssize_t
@@ -2188,7 +2207,7 @@ layout_store(mddev_t *mddev, const char *buf, size_t len)
         return len;
 }
 static struct md_sysfs_entry md_layout =
-__ATTR(layout, 0655, layout_show, layout_store);
+__ATTR(layout, S_IRUGO|S_IWUSR, layout_show, layout_store);
 
 
 static ssize_t
@@ -2219,7 +2238,7 @@ raid_disks_store(mddev_t *mddev, const char *buf, size_t len)
         return rv ? rv : len;
 }
 static struct md_sysfs_entry md_raid_disks =
-__ATTR(raid_disks, 0644, raid_disks_show, raid_disks_store);
+__ATTR(raid_disks, S_IRUGO|S_IWUSR, raid_disks_show, raid_disks_store);
 
 static ssize_t
 chunk_size_show(mddev_t *mddev, char *page)
@@ -2243,7 +2262,7 @@ chunk_size_store(mddev_t *mddev, const char *buf, size_t len)
         return len;
 }
 static struct md_sysfs_entry md_chunk_size =
-__ATTR(chunk_size, 0644, chunk_size_show, chunk_size_store);
+__ATTR(chunk_size, S_IRUGO|S_IWUSR, chunk_size_show, chunk_size_store);
 
 static ssize_t
 resync_start_show(mddev_t *mddev, char *page)
@@ -2267,7 +2286,7 @@ resync_start_store(mddev_t *mddev, const char *buf, size_t len)
         return len;
 }
 static struct md_sysfs_entry md_resync_start =
-__ATTR(resync_start, 0644, resync_start_show, resync_start_store);
+__ATTR(resync_start, S_IRUGO|S_IWUSR, resync_start_show, resync_start_store);
 
 /*
  * The array state can be:
@@ -2437,7 +2456,8 @@ array_state_store(mddev_t *mddev, const char *buf, size_t len)
         else
                 return len;
 }
-static struct md_sysfs_entry md_array_state = __ATTR(array_state, 0644, array_state_show, array_state_store);
+static struct md_sysfs_entry md_array_state =
+__ATTR(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
 
 static ssize_t
 null_show(mddev_t *mddev, char *page)
@@ -2497,7 +2517,7 @@ new_dev_store(mddev_t *mddev, const char *buf, size_t len)
 }
 
 static struct md_sysfs_entry md_new_device =
-__ATTR(new_dev, 0200, null_show, new_dev_store);
+__ATTR(new_dev, S_IWUSR, null_show, new_dev_store);
 
 static ssize_t
 size_show(mddev_t *mddev, char *page)
@@ -2535,7 +2555,7 @@ size_store(mddev_t *mddev, const char *buf, size_t len)
 }
 
 static struct md_sysfs_entry md_size =
-__ATTR(component_size, 0644, size_show, size_store);
+__ATTR(component_size, S_IRUGO|S_IWUSR, size_show, size_store);
 
 
 /* Metdata version.
@@ -2583,7 +2603,7 @@ metadata_store(mddev_t *mddev, const char *buf, size_t len)
 }
 
 static struct md_sysfs_entry md_metadata =
-__ATTR(metadata_version, 0644, metadata_show, metadata_store);
+__ATTR(metadata_version, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
 
 static ssize_t
 action_show(mddev_t *mddev, char *page)
@@ -2651,12 +2671,11 @@ mismatch_cnt_show(mddev_t *mddev, char *page)
                        (unsigned long long) mddev->resync_mismatches);
 }
 
-static struct md_sysfs_entry
-md_scan_mode = __ATTR(sync_action, S_IRUGO|S_IWUSR, action_show, action_store);
+static struct md_sysfs_entry md_scan_mode =
+__ATTR(sync_action, S_IRUGO|S_IWUSR, action_show, action_store);
 
 
-static struct md_sysfs_entry
-md_mismatches = __ATTR_RO(mismatch_cnt);
+static struct md_sysfs_entry md_mismatches = __ATTR_RO(mismatch_cnt);
 
 static ssize_t
 sync_min_show(mddev_t *mddev, char *page)
@@ -2715,15 +2734,14 @@ static ssize_t
 sync_speed_show(mddev_t *mddev, char *page)
 {
         unsigned long resync, dt, db;
-        resync = (mddev->curr_resync - atomic_read(&mddev->recovery_active));
+        resync = (mddev->curr_mark_cnt - atomic_read(&mddev->recovery_active));
         dt = ((jiffies - mddev->resync_mark) / HZ);
         if (!dt) dt++;
         db = resync - (mddev->resync_mark_cnt);
         return sprintf(page, "%ld\n", db/dt/2); /* K/sec */
 }
 
-static struct md_sysfs_entry
-md_sync_speed = __ATTR_RO(sync_speed);
+static struct md_sysfs_entry md_sync_speed = __ATTR_RO(sync_speed);
 
 static ssize_t
 sync_completed_show(mddev_t *mddev, char *page)
@@ -2739,8 +2757,7 @@ sync_completed_show(mddev_t *mddev, char *page)
         return sprintf(page, "%lu / %lu\n", resync, max_blocks);
 }
 
-static struct md_sysfs_entry
-md_sync_completed = __ATTR_RO(sync_completed);
+static struct md_sysfs_entry md_sync_completed = __ATTR_RO(sync_completed);
 
 static ssize_t
 suspend_lo_show(mddev_t *mddev, char *page)
@@ -2857,6 +2874,8 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
 
         if (!entry->store)
                 return -EIO;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
         rv = mddev_lock(mddev);
         if (!rv) {
                 rv = entry->store(mddev, page, length);
@@ -3091,7 +3110,6 @@ static int do_md_run(mddev_t * mddev)
                 }
         
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-        md_wakeup_thread(mddev->thread);
         
         if (mddev->sb_dirty)
                 md_update_sb(mddev);
@@ -3112,7 +3130,7 @@ static int do_md_run(mddev_t * mddev)
          * start recovery here.  If we leave it to md_check_recovery,
          * it will remove the drives and not do the right thing
          */
-        if (mddev->degraded) {
+        if (mddev->degraded && !mddev->sync_thread) {
                 struct list_head *rtmp;
                 int spares = 0;
                 ITERATE_RDEV(mddev,rdev,rtmp)
@@ -3133,10 +3151,11 @@ static int do_md_run(mddev_t * mddev)
                                        mdname(mddev));
                                 /* leave the spares where they are, it shouldn't hurt */
                                 mddev->recovery = 0;
-                        } else
-                                md_wakeup_thread(mddev->sync_thread);
+                        }
                 }
         }
+        md_wakeup_thread(mddev->thread);
+        md_wakeup_thread(mddev->sync_thread); /* possibly kick off a reshape */
 
         mddev->changed = 1;
         md_new_event(mddev);
@@ -4586,6 +4605,8 @@ void md_error(mddev_t *mddev, mdk_rdev_t *rdev)
                 __builtin_return_address(0),__builtin_return_address(1),
                 __builtin_return_address(2),__builtin_return_address(3));
 */
+        if (!mddev->pers)
+                return;
         if (!mddev->pers->error_handler)
                 return;
         mddev->pers->error_handler(mddev,rdev);
@@ -4683,12 +4704,13 @@ static void status_resync(struct seq_file *seq, mddev_t * mddev)
          */
         dt = ((jiffies - mddev->resync_mark) / HZ);
         if (!dt) dt++;
-        db = resync - (mddev->resync_mark_cnt/2);
-        rt = (dt * ((unsigned long)(max_blocks-resync) / (db/100+1)))/100;
+        db = (mddev->curr_mark_cnt - atomic_read(&mddev->recovery_active))
+                - mddev->resync_mark_cnt;
+        rt = (dt * ((unsigned long)(max_blocks-resync) / (db/2/100+1)))/100;
 
         seq_printf(seq, " finish=%lu.%lumin", rt / 60, (rt % 60)/6);
 
-        seq_printf(seq, " speed=%ldK/sec", db/dt);
+        seq_printf(seq, " speed=%ldK/sec", db/2/dt);
 }
 
 static void *md_seq_start(struct seq_file *seq, loff_t *pos)
@@ -5199,6 +5221,7 @@ void md_do_sync(mddev_t *mddev)
 
                 j += sectors;
                 if (j>1) mddev->curr_resync = j;
+                mddev->curr_mark_cnt = io_sectors;
                 if (last_check == 0)
                         /* this is the earliers that rebuilt will be
                          * visible in /proc/mdstat
@@ -5645,8 +5668,8 @@ static int set_ro(const char *val, struct kernel_param *kp)
         return -EINVAL;
 }
 
-module_param_call(start_ro, set_ro, get_ro, NULL, 0600);
-module_param(start_dirty_degraded, int, 0644);
+module_param_call(start_ro, set_ro, get_ro, NULL, S_IRUSR|S_IWUSR);
+module_param(start_dirty_degraded, int, S_IRUGO|S_IWUSR);
 
 
 EXPORT_SYMBOL(register_md_personality);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index cead918578a7..3b4d69c05623 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -930,10 +930,13 @@ static void status(struct seq_file *seq, mddev_t *mddev)
 
         seq_printf(seq, " [%d/%d] [", conf->raid_disks,
                                                 conf->working_disks);
-        for (i = 0; i < conf->raid_disks; i++)
+        rcu_read_lock();
+        for (i = 0; i < conf->raid_disks; i++) {
+                mdk_rdev_t *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 seq_printf(seq, "%s",
-                              conf->mirrors[i].rdev &&
-                              test_bit(In_sync, &conf->mirrors[i].rdev->flags) ? "U" : "_");
+                           rdev && test_bit(In_sync, &rdev->flags) ? "U" : "_");
+        }
+        rcu_read_unlock();
         seq_printf(seq, "]");
 }
 
@@ -975,7 +978,6 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
 static void print_conf(conf_t *conf)
 {
         int i;
-        mirror_info_t *tmp;
 
         printk("RAID1 conf printout:\n");
         if (!conf) {
@@ -985,14 +987,17 @@ static void print_conf(conf_t *conf)
         printk(" --- wd:%d rd:%d\n", conf->working_disks,
                 conf->raid_disks);
 
+        rcu_read_lock();
         for (i = 0; i < conf->raid_disks; i++) {
                 char b[BDEVNAME_SIZE];
-                tmp = conf->mirrors + i;
-                if (tmp->rdev)
+                mdk_rdev_t *rdev = rcu_dereference(conf->mirrors[i].rdev);
+                if (rdev)
                         printk(" disk %d, wo:%d, o:%d, dev:%s\n",
-                                i, !test_bit(In_sync, &tmp->rdev->flags), !test_bit(Faulty, &tmp->rdev->flags),
-                                bdevname(tmp->rdev->bdev,b));
+                               i, !test_bit(In_sync, &rdev->flags),
+                               !test_bit(Faulty, &rdev->flags),
+                               bdevname(rdev->bdev,b));
         }
+        rcu_read_unlock();
 }
 
 static void close_sync(conf_t *conf)
@@ -1008,20 +1013,20 @@ static int raid1_spare_active(mddev_t *mddev)
 {
         int i;
         conf_t *conf = mddev->private;
-        mirror_info_t *tmp;
 
         /*
          * Find all failed disks within the RAID1 configuration 
-         * and mark them readable
+         * and mark them readable.
+         * Called under mddev lock, so rcu protection not needed.
          */
         for (i = 0; i < conf->raid_disks; i++) {
-                tmp = conf->mirrors + i;
-                if (tmp->rdev 
-                    && !test_bit(Faulty, &tmp->rdev->flags)
-                    && !test_bit(In_sync, &tmp->rdev->flags)) {
+                mdk_rdev_t *rdev = conf->mirrors[i].rdev;
+                if (rdev
+                    && !test_bit(Faulty, &rdev->flags)
+                    && !test_bit(In_sync, &rdev->flags)) {
                         conf->working_disks++;
                         mddev->degraded--;
-                        set_bit(In_sync, &tmp->rdev->flags);
+                        set_bit(In_sync, &rdev->flags);
                 }
         }
 
@@ -1145,7 +1150,7 @@ static int end_sync_write(struct bio *bio, unsigned int bytes_done, int error)
                 long sectors_to_go = r1_bio->sectors;
                 /* make sure these bits doesn't get cleared. */
                 do {
-                        bitmap_end_sync(mddev->bitmap, r1_bio->sector,
+                        bitmap_end_sync(mddev->bitmap, s,
                                         &sync_blocks, 1);
                         s += sync_blocks;
                         sectors_to_go -= sync_blocks;
@@ -1237,7 +1242,7 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                 /* ouch - failed to read all of that.
                  * Try some synchronous reads of other devices to get
                  * good data, much like with normal read errors.  Only
-                 * read into the pages we already have so they we don't
+                 * read into the pages we already have so we don't
                  * need to re-issue the read request.
                  * We don't need to freeze the array, because being in an
                  * active sync request, there is no normal IO, and
@@ -1257,6 +1262,10 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                                 s = PAGE_SIZE >> 9;
                         do {
                                 if (r1_bio->bios[d]->bi_end_io == end_sync_read) {
+                                        /* No rcu protection needed here devices
+                                         * can only be removed when no resync is
+                                         * active, and resync is currently active
+                                         */
                                         rdev = conf->mirrors[d].rdev;
                                         if (sync_page_io(rdev->bdev,
                                                          sect + rdev->data_offset,
@@ -1463,6 +1472,11 @@ static void raid1d(mddev_t *mddev)
                                         s = PAGE_SIZE >> 9;
 
                                 do {
+                                        /* Note: no rcu protection needed here
+                                         * as this is synchronous in the raid1d thread
+                                         * which is the thread that might remove
+                                         * a device.  If raid1d ever becomes multi-threaded....
+                                         */
                                         rdev = conf->mirrors[d].rdev;
                                         if (rdev &&
                                             test_bit(In_sync, &rdev->flags) &&
@@ -1486,7 +1500,6 @@ static void raid1d(mddev_t *mddev)
                                                         d = conf->raid_disks;
                                                 d--;
                                                 rdev = conf->mirrors[d].rdev;
-                                                atomic_add(s, &rdev->corrected_errors);
                                                 if (rdev &&
                                                     test_bit(In_sync, &rdev->flags)) {
                                                         if (sync_page_io(rdev->bdev,
@@ -1509,6 +1522,11 @@ static void raid1d(mddev_t *mddev)
                                                                          s<<9, conf->tmppage, READ) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
+                                                        else {
+                                                                atomic_add(s, &rdev->corrected_errors);
+                                                                printk(KERN_INFO "raid1:%s: read error corrected (%d sectors at %llu on %s)\n",
+                                                                       mdname(mddev), s, (unsigned long long)(sect + rdev->data_offset), bdevname(rdev->bdev, b));
+                                                        }
                                                 }
                                         }
                                 } else {
@@ -1622,15 +1640,16 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 return 0;
         }
 
-        /* before building a request, check if we can skip these blocks..
-         * This call the bitmap_start_sync doesn't actually record anything
-         */
         if (mddev->bitmap == NULL &&
             mddev->recovery_cp == MaxSector &&
+            !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
             conf->fullsync == 0) {
                 *skipped = 1;
                 return max_sector - sector_nr;
         }
+        /* before building a request, check if we can skip these blocks..
+         * This call the bitmap_start_sync doesn't actually record anything
+         */
         if (!bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, 1) &&
             !conf->fullsync && !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                 /* We can skip this block, and probably several more */
@@ -1783,19 +1802,17 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 for (i=0; i<conf->raid_disks; i++) {
                         bio = r1_bio->bios[i];
                         if (bio->bi_end_io == end_sync_read) {
-                                md_sync_acct(conf->mirrors[i].rdev->bdev, nr_sectors);
+                                md_sync_acct(bio->bi_bdev, nr_sectors);
                                 generic_make_request(bio);
                         }
                 }
         } else {
                 atomic_set(&r1_bio->remaining, 1);
                 bio = r1_bio->bios[r1_bio->read_disk];
-                md_sync_acct(conf->mirrors[r1_bio->read_disk].rdev->bdev,
-                             nr_sectors);
+                md_sync_acct(bio->bi_bdev, nr_sectors);
                 generic_make_request(bio);
 
         }
-
         return nr_sectors;
 }
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 7f636283a1ba..016ddb831c9b 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1492,6 +1492,10 @@ static void raid10d(mddev_t *mddev)
                                                                          s<<9, conf->tmppage, READ) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
+                                                        else
+                                                                printk(KERN_INFO "raid10:%s: read error corrected (%d sectors at %llu on %s)\n",
+                                                                       mdname(mddev), s, (unsigned long long)(sect+rdev->data_offset), bdevname(rdev->bdev, b));
+
                                                         rdev_dec_pending(rdev, mddev);
                                                         rcu_read_lock();
                                                 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 7433871f4b3a..450066007160 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -18,6 +18,30 @@
  * Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+/*
+ * BITMAP UNPLUGGING:
+ *
+ * The sequencing for updating the bitmap reliably is a little
+ * subtle (and I got it wrong the first time) so it deserves some
+ * explanation.
+ *
+ * We group bitmap updates into batches.  Each batch has a number.
+ * We may write out several batches at once, but that isn't very important.
+ * conf->bm_write is the number of the last batch successfully written.
+ * conf->bm_flush is the number of the last batch that was closed to
+ *    new additions.
+ * When we discover that we will need to write to any block in a stripe
+ * (in add_stripe_bio) we update the in-memory bitmap and record in sh->bm_seq
+ * the number of the batch it will be in. This is bm_flush+1.
+ * When we are ready to do a write, if that batch hasn't been written yet,
+ *   we plug the array and queue the stripe for later.
+ * When an unplug happens, we increment bm_flush, thus closing the current
+ *   batch.
+ * When we notice that bm_flush > bm_write, we write out all pending updates
+ * to the bitmap, and advance bm_write to where bm_flush was.
+ * This may occasionally write a bit out twice, but is sure never to
+ * miss any bits.
+ */
 
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -88,12 +112,14 @@ static void __release_stripe(raid5_conf_t *conf, struct stripe_head *sh)
                 BUG_ON(!list_empty(&sh->lru));
                 BUG_ON(atomic_read(&conf->active_stripes)==0);
                 if (test_bit(STRIPE_HANDLE, &sh->state)) {
-                        if (test_bit(STRIPE_DELAYED, &sh->state))
+                        if (test_bit(STRIPE_DELAYED, &sh->state)) {
                                 list_add_tail(&sh->lru, &conf->delayed_list);
-                        else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
-                                 conf->seq_write == sh->bm_seq)
+                                blk_plug_device(conf->mddev->queue);
+                        } else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
+                                   sh->bm_seq - conf->seq_write > 0) {
                                 list_add_tail(&sh->lru, &conf->bitmap_list);
-                        else {
+                                blk_plug_device(conf->mddev->queue);
+                        } else {
                                 clear_bit(STRIPE_BIT_DELAY, &sh->state);
                                 list_add_tail(&sh->lru, &conf->handle_list);
                         }
@@ -270,7 +296,7 @@ static struct stripe_head *get_active_stripe(raid5_conf_t *conf, sector_t sector
                                                      < (conf->max_nr_stripes *3/4)
                                                      || !conf->inactive_blocked),
                                                     conf->device_lock,
-                                                    unplug_slaves(conf->mddev)
+                                                    raid5_unplug_device(conf->mddev->queue)
                                         );
                                 conf->inactive_blocked = 0;
                         } else
@@ -281,7 +307,8 @@ static struct stripe_head *get_active_stripe(raid5_conf_t *conf, sector_t sector
                         } else {
                                 if (!test_bit(STRIPE_HANDLE, &sh->state))
                                         atomic_inc(&conf->active_stripes);
-                                if (list_empty(&sh->lru))
+                                if (list_empty(&sh->lru) &&
+                                    !test_bit(STRIPE_EXPANDING, &sh->state))
                                         BUG();
                                 list_del_init(&sh->lru);
                         }
@@ -496,6 +523,8 @@ static int raid5_end_read_request(struct bio * bi, unsigned int bytes_done,
         raid5_conf_t *conf = sh->raid_conf;
         int disks = sh->disks, i;
         int uptodate = test_bit(BIO_UPTODATE, &bi->bi_flags);
+        char b[BDEVNAME_SIZE];
+        mdk_rdev_t *rdev;
 
         if (bi->bi_size)
                 return 1;
@@ -543,25 +572,39 @@ static int raid5_end_read_request(struct bio * bi, unsigned int bytes_done,
                 set_bit(R5_UPTODATE, &sh->dev[i].flags);
 #endif
                 if (test_bit(R5_ReadError, &sh->dev[i].flags)) {
-                        printk(KERN_INFO "raid5: read error corrected!!\n");
+                        rdev = conf->disks[i].rdev;
+                        printk(KERN_INFO "raid5:%s: read error corrected (%lu sectors at %llu on %s)\n",
+                               mdname(conf->mddev), STRIPE_SECTORS,
+                               (unsigned long long)sh->sector + rdev->data_offset,
+                               bdevname(rdev->bdev, b));
                         clear_bit(R5_ReadError, &sh->dev[i].flags);
                         clear_bit(R5_ReWrite, &sh->dev[i].flags);
                 }
                 if (atomic_read(&conf->disks[i].rdev->read_errors))
                         atomic_set(&conf->disks[i].rdev->read_errors, 0);
         } else {
+                const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
                 int retry = 0;
+                rdev = conf->disks[i].rdev;
+
                 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
-                atomic_inc(&conf->disks[i].rdev->read_errors);
+                atomic_inc(&rdev->read_errors);
                 if (conf->mddev->degraded)
-                        printk(KERN_WARNING "raid5: read error not correctable.\n");
+                        printk(KERN_WARNING "raid5:%s: read error not correctable (sector %llu on %s).\n",
+                               mdname(conf->mddev),
+                               (unsigned long long)sh->sector + rdev->data_offset,
+                               bdn);
                 else if (test_bit(R5_ReWrite, &sh->dev[i].flags))
                         /* Oh, no!!! */
-                        printk(KERN_WARNING "raid5: read error NOT corrected!!\n");
-                else if (atomic_read(&conf->disks[i].rdev->read_errors)
+                        printk(KERN_WARNING "raid5:%s: read error NOT corrected!! (sector %llu on %s).\n",
+                               mdname(conf->mddev),
+                               (unsigned long long)sh->sector + rdev->data_offset,
+                               bdn);
+                else if (atomic_read(&rdev->read_errors)
                          > conf->max_nr_stripes)
                         printk(KERN_WARNING
-                               "raid5: Too many read errors, failing device.\n");
+                               "raid5:%s: Too many read errors, failing device %s.\n",
+                               mdname(conf->mddev), bdn);
                 else
                         retry = 1;
                 if (retry)
@@ -569,7 +612,7 @@ static int raid5_end_read_request(struct bio * bi, unsigned int bytes_done,
                 else {
                         clear_bit(R5_ReadError, &sh->dev[i].flags);
                         clear_bit(R5_ReWrite, &sh->dev[i].flags);
-                        md_error(conf->mddev, conf->disks[i].rdev);
+                        md_error(conf->mddev, rdev);
                 }
         }
         rdev_dec_pending(conf->disks[i].rdev, conf->mddev);
@@ -1270,9 +1313,9 @@ static int add_stripe_bio(struct stripe_head *sh, struct bio *bi, int dd_idx, in
                 (unsigned long long)sh->sector, dd_idx);
 
         if (conf->mddev->bitmap && firstwrite) {
-                sh->bm_seq = conf->seq_write;
                 bitmap_startwrite(conf->mddev->bitmap, sh->sector,
                                   STRIPE_SECTORS, 0);
+                sh->bm_seq = conf->seq_flush+1;
                 set_bit(STRIPE_BIT_DELAY, &sh->state);
         }
 
@@ -2554,13 +2597,6 @@ static int raid5_issue_flush(request_queue_t *q, struct gendisk *disk,
         return ret;
 }
 
-static inline void raid5_plug_device(raid5_conf_t *conf)
-{
-        spin_lock_irq(&conf->device_lock);
-        blk_plug_device(conf->mddev->queue);
-        spin_unlock_irq(&conf->device_lock);
-}
-
 static int make_request(request_queue_t *q, struct bio * bi)
 {
         mddev_t *mddev = q->queuedata;
@@ -2670,7 +2706,6 @@ static int make_request(request_queue_t *q, struct bio * bi)
                                 goto retry;
                         }
                         finish_wait(&conf->wait_for_overlap, &w);
-                        raid5_plug_device(conf);
                         handle_stripe(sh, NULL);
                         release_stripe(sh);
                 } else {
@@ -2923,7 +2958,7 @@ static void raid5d (mddev_t *mddev)
         while (1) {
                 struct list_head *first;
 
-                if (conf->seq_flush - conf->seq_write > 0) {
+                if (conf->seq_flush != conf->seq_write) {
                         int seq = conf->seq_flush;
                         spin_unlock_irq(&conf->device_lock);
                         bitmap_unplug(mddev->bitmap);
@@ -3246,9 +3281,6 @@ static int run(mddev_t *mddev)
                 set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
                 mddev->sync_thread = md_register_thread(md_do_sync, mddev,
                                                         "%s_reshape");
-                /* FIXME if md_register_thread fails?? */
-                md_wakeup_thread(mddev->sync_thread);
-
         }
 
         /* read-ahead size must cover two whole stripes, which is
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index ef52e6da01ed..ed4aa4e7912c 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -53,7 +53,7 @@ config VIDEO_V4L1_COMPAT
           If you are unsure as to whether this is required, answer Y.
 
 config VIDEO_V4L2
-        tristate
+        bool
         default y
 
 source "drivers/media/video/Kconfig"
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 8393d472d3b8..7e0cedc557df 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -1190,6 +1190,7 @@ int saa7146_video_do_ioctl(struct inode *inode, struct file *file, unsigned int
                 }
                 return err;
         }
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGMBUF:
         {
                 struct video_mbuf *mbuf = arg;
@@ -1218,6 +1219,7 @@ int saa7146_video_do_ioctl(struct inode *inode, struct file *file, unsigned int
                 mutex_unlock(&q->lock);
                 return 0;
         }
+#endif
         default:
                 return v4l_compat_translate_ioctl(inode,file,cmd,arg,
                                                   saa7146_video_do_ioctl);
diff --git a/drivers/media/dvb/b2c2/Kconfig b/drivers/media/dvb/b2c2/Kconfig
index d7f1fd5b7b02..49a06fc54c51 100644
--- a/drivers/media/dvb/b2c2/Kconfig
+++ b/drivers/media/dvb/b2c2/Kconfig
@@ -1,6 +1,7 @@
 config DVB_B2C2_FLEXCOP
         tristate "Technisat/B2C2 FlexCopII(b) and FlexCopIII adapters"
         depends on DVB_CORE && I2C
+        select DVB_PLL
         select DVB_STV0299
         select DVB_MT352
         select DVB_MT312
diff --git a/drivers/media/dvb/bt8xx/Kconfig b/drivers/media/dvb/bt8xx/Kconfig
index f394002118f8..7d0ee1ab2903 100644
--- a/drivers/media/dvb/bt8xx/Kconfig
+++ b/drivers/media/dvb/bt8xx/Kconfig
@@ -1,6 +1,7 @@
 config DVB_BT8XX
         tristate "BT8xx based PCI cards"
         depends on DVB_CORE && PCI && I2C && VIDEO_BT848
+        select DVB_PLL
         select DVB_MT352
         select DVB_SP887X
         select DVB_NXT6000
diff --git a/drivers/media/dvb/bt8xx/dst.c b/drivers/media/dvb/bt8xx/dst.c
index d687a14ec0a7..06ac899a9a26 100644
--- a/drivers/media/dvb/bt8xx/dst.c
+++ b/drivers/media/dvb/bt8xx/dst.c
@@ -393,7 +393,7 @@ static int dst_set_bandwidth(struct dst_state *state, fe_bandwidth_t bandwidth)
         state->bandwidth = bandwidth;
 
         if (state->dst_type != DST_TYPE_IS_TERR)
-                return 0;
+                return -EOPNOTSUPP;
 
         switch (bandwidth) {
         case BANDWIDTH_6_MHZ:
@@ -462,7 +462,7 @@ static int dst_set_symbolrate(struct dst_state *state, u32 srate)
 
         state->symbol_rate = srate;
         if (state->dst_type == DST_TYPE_IS_TERR) {
-                return 0;
+                return -EOPNOTSUPP;
         }
         dprintk(verbose, DST_INFO, 1, "set symrate %u", srate);
         srate /= 1000;
@@ -504,7 +504,7 @@ static int dst_set_symbolrate(struct dst_state *state, u32 srate)
 static int dst_set_modulation(struct dst_state *state, fe_modulation_t modulation)
 {
         if (state->dst_type != DST_TYPE_IS_CABLE)
-                return 0;
+                return -EOPNOTSUPP;
 
         state->modulation = modulation;
         switch (modulation) {
@@ -1234,7 +1234,7 @@ int dst_command(struct dst_state *state, u8 *data, u8 len)
                 goto error;
         }
         if (write_dst(state, data, len)) {
-                dprintk(verbose, DST_INFO, 1, "Tring to recover.. ");
+                dprintk(verbose, DST_INFO, 1, "Trying to recover.. ");
                 if ((dst_error_recovery(state)) < 0) {
                         dprintk(verbose, DST_ERROR, 1, "Recovery Failed.");
                         goto error;
@@ -1328,15 +1328,13 @@ static int dst_tone_power_cmd(struct dst_state *state)
 {
         u8 paket[8] = { 0x00, 0x09, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00 };
 
-        if (state->dst_type == DST_TYPE_IS_TERR)
-                return 0;
+        if (state->dst_type != DST_TYPE_IS_SAT)
+                return -EOPNOTSUPP;
         paket[4] = state->tx_tuna[4];
         paket[2] = state->tx_tuna[2];
         paket[3] = state->tx_tuna[3];
         paket[7] = dst_check_sum (paket, 7);
-        dst_command(state, paket, 8);
-
-        return 0;
+        return dst_command(state, paket, 8);
 }
 
 static int dst_get_tuna(struct dst_state *state)
@@ -1465,7 +1463,7 @@ static int dst_set_diseqc(struct dvb_frontend *fe, struct dvb_diseqc_master_cmd
         u8 paket[8] = { 0x00, 0x08, 0x04, 0xe0, 0x10, 0x38, 0xf0, 0xec };
 
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
         if (cmd->msg_len > 0 && cmd->msg_len < 5)
                 memcpy(&paket[3], cmd->msg, cmd->msg_len);
         else if (cmd->msg_len == 5 && state->dst_hw_cap & DST_TYPE_HAS_DISEQC5)
@@ -1473,18 +1471,17 @@ static int dst_set_diseqc(struct dvb_frontend *fe, struct dvb_diseqc_master_cmd
         else
                 return -EINVAL;
         paket[7] = dst_check_sum(&paket[0], 7);
-        dst_command(state, paket, 8);
-        return 0;
+        return dst_command(state, paket, 8);
 }
 
 static int dst_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
 {
-        int need_cmd;
+        int need_cmd, retval = 0;
         struct dst_state *state = fe->demodulator_priv;
 
         state->voltage = voltage;
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
 
         need_cmd = 0;
 
@@ -1506,9 +1503,9 @@ static int dst_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
         }
 
         if (need_cmd)
-                dst_tone_power_cmd(state);
+                retval = dst_tone_power_cmd(state);
 
-        return 0;
+        return retval;
 }
 
 static int dst_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
@@ -1517,7 +1514,7 @@ static int dst_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
 
         state->tone = tone;
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
 
         switch (tone) {
         case SEC_TONE_OFF:
@@ -1533,9 +1530,7 @@ static int dst_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
         default:
                 return -EINVAL;
         }
-        dst_tone_power_cmd(state);
-
-        return 0;
+        return dst_tone_power_cmd(state);
 }
 
 static int dst_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t minicmd)
@@ -1543,7 +1538,7 @@ static int dst_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t minicmd)
         struct dst_state *state = fe->demodulator_priv;
 
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
         state->minicmd = minicmd;
         switch (minicmd) {
         case SEC_MINI_A:
@@ -1553,9 +1548,7 @@ static int dst_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t minicmd)
                 state->tx_tuna[3] = 0xff;
                 break;
         }
-        dst_tone_power_cmd(state);
-
-        return 0;
+        return dst_tone_power_cmd(state);
 }
 
 
@@ -1608,28 +1601,31 @@ static int dst_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
 {
         struct dst_state *state = fe->demodulator_priv;
 
-        dst_get_signal(state);
+        int retval = dst_get_signal(state);
         *strength = state->decode_strength;
 
-        return 0;
+        return retval;
 }
 
 static int dst_read_snr(struct dvb_frontend *fe, u16 *snr)
 {
         struct dst_state *state = fe->demodulator_priv;
 
-        dst_get_signal(state);
+        int retval = dst_get_signal(state);
         *snr = state->decode_snr;
 
-        return 0;
+        return retval;
 }
 
 static int dst_set_frontend(struct dvb_frontend *fe, struct dvb_frontend_parameters *p)
 {
+        int retval = -EINVAL;
         struct dst_state *state = fe->demodulator_priv;
 
         if (p != NULL) {
-                dst_set_freq(state, p->frequency);
+                retval = dst_set_freq(state, p->frequency);
+                if(retval != 0)
+                        return retval;
                 dprintk(verbose, DST_DEBUG, 1, "Set Frequency=[%d]", p->frequency);
 
                 if (state->dst_type == DST_TYPE_IS_SAT) {
@@ -1647,10 +1643,10 @@ static int dst_set_frontend(struct dvb_frontend *fe, struct dvb_frontend_paramet
                         dst_set_symbolrate(state, p->u.qam.symbol_rate);
                         dst_set_modulation(state, p->u.qam.modulation);
                 }
-                dst_write_tuna(fe);
+                retval = dst_write_tuna(fe);
         }
 
-        return 0;
+        return retval;
 }
 
 static int dst_tune_frontend(struct dvb_frontend* fe,
diff --git a/drivers/media/dvb/dvb-core/Makefile b/drivers/media/dvb/dvb-core/Makefile
index 11054657fdb5..0b5182835cc8 100644
--- a/drivers/media/dvb/dvb-core/Makefile
+++ b/drivers/media/dvb/dvb-core/Makefile
@@ -2,8 +2,8 @@
 # Makefile for the kernel DVB device drivers.
 #
 
-dvb-core-objs = dvbdev.o dmxdev.o dvb_demux.o dvb_filter.o      \
-                dvb_ca_en50221.o dvb_frontend.o                 \
-                dvb_net.o dvb_ringbuffer.o dvb_math.o
+dvb-core-objs := dvbdev.o dmxdev.o dvb_demux.o dvb_filter.o     \
+                 dvb_ca_en50221.o dvb_frontend.o                \
+                 dvb_net.o dvb_ringbuffer.o dvb_math.o
 
 obj-$(CONFIG_DVB_CORE) += dvb-core.o
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 59ac35ddd51e..57b34cda99f5 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -526,7 +526,9 @@ static int dvb_frontend_thread(void *data)
         fepriv->delay = 3*HZ;
         fepriv->status = 0;
         fepriv->wakeup = 0;
-        fepriv->reinitialise = 1;
+        fepriv->reinitialise = 0;
+
+        dvb_frontend_init(fe);
 
         while (1) {
                 up(&fepriv->sem);           /* is locked when we enter the thread... */
@@ -1013,17 +1015,18 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
                 return ret;
 
         if ((file->f_flags & O_ACCMODE) != O_RDONLY) {
+
+                /* normal tune mode when opened R/W */
+                fepriv->tune_mode_flags &= ~FE_TUNE_MODE_ONESHOT;
+                fepriv->tone = -1;
+                fepriv->voltage = -1;
+
                 ret = dvb_frontend_start (fe);
                 if (ret)
                         dvb_generic_release (inode, file);
 
                 /*  empty event queue */
                 fepriv->events.eventr = fepriv->events.eventw = 0;
-
-                /* normal tune mode when opened R/W */
-                fepriv->tune_mode_flags &= ~FE_TUNE_MODE_ONESHOT;
-                fepriv->tone = -1;
-                fepriv->voltage = -1;
         }
 
         return ret;
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 3bc6722a6443..75824b77198a 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -2,6 +2,7 @@ config DVB_USB
         tristate "Support for various USB DVB devices"
         depends on DVB_CORE && USB && I2C
         select FW_LOADER
+        select DVB_PLL
         help
           By enabling this you will be able to choose the various supported
           USB1.1 and USB2.0 DVB devices.
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index 0ef361f0309b..db978555b1eb 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -6,43 +6,43 @@ comment "DVB-S (satellite) frontends"
 
 config DVB_STV0299
         tristate "ST STV0299 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
 config DVB_CX24110
         tristate "Conexant CX24110 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
 config DVB_CX24123
         tristate "Conexant CX24123 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
 config DVB_TDA8083
         tristate "Philips TDA8083 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
 config DVB_MT312
         tristate "Zarlink VP310/MT312 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
 config DVB_VES1X93
         tristate "VLSI VES1893 or VES1993 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
 config DVB_S5H1420
         tristate "Samsung S5H1420 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
@@ -51,7 +51,7 @@ comment "DVB-T (terrestrial) frontends"
 
 config DVB_SP8870
         tristate "Spase sp8870 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
@@ -63,7 +63,7 @@ config DVB_SP8870
 
 config DVB_SP887X
         tristate "Spase sp887x based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
@@ -75,25 +75,25 @@ config DVB_SP887X
 
 config DVB_CX22700
         tristate "Conexant CX22700 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
 
 config DVB_CX22702
         tristate "Conexant cx22702 demodulator (OFDM)"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
 
 config DVB_L64781
         tristate "LSI L64781"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
 
 config DVB_TDA1004X
         tristate "Philips TDA10045H/TDA10046H based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
@@ -106,32 +106,32 @@ config DVB_TDA1004X
 
 config DVB_NXT6000
         tristate "NxtWave Communications NXT6000 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
 
 config DVB_MT352
         tristate "Zarlink MT352 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
 
 config DVB_ZL10353
         tristate "Zarlink ZL10353 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Say Y when you want to support this frontend.
 
 config DVB_DIB3000MB
         tristate "DiBcom 3000M-B"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Designed for mobile usage. Say Y when you want
           to support this frontend.
 
 config DVB_DIB3000MC
         tristate "DiBcom 3000P/M-C"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-T tuner module. Designed for mobile usage. Say Y when you want
           to support this frontend.
@@ -141,19 +141,19 @@ comment "DVB-C (cable) frontends"
 
 config DVB_VES1820
         tristate "VLSI VES1820 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-C tuner module. Say Y when you want to support this frontend.
 
 config DVB_TDA10021
         tristate "Philips TDA10021 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-C tuner module. Say Y when you want to support this frontend.
 
 config DVB_STV0297
         tristate "ST STV0297 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           A DVB-C tuner module. Say Y when you want to support this frontend.
 
@@ -162,7 +162,7 @@ comment "ATSC (North American/Korean Terrestrial/Cable DTV) frontends"
 
 config DVB_NXT200X
         tristate "NxtWave Communications NXT2002/NXT2004 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
@@ -176,7 +176,7 @@ config DVB_NXT200X
 
 config DVB_OR51211
         tristate "Oren OR51211 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           An ATSC 8VSB tuner module. Say Y when you want to support this frontend.
@@ -188,7 +188,7 @@ config DVB_OR51211
 
 config DVB_OR51132
         tristate "Oren OR51132 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
@@ -203,7 +203,7 @@ config DVB_OR51132
 
 config DVB_BCM3510
         tristate "Broadcom BCM3510"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         select FW_LOADER
         help
           An ATSC 8VSB/16VSB and QAM64/256 tuner module. Say Y when you want to
@@ -211,7 +211,7 @@ config DVB_BCM3510
 
 config DVB_LGDT330X
         tristate "LG Electronics LGDT3302/LGDT3303 based"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
           to support this frontend.
@@ -220,15 +220,19 @@ config DVB_LGDT330X
 comment "Miscellaneous devices"
         depends on DVB_CORE
 
+config DVB_PLL
+        tristate
+        depends on DVB_CORE && I2C
+
 config DVB_LNBP21
         tristate "LNBP21 SEC controller"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           An SEC control chip.
 
 config DVB_ISL6421
         tristate "ISL6421 SEC controller"
-        depends on DVB_CORE
+        depends on DVB_CORE && I2C
         help
           An SEC control chip.
 
diff --git a/drivers/media/dvb/frontends/Makefile b/drivers/media/dvb/frontends/Makefile
index 5222245c7f59..0e4880b6db14 100644
--- a/drivers/media/dvb/frontends/Makefile
+++ b/drivers/media/dvb/frontends/Makefile
@@ -4,7 +4,7 @@
 
 EXTRA_CFLAGS = -Idrivers/media/dvb/dvb-core/
 
-obj-$(CONFIG_DVB_CORE) += dvb-pll.o
+obj-$(CONFIG_DVB_PLL) += dvb-pll.o
 obj-$(CONFIG_DVB_STV0299) += stv0299.o
 obj-$(CONFIG_DVB_SP8870) += sp8870.o
 obj-$(CONFIG_DVB_CX22700) += cx22700.o
diff --git a/drivers/media/dvb/frontends/dvb-pll.c b/drivers/media/dvb/frontends/dvb-pll.c
index a189683454b7..2be33f27c69f 100644
--- a/drivers/media/dvb/frontends/dvb-pll.c
+++ b/drivers/media/dvb/frontends/dvb-pll.c
@@ -194,11 +194,11 @@ struct dvb_pll_desc dvb_pll_tda665x = {
                 {  253834000, 36249333, 166667, 0xca, 0x62 /* 011 0 0 0  10 */ },
                 {  383834000, 36249333, 166667, 0xca, 0xa2 /* 101 0 0 0  10 */ },
                 {  443834000, 36249333, 166667, 0xca, 0xc2 /* 110 0 0 0  10 */ },
-                {  444000000, 36249333, 166667, 0xca, 0xc3 /* 110 0 0 0  11 */ },
-                {  583834000, 36249333, 166667, 0xca, 0x63 /* 011 0 0 0  11 */ },
-                {  793834000, 36249333, 166667, 0xca, 0xa3 /* 101 0 0 0  11 */ },
-                {  444834000, 36249333, 166667, 0xca, 0xc3 /* 110 0 0 0  11 */ },
-                {  861000000, 36249333, 166667, 0xca, 0xe3 /* 111 0 0 0  11 */ },
+                {  444000000, 36249333, 166667, 0xca, 0xc4 /* 110 0 0 1  00 */ },
+                {  583834000, 36249333, 166667, 0xca, 0x64 /* 011 0 0 1  00 */ },
+                {  793834000, 36249333, 166667, 0xca, 0xa4 /* 101 0 0 1  00 */ },
+                {  444834000, 36249333, 166667, 0xca, 0xc4 /* 110 0 0 1  00 */ },
+                {  861000000, 36249333, 166667, 0xca, 0xe4 /* 111 0 0 1  00 */ },
         }
 };
 EXPORT_SYMBOL(dvb_pll_tda665x);
@@ -613,7 +613,21 @@ static struct dvb_tuner_ops dvb_pll_tuner_ops = {
 
 int dvb_pll_attach(struct dvb_frontend *fe, int pll_addr, struct i2c_adapter *i2c, struct dvb_pll_desc *desc)
 {
+        u8 b1 [] = { 0 };
+        struct i2c_msg msg = { .addr = pll_addr, .flags = I2C_M_RD, .buf = b1, .len = 1 };
         struct dvb_pll_priv *priv = NULL;
+        int ret;
+
+        if (i2c != NULL) {
+                if (fe->ops.i2c_gate_ctrl)
+                        fe->ops.i2c_gate_ctrl(fe, 1);
+
+                ret = i2c_transfer (i2c, &msg, 1);
+                if (ret != 1)
+                        return -1;
+                if (fe->ops.i2c_gate_ctrl)
+                             fe->ops.i2c_gate_ctrl(fe, 0);
+        }
 
         priv = kzalloc(sizeof(struct dvb_pll_priv), GFP_KERNEL);
         if (priv == NULL)
diff --git a/drivers/media/dvb/frontends/nxt200x.c b/drivers/media/dvb/frontends/nxt200x.c
index 55671cb5255e..87c286ee6a00 100644
--- a/drivers/media/dvb/frontends/nxt200x.c
+++ b/drivers/media/dvb/frontends/nxt200x.c
@@ -896,9 +896,9 @@ static int nxt2002_init(struct dvb_frontend* fe)
         }
 
         ret = nxt2002_load_firmware(fe, fw);
+        release_firmware(fw);
         if (ret) {
                 printk("nxt2002: Writing firmware to device failed\n");
-                release_firmware(fw);
                 return ret;
         }
         printk("nxt2002: Firmware upload complete\n");
@@ -960,9 +960,9 @@ static int nxt2004_init(struct dvb_frontend* fe)
         }
 
         ret = nxt2004_load_firmware(fe, fw);
+        release_firmware(fw);
         if (ret) {
                 printk("nxt2004: Writing firmware to device failed\n");
-                release_firmware(fw);
                 return ret;
         }
         printk("nxt2004: Firmware upload complete\n");
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 26bed616fabe..2bf124b53689 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -437,10 +437,10 @@ static int or51211_init(struct dvb_frontend* fe)
                 }
 
                 ret = or51211_load_firmware(fe, fw);
+                release_firmware(fw);
                 if (ret) {
                         printk(KERN_WARNING "or51211: Writing firmware to "
                                "device failed!\n");
-                        release_firmware(fw);
                         return ret;
                 }
                 printk(KERN_INFO "or51211: Firmware upload complete.\n");
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 44ec5b9a4695..d98fd5c2e13e 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -318,7 +318,6 @@ static int sp8870_init (struct dvb_frontend* fe)
         printk("sp8870: waiting for firmware upload (%s)...\n", SP8870_DEFAULT_FIRMWARE);
         if (state->config->request_firmware(fe, &fw, SP8870_DEFAULT_FIRMWARE)) {
                 printk("sp8870: no firmware upload (timeout or file not found?)\n");
-                release_firmware(fw);
                 return -EIO;
         }
 
@@ -327,6 +326,7 @@ static int sp8870_init (struct dvb_frontend* fe)
                 release_firmware(fw);
                 return -EIO;
         }
+        release_firmware(fw);
         printk("sp8870: firmware upload complete\n");
 
         /* enable TS output and interface pins */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index b0a2b02f6608..5c2f8f4e0ae5 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -520,9 +520,9 @@ static int sp887x_init(struct dvb_frontend* fe)
                 }
 
                 ret = sp887x_initial_setup(fe, fw);
+                release_firmware(fw);
                 if (ret) {
                         printk("sp887x: writing firmware to device failed\n");
-                        release_firmware(fw);
                         return ret;
                 }
                 printk("sp887x: firmware upload complete\n");
diff --git a/drivers/media/dvb/pluto2/Kconfig b/drivers/media/dvb/pluto2/Kconfig
index 7d8e6e87bdbb..9b84b1bdc313 100644
--- a/drivers/media/dvb/pluto2/Kconfig
+++ b/drivers/media/dvb/pluto2/Kconfig
@@ -2,6 +2,7 @@ config DVB_PLUTO2
         tristate "Pluto2 cards"
         depends on DVB_CORE && PCI && I2C
         select I2C_ALGOBIT
+        select DVB_PLL
         select DVB_TDA1004X
         help
           Support for PCI cards based on the Pluto2 FPGA like the Satelco
diff --git a/drivers/media/dvb/ttpci/Kconfig b/drivers/media/dvb/ttpci/Kconfig
index 987881fa988c..5fb097595cfb 100644
--- a/drivers/media/dvb/ttpci/Kconfig
+++ b/drivers/media/dvb/ttpci/Kconfig
@@ -3,6 +3,7 @@ config DVB_AV7110
         depends on DVB_CORE && PCI && I2C && VIDEO_V4L1
         select FW_LOADER
         select VIDEO_SAA7146_VV
+        select DVB_PLL
         select DVB_VES1820
         select DVB_VES1X93
         select DVB_STV0299
@@ -61,6 +62,7 @@ config DVB_BUDGET
         tristate "Budget cards"
         depends on DVB_CORE && PCI && I2C && VIDEO_V4L1
         select VIDEO_SAA7146
+        select DVB_PLL
         select DVB_STV0299
         select DVB_VES1X93
         select DVB_VES1820
@@ -83,6 +85,7 @@ config DVB_BUDGET_CI
         tristate "Budget cards with onboard CI connector"
         depends on DVB_CORE && PCI && I2C && VIDEO_V4L1
         select VIDEO_SAA7146
+        select DVB_PLL
         select DVB_STV0297
         select DVB_STV0299
         select DVB_TDA1004X
@@ -104,6 +107,7 @@ config DVB_BUDGET_AV
         tristate "Budget cards with analog video inputs"
         depends on DVB_CORE && PCI && I2C && VIDEO_V4L1
         select VIDEO_SAA7146_VV
+        select DVB_PLL
         select DVB_STV0299
         select DVB_TDA1004X
         select DVB_TDA10021
@@ -122,6 +126,7 @@ config DVB_BUDGET_PATCH
         tristate "AV7110 cards with Budget Patch"
         depends on DVB_CORE && DVB_BUDGET && VIDEO_V4L1
         select DVB_AV7110
+        select DVB_PLL
         select DVB_STV0299
         select DVB_VES1X93
         select DVB_TDA8083
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 500f15c10aaf..4506165c5de2 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -2203,8 +2203,8 @@ static int frontend_init(struct av7110 *av7110)
                                 av7110->fe->ops.tuner_ops.set_params = nexusca_stv0297_tuner_set_params;
 
                                 /* set TDA9819 into DVB mode */
-                                saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9198 pin9(STD)
-                                saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9198 pin30(VIF)
+                                saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9819 pin9(STD)
+                                saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9819 pin30(VIF)
 
                                 /* tuner on this needs a slower i2c bus speed */
                                 av7110->dev->i2c_bitrate = SAA7146_I2C_BUS_BIT_RATE_240;
diff --git a/drivers/media/dvb/ttpci/av7110_v4l.c b/drivers/media/dvb/ttpci/av7110_v4l.c
index 64055461559d..6ffe53fdcf57 100644
--- a/drivers/media/dvb/ttpci/av7110_v4l.c
+++ b/drivers/media/dvb/ttpci/av7110_v4l.c
@@ -272,8 +272,8 @@ static int av7110_dvb_c_switch(struct saa7146_fh *fh)
                                 if (ves1820_writereg(dev, 0x09, 0x0f, 0x60))
                                         dprintk(1, "setting band in demodulator failed.\n");
                         } else if (av7110->analog_tuner_flags & ANALOG_TUNER_STV0297) {
-                                saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTHI); // TDA9198 pin9(STD)
-                                saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTHI); // TDA9198 pin30(VIF)
+                                saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTHI); // TDA9819 pin9(STD)
+                                saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTHI); // TDA9819 pin30(VIF)
                         }
                         if (i2c_writereg(av7110, 0x48, 0x02, 0xd0) != 1)
                                 dprintk(1, "saa7113 write failed @ card %d", av7110->dvb_adapter.num);
@@ -308,8 +308,8 @@ static int av7110_dvb_c_switch(struct saa7146_fh *fh)
                         if (ves1820_writereg(dev, 0x09, 0x0f, 0x20))
                                 dprintk(1, "setting band in demodulator failed.\n");
                 } else if (av7110->analog_tuner_flags & ANALOG_TUNER_STV0297) {
-                        saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTLO); // TDA9198 pin9(STD)
-                        saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTLO); // TDA9198 pin30(VIF)
+                        saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTLO); // TDA9819 pin9(STD)
+                        saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTLO); // TDA9819 pin30(VIF)
                 }
         }
 
@@ -750,8 +750,8 @@ int av7110_init_analog_module(struct av7110 *av7110)
                         if (ves1820_writereg(av7110->dev, 0x09, 0x0f, 0x20))
                                 dprintk(1, "setting band in demodulator failed.\n");
                 } else if (av7110->analog_tuner_flags & ANALOG_TUNER_STV0297) {
-                        saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9198 pin9(STD)
-                        saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9198 pin30(VIF)
+                        saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9819 pin9(STD)
+                        saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9819 pin30(VIF)
                 }
 
                 /* init the saa7113 */
diff --git a/drivers/media/dvb/ttpci/budget-av.c b/drivers/media/dvb/ttpci/budget-av.c
index 5f111d407730..2d21fec23b4d 100644
--- a/drivers/media/dvb/ttpci/budget-av.c
+++ b/drivers/media/dvb/ttpci/budget-av.c
@@ -1303,6 +1303,9 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
         budget_av->budget.dvb_adapter.priv = budget_av;
         frontend_init(budget_av);
         ciintf_init(budget_av);
+
+        ttpci_budget_init_hooks(&budget_av->budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget-ci.c b/drivers/media/dvb/ttpci/budget-ci.c
index 4b966eea3834..ffbbb3e34be4 100644
--- a/drivers/media/dvb/ttpci/budget-ci.c
+++ b/drivers/media/dvb/ttpci/budget-ci.c
@@ -1101,6 +1101,8 @@ static int budget_ci_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
         budget_ci->budget.dvb_adapter.priv = budget_ci;
         frontend_init(budget_ci);
 
+        ttpci_budget_init_hooks(&budget_ci->budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget-core.c b/drivers/media/dvb/ttpci/budget-core.c
index e4cf7775e07f..e15562f81664 100644
--- a/drivers/media/dvb/ttpci/budget-core.c
+++ b/drivers/media/dvb/ttpci/budget-core.c
@@ -63,9 +63,6 @@ static int stop_ts_capture(struct budget *budget)
 {
         dprintk(2, "budget: %p\n", budget);
 
-        if (--budget->feeding)
-                return budget->feeding;
-
         saa7146_write(budget->dev, MC1, MASK_20);       // DMA3 off
         SAA7146_IER_DISABLE(budget->dev, MASK_10);
         return 0;
@@ -77,8 +74,8 @@ static int start_ts_capture(struct budget *budget)
 
         dprintk(2, "budget: %p\n", budget);
 
-        if (budget->feeding)
-                return ++budget->feeding;
+        if (!budget->feeding || !budget->fe_synced)
+                return 0;
 
         saa7146_write(dev, MC1, MASK_20);       // DMA3 off
 
@@ -139,7 +136,33 @@ static int start_ts_capture(struct budget *budget)
         SAA7146_IER_ENABLE(budget->dev, MASK_10);       /* VPE */
         saa7146_write(dev, MC1, (MASK_04 | MASK_20));   /* DMA3 on */
 
-        return ++budget->feeding;
+        return 0;
+}
+
+static int budget_read_fe_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+        struct budget *budget = (struct budget *) fe->dvb->priv;
+        int synced;
+        int ret;
+
+        if (budget->read_fe_status)
+                ret = budget->read_fe_status(fe, status);
+        else
+                ret = -EINVAL;
+
+        if (!ret) {
+                synced = (*status & FE_HAS_LOCK);
+                if (synced != budget->fe_synced) {
+                        budget->fe_synced = synced;
+                        spin_lock(&budget->feedlock);
+                        if (synced)
+                                start_ts_capture(budget);
+                        else
+                                stop_ts_capture(budget);
+                        spin_unlock(&budget->feedlock);
+                }
+        }
+        return ret;
 }
 
 static void vpeirq(unsigned long data)
@@ -267,7 +290,7 @@ static int budget_start_feed(struct dvb_demux_feed *feed)
 {
         struct dvb_demux *demux = feed->demux;
         struct budget *budget = (struct budget *) demux->priv;
-        int status;
+        int status = 0;
 
         dprintk(2, "budget: %p\n", budget);
 
@@ -276,7 +299,8 @@ static int budget_start_feed(struct dvb_demux_feed *feed)
 
         spin_lock(&budget->feedlock);
         feed->pusi_seen = 0; /* have a clean section start */
-        status = start_ts_capture(budget);
+        if (budget->feeding++ == 0)
+                status = start_ts_capture(budget);
         spin_unlock(&budget->feedlock);
         return status;
 }
@@ -285,12 +309,13 @@ static int budget_stop_feed(struct dvb_demux_feed *feed)
 {
         struct dvb_demux *demux = feed->demux;
         struct budget *budget = (struct budget *) demux->priv;
-        int status;
+        int status = 0;
 
         dprintk(2, "budget: %p\n", budget);
 
         spin_lock(&budget->feedlock);
-        status = stop_ts_capture(budget);
+        if (--budget->feeding == 0)
+                status = stop_ts_capture(budget);
         spin_unlock(&budget->feedlock);
         return status;
 }
@@ -470,6 +495,14 @@ err:
         return ret;
 }
 
+void ttpci_budget_init_hooks(struct budget *budget)
+{
+        if (budget->dvb_frontend && !budget->read_fe_status) {
+                budget->read_fe_status = budget->dvb_frontend->ops.read_status;
+                budget->dvb_frontend->ops.read_status = budget_read_fe_status;
+        }
+}
+
 int ttpci_budget_deinit(struct budget *budget)
 {
         struct saa7146_dev *dev = budget->dev;
@@ -508,11 +541,8 @@ void ttpci_budget_set_video_port(struct saa7146_dev *dev, int video_port)
         spin_lock(&budget->feedlock);
         budget->video_port = video_port;
         if (budget->feeding) {
-                int oldfeeding = budget->feeding;
-                budget->feeding = 1;
                 stop_ts_capture(budget);
                 start_ts_capture(budget);
-                budget->feeding = oldfeeding;
         }
         spin_unlock(&budget->feedlock);
 }
@@ -520,6 +550,7 @@ void ttpci_budget_set_video_port(struct saa7146_dev *dev, int video_port)
 EXPORT_SYMBOL_GPL(ttpci_budget_debiread);
 EXPORT_SYMBOL_GPL(ttpci_budget_debiwrite);
 EXPORT_SYMBOL_GPL(ttpci_budget_init);
+EXPORT_SYMBOL_GPL(ttpci_budget_init_hooks);
 EXPORT_SYMBOL_GPL(ttpci_budget_deinit);
 EXPORT_SYMBOL_GPL(ttpci_budget_irq10_handler);
 EXPORT_SYMBOL_GPL(ttpci_budget_set_video_port);
diff --git a/drivers/media/dvb/ttpci/budget-patch.c b/drivers/media/dvb/ttpci/budget-patch.c
index ee60ce90a400..57227441891e 100644
--- a/drivers/media/dvb/ttpci/budget-patch.c
+++ b/drivers/media/dvb/ttpci/budget-patch.c
@@ -617,6 +617,8 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
         budget->dvb_adapter.priv = budget;
         frontend_init(budget);
 
+        ttpci_budget_init_hooks(budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 35761f13c12b..863dffb4ed8e 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -375,9 +375,6 @@ static void frontend_init(struct budget *budget)
                 if (budget->dvb_frontend) {
                         budget->dvb_frontend->ops.tuner_ops.set_params = alps_bsru6_tuner_set_params;
                         budget->dvb_frontend->tuner_priv = &budget->i2c_adap;
-                        budget->dvb_frontend->ops.diseqc_send_master_cmd = budget_diseqc_send_master_cmd;
-                        budget->dvb_frontend->ops.diseqc_send_burst = budget_diseqc_send_burst;
-                        budget->dvb_frontend->ops.set_tone = budget_set_tone;
                         break;
                 }
                 break;
@@ -474,6 +471,8 @@ static int budget_attach (struct saa7146_dev* dev, struct saa7146_pci_extension_
         budget->dvb_adapter.priv = budget;
         frontend_init(budget);
 
+        ttpci_budget_init_hooks(budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget.h b/drivers/media/dvb/ttpci/budget.h
index ecea3a13030e..e8a5c79178e1 100644
--- a/drivers/media/dvb/ttpci/budget.h
+++ b/drivers/media/dvb/ttpci/budget.h
@@ -52,9 +52,6 @@ struct budget {
         struct dmx_frontend hw_frontend;
         struct dmx_frontend mem_frontend;
 
-        int fe_synced;
-        struct mutex pid_mutex;
-
         int ci_present;
         int video_port;
 
@@ -74,6 +71,9 @@ struct budget {
 
         struct dvb_adapter dvb_adapter;
         struct dvb_frontend *dvb_frontend;
+        int (*read_fe_status)(struct dvb_frontend *fe, fe_status_t *status);
+        int fe_synced;
+
         void *priv;
 };
 
@@ -106,6 +106,7 @@ static struct saa7146_pci_extension_data x_var = { \
 extern int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
                              struct saa7146_pci_extension_data *info,
                              struct module *owner);
+extern void ttpci_budget_init_hooks(struct budget *budget);
 extern int ttpci_budget_deinit(struct budget *budget);
 extern void ttpci_budget_irq10_handler(struct saa7146_dev *dev, u32 * isr);
 extern void ttpci_budget_set_video_port(struct saa7146_dev *dev, int video_port);
diff --git a/drivers/media/dvb/ttusb-budget/Kconfig b/drivers/media/dvb/ttusb-budget/Kconfig
index 92c7cdcf8981..46a6a60d2ab9 100644
--- a/drivers/media/dvb/ttusb-budget/Kconfig
+++ b/drivers/media/dvb/ttusb-budget/Kconfig
@@ -1,6 +1,7 @@
 config DVB_TTUSB_BUDGET
         tristate "Technotrend/Hauppauge Nova-USB devices"
-        depends on DVB_CORE && USB
+        depends on DVB_CORE && USB && I2C
+        select DVB_PLL
         select DVB_CX22700
         select DVB_TDA1004X
         select DVB_VES1820
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index de3128a31de8..220076b1b956 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -350,5 +350,15 @@ config RADIO_ZOLTRIX_PORT
         help
           Enter the I/O port of your Zoltrix radio card.
 
-endmenu
+config USB_DSBR
+        tristate "D-Link USB FM radio support (EXPERIMENTAL)"
+        depends on USB && VIDEO_V4L1 && EXPERIMENTAL
+        ---help---
+          Say Y here if you want to connect this type of radio to your
+          computer's USB port. Note that the audio is not digital, and
+          you must connect the line out connector to a sound card or a
+          set of speakers.
 
+          To compile this driver as a module, choose M here: the
+          module will be called dsbr100.
+endmenu
diff --git a/drivers/media/radio/Makefile b/drivers/media/radio/Makefile
index e95b6805e002..cf55a18e3ddf 100644
--- a/drivers/media/radio/Makefile
+++ b/drivers/media/radio/Makefile
@@ -20,5 +20,6 @@ obj-$(CONFIG_RADIO_GEMTEK) += radio-gemtek.o
 obj-$(CONFIG_RADIO_GEMTEK_PCI) += radio-gemtek-pci.o
 obj-$(CONFIG_RADIO_TRUST) += radio-trust.o
 obj-$(CONFIG_RADIO_MAESTRO) += radio-maestro.o
+obj-$(CONFIG_USB_DSBR) += dsbr100.o
 
 EXTRA_CFLAGS += -Isound
diff --git a/drivers/media/video/dsbr100.c b/drivers/media/radio/dsbr100.c
index f7e33f9ee8e9..f7e33f9ee8e9 100644
--- a/drivers/media/video/dsbr100.c
+++ b/drivers/media/radio/dsbr100.c
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 6d532f170ce5..94d078b77bab 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -145,7 +145,7 @@ config VIDEO_SAA5246A
 
 config VIDEO_SAA5249
         tristate "SAA5249 Teletext processor"
-        depends on VIDEO_DEV && I2C
+        depends on VIDEO_DEV && I2C && VIDEO_V4L1
         help
           Support for I2C bus based teletext using the SAA5249 chip. At the
           moment this is only useful on some European WinTV cards.
@@ -155,7 +155,7 @@ config VIDEO_SAA5249
 
 config TUNER_3036
         tristate "SAB3036 tuner"
-        depends on VIDEO_DEV && I2C
+        depends on VIDEO_DEV && I2C && VIDEO_V4L1
         help
           Say Y here to include support for Philips SAB3036 compatible tuners.
           If in doubt, say N.
@@ -260,7 +260,7 @@ source "drivers/media/video/saa7134/Kconfig"
 
 config VIDEO_MXB
         tristate "Siemens-Nixdorf 'Multimedia eXtension Board'"
-        depends on PCI && VIDEO_V4L1
+        depends on PCI && VIDEO_V4L1 && I2C
         select VIDEO_SAA7146_VV
         select VIDEO_TUNER
         ---help---
@@ -272,7 +272,7 @@ config VIDEO_MXB
 
 config VIDEO_DPC
         tristate "Philips-Semiconductors 'dpc7146 demonstration board'"
-        depends on PCI && VIDEO_V4L1
+        depends on PCI && VIDEO_V4L1 && I2C
         select VIDEO_SAA7146_VV
         select VIDEO_V4L2
         ---help---
@@ -287,7 +287,7 @@ config VIDEO_DPC
 
 config VIDEO_HEXIUM_ORION
         tristate "Hexium HV-PCI6 and Orion frame grabber"
-        depends on PCI && VIDEO_V4L1
+        depends on PCI && VIDEO_V4L1 && I2C
         select VIDEO_SAA7146_VV
         select VIDEO_V4L2
         ---help---
@@ -299,7 +299,7 @@ config VIDEO_HEXIUM_ORION
 
 config VIDEO_HEXIUM_GEMINI
         tristate "Hexium Gemini frame grabber"
-        depends on PCI && VIDEO_V4L1
+        depends on PCI && VIDEO_V4L1 && I2C
         select VIDEO_SAA7146_VV
         select VIDEO_V4L2
         ---help---
@@ -449,18 +449,6 @@ source "drivers/media/video/pvrusb2/Kconfig"
 
 source "drivers/media/video/em28xx/Kconfig"
 
-config USB_DSBR
-        tristate "D-Link USB FM radio support (EXPERIMENTAL)"
-        depends on USB && VIDEO_V4L1 && EXPERIMENTAL
-        ---help---
-          Say Y here if you want to connect this type of radio to your
-          computer's USB port. Note that the audio is not digital, and
-          you must connect the line out connector to a sound card or a
-          set of speakers.
-
-          To compile this driver as a module, choose M here: the
-          module will be called dsbr100.
-
 source "drivers/media/video/usbvideo/Kconfig"
 
 source "drivers/media/video/et61x251/Kconfig"
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index 353d61cfac1b..e82e511f2a72 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -77,7 +77,6 @@ obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o
 obj-$(CONFIG_VIDEO_CX2341X) += cx2341x.o
 
 obj-$(CONFIG_USB_DABUSB)        += dabusb.o
-obj-$(CONFIG_USB_DSBR)          += dsbr100.o
 obj-$(CONFIG_USB_OV511)         += ov511.o
 obj-$(CONFIG_USB_SE401)         += se401.o
 obj-$(CONFIG_USB_STV680)        += stv680.o
@@ -91,6 +90,7 @@ obj-$(CONFIG_USB_ZC0301)        += zc0301/
 obj-$(CONFIG_USB_IBMCAM)        += usbvideo/
 obj-$(CONFIG_USB_KONICAWC)      += usbvideo/
 obj-$(CONFIG_USB_VICAM)         += usbvideo/
+obj-$(CONFIG_USB_QUICKCAM_MESSENGER)    += usbvideo/
 
 obj-$(CONFIG_VIDEO_VIVI) += vivi.o
 
diff --git a/drivers/media/video/bt8xx/Kconfig b/drivers/media/video/bt8xx/Kconfig
index 153f6a4a96c9..cdcf55650714 100644
--- a/drivers/media/video/bt8xx/Kconfig
+++ b/drivers/media/video/bt8xx/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_BT848
         tristate "BT848 Video For Linux"
-        depends on VIDEO_DEV && PCI && I2C && VIDEO_V4L2
+        depends on VIDEO_DEV && PCI && I2C && VIDEO_V4L1
         select I2C_ALGOBIT
         select FW_LOADER
         select VIDEO_BTCX
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 5764a89d3562..20dff7c316eb 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3923,7 +3923,12 @@ static int __devinit bttv_register_video(struct bttv *btv)
                 goto err;
         printk(KERN_INFO "bttv%d: registered device video%d\n",
                btv->c.nr,btv->video_dev->minor & 0x1f);
-        video_device_create_file(btv->video_dev, &class_device_attr_card);
+        if (class_device_create_file(&btv->video_dev->class_dev,
+                                     &class_device_attr_card)<0) {
+                printk(KERN_ERR "bttv%d: class_device_create_file 'card' "
+                       "failed\n", btv->c.nr);
+                goto err;
+        }
 
         /* vbi */
         btv->vbi_dev = vdev_init(btv, &bttv_vbi_template, "vbi");
@@ -4287,6 +4292,8 @@ static struct pci_driver bttv_pci_driver = {
 
 static int bttv_init_module(void)
 {
+        int ret;
+
         bttv_num = 0;
 
         printk(KERN_INFO "bttv: driver version %d.%d.%d loaded\n",
@@ -4308,7 +4315,11 @@ static int bttv_init_module(void)
 
         bttv_check_chipset();
 
-        bus_register(&bttv_sub_bus_type);
+        ret = bus_register(&bttv_sub_bus_type);
+        if (ret < 0) {
+                printk(KERN_WARNING "bttv: bus_register error: %d\n", ret);
+                return ret;
+        }
         return pci_register_driver(&bttv_pci_driver);
 }
 
diff --git a/drivers/media/video/bt8xx/bttv-input.c b/drivers/media/video/bt8xx/bttv-input.c
index b41f81d2372c..933d6db09acb 100644
--- a/drivers/media/video/bt8xx/bttv-input.c
+++ b/drivers/media/video/bt8xx/bttv-input.c
@@ -303,6 +303,7 @@ int bttv_input_init(struct bttv *btv)
                 ir->mask_keyup   = 0x010000;
                 ir->polling      = 50; // ms
                 break;
+        case BTTV_BOARD_PV_M4900:
         case BTTV_BOARD_PV_BT878P_9B:
         case BTTV_BOARD_PV_BT878P_PLUS:
                 ir_codes         = ir_codes_pixelview;
diff --git a/drivers/media/video/bt8xx/bttv-vbi.c b/drivers/media/video/bt8xx/bttv-vbi.c
index 8c9f0f7cf467..63676e7bd635 100644
--- a/drivers/media/video/bt8xx/bttv-vbi.c
+++ b/drivers/media/video/bt8xx/bttv-vbi.c
@@ -31,11 +31,16 @@
 #include <asm/io.h>
 #include "bttvp.h"
 
-/* Offset from line sync pulse leading edge (0H) in 1 / sampling_rate:
-   bt8x8 /HRESET pulse starts at 0H and has length 64 / fCLKx1 (E|O_VTC
-   HSFMT = 0). VBI_HDELAY (always 0) is an offset from the trailing edge
-   of /HRESET in 1 / fCLKx1, and the sampling_rate tvnorm->Fsc is fCLKx2. */
-#define VBI_OFFSET ((64 + 0) * 2)
+/* Offset from line sync pulse leading edge (0H) to start of VBI capture,
+   in fCLKx2 pixels.  According to the datasheet, VBI capture starts
+   VBI_HDELAY fCLKx1 pixels from the tailing edgeof /HRESET, and /HRESET
+   is 64 fCLKx1 pixels wide.  VBI_HDELAY is set to 0, so this should be
+   (64 + 0) * 2 = 128 fCLKx2 pixels.  But it's not!  The datasheet is
+   Just Plain Wrong.  The real value appears to be different for
+   different revisions of the bt8x8 chips, and to be affected by the
+   horizontal scaling factor.  Experimentally, the value is measured
+   to be about 244.  */
+#define VBI_OFFSET 244
 
 #define VBI_DEFLINES 16
 #define VBI_MAXLINES 32
diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
index 353d02b67c33..b69ee1194815 100644
--- a/drivers/media/video/compat_ioctl32.c
+++ b/drivers/media/video/compat_ioctl32.c
@@ -21,7 +21,7 @@
 
 #ifdef CONFIG_COMPAT
 
-
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 struct video_tuner32 {
         compat_int_t tuner;
         char name[32];
@@ -107,6 +107,7 @@ struct video_window32 {
         compat_caddr_t clips;
         compat_int_t clipcount;
 };
+#endif
 
 static int native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
@@ -124,6 +125,7 @@ static int native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 }
 
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 /* You get back everything except the clips... */
 static int put_video_window32(struct video_window *kp, struct video_window32 __user *up)
 {
@@ -138,6 +140,7 @@ static int put_video_window32(struct video_window *kp, struct video_window32 __u
                         return -EFAULT;
         return 0;
 }
+#endif
 
 struct v4l2_clip32
 {
@@ -490,6 +493,24 @@ static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user
         return 0;
 }
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
+struct video_code32
+{
+        char            loadwhat[16];   /* name or tag of file being passed */
+        compat_int_t    datasize;
+        unsigned char   *data;
+};
+
+static inline int microcode32(struct video_code *kp, struct video_code32 __user *up)
+{
+        if(!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
+                copy_from_user(kp->loadwhat, up->loadwhat, sizeof (up->loadwhat)) ||
+                get_user(kp->datasize, &up->datasize) ||
+                copy_from_user(kp->data, up->data, up->datasize))
+                        return -EFAULT;
+        return 0;
+}
+
 #define VIDIOCGTUNER32          _IOWR('v',4, struct video_tuner32)
 #define VIDIOCSTUNER32          _IOW('v',5, struct video_tuner32)
 #define VIDIOCGWIN32            _IOR('v',9, struct video_window32)
@@ -498,6 +519,9 @@ static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user
 #define VIDIOCSFBUF32           _IOW('v',12, struct video_buffer32)
 #define VIDIOCGFREQ32           _IOR('v',14, u32)
 #define VIDIOCSFREQ32           _IOW('v',15, u32)
+#define VIDIOCSMICROCODE32      _IOW('v',27, struct video_code32)
+
+#endif
 
 /* VIDIOC_ENUMINPUT32 is VIDIOC_ENUMINPUT minus 4 bytes of padding alignement */
 #define VIDIOC_ENUMINPUT32      VIDIOC_ENUMINPUT - _IOC(0, 0, 0, 4)
@@ -519,6 +543,7 @@ static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user
 #define VIDIOC_S_INPUT32        _IOWR ('V', 39, compat_int_t)
 #define VIDIOC_TRY_FMT32        _IOWR ('V', 64, struct v4l2_format32)
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 enum {
         MaxClips = (~0U-sizeof(struct video_window))/sizeof(struct video_clip)
 };
@@ -583,13 +608,17 @@ static int do_set_window(struct file *file, unsigned int cmd, unsigned long arg)
 
         return native_ioctl(file, VIDIOCSWIN, (unsigned long)vw);
 }
+#endif
 
 static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         union {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
                 struct video_tuner vt;
                 struct video_buffer vb;
                 struct video_window vw;
+                struct video_code vc;
+#endif
                 struct v4l2_format v2f;
                 struct v4l2_buffer v2b;
                 struct v4l2_framebuffer v2fb;
@@ -605,6 +634,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
 
         /* First, convert the command. */
         switch(cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGTUNER32: cmd = VIDIOCGTUNER; break;
         case VIDIOCSTUNER32: cmd = VIDIOCSTUNER; break;
         case VIDIOCGWIN32: cmd = VIDIOCGWIN; break;
@@ -612,6 +642,8 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
         case VIDIOCSFBUF32: cmd = VIDIOCSFBUF; break;
         case VIDIOCGFREQ32: cmd = VIDIOCGFREQ; break;
         case VIDIOCSFREQ32: cmd = VIDIOCSFREQ; break;
+        case VIDIOCSMICROCODE32: cmd = VIDIOCSMICROCODE; break;
+#endif
         case VIDIOC_G_FMT32: cmd = VIDIOC_G_FMT; break;
         case VIDIOC_S_FMT32: cmd = VIDIOC_S_FMT; break;
         case VIDIOC_QUERYBUF32: cmd = VIDIOC_QUERYBUF; break;
@@ -631,6 +663,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
         };
 
         switch(cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCSTUNER:
         case VIDIOCGTUNER:
                 err = get_video_tuner32(&karg.vt, up);
@@ -644,6 +677,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 break;
 
         case VIDIOCSFREQ:
+#endif
         case VIDIOC_S_INPUT:
         case VIDIOC_OVERLAY:
         case VIDIOC_STREAMON:
@@ -697,14 +731,21 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 compatible_arg = 0;
                 break;
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGWIN:
         case VIDIOCGFBUF:
         case VIDIOCGFREQ:
+#endif
         case VIDIOC_G_FBUF:
         case VIDIOC_G_INPUT:
                 compatible_arg = 0;
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
+        case VIDIOCSMICROCODE:
+                err = microcode32(&karg.vc, up);
+                compatible_arg = 0;
+                break;
+#endif
         };
-
         if(err)
                 goto out;
 
@@ -719,6 +760,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
         }
         if(err == 0) {
                 switch(cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
                 case VIDIOCGTUNER:
                         err = put_video_tuner32(&karg.vt, up);
                         break;
@@ -730,7 +772,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 case VIDIOCGFBUF:
                         err = put_video_buffer32(&karg.vb, up);
                         break;
-
+#endif
                 case VIDIOC_G_FBUF:
                         err = put_v4l2_framebuffer32(&karg.v2fb, up);
                         break;
@@ -768,7 +810,9 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                         err = put_v4l2_input32(&karg.v2i, up);
                         break;
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
                 case VIDIOCGFREQ:
+#endif
                 case VIDIOC_G_INPUT:
                         err = put_user(((u32)karg.vx), (u32 __user *)up);
                         break;
@@ -786,6 +830,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
                 return ret;
 
         switch (cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCSWIN32:
                 ret = do_set_window(file, cmd, arg);
                 break;
@@ -796,6 +841,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOCSFBUF32:
         case VIDIOCGFREQ32:
         case VIDIOCSFREQ32:
+#endif
         case VIDIOC_QUERYCAP:
         case VIDIOC_ENUM_FMT:
         case VIDIOC_G_FMT32:
@@ -827,6 +873,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
                 ret = do_video_ioctl(file, cmd, arg);
                 break;
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         /* Little v, the video4linux ioctls (conflict?) */
         case VIDIOCGCAP:
         case VIDIOCGCHAN:
@@ -855,6 +902,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case _IOR('v' , BASE_VIDIOCPRIVATE+7, int):
                 ret = native_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
                 break;
+#endif
         default:
                 v4l_print_ioctl("compat_ioctl32", cmd);
         }
diff --git a/drivers/media/video/cpia2/Kconfig b/drivers/media/video/cpia2/Kconfig
index 513cc0927389..e39a96152004 100644
--- a/drivers/media/video/cpia2/Kconfig
+++ b/drivers/media/video/cpia2/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_CPIA2
         tristate "CPiA2 Video For Linux"
-        depends on VIDEO_DEV && USB
+        depends on VIDEO_DEV && USB && VIDEO_V4L1
         ---help---
           This is the video4linux driver for cameras based on Vision's CPiA2
           (Colour Processor Interface ASIC), such as the Digital Blue QX5
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 5c2036b40ea1..7bb7589a07c3 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -104,8 +104,8 @@ u32 cx25840_read4(struct i2c_client * client, u16 addr)
         if (i2c_master_recv(client, buffer, 4) < 4)
                 return 0;
 
-        return (buffer[0] << 24) | (buffer[1] << 16) |
-            (buffer[2] << 8) | buffer[3];
+        return (buffer[3] << 24) | (buffer[2] << 16) |
+            (buffer[1] << 8) | buffer[0];
 }
 
 int cx25840_and_or(struct i2c_client *client, u16 addr, unsigned and_mask,
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 80e23ee9801c..7a94e6a11927 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -51,6 +51,7 @@ config VIDEO_CX88_DVB
         tristate "DVB/ATSC Support for cx2388x based TV cards"
         depends on VIDEO_CX88 && DVB_CORE
         select VIDEO_BUF_DVB
+        select DVB_PLL
         ---help---
           This adds support for DVB/ATSC cards based on the
           Conexant 2388x chip.
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index 349632b48e93..b60177f173c3 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -453,11 +453,13 @@ static int blackbird_load_firmware(struct cx8802_dev *dev)
         if (firmware->size != BLACKBIRD_FIRM_IMAGE_SIZE) {
                 dprintk(0, "ERROR: Firmware size mismatch (have %zd, expected %d)\n",
                         firmware->size, BLACKBIRD_FIRM_IMAGE_SIZE);
+                release_firmware(firmware);
                 return -1;
         }
 
         if (0 != memcmp(firmware->data, magic, 8)) {
                 dprintk(0, "ERROR: Firmware magic mismatch, wrong file?\n");
+                release_firmware(firmware);
                 return -1;
         }
 
@@ -478,6 +480,7 @@ static int blackbird_load_firmware(struct cx8802_dev *dev)
         }
         if (checksum) {
                 dprintk(0, "ERROR: Firmware load failed (checksum mismatch).\n");
+                release_firmware(firmware);
                 return -1;
         }
         release_firmware(firmware);
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index 72b630a91f41..c25564648993 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -89,7 +89,7 @@ static void cx88_ir_handle_key(struct cx88_IR *ir)
 
                 auxgpio = cx_read(MO_GP1_IO);
                 /* Take out the parity part */
-                gpio+=(gpio & 0x7fd) + (auxgpio & 0xef);
+                gpio=(gpio & 0x7fd) + (auxgpio & 0xef);
         } else
                 auxgpio = gpio;
 
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 2225d4b94140..94c92bacc342 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -1180,7 +1180,6 @@ static int video_do_ioctl(struct inode *inode, struct file *file,
                         V4L2_CAP_READWRITE     |
                         V4L2_CAP_STREAMING     |
                         V4L2_CAP_VBI_CAPTURE   |
-                        V4L2_CAP_VIDEO_OVERLAY |
                         0;
                 if (UNSET != core->tuner_type)
                         cap->capabilities |= V4L2_CAP_TUNER;
@@ -1226,7 +1225,7 @@ static int video_do_ioctl(struct inode *inode, struct file *file,
                 struct v4l2_format *f = arg;
                 return cx8800_try_fmt(dev,fh,f);
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         /* --- streaming capture ------------------------------------- */
         case VIDIOCGMBUF:
         {
@@ -1585,7 +1584,7 @@ static int radio_do_ioctl(struct inode *inode, struct file *file,
                 *id = 0;
                 return 0;
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCSTUNER:
         {
                 struct video_tuner *v = arg;
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index dbb75a7db199..56246b8578f3 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -362,7 +362,7 @@ int msp_sleep(struct msp_state *state, int timeout)
 }
 
 /* ------------------------------------------------------------------------ */
-
+#ifdef CONFIG_VIDEO_V4L1
 static int msp_mode_v4l2_to_v4l1(int rxsubchans, int audmode)
 {
         if (rxsubchans == V4L2_TUNER_SUB_MONO)
@@ -384,6 +384,7 @@ static int msp_mode_v4l1_to_v4l2(int mode)
                 return V4L2_TUNER_MODE_LANG1;
         return V4L2_TUNER_MODE_MONO;
 }
+#endif
 
 static int msp_get_ctrl(struct i2c_client *client, struct v4l2_control *ctrl)
 {
@@ -509,6 +510,7 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
         /* --- v4l ioctls --- */
         /* take care: bttv does userspace copying, we'll get a
            kernel pointer here... */
+#ifdef CONFIG_VIDEO_V4L1
         case VIDIOCGAUDIO:
         {
                 struct video_audio *va = arg;
@@ -577,6 +579,12 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
         }
 
         case VIDIOCSFREQ:
+        {
+                /* new channel -- kick audio carrier scan */
+                msp_wake_thread(client);
+                break;
+        }
+#endif
         case VIDIOC_S_FREQUENCY:
         {
                 /* new channel -- kick audio carrier scan */
diff --git a/drivers/media/video/msp3400-kthreads.c b/drivers/media/video/msp3400-kthreads.c
index f2fd9195b3ac..ed02ff811388 100644
--- a/drivers/media/video/msp3400-kthreads.c
+++ b/drivers/media/video/msp3400-kthreads.c
@@ -961,10 +961,10 @@ int msp34xxg_thread(void *data)
                 /* setup the chip*/
                 msp34xxg_reset(client);
                 state->std = state->radio ? 0x40 : msp_standard;
-                if (state->std != 1)
-                        goto unmute;
                 /* start autodetect */
                 msp_write_dem(client, 0x20, state->std);
+                if (state->std != 1)
+                        goto unmute;
 
                 /* watch autodetect */
                 v4l_dbg(1, msp_debug, client, "started autodetect, waiting for result\n");
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index 9b48abcf6089..be1e5cc78081 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -852,7 +852,6 @@ unsigned long pvr2_hdw_get_sn(struct pvr2_hdw *hdw)
         return hdw->serial_number;
 }
 
-
 int pvr2_hdw_get_unit_number(struct pvr2_hdw *hdw)
 {
         return hdw->unit_number;
@@ -2318,7 +2317,6 @@ void pvr2_hdw_poll_trigger_unlocked(struct pvr2_hdw *hdw)
         }
 }
 
-
 /* Return name for this driver instance */
 const char *pvr2_hdw_get_driver_name(struct pvr2_hdw *hdw)
 {
@@ -2542,6 +2540,10 @@ static void pvr2_ctl_timeout(unsigned long data)
 }
 
 
+/* Issue a command and get a response from the device.  This extended
+   version includes a probe flag (which if set means that device errors
+   should not be logged or treated as fatal) and a timeout in jiffies.
+   This can be used to non-lethally probe the health of endpoint 1. */
 static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
                                 unsigned int timeout,int probe_fl,
                                 void *write_data,unsigned int write_len,
@@ -2970,6 +2972,7 @@ int pvr2_hdw_cmd_decoder_reset(struct pvr2_hdw *hdw)
 }
 
 
+/* Stop / start video stream transport */
 static int pvr2_hdw_cmd_usbstream(struct pvr2_hdw *hdw,int runFl)
 {
         int status;
@@ -3068,6 +3071,7 @@ int pvr2_hdw_gpio_chg_out(struct pvr2_hdw *hdw,u32 msk,u32 val)
 }
 
 
+/* Find I2C address of eeprom */
 static int pvr2_hdw_get_eeprom_addr(struct pvr2_hdw *hdw)
 {
         int result;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-io.c b/drivers/media/video/pvrusb2/pvrusb2-io.c
index 681f79c8064e..1e393762546c 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-io.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-io.c
@@ -26,6 +26,8 @@
 #include <linux/slab.h>
 #include <linux/mutex.h>
 
+static const char *pvr2_buffer_state_decode(enum pvr2_buffer_state);
+
 #define BUFFER_SIG 0x47653271
 
 // #define SANITY_CHECK_BUFFERS
@@ -515,6 +517,10 @@ void pvr2_stream_set_callback(struct pvr2_stream *sp,
 }
 
 /* Query / set the nominal buffer count */
+int pvr2_stream_get_buffer_count(struct pvr2_stream *sp)
+{
+        return sp->buffer_target_count;
+}
 
 int pvr2_stream_set_buffer_count(struct pvr2_stream *sp,unsigned int cnt)
 {
@@ -553,7 +559,6 @@ int pvr2_stream_get_ready_count(struct pvr2_stream *sp)
         return sp->r_count;
 }
 
-
 void pvr2_stream_kill(struct pvr2_stream *sp)
 {
         struct pvr2_buffer *bp;
@@ -607,7 +612,6 @@ int pvr2_buffer_queue(struct pvr2_buffer *bp)
         return ret;
 }
 
-
 int pvr2_buffer_set_buffer(struct pvr2_buffer *bp,void *ptr,unsigned int cnt)
 {
         int ret = 0;
@@ -646,7 +650,6 @@ int pvr2_buffer_get_status(struct pvr2_buffer *bp)
         return bp->status;
 }
 
-
 int pvr2_buffer_get_id(struct pvr2_buffer *bp)
 {
         return bp->id;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-io.h b/drivers/media/video/pvrusb2/pvrusb2-io.h
index 96285ad234a6..93279cc2a35e 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-io.h
+++ b/drivers/media/video/pvrusb2/pvrusb2-io.h
@@ -47,6 +47,7 @@ void pvr2_stream_set_callback(struct pvr2_stream *,
                               void *data);
 
 /* Query / set the nominal buffer count */
+int pvr2_stream_get_buffer_count(struct pvr2_stream *);
 int pvr2_stream_set_buffer_count(struct pvr2_stream *,unsigned int);
 
 /* Get a pointer to a buffer that is either idle, ready, or is specified
@@ -58,6 +59,7 @@ struct pvr2_buffer *pvr2_stream_get_buffer(struct pvr2_stream *sp,int id);
 /* Find out how many buffers are idle or ready */
 int pvr2_stream_get_ready_count(struct pvr2_stream *);
 
+
 /* Kill all pending buffers and throw away any ready buffers as well */
 void pvr2_stream_kill(struct pvr2_stream *);
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ioread.c b/drivers/media/video/pvrusb2/pvrusb2-ioread.c
index f7a2e225a002..b71f9a961f8a 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ioread.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ioread.c
@@ -213,7 +213,9 @@ int pvr2_ioread_setup(struct pvr2_ioread *cp,struct pvr2_stream *sp)
                                    " pvr2_ioread_setup (tear-down) id=%p",cp);
                         pvr2_ioread_stop(cp);
                         pvr2_stream_kill(cp->stream);
-                        pvr2_stream_set_buffer_count(cp->stream,0);
+                        if (pvr2_stream_get_buffer_count(cp->stream)) {
+                                pvr2_stream_set_buffer_count(cp->stream,0);
+                        }
                         cp->stream = NULL;
                 }
                 if (sp) {
@@ -251,7 +253,6 @@ int pvr2_ioread_set_enabled(struct pvr2_ioread *cp,int fl)
         return ret;
 }
 
-
 static int pvr2_ioread_get_buffer(struct pvr2_ioread *cp)
 {
         int stat;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-sysfs.c b/drivers/media/video/pvrusb2/pvrusb2-sysfs.c
index 6af55a8b6f05..d1dda5caf406 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-sysfs.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-sysfs.c
@@ -44,12 +44,16 @@ struct pvr2_sysfs {
         struct kobj_type ktype;
         struct class_device_attribute attr_v4l_minor_number;
         struct class_device_attribute attr_unit_number;
+        int v4l_minor_number_created_ok;
+        int unit_number_created_ok;
 };
 
 #ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
 struct pvr2_sysfs_debugifc {
         struct class_device_attribute attr_debugcmd;
         struct class_device_attribute attr_debuginfo;
+        int debugcmd_created_ok;
+        int debuginfo_created_ok;
 };
 #endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
 
@@ -67,6 +71,7 @@ struct pvr2_sysfs_ctl_item {
         struct pvr2_sysfs_ctl_item *item_next;
         struct attribute *attr_gen[7];
         struct attribute_group grp;
+        int created_ok;
         char name[80];
 };
 
@@ -487,6 +492,7 @@ static void pvr2_sysfs_add_control(struct pvr2_sysfs *sfp,int ctl_id)
         struct pvr2_sysfs_func_set *fp;
         struct pvr2_ctrl *cptr;
         unsigned int cnt,acnt;
+        int ret;
 
         if ((ctl_id < 0) || (ctl_id >= (sizeof(funcs)/sizeof(funcs[0])))) {
                 return;
@@ -589,7 +595,13 @@ static void pvr2_sysfs_add_control(struct pvr2_sysfs *sfp,int ctl_id)
         cip->grp.name = cip->name;
         cip->grp.attrs = cip->attr_gen;
 
-        sysfs_create_group(&sfp->class_dev->kobj,&cip->grp);
+        ret = sysfs_create_group(&sfp->class_dev->kobj,&cip->grp);
+        if (ret) {
+                printk(KERN_WARNING "%s: sysfs_create_group error: %d\n",
+                       __FUNCTION__, ret);
+                return;
+        }
+        cip->created_ok = !0;
 }
 
 #ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
@@ -600,6 +612,8 @@ static ssize_t debugcmd_store(struct class_device *,const char *,size_t count);
 static void pvr2_sysfs_add_debugifc(struct pvr2_sysfs *sfp)
 {
         struct pvr2_sysfs_debugifc *dip;
+        int ret;
+
         dip = kmalloc(sizeof(*dip),GFP_KERNEL);
         if (!dip) return;
         memset(dip,0,sizeof(*dip));
@@ -613,17 +627,34 @@ static void pvr2_sysfs_add_debugifc(struct pvr2_sysfs *sfp)
         dip->attr_debuginfo.attr.mode = S_IRUGO;
         dip->attr_debuginfo.show = debuginfo_show;
         sfp->debugifc = dip;
-        class_device_create_file(sfp->class_dev,&dip->attr_debugcmd);
-        class_device_create_file(sfp->class_dev,&dip->attr_debuginfo);
+        ret = class_device_create_file(sfp->class_dev,&dip->attr_debugcmd);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                dip->debugcmd_created_ok = !0;
+        }
+        ret = class_device_create_file(sfp->class_dev,&dip->attr_debuginfo);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                dip->debuginfo_created_ok = !0;
+        }
 }
 
 
 static void pvr2_sysfs_tear_down_debugifc(struct pvr2_sysfs *sfp)
 {
         if (!sfp->debugifc) return;
-        class_device_remove_file(sfp->class_dev,
-                                 &sfp->debugifc->attr_debuginfo);
-        class_device_remove_file(sfp->class_dev,&sfp->debugifc->attr_debugcmd);
+        if (sfp->debugifc->debuginfo_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->debugifc->attr_debuginfo);
+        }
+        if (sfp->debugifc->debugcmd_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->debugifc->attr_debugcmd);
+        }
         kfree(sfp->debugifc);
         sfp->debugifc = NULL;
 }
@@ -645,7 +676,9 @@ static void pvr2_sysfs_tear_down_controls(struct pvr2_sysfs *sfp)
         struct pvr2_sysfs_ctl_item *cip1,*cip2;
         for (cip1 = sfp->item_first; cip1; cip1 = cip2) {
                 cip2 = cip1->item_next;
-                sysfs_remove_group(&sfp->class_dev->kobj,&cip1->grp);
+                if (cip1->created_ok) {
+                        sysfs_remove_group(&sfp->class_dev->kobj,&cip1->grp);
+                }
                 pvr2_sysfs_trace("Destroying pvr2_sysfs_ctl_item id=%p",cip1);
                 kfree(cip1);
         }
@@ -675,8 +708,14 @@ static void class_dev_destroy(struct pvr2_sysfs *sfp)
         pvr2_sysfs_tear_down_debugifc(sfp);
 #endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
         pvr2_sysfs_tear_down_controls(sfp);
-        class_device_remove_file(sfp->class_dev,&sfp->attr_v4l_minor_number);
-        class_device_remove_file(sfp->class_dev,&sfp->attr_unit_number);
+        if (sfp->v4l_minor_number_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->attr_v4l_minor_number);
+        }
+        if (sfp->unit_number_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->attr_unit_number);
+        }
         pvr2_sysfs_trace("Destroying class_dev id=%p",sfp->class_dev);
         sfp->class_dev->class_data = NULL;
         class_device_unregister(sfp->class_dev);
@@ -709,6 +748,8 @@ static void class_dev_create(struct pvr2_sysfs *sfp,
 {
         struct usb_device *usb_dev;
         struct class_device *class_dev;
+        int ret;
+
         usb_dev = pvr2_hdw_get_dev(sfp->channel.hdw);
         if (!usb_dev) return;
         class_dev = kmalloc(sizeof(*class_dev),GFP_KERNEL);
@@ -733,20 +774,40 @@ static void class_dev_create(struct pvr2_sysfs *sfp,
 
         sfp->class_dev = class_dev;
         class_dev->class_data = sfp;
-        class_device_register(class_dev);
+        ret = class_device_register(class_dev);
+        if (ret) {
+                printk(KERN_ERR "%s: class_device_register failed\n",
+                       __FUNCTION__);
+                kfree(class_dev);
+                return;
+        }
 
         sfp->attr_v4l_minor_number.attr.owner = THIS_MODULE;
         sfp->attr_v4l_minor_number.attr.name = "v4l_minor_number";
         sfp->attr_v4l_minor_number.attr.mode = S_IRUGO;
         sfp->attr_v4l_minor_number.show = v4l_minor_number_show;
         sfp->attr_v4l_minor_number.store = NULL;
-        class_device_create_file(sfp->class_dev,&sfp->attr_v4l_minor_number);
+        ret = class_device_create_file(sfp->class_dev,
+                                       &sfp->attr_v4l_minor_number);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                sfp->v4l_minor_number_created_ok = !0;
+        }
+
         sfp->attr_unit_number.attr.owner = THIS_MODULE;
         sfp->attr_unit_number.attr.name = "unit_number";
         sfp->attr_unit_number.attr.mode = S_IRUGO;
         sfp->attr_unit_number.show = unit_number_show;
         sfp->attr_unit_number.store = NULL;
-        class_device_create_file(sfp->class_dev,&sfp->attr_unit_number);
+        ret = class_device_create_file(sfp->class_dev,&sfp->attr_unit_number);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                sfp->unit_number_created_ok = !0;
+        }
 
         pvr2_sysfs_add_controls(sfp);
 #ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
diff --git a/drivers/media/video/pwc/Kconfig b/drivers/media/video/pwc/Kconfig
index 697145e0bf15..8fdf7101d3bf 100644
--- a/drivers/media/video/pwc/Kconfig
+++ b/drivers/media/video/pwc/Kconfig
@@ -30,7 +30,7 @@ config USB_PWC
 
 config USB_PWC_DEBUG
         bool "USB Philips Cameras verbose debug"
-        depends USB_PWC
+        depends on USB_PWC
         help
           Say Y here in order to have the pwc driver generate verbose debugging
           messages.
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 47d0d83a0264..d4703944df9c 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -160,6 +160,7 @@ static struct file_operations pwc_fops = {
         .poll =         pwc_video_poll,
         .mmap =         pwc_video_mmap,
         .ioctl =        pwc_video_ioctl,
+        .compat_ioctl = v4l_compat_ioctl32,
         .llseek =       no_llseek,
 };
 static struct video_device pwc_template = {
diff --git a/drivers/media/video/saa7134/Kconfig b/drivers/media/video/saa7134/Kconfig
index e1c1805df1fb..f5543166d193 100644
--- a/drivers/media/video/saa7134/Kconfig
+++ b/drivers/media/video/saa7134/Kconfig
@@ -40,6 +40,7 @@ config VIDEO_SAA7134_DVB
         depends on VIDEO_SAA7134 && DVB_CORE
         select VIDEO_BUF_DVB
         select FW_LOADER
+        select DVB_PLL
         ---help---
           This adds support for DVB cards based on the
           Philips saa7134 chip.
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index f1fd69e7f119..d73cff1970ae 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -997,9 +997,9 @@ static int saa7134_alsa_init(void)
         struct saa7134_dev *dev = NULL;
         struct list_head *list;
 
-        if (!dmasound_init && !dmasound_exit) {
-                dmasound_init = alsa_device_init;
-                dmasound_exit = alsa_device_exit;
+        if (!saa7134_dmasound_init && !saa7134_dmasound_exit) {
+                saa7134_dmasound_init = alsa_device_init;
+                saa7134_dmasound_exit = alsa_device_exit;
         } else {
                 printk(KERN_WARNING "saa7134 ALSA: can't load, DMA sound handler already assigned (probably to OSS)\n");
                 return -EBUSY;
@@ -1036,8 +1036,8 @@ static void saa7134_alsa_exit(void)
                 snd_card_free(snd_saa7134_cards[idx]);
         }
 
-        dmasound_init = NULL;
-        dmasound_exit = NULL;
+        saa7134_dmasound_init = NULL;
+        saa7134_dmasound_exit = NULL;
         printk(KERN_INFO "saa7134 ALSA driver for DMA sound unloaded\n");
 
         return;
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index 6e97cc84ba89..be3a81fc90a2 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -95,8 +95,8 @@ LIST_HEAD(saa7134_devlist);
 static LIST_HEAD(mops_list);
 static unsigned int saa7134_devcount;
 
-int (*dmasound_init)(struct saa7134_dev *dev);
-int (*dmasound_exit)(struct saa7134_dev *dev);
+int (*saa7134_dmasound_init)(struct saa7134_dev *dev);
+int (*saa7134_dmasound_exit)(struct saa7134_dev *dev);
 
 #define dprintk(fmt, arg...)    if (core_debug) \
         printk(KERN_DEBUG "%s/core: " fmt, dev->name , ## arg)
@@ -1008,8 +1008,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
         /* check for signal */
         saa7134_irq_video_intl(dev);
 
-        if (dmasound_init && !dev->dmasound.priv_data) {
-                dmasound_init(dev);
+        if (saa7134_dmasound_init && !dev->dmasound.priv_data) {
+                saa7134_dmasound_init(dev);
         }
 
         return 0;
@@ -1036,8 +1036,8 @@ static void __devexit saa7134_finidev(struct pci_dev *pci_dev)
         struct saa7134_mpeg_ops *mops;
 
         /* Release DMA sound modules if present */
-        if (dmasound_exit && dev->dmasound.priv_data) {
-                dmasound_exit(dev);
+        if (saa7134_dmasound_exit && dev->dmasound.priv_data) {
+                saa7134_dmasound_exit(dev);
         }
 
         /* debugging ... */
@@ -1169,8 +1169,8 @@ EXPORT_SYMBOL(saa7134_boards);
 
 /* ----------------- for the DMA sound modules --------------- */
 
-EXPORT_SYMBOL(dmasound_init);
-EXPORT_SYMBOL(dmasound_exit);
+EXPORT_SYMBOL(saa7134_dmasound_init);
+EXPORT_SYMBOL(saa7134_dmasound_exit);
 EXPORT_SYMBOL(saa7134_pgtable_free);
 EXPORT_SYMBOL(saa7134_pgtable_build);
 EXPORT_SYMBOL(saa7134_pgtable_alloc);
diff --git a/drivers/media/video/saa7134/saa7134-oss.c b/drivers/media/video/saa7134/saa7134-oss.c
index 3895d05804ae..2e3ba5f31453 100644
--- a/drivers/media/video/saa7134/saa7134-oss.c
+++ b/drivers/media/video/saa7134/saa7134-oss.c
@@ -993,9 +993,9 @@ static int saa7134_oss_init(void)
         struct saa7134_dev *dev = NULL;
         struct list_head *list;
 
-        if (!dmasound_init && !dmasound_exit) {
-                dmasound_init = oss_device_init;
-                dmasound_exit = oss_device_exit;
+        if (!saa7134_dmasound_init && !saa7134_dmasound_exit) {
+                saa7134_dmasound_init = oss_device_init;
+                saa7134_dmasound_exit = oss_device_exit;
         } else {
                 printk(KERN_WARNING "saa7134 OSS: can't load, DMA sound handler already assigned (probably to ALSA)\n");
                 return -EBUSY;
@@ -1037,8 +1037,8 @@ static void saa7134_oss_exit(void)
 
         }
 
-        dmasound_init = NULL;
-        dmasound_exit = NULL;
+        saa7134_dmasound_init = NULL;
+        saa7134_dmasound_exit = NULL;
 
         printk(KERN_INFO "saa7134 OSS driver for DMA sound unloaded\n");
 
diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c
index e4156ec9c6d7..2c171af9a9f2 100644
--- a/drivers/media/video/saa7134/saa7134-video.c
+++ b/drivers/media/video/saa7134/saa7134-video.c
@@ -40,7 +40,7 @@
 
 static unsigned int video_debug   = 0;
 static unsigned int gbuffers      = 8;
-static unsigned int noninterlaced = 0;
+static unsigned int noninterlaced = 1;
 static unsigned int gbufsize      = 720*576*4;
 static unsigned int gbufsize_max  = 720*576*4;
 module_param(video_debug, int, 0644);
@@ -48,7 +48,7 @@ MODULE_PARM_DESC(video_debug,"enable debug messages [video]");
 module_param(gbuffers, int, 0444);
 MODULE_PARM_DESC(gbuffers,"number of capture buffers, range 2-32");
 module_param(noninterlaced, int, 0644);
-MODULE_PARM_DESC(noninterlaced,"video input is noninterlaced");
+MODULE_PARM_DESC(noninterlaced,"capture non interlaced video");
 
 #define dprintk(fmt, arg...)    if (video_debug) \
         printk(KERN_DEBUG "%s/video: " fmt, dev->name , ## arg)
@@ -2087,7 +2087,7 @@ static int video_do_ioctl(struct inode *inode, struct file *file,
                 struct v4l2_format *f = arg;
                 return saa7134_try_fmt(dev,fh,f);
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGMBUF:
         {
                 struct video_mbuf *mbuf = arg;
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index d5ee99c574cc..c04ce6152fd5 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -586,8 +586,8 @@ void saa7134_dma_free(struct videobuf_queue *q,struct saa7134_buf *buf);
 
 int saa7134_set_dmabits(struct saa7134_dev *dev);
 
-extern int (*dmasound_init)(struct saa7134_dev *dev);
-extern int (*dmasound_exit)(struct saa7134_dev *dev);
+extern int (*saa7134_dmasound_init)(struct saa7134_dev *dev);
+extern int (*saa7134_dmasound_exit)(struct saa7134_dev *dev);
 
 
 /* ----------------------------------------------------------- */
diff --git a/drivers/media/video/stradis.c b/drivers/media/video/stradis.c
index b36ba9fa3a28..5686547ba76a 100644
--- a/drivers/media/video/stradis.c
+++ b/drivers/media/video/stradis.c
@@ -2181,7 +2181,6 @@ static struct pci_device_id stradis_pci_tbl[] = {
         { 0 }
 };
 
-MODULE_DEVICE_TABLE(pci, stradis_pci_tbl);
 
 static struct pci_driver stradis_driver = {
         .name = "stradis",
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index f7eb402d5f2b..40590bae5ff7 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -196,14 +196,6 @@ static void set_type(struct i2c_client *c, unsigned int type,
                 i2c_master_send(c, buffer, 4);
                 default_tuner_init(c);
                 break;
-        case TUNER_LG_TDVS_H06XF:
-                /* Set the Auxiliary Byte. */
-                buffer[2] &= ~0x20;
-                buffer[2] |= 0x18;
-                buffer[3] = 0x20;
-                i2c_master_send(c, buffer, 4);
-                default_tuner_init(c);
-                break;
         case TUNER_PHILIPS_TD1316:
                 buffer[0] = 0x0b;
                 buffer[1] = 0xdc;
@@ -598,6 +590,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 if (t->standby)
                         t->standby (client);
                 break;
+#ifdef CONFIG_VIDEO_V4L1
         case VIDIOCSAUDIO:
                 if (check_mode(t, "VIDIOCSAUDIO") == EINVAL)
                         return 0;
@@ -607,17 +600,6 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 /* Should be implemented, since bttv calls it */
                 tuner_dbg("VIDIOCSAUDIO not implemented.\n");
                 break;
-        case TDA9887_SET_CONFIG:
-                if (t->type == TUNER_TDA9887) {
-                        int *i = arg;
-
-                        t->tda9887_config = *i;
-                        set_freq(client, t->tv_freq);
-                }
-                break;
-        /* --- v4l ioctls --- */
-        /* take care: bttv does userspace copying, we'll get a
-           kernel pointer here... */
         case VIDIOCSCHAN:
                 {
                         static const v4l2_std_id map[] = {
@@ -701,7 +683,18 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                                     ? VIDEO_SOUND_STEREO : VIDEO_SOUND_MONO;
                         return 0;
                 }
+#endif
+        case TDA9887_SET_CONFIG:
+                if (t->type == TUNER_TDA9887) {
+                        int *i = arg;
 
+                        t->tda9887_config = *i;
+                        set_freq(client, t->tv_freq);
+                }
+                break;
+        /* --- v4l ioctls --- */
+        /* take care: bttv does userspace copying, we'll get a
+           kernel pointer here... */
         case VIDIOC_S_STD:
                 {
                         v4l2_std_id *id = arg;
diff --git a/drivers/media/video/tuner-simple.c b/drivers/media/video/tuner-simple.c
index d071c5cbf013..abe37cf632c6 100644
--- a/drivers/media/video/tuner-simple.c
+++ b/drivers/media/video/tuner-simple.c
@@ -339,7 +339,20 @@ static void default_set_tv_freq(struct i2c_client *c, unsigned int freq)
         if (4 != (rc = i2c_master_send(c,buffer,4)))
                 tuner_warn("i2c i/o error: rc == %d (should be 4)\n",rc);
 
-        if (t->type == TUNER_MICROTUNE_4042FI5) {
+        switch (t->type) {
+        case TUNER_LG_TDVS_H06XF:
+                /* Set the Auxiliary Byte. */
+                buffer[0] = buffer[2];
+                buffer[0] &= ~0x20;
+                buffer[0] |= 0x18;
+                buffer[1] = 0x20;
+                tuner_dbg("tv 0x%02x 0x%02x\n",buffer[0],buffer[1]);
+
+                if (2 != (rc = i2c_master_send(c,buffer,2)))
+                        tuner_warn("i2c i/o error: rc == %d (should be 2)\n",rc);
+                break;
+        case TUNER_MICROTUNE_4042FI5:
+        {
                 // FIXME - this may also work for other tuners
                 unsigned long timeout = jiffies + msecs_to_jiffies(1);
                 u8 status_byte = 0;
@@ -364,10 +377,12 @@ static void default_set_tv_freq(struct i2c_client *c, unsigned int freq)
                 buffer[2] = config;
                 buffer[3] = cb;
                 tuner_dbg("tv 0x%02x 0x%02x 0x%02x 0x%02x\n",
-                       buffer[0],buffer[1],buffer[2],buffer[3]);
+                          buffer[0],buffer[1],buffer[2],buffer[3]);
 
                 if (4 != (rc = i2c_master_send(c,buffer,4)))
                         tuner_warn("i2c i/o error: rc == %d (should be 4)\n",rc);
+                break;
+        }
         }
 }
 
diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
index a167e17c6dcd..8b542599ed47 100644
--- a/drivers/media/video/tuner-types.c
+++ b/drivers/media/video/tuner-types.c
@@ -926,11 +926,17 @@ static struct tuner_params tuner_lg_tdvs_h06xf_params[] = {
 
 /* ------------ TUNER_YMEC_TVF66T5_B_DFF - Philips PAL ------------ */
 
+static struct tuner_range tuner_ymec_tvf66t5_b_dff_pal_ranges[] = {
+        { 16 * 160.25 /*MHz*/, 0x8e, 0x01, },
+        { 16 * 464.25 /*MHz*/, 0x8e, 0x02, },
+        { 16 * 999.99        , 0x8e, 0x08, },
+};
+
 static struct tuner_params tuner_ymec_tvf66t5_b_dff_params[] = {
         {
                 .type   = TUNER_PARAM_TYPE_PAL,
-                .ranges = tuner_tena_9533_di_pal_ranges,
-                .count  = ARRAY_SIZE(tuner_tena_9533_di_pal_ranges),
+                .ranges = tuner_ymec_tvf66t5_b_dff_pal_ranges,
+                .count  = ARRAY_SIZE(tuner_ymec_tvf66t5_b_dff_pal_ranges),
         },
 };
 
@@ -1027,10 +1033,11 @@ static struct tuner_params tuner_tnf_5335mf_params[] = {
 /* 70-79 */
 /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
 
+/* '+ 4' turns on the Low Noise Amplifier */
 static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
-        { 16 * 130.00 /*MHz*/, 0xce, 0x01, },
-        { 16 * 364.50 /*MHz*/, 0xce, 0x02, },
-        { 16 * 999.99        , 0xce, 0x08, },
+        { 16 * 130.00 /*MHz*/, 0xce, 0x01 + 4, },
+        { 16 * 364.50 /*MHz*/, 0xce, 0x02 + 4, },
+        { 16 * 999.99        , 0xce, 0x08 + 4, },
 };
 
 static struct tuner_params tuner_samsung_tcpn_2121p30a_params[] = {
@@ -1060,10 +1067,11 @@ static struct tuner_params tuner_thomson_fe6600_params[] = {
 
 /* ------------ TUNER_SAMSUNG_TCPG_6121P30A - Samsung PAL ------------ */
 
+/* '+ 4' turns on the Low Noise Amplifier */
 static struct tuner_range tuner_samsung_tcpg_6121p30a_pal_ranges[] = {
-        { 16 * 146.25 /*MHz*/, 0xce, 0x01, },
-        { 16 * 428.50 /*MHz*/, 0xce, 0x02, },
-        { 16 * 999.99        , 0xce, 0x08, },
+        { 16 * 146.25 /*MHz*/, 0xce, 0x01 + 4, },
+        { 16 * 428.50 /*MHz*/, 0xce, 0x02 + 4, },
+        { 16 * 999.99        , 0xce, 0x08 + 4, },
 };
 
 static struct tuner_params tuner_samsung_tcpg_6121p30a_params[] = {
diff --git a/drivers/media/video/usbvideo/Kconfig b/drivers/media/video/usbvideo/Kconfig
index 59fb899f31f3..a0fd82b924f2 100644
--- a/drivers/media/video/usbvideo/Kconfig
+++ b/drivers/media/video/usbvideo/Kconfig
@@ -3,7 +3,7 @@ config VIDEO_USBVIDEO
 
 config USB_VICAM
         tristate "USB 3com HomeConnect (aka vicam) support (EXPERIMENTAL)"
-        depends on USB && VIDEO_V4L1 && EXPERIMENTAL
+        depends on USB && VIDEO_DEV && VIDEO_V4L1 && EXPERIMENTAL
         select VIDEO_USBVIDEO
         ---help---
           Say Y here if you have 3com homeconnect camera (vicam).
@@ -13,7 +13,7 @@ config USB_VICAM
 
 config USB_IBMCAM
         tristate "USB IBM (Xirlink) C-it Camera support"
-        depends on USB && VIDEO_V4L1
+        depends on USB && VIDEO_DEV && VIDEO_V4L1
         select VIDEO_USBVIDEO
         ---help---
           Say Y here if you want to connect a IBM "C-It" camera, also known as
@@ -28,7 +28,7 @@ config USB_IBMCAM
 
 config USB_KONICAWC
         tristate "USB Konica Webcam support"
-        depends on USB && VIDEO_V4L1
+        depends on USB && VIDEO_DEV && VIDEO_V4L1
         select VIDEO_USBVIDEO
         ---help---
           Say Y here if you want support for webcams based on a Konica
@@ -39,7 +39,7 @@ config USB_KONICAWC
 
 config USB_QUICKCAM_MESSENGER
         tristate "USB Logitech Quickcam Messenger"
-        depends on USB && VIDEO_DEV
+        depends on USB && VIDEO_DEV && VIDEO_V4L1
         select VIDEO_USBVIDEO
         ---help---
           Say Y or M here to enable support for the USB Logitech Quickcam
diff --git a/drivers/media/video/v4l1-compat.c b/drivers/media/video/v4l1-compat.c
index d83a2c84d233..d7c3fcbc80f7 100644
--- a/drivers/media/video/v4l1-compat.c
+++ b/drivers/media/video/v4l1-compat.c
@@ -599,6 +599,10 @@ v4l_compat_translate_ioctl(struct inode         *inode,
                         dprintk("VIDIOCGPICT / VIDIOC_G_FMT: %d\n",err);
                         break;
                 }
+
+                pict->depth   = ((fmt2->fmt.pix.bytesperline<<3)
+                                 + (fmt2->fmt.pix.width-1) )
+                                 /fmt2->fmt.pix.width;
                 pict->palette = pixelformat_to_palette(
                         fmt2->fmt.pix.pixelformat);
                 break;
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index f06dc19e504a..8d972ffdaf98 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -202,7 +202,7 @@ static char *v4l2_memory_names[] = {
 /* ------------------------------------------------------------------ */
 /* debug help functions                                               */
 
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 static const char *v4l1_ioctls[] = {
         [_IOC_NR(VIDIOCGCAP)]       = "VIDIOCGCAP",
         [_IOC_NR(VIDIOCGCHAN)]      = "VIDIOCGCHAN",
@@ -301,7 +301,7 @@ static const char *v4l2_ioctls[] = {
 #define V4L2_IOCTLS ARRAY_SIZE(v4l2_ioctls)
 
 static const char *v4l2_int_ioctls[] = {
-#ifdef HAVE_VIDEO_DECODER
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         [_IOC_NR(DECODER_GET_CAPABILITIES)]    = "DECODER_GET_CAPABILITIES",
         [_IOC_NR(DECODER_GET_STATUS)]          = "DECODER_GET_STATUS",
         [_IOC_NR(DECODER_SET_NORM)]            = "DECODER_SET_NORM",
@@ -367,7 +367,7 @@ void v4l_printk_ioctl(unsigned int cmd)
                        (_IOC_NR(cmd) < V4L2_INT_IOCTLS) ?
                        v4l2_int_ioctls[_IOC_NR(cmd)] : "UNKNOWN", dir, cmd);
                 break;
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case 'v':
                 printk("v4l1 ioctl %s, dir=%s (0x%08x)\n",
                        (_IOC_NR(cmd) < V4L1_IOCTLS) ?
@@ -414,6 +414,7 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                 printk ("%s: tuner type=%d\n", s, *p);
                 break;
         }
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case DECODER_SET_VBI_BYPASS:
         case DECODER_ENABLE_OUTPUT:
         case DECODER_GET_STATUS:
@@ -424,6 +425,7 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
         case VIDIOCCAPTURE:
         case VIDIOCSYNC:
         case VIDIOCSWRITEMODE:
+#endif
         case TUNER_SET_TYPE_ADDR:
         case TUNER_SET_STANDBY:
         case TDA9887_SET_CONFIG:
@@ -755,6 +757,7 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                                 p->afc);
                 break;
         }
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGVBIFMT:
         case VIDIOCSVBIFMT:
         {
@@ -924,6 +927,14 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                                 p->clipcount);
                 break;
         }
+        case VIDIOCGFREQ:
+        case VIDIOCSFREQ:
+        {
+                unsigned long *p=arg;
+                printk ("%s: value=%lu\n", s, *p);
+                break;
+        }
+#endif
         case VIDIOC_INT_AUDIO_CLOCK_FREQ:
         case VIDIOC_INT_I2S_CLOCK_FREQ:
         case VIDIOC_INT_S_STANDBY:
@@ -933,13 +944,6 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                 printk ("%s: value=%d\n", s, *p);
                 break;
         }
-        case VIDIOCGFREQ:
-        case VIDIOCSFREQ:
-        {
-                unsigned long *p=arg;
-                printk ("%s: value=%lu\n", s, *p);
-                break;
-        }
         case VIDIOC_G_STD:
         case VIDIOC_S_STD:
         case VIDIOC_QUERYSTD:
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index b26ebaff226f..88bf2af2a0e7 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -760,7 +760,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                 ret=vfd->vidioc_overlay(file, fh, *i);
                 break;
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         /* --- streaming capture ------------------------------------- */
         case VIDIOCGMBUF:
         {
@@ -1512,6 +1512,7 @@ int video_register_device(struct video_device *vfd, int type, int nr)
         int i=0;
         int base;
         int end;
+        int ret;
         char *name_base;
 
         switch(type)
@@ -1537,6 +1538,8 @@ int video_register_device(struct video_device *vfd, int type, int nr)
                         name_base = "radio";
                         break;
                 default:
+                        printk(KERN_ERR "%s called with unknown type: %d\n",
+                               __FUNCTION__, type);
                         return -1;
         }
 
@@ -1571,9 +1574,18 @@ int video_register_device(struct video_device *vfd, int type, int nr)
         vfd->class_dev.class       = &video_class;
         vfd->class_dev.devt        = MKDEV(VIDEO_MAJOR, vfd->minor);
         sprintf(vfd->class_dev.class_id, "%s%d", name_base, i - base);
-        class_device_register(&vfd->class_dev);
-        class_device_create_file(&vfd->class_dev,
-                                &class_device_attr_name);
+        ret = class_device_register(&vfd->class_dev);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: class_device_register failed\n",
+                       __FUNCTION__);
+                goto fail_minor;
+        }
+        ret = class_device_create_file(&vfd->class_dev, &class_device_attr_name);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: class_device_create_file 'name' failed\n",
+                       __FUNCTION__);
+                goto fail_classdev;
+        }
 
 #if 1
         /* needed until all drivers are fixed */
@@ -1583,6 +1595,15 @@ int video_register_device(struct video_device *vfd, int type, int nr)
                        "http://lwn.net/Articles/36850/\n", vfd->name);
 #endif
         return 0;
+
+fail_classdev:
+        class_device_unregister(&vfd->class_dev);
+fail_minor:
+        mutex_lock(&videodev_lock);
+        video_device[vfd->minor] = NULL;
+        vfd->minor = -1;
+        mutex_unlock(&videodev_lock);
+        return ret;
 }
 
 /**
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index 41d23c8acbd8..841884af0cc0 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -986,7 +986,7 @@ static int vidioc_dqbuf (struct file *file, void *priv, struct v4l2_buffer *p)
                                 file->f_flags & O_NONBLOCK));
 }
 
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 static int vidiocgmbuf (struct file *file, void *priv, struct video_mbuf *mbuf)
 {
         struct vivi_fh  *fh=priv;
@@ -1328,7 +1328,7 @@ static struct video_device vivi = {
         .vidioc_s_ctrl        = vidioc_s_ctrl,
         .vidioc_streamon      = vidioc_streamon,
         .vidioc_streamoff     = vidioc_streamoff,
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         .vidiocgmbuf          = vidiocgmbuf,
 #endif
         .tvnorms              = tvnorms,
diff --git a/drivers/media/video/zoran.h b/drivers/media/video/zoran.h
index ffcda95ed9d4..8fb4a3414e0a 100644
--- a/drivers/media/video/zoran.h
+++ b/drivers/media/video/zoran.h
@@ -267,7 +267,7 @@ struct zoran_v4l_settings {
 };
 
 /* whoops, this one is undeclared if !v4l2 */
-#ifndef HAVE_V4L2
+#ifndef CONFIG_VIDEO_V4L2
 struct v4l2_jpegcompression {
         int quality;
         int APPn;
diff --git a/drivers/media/video/zoran_driver.c b/drivers/media/video/zoran_driver.c
index d9a5876eb386..5f90db27892b 100644
--- a/drivers/media/video/zoran_driver.c
+++ b/drivers/media/video/zoran_driver.c
@@ -86,7 +86,7 @@
 #include "zoran_device.h"
 #include "zoran_card.h"
 
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
         /* we declare some card type definitions here, they mean
          * the same as the v4l1 ZORAN_VID_TYPE above, except it's v4l2 */
 #define ZORAN_V4L2_VID_FLAGS ( \
@@ -103,7 +103,7 @@ const struct zoran_format zoran_formats[] = {
         {
                 .name = "15-bit RGB",
                 .palette = VIDEO_PALETTE_RGB555,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
 #ifdef __LITTLE_ENDIAN
                 .fourcc = V4L2_PIX_FMT_RGB555,
 #else
@@ -117,7 +117,7 @@ const struct zoran_format zoran_formats[] = {
         }, {
                 .name = "16-bit RGB",
                 .palette = VIDEO_PALETTE_RGB565,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
 #ifdef __LITTLE_ENDIAN
                 .fourcc = V4L2_PIX_FMT_RGB565,
 #else
@@ -131,7 +131,7 @@ const struct zoran_format zoran_formats[] = {
         }, {
                 .name = "24-bit RGB",
                 .palette = VIDEO_PALETTE_RGB24,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
 #ifdef __LITTLE_ENDIAN
                 .fourcc = V4L2_PIX_FMT_BGR24,
 #else
@@ -145,7 +145,7 @@ const struct zoran_format zoran_formats[] = {
         }, {
                 .name = "32-bit RGB",
                 .palette = VIDEO_PALETTE_RGB32,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
 #ifdef __LITTLE_ENDIAN
                 .fourcc = V4L2_PIX_FMT_BGR32,
 #else
@@ -159,7 +159,7 @@ const struct zoran_format zoran_formats[] = {
         }, {
                 .name = "4:2:2, packed, YUYV",
                 .palette = VIDEO_PALETTE_YUV422,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
                 .fourcc = V4L2_PIX_FMT_YUYV,
                 .colorspace = V4L2_COLORSPACE_SMPTE170M,
 #endif
@@ -169,7 +169,7 @@ const struct zoran_format zoran_formats[] = {
         }, {
                 .name = "Hardware-encoded Motion-JPEG",
                 .palette = -1,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
                 .fourcc = V4L2_PIX_FMT_MJPEG,
                 .colorspace = V4L2_COLORSPACE_SMPTE170M,
 #endif
@@ -210,7 +210,7 @@ static int lock_norm = 0;	/* 1=Don't change TV standard (norm) */
 module_param(lock_norm, int, 0);
 MODULE_PARM_DESC(lock_norm, "Users can't change norm");
 
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
         /* small helper function for calculating buffersizes for v4l2
          * we calculate the nearest higher power-of-two, which
          * will be the recommended buffersize */
@@ -1761,7 +1761,7 @@ setup_overlay (struct file *file,
         return wait_grab_pending(zr);
 }
 
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
         /* get the status of a buffer in the clients buffer queue */
 static int
 zoran_v4l2_buffer_status (struct file        *file,
@@ -2676,7 +2676,7 @@ zoran_do_ioctl (struct inode *inode,
         }
                 break;
 
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
 
                 /* The new video4linux2 capture interface - much nicer than video4linux1, since
                  * it allows for integrating the JPEG capturing calls inside standard v4l2
@@ -4689,7 +4689,7 @@ static struct file_operations zoran_fops = {
 struct video_device zoran_template __devinitdata = {
         .name = ZORAN_NAME,
         .type = ZORAN_VID_TYPE,
-#ifdef HAVE_V4L2
+#ifdef CONFIG_VIDEO_V4L2
         .type2 = ZORAN_V4L2_VID_FLAGS,
 #endif
         .hardware = ZORAN_HARDWARE,
diff --git a/drivers/message/fusion/Kconfig b/drivers/message/fusion/Kconfig
index bbc229852881..ea31d8470510 100644
--- a/drivers/message/fusion/Kconfig
+++ b/drivers/message/fusion/Kconfig
@@ -48,10 +48,8 @@ config FUSION_SAS
           List of supported controllers:
 
           LSISAS1064
-          LSISAS1066
           LSISAS1068
           LSISAS1064E
-          LSISAS1066E
           LSISAS1068E
 
 config FUSION_MAX_SGE
diff --git a/drivers/message/fusion/Makefile b/drivers/message/fusion/Makefile
index 51740b346224..341691390e86 100644
--- a/drivers/message/fusion/Makefile
+++ b/drivers/message/fusion/Makefile
@@ -9,7 +9,6 @@
 #EXTRA_CFLAGS += -DMPT_DEBUG_EXIT
 #EXTRA_CFLAGS += -DMPT_DEBUG_FAIL
 
-
 #
 # driver/module specifics...
 #
@@ -33,6 +32,11 @@
 #  For mptfc:
 #CFLAGS_mptfc.o += -DMPT_DEBUG_FC
 
+#  For mptsas:
+#CFLAGS_mptsas.o += -DMPT_DEBUG_SAS
+#CFLAGS_mptsas.o += -DMPT_DEBUG_SAS_WIDE
+
+
 #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-} LSI_LOGIC
 
 obj-$(CONFIG_FUSION_SPI)        += mptbase.o mptscsih.o mptspi.o
diff --git a/drivers/message/fusion/lsi/fc_log.h b/drivers/message/fusion/lsi/fc_log.h
deleted file mode 100644
index dc98d46f9071..000000000000
--- a/drivers/message/fusion/lsi/fc_log.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- *  Copyright (c) 2000-2001 LSI Logic Corporation. All rights reserved.
- *
- *  NAME:           fc_log.h
- *  SUMMARY:        MPI IocLogInfo definitions for the SYMFC9xx chips
- *  DESCRIPTION:    Contains the enumerated list of values that may be returned
- *                  in the IOCLogInfo field of a MPI Default Reply Message.
- *
- *  CREATION DATE:  6/02/2000
- *  ID:             $Id: fc_log.h,v 4.6 2001/07/26 14:41:33 sschremm Exp $
- */
-
-
-/*
- * MpiIocLogInfo_t enum
- *
- * These 32 bit values are used in the IOCLogInfo field of the MPI reply
- * messages.
- * The value is 0xabcccccc where
- *          a = The type of log info as per the MPI spec. Since these codes are
- *              all for Fibre Channel this value will always be 2.
- *          b = Specifies a subclass of the firmware where
- *                  0 = FCP Initiator
- *                  1 = FCP Target
- *                  2 = LAN
- *                  3 = MPI Message Layer
- *                  4 = FC Link
- *                  5 = Context Manager
- *                  6 = Invalid Field Offset
- *                  7 = State Change Info
- *                  all others are reserved for future use
- *          c = A specific value within the subclass.
- *
- * NOTE: Any new values should be added to the end of each subclass so that the
- *       codes remain consistent across firmware releases.
- */
-typedef enum _MpiIocLogInfoFc
-{
-    MPI_IOCLOGINFO_FC_INIT_BASE                     = 0x20000000,
-    MPI_IOCLOGINFO_FC_INIT_ERROR_OUT_OF_ORDER_FRAME = 0x20000001, /* received an out of order frame - unsupported */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_BAD_START_OF_FRAME = 0x20000002, /* Bad Rx Frame, bad start of frame primative */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_BAD_END_OF_FRAME   = 0x20000003, /* Bad Rx Frame, bad end of frame primative */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_OVER_RUN           = 0x20000004, /* Bad Rx Frame, overrun */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_OTHER           = 0x20000005, /* Other errors caught by IOC which require retries */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_SUBPROC_DEAD       = 0x20000006, /* Main processor could not initialize sub-processor */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_OVERRUN         = 0x20000007, /* Scatter Gather overrun  */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_BAD_STATUS      = 0x20000008, /* Receiver detected context mismatch via invalid header */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_UNEXPECTED_FRAME= 0x20000009, /* CtxMgr detected unsupported frame type  */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_LINK_FAILURE       = 0x2000000A, /* Link failure occurred  */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_TX_TIMEOUT         = 0x2000000B, /* Transmitter timeout error */
-
-    MPI_IOCLOGINFO_FC_TARGET_BASE                   = 0x21000000,
-    MPI_IOCLOGINFO_FC_TARGET_NO_PDISC               = 0x21000001, /* not sent because we are waiting for a PDISC from the initiator */
-    MPI_IOCLOGINFO_FC_TARGET_NO_LOGIN               = 0x21000002, /* not sent because we are not logged in to the remote node */
-    MPI_IOCLOGINFO_FC_TARGET_DOAR_KILLED_BY_LIP     = 0x21000003, /* Data Out, Auto Response, not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DIAR_KILLED_BY_LIP     = 0x21000004, /* Data In, Auto Response, not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DIAR_MISSING_DATA      = 0x21000005, /* Data In, Auto Response, missing data frames */
-    MPI_IOCLOGINFO_FC_TARGET_DONR_KILLED_BY_LIP     = 0x21000006, /* Data Out, No Response, not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_WRSP_KILLED_BY_LIP     = 0x21000007, /* Auto-response after a write not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DINR_KILLED_BY_LIP     = 0x21000008, /* Data In, No Response, not completed due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DINR_MISSING_DATA      = 0x21000009, /* Data In, No Response, missing data frames */
-    MPI_IOCLOGINFO_FC_TARGET_MRSP_KILLED_BY_LIP     = 0x2100000a, /* Manual Response not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_NO_CLASS_3             = 0x2100000b, /* not sent because remote node does not support Class 3 */
-    MPI_IOCLOGINFO_FC_TARGET_LOGIN_NOT_VALID        = 0x2100000c, /* not sent because login to remote node not validated */
-    MPI_IOCLOGINFO_FC_TARGET_FROM_OUTBOUND          = 0x2100000e, /* cleared from the outbound queue after a logout */
-    MPI_IOCLOGINFO_FC_TARGET_WAITING_FOR_DATA_IN    = 0x2100000f, /* cleared waiting for data after a logout */
-
-    MPI_IOCLOGINFO_FC_LAN_BASE                      = 0x22000000,
-    MPI_IOCLOGINFO_FC_LAN_TRANS_SGL_MISSING         = 0x22000001, /* Transaction Context Sgl Missing */
-    MPI_IOCLOGINFO_FC_LAN_TRANS_WRONG_PLACE         = 0x22000002, /* Transaction Context found before an EOB */
-    MPI_IOCLOGINFO_FC_LAN_TRANS_RES_BITS_SET        = 0x22000003, /* Transaction Context value has reserved bits set */
-    MPI_IOCLOGINFO_FC_LAN_WRONG_SGL_FLAG            = 0x22000004, /* Invalid SGL Flags */
-
-    MPI_IOCLOGINFO_FC_MSG_BASE                      = 0x23000000,
-
-    MPI_IOCLOGINFO_FC_LINK_BASE                     = 0x24000000,
-    MPI_IOCLOGINFO_FC_LINK_LOOP_INIT_TIMEOUT        = 0x24000001, /* Loop initialization timed out */
-    MPI_IOCLOGINFO_FC_LINK_ALREADY_INITIALIZED      = 0x24000002, /* Another system controller already initialized the loop */
-    MPI_IOCLOGINFO_FC_LINK_LINK_NOT_ESTABLISHED     = 0x24000003, /* Not synchronized to signal or still negotiating (possible cable problem) */
-    MPI_IOCLOGINFO_FC_LINK_CRC_ERROR                = 0x24000004, /* CRC check detected error on received frame */
-
-    MPI_IOCLOGINFO_FC_CTX_BASE                      = 0x25000000,
-
-    MPI_IOCLOGINFO_FC_INVALID_FIELD_BYTE_OFFSET     = 0x26000000, /* The lower 24 bits give the byte offset of the field in the request message that is invalid */
-    MPI_IOCLOGINFO_FC_INVALID_FIELD_MAX_OFFSET      = 0x26ffffff,
-
-    MPI_IOCLOGINFO_FC_STATE_CHANGE                  = 0x27000000  /* The lower 24 bits give additional information concerning state change */
-
-} MpiIocLogInfoFc_t;
diff --git a/drivers/message/fusion/lsi/mpi.h b/drivers/message/fusion/lsi/mpi.h
index 02cdc840a06b..81ad77622dac 100644
--- a/drivers/message/fusion/lsi/mpi.h
+++ b/drivers/message/fusion/lsi/mpi.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Message independent structures and definitions
  *  Creation Date:  July 27, 2000
  *
- *    mpi.h Version:  01.05.10
+ *    mpi.h Version:  01.05.11
  *
  *  Version History
  *  ---------------
@@ -76,6 +76,7 @@
  *                      Added EEDP IOCStatus codes.
  *  08-03-05  01.05.09  Bumped MPI_HEADER_VERSION_UNIT.
  *  08-30-05  01.05.10  Added 2 new IOCStatus codes for Target.
+ *  03-27-06  01.05.11  Bumped MPI_HEADER_VERSION_UNIT.
  *  --------------------------------------------------------------------------
  */
 
@@ -106,7 +107,7 @@
 /* Note: The major versions of 0xe0 through 0xff are reserved */
 
 /* versioning for this MPI header set */
-#define MPI_HEADER_VERSION_UNIT             (0x0C)
+#define MPI_HEADER_VERSION_UNIT             (0x0D)
 #define MPI_HEADER_VERSION_DEV              (0x00)
 #define MPI_HEADER_VERSION_UNIT_MASK        (0xFF00)
 #define MPI_HEADER_VERSION_UNIT_SHIFT       (8)
diff --git a/drivers/message/fusion/lsi/mpi_cnfg.h b/drivers/message/fusion/lsi/mpi_cnfg.h
index b1becec27e1b..47e13e360c10 100644
--- a/drivers/message/fusion/lsi/mpi_cnfg.h
+++ b/drivers/message/fusion/lsi/mpi_cnfg.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Config message, structures, and Pages
  *  Creation Date:  July 27, 2000
  *
- *    mpi_cnfg.h Version:  01.05.11
+ *    mpi_cnfg.h Version:  01.05.12
  *
  *  Version History
  *  ---------------
@@ -266,6 +266,16 @@
  *                      Added postpone SATA Init bit to SAS IO Unit Page 1
  *                      ControlFlags.
  *                      Changed LogEntry format for Log Page 0.
+ *  03-27-06  01.05.12  Added two new Flags defines for Manufacturing Page 4.
+ *                      Added Manufacturing Page 7.
+ *                      Added MPI_IOCPAGE2_CAP_FLAGS_RAID_64_BIT_ADDRESSING.
+ *                      Added IOC Page 6.
+ *                      Added PrevBootDeviceForm field to CONFIG_PAGE_BIOS_2.
+ *                      Added MaxLBAHigh field to RAID Volume Page 0.
+ *                      Added Nvdata version fields to SAS IO Unit Page 0.
+ *                      Added AdditionalControlFlags, MaxTargetPortConnectTime,
+ *                      ReportDeviceMissingDelay, and IODeviceMissingDelay
+ *                      fields to SAS IO Unit Page 1.
  *  --------------------------------------------------------------------------
  */
 
@@ -631,9 +641,11 @@ typedef struct _CONFIG_PAGE_MANUFACTURING_4
 } CONFIG_PAGE_MANUFACTURING_4, MPI_POINTER PTR_CONFIG_PAGE_MANUFACTURING_4,
   ManufacturingPage4_t, MPI_POINTER pManufacturingPage4_t;
 
-#define MPI_MANUFACTURING4_PAGEVERSION                  (0x03)
+#define MPI_MANUFACTURING4_PAGEVERSION                  (0x04)
 
 /* defines for the Flags field */
+#define MPI_MANPAGE4_FORCE_BAD_BLOCK_TABLE              (0x80)
+#define MPI_MANPAGE4_FORCE_OFFLINE_FAILOVER             (0x40)
 #define MPI_MANPAGE4_IME_DISABLE                        (0x20)
 #define MPI_MANPAGE4_IM_DISABLE                         (0x10)
 #define MPI_MANPAGE4_IS_DISABLE                         (0x08)
@@ -668,6 +680,66 @@ typedef struct _CONFIG_PAGE_MANUFACTURING_6
 #define MPI_MANUFACTURING6_PAGEVERSION                  (0x00)
 
 
+typedef struct _MPI_MANPAGE7_CONNECTOR_INFO
+{
+    U32                         Pinout;                 /* 00h */
+    U8                          Connector[16];          /* 04h */
+    U8                          Location;               /* 14h */
+    U8                          Reserved1;              /* 15h */
+    U16                         Slot;                   /* 16h */
+    U32                         Reserved2;              /* 18h */
+} MPI_MANPAGE7_CONNECTOR_INFO, MPI_POINTER PTR_MPI_MANPAGE7_CONNECTOR_INFO,
+  MpiManPage7ConnectorInfo_t, MPI_POINTER pMpiManPage7ConnectorInfo_t;
+
+/* defines for the Pinout field */
+#define MPI_MANPAGE7_PINOUT_SFF_8484_L4                 (0x00080000)
+#define MPI_MANPAGE7_PINOUT_SFF_8484_L3                 (0x00040000)
+#define MPI_MANPAGE7_PINOUT_SFF_8484_L2                 (0x00020000)
+#define MPI_MANPAGE7_PINOUT_SFF_8484_L1                 (0x00010000)
+#define MPI_MANPAGE7_PINOUT_SFF_8470_L4                 (0x00000800)
+#define MPI_MANPAGE7_PINOUT_SFF_8470_L3                 (0x00000400)
+#define MPI_MANPAGE7_PINOUT_SFF_8470_L2                 (0x00000200)
+#define MPI_MANPAGE7_PINOUT_SFF_8470_L1                 (0x00000100)
+#define MPI_MANPAGE7_PINOUT_SFF_8482                    (0x00000002)
+#define MPI_MANPAGE7_PINOUT_CONNECTION_UNKNOWN          (0x00000001)
+
+/* defines for the Location field */
+#define MPI_MANPAGE7_LOCATION_UNKNOWN                   (0x01)
+#define MPI_MANPAGE7_LOCATION_INTERNAL                  (0x02)
+#define MPI_MANPAGE7_LOCATION_EXTERNAL                  (0x04)
+#define MPI_MANPAGE7_LOCATION_SWITCHABLE                (0x08)
+#define MPI_MANPAGE7_LOCATION_AUTO                      (0x10)
+#define MPI_MANPAGE7_LOCATION_NOT_PRESENT               (0x20)
+#define MPI_MANPAGE7_LOCATION_NOT_CONNECTED             (0x80)
+
+/*
+ * Host code (drivers, BIOS, utilities, etc.) should leave this define set to
+ * one and check NumPhys at runtime.
+ */
+#ifndef MPI_MANPAGE7_CONNECTOR_INFO_MAX
+#define MPI_MANPAGE7_CONNECTOR_INFO_MAX   (1)
+#endif
+
+typedef struct _CONFIG_PAGE_MANUFACTURING_7
+{
+    CONFIG_PAGE_HEADER          Header;                 /* 00h */
+    U32                         Reserved1;              /* 04h */
+    U32                         Reserved2;              /* 08h */
+    U32                         Flags;                  /* 0Ch */
+    U8                          EnclosureName[16];      /* 10h */
+    U8                          NumPhys;                /* 20h */
+    U8                          Reserved3;              /* 21h */
+    U16                         Reserved4;              /* 22h */
+    MPI_MANPAGE7_CONNECTOR_INFO ConnectorInfo[MPI_MANPAGE7_CONNECTOR_INFO_MAX]; /* 24h */
+} CONFIG_PAGE_MANUFACTURING_7, MPI_POINTER PTR_CONFIG_PAGE_MANUFACTURING_7,
+  ManufacturingPage7_t, MPI_POINTER pManufacturingPage7_t;
+
+#define MPI_MANUFACTURING7_PAGEVERSION                  (0x00)
+
+/* defines for the Flags field */
+#define MPI_MANPAGE7_FLAG_USE_SLOT_INFO                 (0x00000001)
+
+
 /****************************************************************************
 *   IO Unit Config Pages
 ****************************************************************************/
@@ -867,7 +939,7 @@ typedef struct _CONFIG_PAGE_IOC_2
 } CONFIG_PAGE_IOC_2, MPI_POINTER PTR_CONFIG_PAGE_IOC_2,
   IOCPage2_t, MPI_POINTER pIOCPage2_t;
 
-#define MPI_IOCPAGE2_PAGEVERSION                        (0x03)
+#define MPI_IOCPAGE2_PAGEVERSION                        (0x04)
 
 /* IOC Page 2 Capabilities flags */
 
@@ -878,6 +950,7 @@ typedef struct _CONFIG_PAGE_IOC_2
 #define MPI_IOCPAGE2_CAP_FLAGS_RAID_6_SUPPORT           (0x00000010)
 #define MPI_IOCPAGE2_CAP_FLAGS_RAID_10_SUPPORT          (0x00000020)
 #define MPI_IOCPAGE2_CAP_FLAGS_RAID_50_SUPPORT          (0x00000040)
+#define MPI_IOCPAGE2_CAP_FLAGS_RAID_64_BIT_ADDRESSING   (0x10000000)
 #define MPI_IOCPAGE2_CAP_FLAGS_SES_SUPPORT              (0x20000000)
 #define MPI_IOCPAGE2_CAP_FLAGS_SAFTE_SUPPORT            (0x40000000)
 #define MPI_IOCPAGE2_CAP_FLAGS_CROSS_CHANNEL_SUPPORT    (0x80000000)
@@ -975,6 +1048,44 @@ typedef struct _CONFIG_PAGE_IOC_5
 
 #define MPI_IOCPAGE5_PAGEVERSION                        (0x00)
 
+typedef struct _CONFIG_PAGE_IOC_6
+{
+    CONFIG_PAGE_HEADER          Header;                         /* 00h */
+    U32                         CapabilitiesFlags;              /* 04h */
+    U8                          MaxDrivesIS;                    /* 08h */
+    U8                          MaxDrivesIM;                    /* 09h */
+    U8                          MaxDrivesIME;                   /* 0Ah */
+    U8                          Reserved1;                      /* 0Bh */
+    U8                          MinDrivesIS;                    /* 0Ch */
+    U8                          MinDrivesIM;                    /* 0Dh */
+    U8                          MinDrivesIME;                   /* 0Eh */
+    U8                          Reserved2;                      /* 0Fh */
+    U8                          MaxGlobalHotSpares;             /* 10h */
+    U8                          Reserved3;                      /* 11h */
+    U16                         Reserved4;                      /* 12h */
+    U32                         Reserved5;                      /* 14h */
+    U32                         SupportedStripeSizeMapIS;       /* 18h */
+    U32                         SupportedStripeSizeMapIME;      /* 1Ch */
+    U32                         Reserved6;                      /* 20h */
+    U8                          MetadataSize;                   /* 24h */
+    U8                          Reserved7;                      /* 25h */
+    U16                         Reserved8;                      /* 26h */
+    U16                         MaxBadBlockTableEntries;        /* 28h */
+    U16                         Reserved9;                      /* 2Ah */
+    U16                         IRNvsramUsage;                  /* 2Ch */
+    U16                         Reserved10;                     /* 2Eh */
+    U32                         IRNvsramVersion;                /* 30h */
+    U32                         Reserved11;                     /* 34h */
+    U32                         Reserved12;                     /* 38h */
+} CONFIG_PAGE_IOC_6, MPI_POINTER PTR_CONFIG_PAGE_IOC_6,
+  IOCPage6_t, MPI_POINTER pIOCPage6_t;
+
+#define MPI_IOCPAGE6_PAGEVERSION                        (0x00)
+
+/* IOC Page 6 Capabilities Flags */
+
+#define MPI_IOCPAGE6_CAP_FLAGS_GLOBAL_HOT_SPARE         (0x00000001)
+
 
 /****************************************************************************
 *   BIOS Config Pages
@@ -1218,13 +1329,13 @@ typedef struct _CONFIG_PAGE_BIOS_2
     U32                         Reserved5;              /* 14h */
     U32                         Reserved6;              /* 18h */
     U8                          BootDeviceForm;         /* 1Ch */
-    U8                          Reserved7;              /* 1Dh */
+    U8                          PrevBootDeviceForm;     /* 1Ch */
     U16                         Reserved8;              /* 1Eh */
     MPI_BIOSPAGE2_BOOT_DEVICE   BootDevice;             /* 20h */
 } CONFIG_PAGE_BIOS_2, MPI_POINTER PTR_CONFIG_PAGE_BIOS_2,
   BIOSPage2_t, MPI_POINTER pBIOSPage2_t;
 
-#define MPI_BIOSPAGE2_PAGEVERSION                       (0x01)
+#define MPI_BIOSPAGE2_PAGEVERSION                       (0x02)
 
 #define MPI_BIOSPAGE2_FORM_MASK                         (0x0F)
 #define MPI_BIOSPAGE2_FORM_ADAPTER_ORDER                (0x00)
@@ -2080,7 +2191,7 @@ typedef struct _CONFIG_PAGE_RAID_VOL_0
     RAID_VOL0_STATUS        VolumeStatus;   /* 08h */
     RAID_VOL0_SETTINGS      VolumeSettings; /* 0Ch */
     U32                     MaxLBA;         /* 10h */
-    U32                     Reserved1;      /* 14h */
+    U32                     MaxLBAHigh;     /* 14h */
     U32                     StripeSize;     /* 18h */
     U32                     Reserved2;      /* 1Ch */
     U32                     Reserved3;      /* 20h */
@@ -2092,7 +2203,7 @@ typedef struct _CONFIG_PAGE_RAID_VOL_0
 } CONFIG_PAGE_RAID_VOL_0, MPI_POINTER PTR_CONFIG_PAGE_RAID_VOL_0,
   RaidVolumePage0_t, MPI_POINTER pRaidVolumePage0_t;
 
-#define MPI_RAIDVOLPAGE0_PAGEVERSION                    (0x05)
+#define MPI_RAIDVOLPAGE0_PAGEVERSION                    (0x06)
 
 /* values for RAID Volume Page 0 InactiveStatus field */
 #define MPI_RAIDVOLPAGE0_UNKNOWN_INACTIVE               (0x00)
@@ -2324,7 +2435,8 @@ typedef struct _MPI_SAS_IO_UNIT0_PHY_DATA
 typedef struct _CONFIG_PAGE_SAS_IO_UNIT_0
 {
     CONFIG_EXTENDED_PAGE_HEADER     Header;                             /* 00h */
-    U32                             Reserved1;                          /* 08h */
+    U16                             NvdataVersionDefault;               /* 08h */
+    U16                             NvdataVersionPersistent;            /* 0Ah */
     U8                              NumPhys;                            /* 0Ch */
     U8                              Reserved2;                          /* 0Dh */
     U16                             Reserved3;                          /* 0Eh */
@@ -2332,7 +2444,7 @@ typedef struct _CONFIG_PAGE_SAS_IO_UNIT_0
 } CONFIG_PAGE_SAS_IO_UNIT_0, MPI_POINTER PTR_CONFIG_PAGE_SAS_IO_UNIT_0,
   SasIOUnitPage0_t, MPI_POINTER pSasIOUnitPage0_t;
 
-#define MPI_SASIOUNITPAGE0_PAGEVERSION      (0x03)
+#define MPI_SASIOUNITPAGE0_PAGEVERSION      (0x04)
 
 /* values for SAS IO Unit Page 0 PortFlags */
 #define MPI_SAS_IOUNIT0_PORT_FLAGS_DISCOVERY_IN_PROGRESS    (0x08)
@@ -2373,12 +2485,13 @@ typedef struct _CONFIG_PAGE_SAS_IO_UNIT_0
 
 typedef struct _MPI_SAS_IO_UNIT1_PHY_DATA
 {
-    U8          Port;                   /* 00h */
-    U8          PortFlags;              /* 01h */
-    U8          PhyFlags;               /* 02h */
-    U8          MaxMinLinkRate;         /* 03h */
-    U32         ControllerPhyDeviceInfo;/* 04h */
-    U32         Reserved1;              /* 08h */
+    U8          Port;                       /* 00h */
+    U8          PortFlags;                  /* 01h */
+    U8          PhyFlags;                   /* 02h */
+    U8          MaxMinLinkRate;             /* 03h */
+    U32         ControllerPhyDeviceInfo;    /* 04h */
+    U16         MaxTargetPortConnectTime;   /* 08h */
+    U16         Reserved1;                  /* 0Ah */
 } MPI_SAS_IO_UNIT1_PHY_DATA, MPI_POINTER PTR_MPI_SAS_IO_UNIT1_PHY_DATA,
   SasIOUnit1PhyData, MPI_POINTER pSasIOUnit1PhyData;
 
@@ -2395,15 +2508,17 @@ typedef struct _CONFIG_PAGE_SAS_IO_UNIT_1
     CONFIG_EXTENDED_PAGE_HEADER Header;                             /* 00h */
     U16                         ControlFlags;                       /* 08h */
     U16                         MaxNumSATATargets;                  /* 0Ah */
-    U32                         Reserved1;                          /* 0Ch */
+    U16                         AdditionalControlFlags;             /* 0Ch */
+    U16                         Reserved1;                          /* 0Eh */
     U8                          NumPhys;                            /* 10h */
     U8                          SATAMaxQDepth;                      /* 11h */
-    U16                         Reserved2;                          /* 12h */
+    U8                          ReportDeviceMissingDelay;           /* 12h */
+    U8                          IODeviceMissingDelay;               /* 13h */
     MPI_SAS_IO_UNIT1_PHY_DATA   PhyData[MPI_SAS_IOUNIT1_PHY_MAX];   /* 14h */
 } CONFIG_PAGE_SAS_IO_UNIT_1, MPI_POINTER PTR_CONFIG_PAGE_SAS_IO_UNIT_1,
   SasIOUnitPage1_t, MPI_POINTER pSasIOUnitPage1_t;
 
-#define MPI_SASIOUNITPAGE1_PAGEVERSION      (0x05)
+#define MPI_SASIOUNITPAGE1_PAGEVERSION      (0x06)
 
 /* values for SAS IO Unit Page 1 ControlFlags */
 #define MPI_SAS_IOUNIT1_CONTROL_DEVICE_SELF_TEST            (0x8000)
@@ -2428,6 +2543,13 @@ typedef struct _CONFIG_PAGE_SAS_IO_UNIT_1
 #define MPI_SAS_IOUNIT1_CONTROL_FIRST_LVL_DISC_ONLY         (0x0002)
 #define MPI_SAS_IOUNIT1_CONTROL_CLEAR_AFFILIATION           (0x0001)
 
+/* values for SAS IO Unit Page 1 AdditionalControlFlags */
+#define MPI_SAS_IOUNIT1_ACONTROL_ALLOW_TABLE_TO_TABLE       (0x0001)
+
+/* defines for SAS IO Unit Page 1 ReportDeviceMissingDelay */
+#define MPI_SAS_IOUNIT1_REPORT_MISSING_TIMEOUT_MASK         (0x7F)
+#define MPI_SAS_IOUNIT1_REPORT_MISSING_UNIT_16              (0x80)
+
 /* values for SAS IO Unit Page 1 PortFlags */
 #define MPI_SAS_IOUNIT1_PORT_FLAGS_0_TARGET_IOC_NUM         (0x00)
 #define MPI_SAS_IOUNIT1_PORT_FLAGS_1_TARGET_IOC_NUM         (0x04)
diff --git a/drivers/message/fusion/lsi/mpi_history.txt b/drivers/message/fusion/lsi/mpi_history.txt
index 4a5f8dd1d766..582cfe7c2aa1 100644
--- a/drivers/message/fusion/lsi/mpi_history.txt
+++ b/drivers/message/fusion/lsi/mpi_history.txt
@@ -6,25 +6,25 @@
  Copyright (c) 2000-2005 LSI Logic Corporation.
 
  ---------------------------------------
- Header Set Release Version:    01.05.12
- Header Set Release Date:       08-30-05
+ Header Set Release Version:    01.05.13
+ Header Set Release Date:       03-27-06
  ---------------------------------------
 
  Filename               Current version     Prior version
  ----------             ---------------     -------------
- mpi.h                  01.05.10            01.05.09
- mpi_ioc.h              01.05.10            01.05.09
- mpi_cnfg.h             01.05.11            01.05.10
- mpi_init.h             01.05.06            01.05.06
- mpi_targ.h             01.05.05            01.05.05
+ mpi.h                  01.05.11            01.05.10
+ mpi_ioc.h              01.05.11            01.05.10
+ mpi_cnfg.h             01.05.12            01.05.11
+ mpi_init.h             01.05.07            01.05.06
+ mpi_targ.h             01.05.06            01.05.05
  mpi_fc.h               01.05.01            01.05.01
  mpi_lan.h              01.05.01            01.05.01
  mpi_raid.h             01.05.02            01.05.02
  mpi_tool.h             01.05.03            01.05.03
  mpi_inb.h              01.05.01            01.05.01
- mpi_sas.h              01.05.02            01.05.01
- mpi_type.h             01.05.02            01.05.01
- mpi_history.txt        01.05.12            01.05.11
+ mpi_sas.h              01.05.03            01.05.02
+ mpi_type.h             01.05.02            01.05.02
+ mpi_history.txt        01.05.13            01.05.12
 
 
  *  Date      Version   Description
@@ -93,6 +93,7 @@ mpi.h
  *                      Added EEDP IOCStatus codes.
  *  08-03-05  01.05.09  Bumped MPI_HEADER_VERSION_UNIT.
  *  08-30-05  01.05.10  Added 2 new IOCStatus codes for Target.
+ *  03-27-06  01.05.11  Bumped MPI_HEADER_VERSION_UNIT.
  *  --------------------------------------------------------------------------
 
 mpi_ioc.h
@@ -170,6 +171,17 @@ mpi_ioc.h
  *                      Added new ReasonCode value for SAS Device Status Change
  *                      event.
  *                      Added new family code for FC949E.
+ *  03-27-06  01.05.11  Added MPI_IOCFACTS_CAPABILITY_TLR.
+ *                      Added additional Reason Codes and more event data fields
+ *                      to EVENT_DATA_SAS_DEVICE_STATUS_CHANGE.
+ *                      Added EVENT_DATA_SAS_BROADCAST_PRIMITIVE structure and
+ *                      new event.
+ *                      Added MPI_EVENT_SAS_SMP_ERROR and event data structure.
+ *                      Added MPI_EVENT_SAS_INIT_DEVICE_STATUS_CHANGE and event
+ *                      data structure.
+ *                      Added MPI_EVENT_SAS_INIT_TABLE_OVERFLOW and event
+ *                      data structure.
+ *                      Added MPI_EXT_IMAGE_TYPE_INITIALIZATION.
  *  --------------------------------------------------------------------------
 
 mpi_cnfg.h
@@ -425,6 +437,16 @@ mpi_cnfg.h
  *                      Added postpone SATA Init bit to SAS IO Unit Page 1
  *                      ControlFlags.
  *                      Changed LogEntry format for Log Page 0.
+ *  03-27-06  01.05.12  Added two new Flags defines for Manufacturing Page 4.
+ *                      Added Manufacturing Page 7.
+ *                      Added MPI_IOCPAGE2_CAP_FLAGS_RAID_64_BIT_ADDRESSING.
+ *                      Added IOC Page 6.
+ *                      Added PrevBootDeviceForm field to CONFIG_PAGE_BIOS_2.
+ *                      Added MaxLBAHigh field to RAID Volume Page 0.
+ *                      Added Nvdata version fields to SAS IO Unit Page 0.
+ *                      Added AdditionalControlFlags, MaxTargetPortConnectTime,
+ *                      ReportDeviceMissingDelay, and IODeviceMissingDelay
+ *                      fields to SAS IO Unit Page 1.
  *  --------------------------------------------------------------------------
 
 mpi_init.h
@@ -467,6 +489,7 @@ mpi_init.h
  *                      Added four new defines for SEP SlotStatus.
  *  08-03-05  01.05.06  Fixed some MPI_SCSIIO32_MSGFLGS_ defines to make them
  *                      unique in the first 32 characters.
+ *  03-27-06  01.05.07  Added Task Management type of Clear ACA.
  *  --------------------------------------------------------------------------
 
 mpi_targ.h
@@ -511,6 +534,7 @@ mpi_targ.h
  *  02-22-05  01.05.03  Changed a comment.
  *  03-11-05  01.05.04  Removed TargetAssistExtended Request.
  *  06-24-05  01.05.05  Added TargetAssistExtended structures and defines.
+ *  03-27-06  01.05.06  Added a comment.
  *  --------------------------------------------------------------------------
 
 mpi_fc.h
@@ -610,6 +634,10 @@ mpi_sas.h
  *  08-30-05  01.05.02  Added DeviceInfo bit for SEP.
  *                      Added PrimFlags and Primitive field to SAS IO Unit
  *                      Control request, and added a new operation code.
+ *  03-27-06  01.05.03  Added Force Full Discovery, Transmit Port Select Signal,
+ *                      and Remove Device operations to SAS IO Unit Control.
+ *                      Added DevHandle field to SAS IO Unit Control request and
+ *                      reply.
  *  --------------------------------------------------------------------------
 
 mpi_type.h
@@ -625,20 +653,20 @@ mpi_type.h
 
 mpi_history.txt         Parts list history
 
-Filename    01.05.12  01.05.11  01.05.10  01.05.09
-----------  --------  --------  --------  --------
-mpi.h       01.05.10  01.05.09  01.05.08  01.05.07
-mpi_ioc.h   01.05.10  01.05.09  01.05.09  01.05.08
-mpi_cnfg.h  01.05.11  01.05.10  01.05.09  01.05.08
-mpi_init.h  01.05.06  01.05.06  01.05.05  01.05.04
-mpi_targ.h  01.05.05  01.05.05  01.05.05  01.05.04
-mpi_fc.h    01.05.01  01.05.01  01.05.01  01.05.01
-mpi_lan.h   01.05.01  01.05.01  01.05.01  01.05.01
-mpi_raid.h  01.05.02  01.05.02  01.05.02  01.05.02
-mpi_tool.h  01.05.03  01.05.03  01.05.03  01.05.03
-mpi_inb.h   01.05.01  01.05.01  01.05.01  01.05.01
-mpi_sas.h   01.05.02  01.05.01  01.05.01  01.05.01
-mpi_type.h  01.05.02  01.05.01  01.05.01  01.05.01
+Filename    01.05.13  01.05.12  01.05.11  01.05.10  01.05.09
+----------  --------  --------  --------  --------  --------
+mpi.h       01.05.11  01.05.10  01.05.09  01.05.08  01.05.07
+mpi_ioc.h   01.05.11  01.05.10  01.05.09  01.05.09  01.05.08
+mpi_cnfg.h  01.05.12  01.05.11  01.05.10  01.05.09  01.05.08
+mpi_init.h  01.05.07  01.05.06  01.05.06  01.05.05  01.05.04
+mpi_targ.h  01.05.06  01.05.05  01.05.05  01.05.05  01.05.04
+mpi_fc.h    01.05.01  01.05.01  01.05.01  01.05.01  01.05.01
+mpi_lan.h   01.05.01  01.05.01  01.05.01  01.05.01  01.05.01
+mpi_raid.h  01.05.02  01.05.02  01.05.02  01.05.02  01.05.02
+mpi_tool.h  01.05.03  01.05.03  01.05.03  01.05.03  01.05.03
+mpi_inb.h   01.05.01  01.05.01  01.05.01  01.05.01  01.05.01
+mpi_sas.h   01.05.03  01.05.02  01.05.01  01.05.01  01.05.01
+mpi_type.h  01.05.02  01.05.02  01.05.01  01.05.01  01.05.01
 
 Filename    01.05.08   01.05.07   01.05.06   01.05.05   01.05.04   01.05.03
 ----------  --------   --------   --------   --------   --------   --------
diff --git a/drivers/message/fusion/lsi/mpi_init.h b/drivers/message/fusion/lsi/mpi_init.h
index 68941f459ca3..c1c678989a23 100644
--- a/drivers/message/fusion/lsi/mpi_init.h
+++ b/drivers/message/fusion/lsi/mpi_init.h
@@ -6,7 +6,7 @@
  *          Title:  MPI initiator mode messages and structures
  *  Creation Date:  June 8, 2000
  *
- *    mpi_init.h Version:  01.05.06
+ *    mpi_init.h Version:  01.05.07
  *
  *  Version History
  *  ---------------
@@ -52,6 +52,7 @@
  *                      Added four new defines for SEP SlotStatus.
  *  08-03-05  01.05.06  Fixed some MPI_SCSIIO32_MSGFLGS_ defines to make them
  *                      unique in the first 32 characters.
+ *  03-27-06  01.05.07  Added Task Management type of Clear ACA.
  *  --------------------------------------------------------------------------
  */
 
@@ -427,6 +428,7 @@ typedef struct _MSG_SCSI_TASK_MGMT
 #define MPI_SCSITASKMGMT_TASKTYPE_LOGICAL_UNIT_RESET    (0x05)
 #define MPI_SCSITASKMGMT_TASKTYPE_CLEAR_TASK_SET        (0x06)
 #define MPI_SCSITASKMGMT_TASKTYPE_QUERY_TASK            (0x07)
+#define MPI_SCSITASKMGMT_TASKTYPE_CLEAR_ACA             (0x08)
 
 /* MsgFlags bits */
 #define MPI_SCSITASKMGMT_MSGFLAGS_TARGET_RESET_OPTION   (0x00)
diff --git a/drivers/message/fusion/lsi/mpi_ioc.h b/drivers/message/fusion/lsi/mpi_ioc.h
index 2c5f43fa7c73..18ba407fd399 100644
--- a/drivers/message/fusion/lsi/mpi_ioc.h
+++ b/drivers/message/fusion/lsi/mpi_ioc.h
@@ -6,7 +6,7 @@
  *          Title:  MPI IOC, Port, Event, FW Download, and FW Upload messages
  *  Creation Date:  August 11, 2000
  *
- *    mpi_ioc.h Version:  01.05.10
+ *    mpi_ioc.h Version:  01.05.11
  *
  *  Version History
  *  ---------------
@@ -87,6 +87,17 @@
  *                      Added new ReasonCode value for SAS Device Status Change
  *                      event.
  *                      Added new family code for FC949E.
+ *  03-27-06  01.05.11  Added MPI_IOCFACTS_CAPABILITY_TLR.
+ *                      Added additional Reason Codes and more event data fields
+ *                      to EVENT_DATA_SAS_DEVICE_STATUS_CHANGE.
+ *                      Added EVENT_DATA_SAS_BROADCAST_PRIMITIVE structure and
+ *                      new event.
+ *                      Added MPI_EVENT_SAS_SMP_ERROR and event data structure.
+ *                      Added MPI_EVENT_SAS_INIT_DEVICE_STATUS_CHANGE and event
+ *                      data structure.
+ *                      Added MPI_EVENT_SAS_INIT_TABLE_OVERFLOW and event
+ *                      data structure.
+ *                      Added MPI_EXT_IMAGE_TYPE_INITIALIZATION.
  *  --------------------------------------------------------------------------
  */
 
@@ -272,6 +283,7 @@ typedef struct _MSG_IOC_FACTS_REPLY
 #define MPI_IOCFACTS_CAPABILITY_MULTICAST               (0x00000100)
 #define MPI_IOCFACTS_CAPABILITY_SCSIIO32                (0x00000200)
 #define MPI_IOCFACTS_CAPABILITY_NO_SCSIIO16             (0x00000400)
+#define MPI_IOCFACTS_CAPABILITY_TLR                     (0x00000800)
 
 
 /*****************************************************************************
@@ -448,30 +460,34 @@ typedef struct _MSG_EVENT_ACK_REPLY
 
 /* Event */
 
-#define MPI_EVENT_NONE                      (0x00000000)
-#define MPI_EVENT_LOG_DATA                  (0x00000001)
-#define MPI_EVENT_STATE_CHANGE              (0x00000002)
-#define MPI_EVENT_UNIT_ATTENTION            (0x00000003)
-#define MPI_EVENT_IOC_BUS_RESET             (0x00000004)
-#define MPI_EVENT_EXT_BUS_RESET             (0x00000005)
-#define MPI_EVENT_RESCAN                    (0x00000006)
-#define MPI_EVENT_LINK_STATUS_CHANGE        (0x00000007)
-#define MPI_EVENT_LOOP_STATE_CHANGE         (0x00000008)
-#define MPI_EVENT_LOGOUT                    (0x00000009)
-#define MPI_EVENT_EVENT_CHANGE              (0x0000000A)
-#define MPI_EVENT_INTEGRATED_RAID           (0x0000000B)
-#define MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE (0x0000000C)
-#define MPI_EVENT_ON_BUS_TIMER_EXPIRED      (0x0000000D)
-#define MPI_EVENT_QUEUE_FULL                (0x0000000E)
-#define MPI_EVENT_SAS_DEVICE_STATUS_CHANGE  (0x0000000F)
-#define MPI_EVENT_SAS_SES                   (0x00000010)
-#define MPI_EVENT_PERSISTENT_TABLE_FULL     (0x00000011)
-#define MPI_EVENT_SAS_PHY_LINK_STATUS       (0x00000012)
-#define MPI_EVENT_SAS_DISCOVERY_ERROR       (0x00000013)
-#define MPI_EVENT_IR_RESYNC_UPDATE          (0x00000014)
-#define MPI_EVENT_IR2                       (0x00000015)
-#define MPI_EVENT_SAS_DISCOVERY             (0x00000016)
-#define MPI_EVENT_LOG_ENTRY_ADDED           (0x00000021)
+#define MPI_EVENT_NONE                          (0x00000000)
+#define MPI_EVENT_LOG_DATA                      (0x00000001)
+#define MPI_EVENT_STATE_CHANGE                  (0x00000002)
+#define MPI_EVENT_UNIT_ATTENTION                (0x00000003)
+#define MPI_EVENT_IOC_BUS_RESET                 (0x00000004)
+#define MPI_EVENT_EXT_BUS_RESET                 (0x00000005)
+#define MPI_EVENT_RESCAN                        (0x00000006)
+#define MPI_EVENT_LINK_STATUS_CHANGE            (0x00000007)
+#define MPI_EVENT_LOOP_STATE_CHANGE             (0x00000008)
+#define MPI_EVENT_LOGOUT                        (0x00000009)
+#define MPI_EVENT_EVENT_CHANGE                  (0x0000000A)
+#define MPI_EVENT_INTEGRATED_RAID               (0x0000000B)
+#define MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE     (0x0000000C)
+#define MPI_EVENT_ON_BUS_TIMER_EXPIRED          (0x0000000D)
+#define MPI_EVENT_QUEUE_FULL                    (0x0000000E)
+#define MPI_EVENT_SAS_DEVICE_STATUS_CHANGE      (0x0000000F)
+#define MPI_EVENT_SAS_SES                       (0x00000010)
+#define MPI_EVENT_PERSISTENT_TABLE_FULL         (0x00000011)
+#define MPI_EVENT_SAS_PHY_LINK_STATUS           (0x00000012)
+#define MPI_EVENT_SAS_DISCOVERY_ERROR           (0x00000013)
+#define MPI_EVENT_IR_RESYNC_UPDATE              (0x00000014)
+#define MPI_EVENT_IR2                           (0x00000015)
+#define MPI_EVENT_SAS_DISCOVERY                 (0x00000016)
+#define MPI_EVENT_SAS_BROADCAST_PRIMITIVE       (0x00000017)
+#define MPI_EVENT_SAS_INIT_DEVICE_STATUS_CHANGE (0x00000018)
+#define MPI_EVENT_SAS_INIT_TABLE_OVERFLOW       (0x00000019)
+#define MPI_EVENT_SAS_SMP_ERROR                 (0x0000001A)
+#define MPI_EVENT_LOG_ENTRY_ADDED               (0x00000021)
 
 /* AckRequired field values */
 
@@ -558,18 +574,25 @@ typedef struct _EVENT_DATA_SAS_DEVICE_STATUS_CHANGE
     U8                      PhyNum;                     /* 0Eh */
     U8                      Reserved1;                  /* 0Fh */
     U64                     SASAddress;                 /* 10h */
+    U8                      LUN[8];                     /* 18h */
+    U16                     TaskTag;                    /* 20h */
+    U16                     Reserved2;                  /* 22h */
 } EVENT_DATA_SAS_DEVICE_STATUS_CHANGE,
   MPI_POINTER PTR_EVENT_DATA_SAS_DEVICE_STATUS_CHANGE,
   MpiEventDataSasDeviceStatusChange_t,
   MPI_POINTER pMpiEventDataSasDeviceStatusChange_t;
 
 /* MPI SAS Device Status Change Event data ReasonCode values */
-#define MPI_EVENT_SAS_DEV_STAT_RC_ADDED                 (0x03)
-#define MPI_EVENT_SAS_DEV_STAT_RC_NOT_RESPONDING        (0x04)
-#define MPI_EVENT_SAS_DEV_STAT_RC_SMART_DATA            (0x05)
-#define MPI_EVENT_SAS_DEV_STAT_RC_NO_PERSIST_ADDED      (0x06)
-#define MPI_EVENT_SAS_DEV_STAT_RC_UNSUPPORTED           (0x07)
-#define MPI_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET (0x08)
+#define MPI_EVENT_SAS_DEV_STAT_RC_ADDED                     (0x03)
+#define MPI_EVENT_SAS_DEV_STAT_RC_NOT_RESPONDING            (0x04)
+#define MPI_EVENT_SAS_DEV_STAT_RC_SMART_DATA                (0x05)
+#define MPI_EVENT_SAS_DEV_STAT_RC_NO_PERSIST_ADDED          (0x06)
+#define MPI_EVENT_SAS_DEV_STAT_RC_UNSUPPORTED               (0x07)
+#define MPI_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET     (0x08)
+#define MPI_EVENT_SAS_DEV_STAT_RC_TASK_ABORT_INTERNAL       (0x09)
+#define MPI_EVENT_SAS_DEV_STAT_RC_ABORT_TASK_SET_INTERNAL   (0x0A)
+#define MPI_EVENT_SAS_DEV_STAT_RC_CLEAR_TASK_SET_INTERNAL   (0x0B)
+#define MPI_EVENT_SAS_DEV_STAT_RC_QUERY_TASK_INTERNAL       (0x0C)
 
 
 /* SCSI Event data for Queue Full event */
@@ -742,6 +765,27 @@ typedef struct _EVENT_DATA_SAS_SES
 } EVENT_DATA_SAS_SES, MPI_POINTER PTR_EVENT_DATA_SAS_SES,
   MpiEventDataSasSes_t, MPI_POINTER pMpiEventDataSasSes_t;
 
+/* SAS Broadcast Primitive Event data */
+
+typedef struct _EVENT_DATA_SAS_BROADCAST_PRIMITIVE
+{
+    U8                      PhyNum;                     /* 00h */
+    U8                      Port;                       /* 01h */
+    U8                      PortWidth;                  /* 02h */
+    U8                      Primitive;                  /* 04h */
+} EVENT_DATA_SAS_BROADCAST_PRIMITIVE,
+  MPI_POINTER PTR_EVENT_DATA_SAS_BROADCAST_PRIMITIVE,
+  MpiEventDataSasBroadcastPrimitive_t,
+  MPI_POINTER pMpiEventDataSasBroadcastPrimitive_t;
+
+#define MPI_EVENT_PRIMITIVE_CHANGE              (0x01)
+#define MPI_EVENT_PRIMITIVE_EXPANDER            (0x03)
+#define MPI_EVENT_PRIMITIVE_RESERVED2           (0x04)
+#define MPI_EVENT_PRIMITIVE_RESERVED3           (0x05)
+#define MPI_EVENT_PRIMITIVE_RESERVED4           (0x06)
+#define MPI_EVENT_PRIMITIVE_CHANGE0_RESERVED    (0x07)
+#define MPI_EVENT_PRIMITIVE_CHANGE1_RESERVED    (0x08)
+
 /* SAS Phy Link Status Event data */
 
 typedef struct _EVENT_DATA_SAS_PHY_LINK_STATUS
@@ -804,6 +848,53 @@ typedef struct _EVENT_DATA_DISCOVERY_ERROR
 #define MPI_EVENT_DSCVRY_ERR_DS_MULTPL_PATHS                (0x00000800)
 #define MPI_EVENT_DSCVRY_ERR_DS_MAX_SATA_TARGETS            (0x00001000)
 
+/* SAS SMP Error Event data */
+
+typedef struct _EVENT_DATA_SAS_SMP_ERROR
+{
+    U8                      Status;                     /* 00h */
+    U8                      Port;                       /* 01h */
+    U8                      SMPFunctionResult;          /* 02h */
+    U8                      Reserved1;                  /* 03h */
+    U64                     SASAddress;                 /* 04h */
+} EVENT_DATA_SAS_SMP_ERROR, MPI_POINTER PTR_EVENT_DATA_SAS_SMP_ERROR,
+  MpiEventDataSasSmpError_t, MPI_POINTER pMpiEventDataSasSmpError_t;
+
+/* defines for the Status field of the SAS SMP Error event */
+#define MPI_EVENT_SAS_SMP_FUNCTION_RESULT_VALID         (0x00)
+#define MPI_EVENT_SAS_SMP_CRC_ERROR                     (0x01)
+#define MPI_EVENT_SAS_SMP_TIMEOUT                       (0x02)
+#define MPI_EVENT_SAS_SMP_NO_DESTINATION                (0x03)
+#define MPI_EVENT_SAS_SMP_BAD_DESTINATION               (0x04)
+
+/* SAS Initiator Device Status Change Event data */
+
+typedef struct _EVENT_DATA_SAS_INIT_DEV_STATUS_CHANGE
+{
+    U8                      ReasonCode;                 /* 00h */
+    U8                      Port;                       /* 01h */
+    U16                     DevHandle;                  /* 02h */
+    U64                     SASAddress;                 /* 04h */
+} EVENT_DATA_SAS_INIT_DEV_STATUS_CHANGE,
+  MPI_POINTER PTR_EVENT_DATA_SAS_INIT_DEV_STATUS_CHANGE,
+  MpiEventDataSasInitDevStatusChange_t,
+  MPI_POINTER pMpiEventDataSasInitDevStatusChange_t;
+
+/* defines for the ReasonCode field of the SAS Initiator Device Status Change event */
+#define MPI_EVENT_SAS_INIT_RC_ADDED                 (0x01)
+
+/* SAS Initiator Device Table Overflow Event data */
+
+typedef struct _EVENT_DATA_SAS_INIT_TABLE_OVERFLOW
+{
+    U8                      MaxInit;                    /* 00h */
+    U8                      CurrentInit;                /* 01h */
+    U16                     Reserved1;                  /* 02h */
+} EVENT_DATA_SAS_INIT_TABLE_OVERFLOW,
+  MPI_POINTER PTR_EVENT_DATA_SAS_INIT_TABLE_OVERFLOW,
+  MpiEventDataSasInitTableOverflow_t,
+  MPI_POINTER pMpiEventDataSasInitTableOverflow_t;
+
 
 /*****************************************************************************
 *
@@ -1013,5 +1104,6 @@ typedef struct _MPI_EXT_IMAGE_HEADER
 #define MPI_EXT_IMAGE_TYPE_FW                   (0x01)
 #define MPI_EXT_IMAGE_TYPE_NVDATA               (0x03)
 #define MPI_EXT_IMAGE_TYPE_BOOTLOADER           (0x04)
+#define MPI_EXT_IMAGE_TYPE_INITIALIZATION       (0x05)
 
 #endif
diff --git a/drivers/message/fusion/lsi/mpi_log_sas.h b/drivers/message/fusion/lsi/mpi_log_sas.h
index a9c14ad132ce..871ebc08b706 100644
--- a/drivers/message/fusion/lsi/mpi_log_sas.h
+++ b/drivers/message/fusion/lsi/mpi_log_sas.h
@@ -13,6 +13,8 @@
 #ifndef IOPI_IOCLOGINFO_H_INCLUDED
 #define IOPI_IOCLOGINFO_H_INCLUDED
 
+#define SAS_LOGINFO_NEXUS_LOSS          0x31170000
+#define SAS_LOGINFO_MASK                        0xFFFF0000
 
 /****************************************************************************/
 /*  IOC LOGINFO defines, 0x00000000 - 0x0FFFFFFF                            */
@@ -51,6 +53,9 @@
 #define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_DNM        (0x00030500) /* Device Not Mapped */
 #define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_PERSIST    (0x00030600) /* Persistent Page not found */
 #define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_DEFAULT    (0x00030700) /* Default Page not found */
+
+#define IOP_LOGINFO_CODE_DIAG_MSG_ERROR                 (0x00040000) /* Error handling diag msg - or'd with diag status */
+
 #define IOP_LOGINFO_CODE_TASK_TERMINATED                (0x00050000)
 
 #define IOP_LOGINFO_CODE_ENCL_MGMT_READ_ACTION_ERR0R    (0x00060001) /* Read Action not supported for SEP msg */
@@ -103,6 +108,7 @@
 #define PL_LOGINFO_CODE_IO_EXECUTED                         (0x00140000)
 #define PL_LOGINFO_CODE_PERS_RESV_OUT_NOT_AFFIL_OWNER       (0x00150000)
 #define PL_LOGINFO_CODE_OPEN_TXDMA_ABORT                    (0x00160000)
+#define PL_LOGINFO_CODE_IO_DEVICE_MISSING_DELAY_RETRY       (0x00170000)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAILURE                    (0x00000100)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAILURE_NO_DEST_TIMEOUT    (0x00000101)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAILURE_ORR_TIMEOUT        (0x0000011A) /* Open Reject (Retry) Timeout */
@@ -165,11 +171,81 @@
 /****************************************************************************/
 /* IR LOGINFO_CODE defines, valid if IOC_LOGINFO_ORIGINATOR = IR            */
 /****************************************************************************/
-#define IR_LOGINFO_CODE_UNUSED1                         (0x00010000)
-#define IR_LOGINFO_CODE_UNUSED2                         (0x00020000)
+#define IR_LOGINFO_RAID_ACTION_ERROR                           (0x00010000)
+#define IR_LOGINFO_CODE_UNUSED2                                (0x00020000)
+
+/* Amount of information passed down for Create Volume is too large */
+#define IR_LOGINFO_VOLUME_CREATE_INVALID_LENGTH                (0x00010001)
+/* Creation of duplicate volume attempted (Bus/Target ID checked) */
+#define IR_LOGINFO_VOLUME_CREATE_DUPLICATE                     (0x00010002)
+/* Creation failed due to maximum number of supported volumes exceeded */
+#define IR_LOGINFO_VOLUME_CREATE_NO_SLOTS                      (0x00010003)
+/* Creation failed due to DMA error in trying to read from host */
+#define IR_LOGINFO_VOLUME_CREATE_DMA_ERROR                     (0x00010004)
+/* Creation failed due to invalid volume type passed down */
+#define IR_LOGINFO_VOLUME_CREATE_INVALID_VOLUME_TYPE           (0x00010005)
+/* Creation failed due to error reading MFG Page 4 */
+#define IR_LOGINFO_VOLUME_MFG_PAGE4_ERROR                      (0x00010006)
+/* Creation failed when trying to create internal structures */
+#define IR_LOGINFO_VOLUME_INTERNAL_CONFIG_STRUCTURE_ERROR      (0x00010007)
+
+/* Activation failed due to trying to activate an already active volume */
+#define IR_LOGINFO_VOLUME_ACTIVATING_AN_ACTIVE_VOLUME          (0x00010010)
+/* Activation failed due to trying to active unsupported volume type  */
+#define IR_LOGINFO_VOLUME_ACTIVATING_INVALID_VOLUME_TYPE       (0x00010011)
+/* Activation failed due to trying to active too many volumes  */
+#define IR_LOGINFO_VOLUME_ACTIVATING_TOO_MANY_VOLUMES          (0x00010012)
+/* Activation failed due to Volume ID in use already */
+#define IR_LOGINFO_VOLUME_ACTIVATING_VOLUME_ID_IN_USE          (0x00010013)
+/* Activation failed call to activateVolume returned failure */
+#define IR_LOGINFO_VOLUME_ACTIVATE_VOLUME_FAILED               (0x00010014)
+/* Activation failed trying to import the volume */
+#define IR_LOGINFO_VOLUME_ACTIVATING_IMPORT_VOLUME_FAILED      (0x00010015)
+
+/* Phys Disk failed, too many phys disks */
+#define IR_LOGINFO_PHYSDISK_CREATE_TOO_MANY_DISKS              (0x00010020)
+/* Amount of information passed down for Create Pnysdisk is too large */
+#define IR_LOGINFO_PHYSDISK_CREATE_INVALID_LENGTH              (0x00010021)
+/* Creation failed due to DMA error in trying to read from host */
+#define IR_LOGINFO_PHYSDISK_CREATE_DMA_ERROR                   (0x00010022)
+/* Creation failed due to invalid Bus TargetID passed down */
+#define IR_LOGINFO_PHYSDISK_CREATE_BUS_TID_INVALID             (0x00010023)
+/* Creation failed due to error in creating RAID Phys Disk Config Page */
+#define IR_LOGINFO_PHYSDISK_CREATE_CONFIG_PAGE_ERROR           (0x00010024)
+
+
+/* Compatibility Error : IR Disabled */
+#define IR_LOGINFO_COMPAT_ERROR_RAID_DISABLED                  (0x00010030)
+/* Compatibility Error : Inquiry Comand failed */
+#define IR_LOGINFO_COMPAT_ERROR_INQUIRY_FAILED                 (0x00010031)
+/* Compatibility Error : Device not direct access device */
+#define IR_LOGINFO_COMPAT_ERROR_NOT_DIRECT_ACCESS              (0x00010032)
+/* Compatibility Error : Removable device found */
+#define IR_LOGINFO_COMPAT_ERROR_REMOVABLE_FOUND                (0x00010033)
+/* Compatibility Error : Device SCSI Version not 2 or higher */
+#define IR_LOGINFO_COMPAT_ERROR_NEED_SCSI_2_OR_HIGHER          (0x00010034)
+/* Compatibility Error : SATA device, 48 BIT LBA not supported */
+#define IR_LOGINFO_COMPAT_ERROR_SATA_48BIT_LBA_NOT_SUPPORTED   (0x00010035)
+/* Compatibility Error : Device does not have 512 byte block sizes */
+#define IR_LOGINFO_COMPAT_ERROR_DEVICE_NOT_512_BYTE_BLOCK      (0x00010036)
+/* Compatibility Error : Volume Type check failed */
+#define IR_LOGINFO_COMPAT_ERROR_VOLUME_TYPE_CHECK_FAILED       (0x00010037)
+/* Compatibility Error : Volume Type is unsupported by FW */
+#define IR_LOGINFO_COMPAT_ERROR_UNSUPPORTED_VOLUME_TYPE        (0x00010038)
+/* Compatibility Error : Disk drive too small for use in volume */
+#define IR_LOGINFO_COMPAT_ERROR_DISK_TOO_SMALL                 (0x00010039)
+/* Compatibility Error : Phys disk for Create Volume not found */
+#define IR_LOGINFO_COMPAT_ERROR_PHYS_DISK_NOT_FOUND            (0x0001003A)
+/* Compatibility Error : membership count error, too many or too few disks for volume type */
+#define IR_LOGINFO_COMPAT_ERROR_MEMBERSHIP_COUNT               (0x0001003B)
+/* Compatibility Error : Disk stripe sizes must be 64KB */
+#define IR_LOGINFO_COMPAT_ERROR_NON_64K_STRIPE_SIZE            (0x0001003C)
+/* Compatibility Error : IME size limited to < 2TB */
+#define IR_LOGINFO_COMPAT_ERROR_IME_VOL_NOT_CURRENTLY_SUPPORTED (0x0001003D)
+
 
 /****************************************************************************/
-/* Defines for convienence                                                  */
+/* Defines for convenience                                                  */
 /****************************************************************************/
 #define IOC_LOGINFO_PREFIX_IOP                          ((MPI_IOCLOGINFO_TYPE_SAS << MPI_IOCLOGINFO_TYPE_SHIFT) | IOC_LOGINFO_ORIGINATOR_IOP)
 #define IOC_LOGINFO_PREFIX_PL                           ((MPI_IOCLOGINFO_TYPE_SAS << MPI_IOCLOGINFO_TYPE_SHIFT) | IOC_LOGINFO_ORIGINATOR_PL)
diff --git a/drivers/message/fusion/lsi/mpi_sas.h b/drivers/message/fusion/lsi/mpi_sas.h
index 70514867bddf..50b8f0a8f456 100644
--- a/drivers/message/fusion/lsi/mpi_sas.h
+++ b/drivers/message/fusion/lsi/mpi_sas.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Serial Attached SCSI structures and definitions
  *  Creation Date:  August 19, 2004
  *
- *    mpi_sas.h Version:  01.05.02
+ *    mpi_sas.h Version:  01.05.03
  *
  *  Version History
  *  ---------------
@@ -17,6 +17,10 @@
  *  08-30-05  01.05.02  Added DeviceInfo bit for SEP.
  *                      Added PrimFlags and Primitive field to SAS IO Unit
  *                      Control request, and added a new operation code.
+ *  03-27-06  01.05.03  Added Force Full Discovery, Transmit Port Select Signal,
+ *                      and Remove Device operations to SAS IO Unit Control.
+ *                      Added DevHandle field to SAS IO Unit Control request and
+ *                      reply.
  *  --------------------------------------------------------------------------
  */
 
@@ -209,7 +213,7 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REQUEST
     U8                      Reserved1;          /* 01h */
     U8                      ChainOffset;        /* 02h */
     U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
+    U16                     DevHandle;          /* 04h */
     U8                      Reserved3;          /* 06h */
     U8                      MsgFlags;           /* 07h */
     U32                     MsgContext;         /* 08h */
@@ -231,6 +235,9 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REQUEST
 #define MPI_SAS_OP_PHY_CLEAR_ERROR_LOG          (0x08)
 #define MPI_SAS_OP_MAP_CURRENT                  (0x09)
 #define MPI_SAS_OP_SEND_PRIMITIVE               (0x0A)
+#define MPI_SAS_OP_FORCE_FULL_DISCOVERY         (0x0B)
+#define MPI_SAS_OP_TRANSMIT_PORT_SELECT_SIGNAL  (0x0C)
+#define MPI_SAS_OP_TRANSMIT_REMOVE_DEVICE       (0x0D)
 
 /* values for the PrimFlags field */
 #define MPI_SAS_PRIMFLAGS_SINGLE                (0x08)
@@ -245,7 +252,7 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REPLY
     U8                      Reserved1;          /* 01h */
     U8                      MsgLength;          /* 02h */
     U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
+    U16                     DevHandle;          /* 04h */
     U8                      Reserved3;          /* 06h */
     U8                      MsgFlags;           /* 07h */
     U32                     MsgContext;         /* 08h */
diff --git a/drivers/message/fusion/lsi/mpi_targ.h b/drivers/message/fusion/lsi/mpi_targ.h
index 3f462859ceea..20b667315773 100644
--- a/drivers/message/fusion/lsi/mpi_targ.h
+++ b/drivers/message/fusion/lsi/mpi_targ.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Target mode messages and structures
  *  Creation Date:  June 22, 2000
  *
- *    mpi_targ.h Version:  01.05.05
+ *    mpi_targ.h Version:  01.05.06
  *
  *  Version History
  *  ---------------
@@ -54,6 +54,7 @@
  *  02-22-05  01.05.03  Changed a comment.
  *  03-11-05  01.05.04  Removed TargetAssistExtended Request.
  *  06-24-05  01.05.05  Added TargetAssistExtended structures and defines.
+ *  03-27-06  01.05.06  Added a comment.
  *  --------------------------------------------------------------------------
  */
 
@@ -351,7 +352,7 @@ typedef struct _MSG_TARGET_ASSIST_REQUEST
 #define TARGET_ASSIST_FLAGS_CONFIRMED               (0x08)
 #define TARGET_ASSIST_FLAGS_REPOST_CMD_BUFFER       (0x80)
 
-
+/* Standard Target Mode Reply message */
 typedef struct _MSG_TARGET_ERROR_REPLY
 {
     U16                     Reserved;                   /* 00h */
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 57543603d6c8..29d0635cce1d 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -368,20 +368,21 @@ static irqreturn_t
 mpt_interrupt(int irq, void *bus_id, struct pt_regs *r)
 {
         MPT_ADAPTER *ioc = bus_id;
-        u32 pa;
+        u32 pa = CHIPREG_READ32_dmasync(&ioc->chip->ReplyFifo);
+
+        if (pa == 0xFFFFFFFF)
+                return IRQ_NONE;
 
         /*
          *  Drain the reply FIFO!
          */
-        while (1) {
-                pa = CHIPREG_READ32_dmasync(&ioc->chip->ReplyFifo);
-                if (pa == 0xFFFFFFFF)
-                        return IRQ_HANDLED;
-                else if (pa & MPI_ADDRESS_REPLY_A_BIT)
+        do {
+                if (pa & MPI_ADDRESS_REPLY_A_BIT)
                         mpt_reply(ioc, pa);
                 else
                         mpt_turbo_reply(ioc, pa);
-        }
+                pa = CHIPREG_READ32_dmasync(&ioc->chip->ReplyFifo);
+        } while (pa != 0xFFFFFFFF);
 
         return IRQ_HANDLED;
 }
@@ -435,8 +436,6 @@ mpt_base_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *reply)
                  */
                 if (pEvReply->MsgFlags & MPI_MSGFLAGS_CONTINUATION_REPLY) {
                         freereq = 0;
-                        devtverboseprintk((MYIOC_s_WARN_FMT "EVENT_NOTIFICATION reply %p does not return Request frame\n",
-                                ioc->name, pEvReply));
                 } else {
                         devtverboseprintk((MYIOC_s_WARN_FMT "EVENT_NOTIFICATION reply %p returns Request frame\n",
                                 ioc->name, pEvReply));
@@ -677,19 +676,19 @@ int
 mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, int cb_idx)
 {
         MPT_ADAPTER     *ioc;
+        const struct pci_device_id *id;
 
-        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS) {
+        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
                 return -EINVAL;
-        }
 
         MptDeviceDriverHandlers[cb_idx] = dd_cbfunc;
 
         /* call per pci device probe entry point */
         list_for_each_entry(ioc, &ioc_list, list) {
-                if(dd_cbfunc->probe) {
-                        dd_cbfunc->probe(ioc->pcidev,
-                          ioc->pcidev->driver->id_table);
-                }
+                id = ioc->pcidev->driver ?
+                    ioc->pcidev->driver->id_table : NULL;
+                if (dd_cbfunc->probe)
+                        dd_cbfunc->probe(ioc->pcidev, id);
          }
 
         return 0;
@@ -1055,9 +1054,8 @@ mpt_host_page_alloc(MPT_ADAPTER *ioc, pIOCInit_t ioc_init)
 
                                 dinitprintk((MYIOC_s_INFO_FMT
                                     "host_page_buffer @ %p, dma @ %x, sz=%d bytes\n",
-                                    ioc->name,
-                                    ioc->HostPageBuffer,
-                                    ioc->HostPageBuffer_dma,
+                                    ioc->name, ioc->HostPageBuffer,
+                                    (u32)ioc->HostPageBuffer_dma,
                                     host_page_buffer_sz));
                                 ioc->alloc_total += host_page_buffer_sz;
                                 ioc->HostPageBuffer_sz = host_page_buffer_sz;
@@ -1219,31 +1217,25 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
         port = psize = 0;
         for (ii=0; ii < DEVICE_COUNT_RESOURCE; ii++) {
                 if (pci_resource_flags(pdev, ii) & PCI_BASE_ADDRESS_SPACE_IO) {
+                        if (psize)
+                                continue;
                         /* Get I/O space! */
                         port = pci_resource_start(pdev, ii);
                         psize = pci_resource_len(pdev,ii);
                 } else {
+                        if (msize)
+                                continue;
                         /* Get memmap */
                         mem_phys = pci_resource_start(pdev, ii);
                         msize = pci_resource_len(pdev,ii);
-                        break;
                 }
         }
         ioc->mem_size = msize;
 
-        if (ii == DEVICE_COUNT_RESOURCE) {
-                printk(KERN_ERR MYNAM ": ERROR - MPT adapter has no memory regions defined!\n");
-                kfree(ioc);
-                return -EINVAL;
-        }
-
-        dinitprintk((KERN_INFO MYNAM ": MPT adapter @ %lx, msize=%dd bytes\n", mem_phys, msize));
-        dinitprintk((KERN_INFO MYNAM ": (port i/o @ %lx, psize=%dd bytes)\n", port, psize));
-
         mem = NULL;
         /* Get logical ptr for PciMem0 space */
         /*mem = ioremap(mem_phys, msize);*/
-        mem = ioremap(mem_phys, 0x100);
+        mem = ioremap(mem_phys, msize);
         if (mem == NULL) {
                 printk(KERN_ERR MYNAM ": ERROR - Unable to map adapter memory!\n");
                 kfree(ioc);
@@ -1343,11 +1335,6 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                 ioc->bus_type = SAS;
                 ioc->errata_flag_1064 = 1;
         }
-        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1066) {
-                ioc->prod_name = "LSISAS1066";
-                ioc->bus_type = SAS;
-                ioc->errata_flag_1064 = 1;
-        }
         else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1068) {
                 ioc->prod_name = "LSISAS1068";
                 ioc->bus_type = SAS;
@@ -1357,14 +1344,14 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                 ioc->prod_name = "LSISAS1064E";
                 ioc->bus_type = SAS;
         }
-        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1066E) {
-                ioc->prod_name = "LSISAS1066E";
-                ioc->bus_type = SAS;
-        }
         else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1068E) {
                 ioc->prod_name = "LSISAS1068E";
                 ioc->bus_type = SAS;
         }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1078) {
+                ioc->prod_name = "LSISAS1078";
+                ioc->bus_type = SAS;
+        }
 
         if (ioc->errata_flag_1064)
                 pci_disable_io_access(pdev);
@@ -1390,6 +1377,7 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                 printk(KERN_WARNING MYNAM
                   ": WARNING - %s did not initialize properly! (%d)\n",
                   ioc->name, r);
+
                 list_del(&ioc->list);
                 if (ioc->alt_ioc)
                         ioc->alt_ioc->alt_ioc = NULL;
@@ -1772,9 +1760,9 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                                                  * chips (mpt_adapter_disable,
                                                  * mpt_diag_reset)
                                                  */
-                                                ioc->cached_fw = NULL;
                                                 ddlprintk((MYIOC_s_INFO_FMT ": mpt_upload:  alt_%s has cached_fw=%p \n",
                                                         ioc->name, ioc->alt_ioc->name, ioc->alt_ioc->cached_fw));
+                                                ioc->alt_ioc->cached_fw = NULL;
                                         }
                                 } else {
                                         printk(KERN_WARNING MYNAM ": firmware upload failure!\n");
@@ -1895,7 +1883,7 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                 /* FIXME?  Examine results here? */
         }
 
-out:
+ out:
         if ((ret != 0) && irq_allocated) {
                 free_irq(ioc->pci_irq, ioc);
                 if (mpt_msi_enable)
@@ -2680,6 +2668,7 @@ SendIocInit(MPT_ADAPTER *ioc, int sleepFlag)
         dinitprintk((MYIOC_s_INFO_FMT "INFO - Wait IOC_OPERATIONAL state (cnt=%d)\n",
                         ioc->name, count));
 
+        ioc->aen_event_read_flag=0;
         return r;
 }
 
@@ -2747,6 +2736,8 @@ mpt_alloc_fw_memory(MPT_ADAPTER *ioc, int size)
         if (ioc->alt_ioc && ioc->alt_ioc->cached_fw) {
                 ioc->cached_fw = ioc->alt_ioc->cached_fw;  /* use alt_ioc's memory */
                 ioc->cached_fw_dma = ioc->alt_ioc->cached_fw_dma;
+                ioc->alloc_total += size;
+                ioc->alt_ioc->alloc_total -= size;
         } else {
                 if ( (ioc->cached_fw = pci_alloc_consistent(ioc->pcidev, size, &ioc->cached_fw_dma) ) )
                         ioc->alloc_total += size;
@@ -3176,6 +3167,7 @@ KickStart(MPT_ADAPTER *ioc, int force, int sleepFlag)
 static int
 mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
 {
+        MPT_ADAPTER     *iocp=NULL;
         u32 diag0val;
         u32 doorbell;
         int hard_reset_done = 0;
@@ -3184,6 +3176,37 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
         u32 diag1val = 0;
 #endif
 
+        if (ioc->pcidev->device == MPI_MANUFACTPAGE_DEVID_SAS1078) {
+                drsprintk((MYIOC_s_WARN_FMT "%s: Doorbell=%p; 1078 reset "
+                        "address=%p\n",  ioc->name, __FUNCTION__,
+                        &ioc->chip->Doorbell, &ioc->chip->Reset_1078));
+                CHIPREG_WRITE32(&ioc->chip->Reset_1078, 0x07);
+                if (sleepFlag == CAN_SLEEP)
+                        msleep(1);
+                else
+                        mdelay(1);
+
+                for (count = 0; count < 60; count ++) {
+                        doorbell = CHIPREG_READ32(&ioc->chip->Doorbell);
+                        doorbell &= MPI_IOC_STATE_MASK;
+
+                        drsprintk((MYIOC_s_INFO_FMT
+                                "looking for READY STATE: doorbell=%x"
+                                " count=%d\n",
+                                ioc->name, doorbell, count));
+                        if (doorbell == MPI_IOC_STATE_READY) {
+                                return 0;
+                        }
+
+                        /* wait 1 sec */
+                        if (sleepFlag == CAN_SLEEP)
+                                msleep(1000);
+                        else
+                                mdelay(1000);
+                }
+                return -1;
+        }
+
         /* Clear any existing interrupts */
         CHIPREG_WRITE32(&ioc->chip->IntStatus, 0);
 
@@ -3280,17 +3303,23 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                         /* FIXME?  Examine results here? */
                 }
 
-                if (ioc->cached_fw) {
+                if (ioc->cached_fw)
+                        iocp = ioc;
+                else if (ioc->alt_ioc && ioc->alt_ioc->cached_fw)
+                        iocp = ioc->alt_ioc;
+                if (iocp) {
                         /* If the DownloadBoot operation fails, the
                          * IOC will be left unusable. This is a fatal error
                          * case.  _diag_reset will return < 0
                          */
                         for (count = 0; count < 30; count ++) {
-                                diag0val = CHIPREG_READ32(&ioc->chip->Diagnostic);
+                                diag0val = CHIPREG_READ32(&iocp->chip->Diagnostic);
                                 if (!(diag0val & MPI_DIAG_RESET_ADAPTER)) {
                                         break;
                                 }
 
+                                dprintk((MYIOC_s_INFO_FMT "cached_fw: diag0val=%x count=%d\n",
+                                        iocp->name, diag0val, count));
                                 /* wait 1 sec */
                                 if (sleepFlag == CAN_SLEEP) {
                                         msleep (1000);
@@ -3299,7 +3328,7 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                                 }
                         }
                         if ((count = mpt_downloadboot(ioc,
-                                (MpiFwHeader_t *)ioc->cached_fw, sleepFlag)) < 0) {
+                                (MpiFwHeader_t *)iocp->cached_fw, sleepFlag)) < 0) {
                                 printk(KERN_WARNING MYNAM
                                         ": firmware downloadboot failure (%d)!\n", count);
                         }
@@ -3886,18 +3915,18 @@ WaitForDoorbellAck(MPT_ADAPTER *ioc, int howlong, int sleepFlag)
 
         if (sleepFlag == CAN_SLEEP) {
                 while (--cntdn) {
+                        msleep (1);
                         intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
                         if (! (intstat & MPI_HIS_IOP_DOORBELL_STATUS))
                                 break;
-                        msleep (1);
                         count++;
                 }
         } else {
                 while (--cntdn) {
+                        mdelay (1);
                         intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
                         if (! (intstat & MPI_HIS_IOP_DOORBELL_STATUS))
                                 break;
-                        mdelay (1);
                         count++;
                 }
         }
@@ -4862,6 +4891,7 @@ mpt_read_ioc_pg_4(MPT_ADAPTER *ioc)
                 pIoc4 = pci_alloc_consistent(ioc->pcidev, iocpage4sz, &ioc4_dma);
                 if (!pIoc4)
                         return;
+                ioc->alloc_total += iocpage4sz;
         } else {
                 ioc4_dma = ioc->spi_data.IocPg4_dma;
                 iocpage4sz = ioc->spi_data.IocPg4Sz;
@@ -4878,6 +4908,7 @@ mpt_read_ioc_pg_4(MPT_ADAPTER *ioc)
         } else {
                 pci_free_consistent(ioc->pcidev, iocpage4sz, pIoc4, ioc4_dma);
                 ioc->spi_data.pIocPg4 = NULL;
+                ioc->alloc_total -= iocpage4sz;
         }
 }
 
@@ -5009,19 +5040,18 @@ SendEventAck(MPT_ADAPTER *ioc, EventNotificationReply_t *evnp)
         EventAck_t      *pAck;
 
         if ((pAck = (EventAck_t *) mpt_get_msg_frame(mpt_base_index, ioc)) == NULL) {
-                printk(MYIOC_s_WARN_FMT "Unable to allocate event ACK "
-                        "request frame for Event=%x EventContext=%x EventData=%x!\n",
-                        ioc->name, evnp->Event, le32_to_cpu(evnp->EventContext),
-                        le32_to_cpu(evnp->Data[0]));
+                dfailprintk((MYIOC_s_WARN_FMT "%s, no msg frames!!\n",
+                    ioc->name,__FUNCTION__));
                 return -1;
         }
-        memset(pAck, 0, sizeof(*pAck));
 
-        dprintk((MYIOC_s_INFO_FMT "Sending EventAck\n", ioc->name));
+        devtverboseprintk((MYIOC_s_INFO_FMT "Sending EventAck\n", ioc->name));
 
         pAck->Function     = MPI_FUNCTION_EVENT_ACK;
         pAck->ChainOffset  = 0;
+        pAck->Reserved[0]  = pAck->Reserved[1] = 0;
         pAck->MsgFlags     = 0;
+        pAck->Reserved1[0] = pAck->Reserved1[1] = pAck->Reserved1[2] = 0;
         pAck->Event        = evnp->Event;
         pAck->EventContext = evnp->EventContext;
 
@@ -5683,9 +5713,9 @@ EventDescriptionStr(u8 event, u32 evData0, char *evStr)
                 break;
         case MPI_EVENT_EVENT_CHANGE:
                 if (evData0)
-                        ds = "Events(ON) Change";
+                        ds = "Events ON";
                 else
-                        ds = "Events(OFF) Change";
+                        ds = "Events OFF";
                 break;
         case MPI_EVENT_INTEGRATED_RAID:
         {
@@ -5756,8 +5786,27 @@ EventDescriptionStr(u8 event, u32 evData0, char *evStr)
                         break;
                 case MPI_EVENT_SAS_DEV_STAT_RC_NO_PERSIST_ADDED:
                         snprintf(evStr, EVENT_DESCR_STR_SZ,
-                            "SAS Device Status Change: No Persistancy "
-                            "Added: id=%d", id);
+                            "SAS Device Status Change: No Persistancy: id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Device Reset : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_TASK_ABORT_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Task Abort : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_ABORT_TASK_SET_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Abort Task Set : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_CLEAR_TASK_SET_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Clear Task Set : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_QUERY_TASK_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Query Task : id=%d", id);
                         break;
                 default:
                         snprintf(evStr, EVENT_DESCR_STR_SZ,
@@ -6013,7 +6062,7 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
  *      @ioc: Pointer to MPT_ADAPTER structure
  *      @log_info: U32 LogInfo reply word from the IOC
  *
- *      Refer to lsi/fc_log.h.
+ *      Refer to lsi/mpi_log_fc.h.
  */
 static void
 mpt_fc_log_info(MPT_ADAPTER *ioc, u32 log_info)
@@ -6110,8 +6159,10 @@ mpt_spi_log_info(MPT_ADAPTER *ioc, u32 log_info)
                 "Invalid SAS Address",                          /* 01h */
                 NULL,                                           /* 02h */
                 "Invalid Page",                                 /* 03h */
-                NULL,                                           /* 04h */
-                "Task Terminated"                               /* 05h */
+                "Diag Message Error",                           /* 04h */
+                "Task Terminated",                              /* 05h */
+                "Enclosure Management",                         /* 06h */
+                "Target Mode"                                   /* 07h */
         };
         static char *pl_code_str[] = {
                 NULL,                                           /* 00h */
@@ -6137,7 +6188,7 @@ mpt_spi_log_info(MPT_ADAPTER *ioc, u32 log_info)
                 "IO Executed",                                  /* 14h */
                 "Persistant Reservation Out Not Affiliation Owner", /* 15h */
                 "Open Transmit DMA Abort",                      /* 16h */
-                NULL,                                           /* 17h */
+                "IO Device Missing Delay Retry",                /* 17h */
                 NULL,                                           /* 18h */
                 NULL,                                           /* 19h */
                 NULL,                                           /* 1Ah */
@@ -6217,7 +6268,7 @@ static void
 mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf)
 {
         u32 status = ioc_status & MPI_IOCSTATUS_MASK;
-        char *desc = "";
+        char *desc = NULL;
 
         switch (status) {
         case MPI_IOCSTATUS_INVALID_FUNCTION: /* 0x0001 */
@@ -6327,7 +6378,7 @@ mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf)
                 desc = "Others";
                 break;
         }
-        if (desc != "")
+        if (desc != NULL)
                 printk(MYIOC_s_INFO_FMT "IOCStatus(0x%04x): %s\n", ioc->name, status, desc);
 }
 
@@ -6365,7 +6416,6 @@ EXPORT_SYMBOL(mpt_alloc_fw_memory);
 EXPORT_SYMBOL(mpt_free_fw_memory);
 EXPORT_SYMBOL(mptbase_sas_persist_operation);
 
-
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *      fusion_init - Fusion MPT base driver initialization routine.
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index 32ae4d664545..c537d71c18e4 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -75,8 +75,8 @@
 #define COPYRIGHT       "Copyright (c) 1999-2005 " MODULEAUTHOR
 #endif
 
-#define MPT_LINUX_VERSION_COMMON        "3.03.10"
-#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.03.10"
+#define MPT_LINUX_VERSION_COMMON        "3.04.01"
+#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.01"
 #define WHAT_MAGIC_STRING               "@" "(" "#" ")"
 
 #define show_mptmod_ver(s,ver)  \
@@ -307,7 +307,8 @@ typedef struct _SYSIF_REGS
         u32     HostIndex;      /* 50     Host Index register        */
         u32     Reserved4[15];  /* 54-8F                             */
         u32     Fubar;          /* 90     For Fubar usage            */
-        u32     Reserved5[27];  /* 94-FF                             */
+        u32     Reserved5[1050];/* 94-10F8                           */
+        u32     Reset_1078;     /* 10FC   Reset 1078                 */
 } SYSIF_REGS;
 
 /*
@@ -341,6 +342,7 @@ typedef struct _VirtTarget {
         u8                       negoFlags;     /* bit field, see above */
         u8                       raidVolume;    /* set, if RAID Volume */
         u8                       type;          /* byte 0 of Inquiry data */
+        u8                       deleted;       /* target in process of being removed */
         u32                      num_luns;
         u32                      luns[8];               /* Max LUNs is 256 */
 } VirtTarget;
@@ -361,6 +363,7 @@ typedef struct _VirtDevice {
 #define MPT_TARGET_FLAGS_VALID_56       0x10
 #define MPT_TARGET_FLAGS_SAF_TE_ISSUED  0x20
 #define MPT_TARGET_FLAGS_RAID_COMPONENT 0x40
+#define MPT_TARGET_FLAGS_LED_ON         0x80
 
 /*
  *      /proc/mpt interface
@@ -629,15 +632,14 @@ typedef struct _MPT_ADAPTER
         struct mutex             sas_discovery_mutex;
         u8                       sas_discovery_runtime;
         u8                       sas_discovery_ignore_events;
+        u16                      handle;
         int                      sas_index; /* index refrencing */
         MPT_SAS_MGMT             sas_mgmt;
-        int                      num_ports;
-        struct work_struct       mptscsih_persistTask;
+        struct work_struct       sas_persist_task;
 
         struct work_struct       fc_setup_reset_work;
         struct list_head         fc_rports;
         spinlock_t               fc_rescan_work_lock;
-        int                      fc_rescan_work_count;
         struct work_struct       fc_rescan_work;
         char                     fc_rescan_work_q_name[KOBJ_NAME_LEN];
         struct workqueue_struct *fc_rescan_work_q;
@@ -892,6 +894,13 @@ typedef struct _mpt_sge {
 #define DBG_DUMP_REQUEST_FRAME_HDR(mfp)
 #endif
 
+// debug sas wide ports
+#ifdef MPT_DEBUG_SAS_WIDE
+#define dsaswideprintk(x) printk x
+#else
+#define dsaswideprintk(x)
+#endif
+
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 
@@ -971,7 +980,7 @@ typedef struct _MPT_SCSI_HOST {
         wait_queue_head_t         scandv_waitq;
         int                       scandv_wait_done;
         long                      last_queue_full;
-        u8                        mpt_pq_filter;
+        u16                       tm_iocstatus;
 } MPT_SCSI_HOST;
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index b4967bb8a7d6..30975ccd9947 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2332,7 +2332,7 @@ done_free_mem:
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/* Prototype Routine for the HP HOST INFO command.
+/* Prototype Routine for the HOST INFO command.
  *
  * Outputs:     None.
  * Return:      0 if successful
@@ -2568,7 +2568,7 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/* Prototype Routine for the HP TARGET INFO command.
+/* Prototype Routine for the TARGET INFO command.
  *
  * Outputs:     None.
  * Return:      0 if successful
diff --git a/drivers/message/fusion/mptctl.h b/drivers/message/fusion/mptctl.h
index a2f8a97992e6..043941882c6e 100644
--- a/drivers/message/fusion/mptctl.h
+++ b/drivers/message/fusion/mptctl.h
@@ -354,9 +354,6 @@ struct mpt_ioctl_command32 {
 
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/*
- *      HP Specific IOCTL Defines and Structures
- */
 
 #define CPQFCTS_IOC_MAGIC 'Z'
 #define HP_IOC_MAGIC 'Z'
@@ -364,8 +361,6 @@ struct mpt_ioctl_command32 {
 #define HP_GETHOSTINFO1         _IOR(HP_IOC_MAGIC, 20, hp_host_info_rev0_t)
 #define HP_GETTARGETINFO        _IOR(HP_IOC_MAGIC, 21, hp_target_info_t)
 
-/* All HP IOCTLs must include this header
- */
 typedef struct _hp_header {
         unsigned int iocnum;
         unsigned int host;
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index 3ff8378ea660..85696f34c310 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -77,10 +77,6 @@ MODULE_DESCRIPTION(my_NAME);
 MODULE_LICENSE("GPL");
 
 /* Command line args */
-static int mpt_pq_filter = 0;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter, " Enable peripheral qualifier filter: enable=1  (default=0)");
-
 #define MPTFC_DEV_LOSS_TMO (60)
 static int mptfc_dev_loss_tmo = MPTFC_DEV_LOSS_TMO;     /* reasonable default */
 module_param(mptfc_dev_loss_tmo, int, 0);
@@ -132,21 +128,21 @@ static struct scsi_host_template mptfc_driver_template = {
  */
 
 static struct pci_device_id mptfc_pci_table[] = {
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC909,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC909,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC919,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC919,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC929,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC929,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC919X,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC919X,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC929X,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC929X,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC939X,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC939X,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC949X,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC949X,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_FC949ES,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVICEID_FC949E,
                 PCI_ANY_ID, PCI_ANY_ID },
         {0}     /* Terminating entry */
 };
@@ -513,8 +509,7 @@ mptfc_slave_alloc(struct scsi_device *sdev)
 
         if (vtarget->num_luns == 0) {
                 vtarget->ioc_id = hd->ioc->id;
-                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES |
-                                  MPT_TARGET_FLAGS_VALID_INQUIRY;
+                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES;
                 hd->Targets[sdev->id] = vtarget;
         }
 
@@ -674,7 +669,10 @@ mptfc_GetFcPortPage0(MPT_ADAPTER *ioc, int portnum)
                          * if still doing discovery,
                          * hang loose a while until finished
                          */
-                        if (pp0dest->PortState == MPI_FCPORTPAGE0_PORTSTATE_UNKNOWN) {
+                        if ((pp0dest->PortState == MPI_FCPORTPAGE0_PORTSTATE_UNKNOWN) ||
+                            (pp0dest->PortState == MPI_FCPORTPAGE0_PORTSTATE_ONLINE &&
+                             (pp0dest->Flags & MPI_FCPORTPAGE0_FLAGS_ATTACH_TYPE_MASK)
+                              == MPI_FCPORTPAGE0_FLAGS_ATTACH_NO_INIT)) {
                                 if (count-- > 0) {
                                         msleep(100);
                                         goto try_again;
@@ -900,59 +898,45 @@ mptfc_rescan_devices(void *arg)
 {
         MPT_ADAPTER             *ioc = (MPT_ADAPTER *)arg;
         int                     ii;
-        int                     work_to_do;
         u64                     pn;
-        unsigned long           flags;
         struct mptfc_rport_info *ri;
 
-        do {
-                /* start by tagging all ports as missing */
-                list_for_each_entry(ri, &ioc->fc_rports, list) {
-                        if (ri->flags & MPT_RPORT_INFO_FLAGS_REGISTERED) {
-                                ri->flags |= MPT_RPORT_INFO_FLAGS_MISSING;
-                        }
+        /* start by tagging all ports as missing */
+        list_for_each_entry(ri, &ioc->fc_rports, list) {
+                if (ri->flags & MPT_RPORT_INFO_FLAGS_REGISTERED) {
+                        ri->flags |= MPT_RPORT_INFO_FLAGS_MISSING;
                 }
+        }
 
-                /*
-                 * now rescan devices known to adapter,
-                 * will reregister existing rports
-                 */
-                for (ii=0; ii < ioc->facts.NumberOfPorts; ii++) {
-                        (void) mptfc_GetFcPortPage0(ioc, ii);
-                        mptfc_init_host_attr(ioc,ii);   /* refresh */
-                        mptfc_GetFcDevPage0(ioc,ii,mptfc_register_dev);
-                }
+        /*
+         * now rescan devices known to adapter,
+         * will reregister existing rports
+         */
+        for (ii=0; ii < ioc->facts.NumberOfPorts; ii++) {
+                (void) mptfc_GetFcPortPage0(ioc, ii);
+                mptfc_init_host_attr(ioc, ii);  /* refresh */
+                mptfc_GetFcDevPage0(ioc, ii, mptfc_register_dev);
+        }
 
-                /* delete devices still missing */
-                list_for_each_entry(ri, &ioc->fc_rports, list) {
-                        /* if newly missing, delete it */
-                        if (ri->flags & MPT_RPORT_INFO_FLAGS_MISSING) {
+        /* delete devices still missing */
+        list_for_each_entry(ri, &ioc->fc_rports, list) {
+                /* if newly missing, delete it */
+                if (ri->flags & MPT_RPORT_INFO_FLAGS_MISSING) {
 
-                                ri->flags &= ~(MPT_RPORT_INFO_FLAGS_REGISTERED|
-                                               MPT_RPORT_INFO_FLAGS_MISSING);
-                                fc_remote_port_delete(ri->rport);       /* won't sleep */
-                                ri->rport = NULL;
+                        ri->flags &= ~(MPT_RPORT_INFO_FLAGS_REGISTERED|
+                                       MPT_RPORT_INFO_FLAGS_MISSING);
+                        fc_remote_port_delete(ri->rport);       /* won't sleep */
+                        ri->rport = NULL;
 
-                                pn = (u64)ri->pg0.WWPN.High << 32 |
-                                     (u64)ri->pg0.WWPN.Low;
-                                dfcprintk ((MYIOC_s_INFO_FMT
-                                        "mptfc_rescan.%d: %llx deleted\n",
-                                        ioc->name,
-                                        ioc->sh->host_no,
-                                        (unsigned long long)pn));
-                        }
+                        pn = (u64)ri->pg0.WWPN.High << 32 |
+                             (u64)ri->pg0.WWPN.Low;
+                        dfcprintk ((MYIOC_s_INFO_FMT
+                                "mptfc_rescan.%d: %llx deleted\n",
+                                ioc->name,
+                                ioc->sh->host_no,
+                                (unsigned long long)pn));
                 }
-
-                /*
-                 * allow multiple passes as target state
-                 * might have changed during scan
-                 */
-                spin_lock_irqsave(&ioc->fc_rescan_work_lock, flags);
-                if (ioc->fc_rescan_work_count > 2)      /* only need one more */
-                        ioc->fc_rescan_work_count = 2;
-                work_to_do = --ioc->fc_rescan_work_count;
-                spin_unlock_irqrestore(&ioc->fc_rescan_work_lock, flags);
-        } while (work_to_do);
+        }
 }
 
 static int
@@ -1129,13 +1113,6 @@ mptfc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         hd->timer.data = (unsigned long) hd;
         hd->timer.function = mptscsih_timer_expired;
 
-        hd->mpt_pq_filter = mpt_pq_filter;
-
-        ddvprintk((MYIOC_s_INFO_FMT
-                "mpt_pq_filter %x\n",
-                ioc->name, 
-                mpt_pq_filter));
-
         init_waitqueue_head(&hd->scandv_waitq);
         hd->scandv_wait_done = 0;
         hd->last_queue_full = 0;
@@ -1171,7 +1148,6 @@ mptfc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
          *      by doing it via the workqueue, some locking is eliminated
          */
 
-        ioc->fc_rescan_work_count = 1;
         queue_work(ioc->fc_rescan_work_q, &ioc->fc_rescan_work);
         flush_workqueue(ioc->fc_rescan_work_q);
 
@@ -1214,10 +1190,8 @@ mptfc_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
         case MPI_EVENT_RESCAN:
                 spin_lock_irqsave(&ioc->fc_rescan_work_lock, flags);
                 if (ioc->fc_rescan_work_q) {
-                        if (ioc->fc_rescan_work_count++ == 0) {
-                                queue_work(ioc->fc_rescan_work_q,
-                                           &ioc->fc_rescan_work);
-                        }
+                        queue_work(ioc->fc_rescan_work_q,
+                                   &ioc->fc_rescan_work);
                 }
                 spin_unlock_irqrestore(&ioc->fc_rescan_work_lock, flags);
                 break;
@@ -1260,10 +1234,8 @@ mptfc_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
                 mptfc_SetFcPortPage1_defaults(ioc);
                 spin_lock_irqsave(&ioc->fc_rescan_work_lock, flags);
                 if (ioc->fc_rescan_work_q) {
-                        if (ioc->fc_rescan_work_count++ == 0) {
-                                queue_work(ioc->fc_rescan_work_q,
-                                           &ioc->fc_rescan_work);
-                        }
+                        queue_work(ioc->fc_rescan_work_q,
+                                   &ioc->fc_rescan_work);
                 }
                 spin_unlock_irqrestore(&ioc->fc_rescan_work_lock, flags);
         }
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 85689ab46cbc..f66f2203143a 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -50,11 +50,14 @@
 #include <linux/errno.h>
 #include <linux/sched.h>
 #include <linux/workqueue.h>
+#include <linux/delay.h>        /* for mdelay */
 
+#include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport_sas.h>
+#include <scsi/scsi_dbg.h>
 
 #include "mptbase.h"
 #include "mptscsih.h"
@@ -64,20 +67,19 @@
 #define my_VERSION      MPT_LINUX_VERSION_COMMON
 #define MYNAM           "mptsas"
 
+/*
+ * Reserved channel for integrated raid
+ */
+#define MPTSAS_RAID_CHANNEL     1
+
 MODULE_AUTHOR(MODULEAUTHOR);
 MODULE_DESCRIPTION(my_NAME);
 MODULE_LICENSE("GPL");
 
-static int mpt_pq_filter;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter,
-                "Enable peripheral qualifier filter: enable=1  "
-                "(default=0)");
-
 static int mpt_pt_clear;
 module_param(mpt_pt_clear, int, 0);
 MODULE_PARM_DESC(mpt_pt_clear,
-                "Clear persistency table: enable=1  "
+                " Clear persistency table: enable=1  "
                 "(default=MPTSCSIH_PT_CLEAR=0)");
 
 static int      mptsasDoneCtx = -1;
@@ -137,23 +139,36 @@ struct mptsas_devinfo {
         u32     device_info;    /* bitfield detailed info about this device */
 };
 
+/*
+ * Specific details on ports, wide/narrow
+ */
+struct mptsas_portinfo_details{
+        u16     num_phys;       /* number of phys belong to this port */
+        u64     phy_bitmask;    /* TODO, extend support for 255 phys */
+        struct sas_rphy *rphy;  /* transport layer rphy object */
+        struct sas_port *port;  /* transport layer port object */
+        struct scsi_target *starget;
+        struct mptsas_portinfo *port_info;
+};
+
 struct mptsas_phyinfo {
         u8      phy_id;                 /* phy index */
-        u8      port_id;                /* port number this phy is part of */
+        u8      port_id;                /* firmware port identifier */
         u8      negotiated_link_rate;   /* nego'd link rate for this phy */
         u8      hw_link_rate;           /* hardware max/min phys link rate */
         u8      programmed_link_rate;   /* programmed max/min phy link rate */
+        u8      sas_port_add_phy;       /* flag to request sas_port_add_phy*/
         struct mptsas_devinfo identify; /* point to phy device info */
         struct mptsas_devinfo attached; /* point to attached device info */
-        struct sas_phy *phy;
-        struct sas_rphy *rphy;
-        struct scsi_target *starget;
+        struct sas_phy *phy;            /* transport layer phy object */
+        struct mptsas_portinfo *portinfo;
+        struct mptsas_portinfo_details * port_details;
 };
 
 struct mptsas_portinfo {
         struct list_head list;
         u16             handle;         /* unique id to address this */
-        u8              num_phys;       /* number of phys */
+        u16             num_phys;       /* number of phys */
         struct mptsas_phyinfo *phy_info;
 };
 
@@ -169,7 +184,7 @@ struct mptsas_enclosure {
         u8      sep_channel;            /* SEP channel logical channel id */
 };
 
-#ifdef SASDEBUG
+#ifdef MPT_DEBUG_SAS
 static void mptsas_print_phy_data(MPI_SAS_IO_UNIT0_PHY_DATA *phy_data)
 {
         printk("---- IO UNIT PAGE 0 ------------\n");
@@ -305,7 +320,7 @@ mptsas_find_portinfo_by_handle(MPT_ADAPTER *ioc, u16 handle)
 static inline int
 mptsas_is_end_device(struct mptsas_devinfo * attached)
 {
-        if ((attached->handle) &&
+        if ((attached->sas_address) &&
             (attached->device_info &
             MPI_SAS_DEVICE_INFO_END_DEVICE) &&
             ((attached->device_info &
@@ -319,6 +334,247 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
                 return 0;
 }
 
+/* no mutex */
+static void
+mptsas_port_delete(struct mptsas_portinfo_details * port_details)
+{
+        struct mptsas_portinfo *port_info;
+        struct mptsas_phyinfo *phy_info;
+        u8      i;
+
+        if (!port_details)
+                return;
+
+        port_info = port_details->port_info;
+        phy_info = port_info->phy_info;
+
+        dsaswideprintk((KERN_DEBUG "%s: [%p]: num_phys=%02d "
+                "bitmask=0x%016llX\n",
+                __FUNCTION__, port_details, port_details->num_phys,
+                    port_details->phy_bitmask));
+
+        for (i = 0; i < port_info->num_phys; i++, phy_info++) {
+                if(phy_info->port_details != port_details)
+                        continue;
+                memset(&phy_info->attached, 0, sizeof(struct mptsas_devinfo));
+                phy_info->port_details = NULL;
+        }
+        kfree(port_details);
+}
+
+static inline struct sas_rphy *
+mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
+{
+        if (phy_info->port_details)
+                return phy_info->port_details->rphy;
+        else
+                return NULL;
+}
+
+static inline void
+mptsas_set_rphy(struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
+{
+        if (phy_info->port_details) {
+                phy_info->port_details->rphy = rphy;
+                dsaswideprintk((KERN_DEBUG "sas_rphy_add: rphy=%p\n", rphy));
+        }
+
+#ifdef MPT_DEBUG_SAS_WIDE
+        if (rphy) {
+                dev_printk(KERN_DEBUG, &rphy->dev, "add:");
+                printk("rphy=%p release=%p\n",
+                        rphy, rphy->dev.release);
+        }
+#endif
+}
+
+static inline struct sas_port *
+mptsas_get_port(struct mptsas_phyinfo *phy_info)
+{
+        if (phy_info->port_details)
+                return phy_info->port_details->port;
+        else
+                return NULL;
+}
+
+static inline void
+mptsas_set_port(struct mptsas_phyinfo *phy_info, struct sas_port *port)
+{
+        if (phy_info->port_details)
+                phy_info->port_details->port = port;
+
+#ifdef MPT_DEBUG_SAS_WIDE
+        if (port) {
+                dev_printk(KERN_DEBUG, &port->dev, "add: ");
+                printk("port=%p release=%p\n",
+                        port, port->dev.release);
+        }
+#endif
+}
+
+static inline struct scsi_target *
+mptsas_get_starget(struct mptsas_phyinfo *phy_info)
+{
+        if (phy_info->port_details)
+                return phy_info->port_details->starget;
+        else
+                return NULL;
+}
+
+static inline void
+mptsas_set_starget(struct mptsas_phyinfo *phy_info, struct scsi_target *
+starget)
+{
+        if (phy_info->port_details)
+                phy_info->port_details->starget = starget;
+}
+
+
+/*
+ * mptsas_setup_wide_ports
+ *
+ * Updates for new and existing narrow/wide port configuration
+ * in the sas_topology
+ */
+static void
+mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
+{
+        struct mptsas_portinfo_details * port_details;
+        struct mptsas_phyinfo *phy_info, *phy_info_cmp;
+        u64     sas_address;
+        int     i, j;
+
+        mutex_lock(&ioc->sas_topology_mutex);
+
+        phy_info = port_info->phy_info;
+        for (i = 0 ; i < port_info->num_phys ; i++, phy_info++) {
+                if (phy_info->attached.handle)
+                        continue;
+                port_details = phy_info->port_details;
+                if (!port_details)
+                        continue;
+                if (port_details->num_phys < 2)
+                        continue;
+                /*
+                 * Removing a phy from a port, letting the last
+                 * phy be removed by firmware events.
+                 */
+                dsaswideprintk((KERN_DEBUG
+                        "%s: [%p]: deleting phy = %d\n",
+                        __FUNCTION__, port_details, i));
+                port_details->num_phys--;
+                port_details->phy_bitmask &= ~ (1 << phy_info->phy_id);
+                memset(&phy_info->attached, 0, sizeof(struct mptsas_devinfo));
+                sas_port_delete_phy(port_details->port, phy_info->phy);
+                phy_info->port_details = NULL;
+        }
+
+        /*
+         * Populate and refresh the tree
+         */
+        phy_info = port_info->phy_info;
+        for (i = 0 ; i < port_info->num_phys ; i++, phy_info++) {
+                sas_address = phy_info->attached.sas_address;
+                dsaswideprintk((KERN_DEBUG "phy_id=%d sas_address=0x%018llX\n",
+                        i, sas_address));
+                if (!sas_address)
+                        continue;
+                port_details = phy_info->port_details;
+                /*
+                 * Forming a port
+                 */
+                if (!port_details) {
+                        port_details = kzalloc(sizeof(*port_details),
+                                GFP_KERNEL);
+                        if (!port_details)
+                                goto out;
+                        port_details->num_phys = 1;
+                        port_details->port_info = port_info;
+                        if (phy_info->phy_id < 64 )
+                                port_details->phy_bitmask |=
+                                    (1 << phy_info->phy_id);
+                        phy_info->sas_port_add_phy=1;
+                        dsaswideprintk((KERN_DEBUG "\t\tForming port\n\t\t"
+                                "phy_id=%d sas_address=0x%018llX\n",
+                                i, sas_address));
+                        phy_info->port_details = port_details;
+                }
+
+                if (i == port_info->num_phys - 1)
+                        continue;
+                phy_info_cmp = &port_info->phy_info[i + 1];
+                for (j = i + 1 ; j < port_info->num_phys ; j++,
+                    phy_info_cmp++) {
+                        if (!phy_info_cmp->attached.sas_address)
+                                continue;
+                        if (sas_address != phy_info_cmp->attached.sas_address)
+                                continue;
+                        if (phy_info_cmp->port_details == port_details )
+                                continue;
+                        dsaswideprintk((KERN_DEBUG
+                                "\t\tphy_id=%d sas_address=0x%018llX\n",
+                                j, phy_info_cmp->attached.sas_address));
+                        if (phy_info_cmp->port_details) {
+                                port_details->rphy =
+                                    mptsas_get_rphy(phy_info_cmp);
+                                port_details->port =
+                                    mptsas_get_port(phy_info_cmp);
+                                port_details->starget =
+                                    mptsas_get_starget(phy_info_cmp);
+                                port_details->num_phys =
+                                        phy_info_cmp->port_details->num_phys;
+                                if (!phy_info_cmp->port_details->num_phys)
+                                        kfree(phy_info_cmp->port_details);
+                        } else
+                                phy_info_cmp->sas_port_add_phy=1;
+                        /*
+                         * Adding a phy to a port
+                         */
+                        phy_info_cmp->port_details = port_details;
+                        if (phy_info_cmp->phy_id < 64 )
+                                port_details->phy_bitmask |=
+                                (1 << phy_info_cmp->phy_id);
+                        port_details->num_phys++;
+                }
+        }
+
+ out:
+
+#ifdef MPT_DEBUG_SAS_WIDE
+        for (i = 0; i < port_info->num_phys; i++) {
+                port_details = port_info->phy_info[i].port_details;
+                if (!port_details)
+                        continue;
+                dsaswideprintk((KERN_DEBUG
+                        "%s: [%p]: phy_id=%02d num_phys=%02d "
+                        "bitmask=0x%016llX\n",
+                        __FUNCTION__,
+                        port_details, i, port_details->num_phys,
+                        port_details->phy_bitmask));
+                dsaswideprintk((KERN_DEBUG"\t\tport = %p rphy=%p\n",
+                        port_details->port, port_details->rphy));
+        }
+        dsaswideprintk((KERN_DEBUG"\n"));
+#endif
+        mutex_unlock(&ioc->sas_topology_mutex);
+}
+
+static void
+mptsas_target_reset(MPT_ADAPTER *ioc, VirtTarget * vtarget)
+{
+        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)ioc->sh->hostdata;
+
+        if (mptscsih_TMHandler(hd,
+             MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
+             vtarget->bus_id, vtarget->target_id, 0, 0, 5) < 0) {
+                hd->tmPending = 0;
+                hd->tmState = TM_STATE_NONE;
+                printk(MYIOC_s_WARN_FMT
+               "Error processing TaskMgmt id=%d TARGET_RESET\n",
+                        ioc->name, vtarget->target_id);
+        }
+}
+
 static int
 mptsas_sas_enclosure_pg0(MPT_ADAPTER *ioc, struct mptsas_enclosure *enclosure,
                 u32 form, u32 form_specific)
@@ -387,24 +643,112 @@ mptsas_sas_enclosure_pg0(MPT_ADAPTER *ioc, struct mptsas_enclosure *enclosure,
 static int
 mptsas_slave_configure(struct scsi_device *sdev)
 {
-        struct Scsi_Host        *host = sdev->host;
-        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
 
-        /*
-         * RAID volumes placed beyond the last expected port.
-         * Ignore sending sas mode pages in that case..
-         */
-        if (sdev->channel < hd->ioc->num_ports)
-                sas_read_port_mode_page(sdev);
+        if (sdev->channel == MPTSAS_RAID_CHANNEL)
+                goto out;
 
+        sas_read_port_mode_page(sdev);
+
+ out:
         return mptscsih_slave_configure(sdev);
 }
 
-/*
- * This is pretty ugly.  We will be able to seriously clean it up
- * once the DV code in mptscsih goes away and we can properly
- * implement ->target_alloc.
- */
+static int
+mptsas_target_alloc(struct scsi_target *starget)
+{
+        struct Scsi_Host *host = dev_to_shost(&starget->dev);
+        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
+        VirtTarget              *vtarget;
+        u32                     target_id;
+        u32                     channel;
+        struct sas_rphy         *rphy;
+        struct mptsas_portinfo  *p;
+        int                      i;
+
+        vtarget = kzalloc(sizeof(VirtTarget), GFP_KERNEL);
+        if (!vtarget)
+                return -ENOMEM;
+
+        vtarget->starget = starget;
+        vtarget->ioc_id = hd->ioc->id;
+        vtarget->tflags = MPT_TARGET_FLAGS_Q_YES|MPT_TARGET_FLAGS_VALID_INQUIRY;
+
+        target_id = starget->id;
+        channel = 0;
+
+        hd->Targets[target_id] = vtarget;
+
+        if (starget->channel == MPTSAS_RAID_CHANNEL)
+                goto out;
+
+        rphy = dev_to_rphy(starget->dev.parent);
+        mutex_lock(&hd->ioc->sas_topology_mutex);
+        list_for_each_entry(p, &hd->ioc->sas_topology, list) {
+                for (i = 0; i < p->num_phys; i++) {
+                        if (p->phy_info[i].attached.sas_address !=
+                                        rphy->identify.sas_address)
+                                continue;
+                        target_id = p->phy_info[i].attached.id;
+                        channel = p->phy_info[i].attached.channel;
+                        mptsas_set_starget(&p->phy_info[i], starget);
+
+                        /*
+                         * Exposing hidden raid components
+                         */
+                        if (mptscsih_is_phys_disk(hd->ioc, target_id)) {
+                                target_id = mptscsih_raid_id_to_num(hd,
+                                                target_id);
+                                vtarget->tflags |=
+                                    MPT_TARGET_FLAGS_RAID_COMPONENT;
+                        }
+                        mutex_unlock(&hd->ioc->sas_topology_mutex);
+                        goto out;
+                }
+        }
+        mutex_unlock(&hd->ioc->sas_topology_mutex);
+
+        kfree(vtarget);
+        return -ENXIO;
+
+ out:
+        vtarget->target_id = target_id;
+        vtarget->bus_id = channel;
+        starget->hostdata = vtarget;
+        return 0;
+}
+
+static void
+mptsas_target_destroy(struct scsi_target *starget)
+{
+        struct Scsi_Host *host = dev_to_shost(&starget->dev);
+        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
+        struct sas_rphy         *rphy;
+        struct mptsas_portinfo  *p;
+        int                      i;
+
+        if (!starget->hostdata)
+                return;
+
+        if (starget->channel == MPTSAS_RAID_CHANNEL)
+                goto out;
+
+        rphy = dev_to_rphy(starget->dev.parent);
+        list_for_each_entry(p, &hd->ioc->sas_topology, list) {
+                for (i = 0; i < p->num_phys; i++) {
+                        if (p->phy_info[i].attached.sas_address !=
+                                        rphy->identify.sas_address)
+                                continue;
+                        mptsas_set_starget(&p->phy_info[i], NULL);
+                        goto out;
+                }
+        }
+
+ out:
+        kfree(starget->hostdata);
+        starget->hostdata = NULL;
+}
+
+
 static int
 mptsas_slave_alloc(struct scsi_device *sdev)
 {
@@ -412,61 +756,38 @@ mptsas_slave_alloc(struct scsi_device *sdev)
         MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
         struct sas_rphy         *rphy;
         struct mptsas_portinfo  *p;
-        VirtTarget              *vtarget;
         VirtDevice              *vdev;
         struct scsi_target      *starget;
-        u32                     target_id;
-        int i;
+        int                     i;
 
         vdev = kzalloc(sizeof(VirtDevice), GFP_KERNEL);
         if (!vdev) {
-                printk(MYIOC_s_ERR_FMT "slave_alloc kmalloc(%zd) FAILED!\n",
+                printk(MYIOC_s_ERR_FMT "slave_alloc kzalloc(%zd) FAILED!\n",
                                 hd->ioc->name, sizeof(VirtDevice));
                 return -ENOMEM;
         }
-        sdev->hostdata = vdev;
         starget = scsi_target(sdev);
-        vtarget = starget->hostdata;
-        vtarget->ioc_id = hd->ioc->id;
-        vdev->vtarget = vtarget;
-        if (vtarget->num_luns == 0) {
-                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES|MPT_TARGET_FLAGS_VALID_INQUIRY;
-                hd->Targets[sdev->id] = vtarget;
-        }
+        vdev->vtarget = starget->hostdata;
 
-        /*
-          RAID volumes placed beyond the last expected port.
-        */
-        if (sdev->channel == hd->ioc->num_ports) {
-                target_id = sdev->id;
-                vtarget->bus_id = 0;
-                vdev->lun = 0;
+        if (sdev->channel == MPTSAS_RAID_CHANNEL)
                 goto out;
-        }
 
         rphy = dev_to_rphy(sdev->sdev_target->dev.parent);
         mutex_lock(&hd->ioc->sas_topology_mutex);
         list_for_each_entry(p, &hd->ioc->sas_topology, list) {
                 for (i = 0; i < p->num_phys; i++) {
-                        if (p->phy_info[i].attached.sas_address ==
-                                        rphy->identify.sas_address) {
-                                target_id = p->phy_info[i].attached.id;
-                                vtarget->bus_id = p->phy_info[i].attached.channel;
-                                vdev->lun = sdev->lun;
-                                p->phy_info[i].starget = sdev->sdev_target;
-                                /*
-                                 * Exposing hidden disk (RAID)
-                                 */
-                                if (mptscsih_is_phys_disk(hd->ioc, target_id)) {
-                                        target_id = mptscsih_raid_id_to_num(hd,
-                                                        target_id);
-                                        vdev->vtarget->tflags |=
-                                            MPT_TARGET_FLAGS_RAID_COMPONENT;
-                                        sdev->no_uld_attach = 1;
-                                }
-                                mutex_unlock(&hd->ioc->sas_topology_mutex);
-                                goto out;
-                        }
+                        if (p->phy_info[i].attached.sas_address !=
+                                        rphy->identify.sas_address)
+                                continue;
+                        vdev->lun = sdev->lun;
+                        /*
+                         * Exposing hidden raid components
+                         */
+                        if (mptscsih_is_phys_disk(hd->ioc,
+                                        p->phy_info[i].attached.id))
+                                sdev->no_uld_attach = 1;
+                        mutex_unlock(&hd->ioc->sas_topology_mutex);
+                        goto out;
                 }
         }
         mutex_unlock(&hd->ioc->sas_topology_mutex);
@@ -475,57 +796,39 @@ mptsas_slave_alloc(struct scsi_device *sdev)
         return -ENXIO;
 
  out:
-        vtarget->target_id = target_id;
-        vtarget->num_luns++;
+        vdev->vtarget->num_luns++;
+        sdev->hostdata = vdev;
         return 0;
 }
 
-static void
-mptsas_slave_destroy(struct scsi_device *sdev)
+static int
+mptsas_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
 {
-        struct Scsi_Host *host = sdev->host;
-        MPT_SCSI_HOST *hd = (MPT_SCSI_HOST *)host->hostdata;
-        VirtDevice *vdev;
-
-        /*
-         * Issue target reset to flush firmware outstanding commands.
-         */
-        vdev = sdev->hostdata;
-        if (vdev->configured_lun){
-                if (mptscsih_TMHandler(hd,
-                     MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
-                     vdev->vtarget->bus_id,
-                     vdev->vtarget->target_id,
-                     0, 0, 5 /* 5 second timeout */)
-                     < 0){
-
-                        /* The TM request failed!
-                         * Fatal error case.
-                         */
-                        printk(MYIOC_s_WARN_FMT
-                       "Error processing TaskMgmt id=%d TARGET_RESET\n",
-                                hd->ioc->name,
-                                vdev->vtarget->target_id);
+        VirtDevice      *vdev = SCpnt->device->hostdata;
 
-                        hd->tmPending = 0;
-                        hd->tmState = TM_STATE_NONE;
-                }
+//      scsi_print_command(SCpnt);
+        if (vdev->vtarget->deleted) {
+                SCpnt->result = DID_NO_CONNECT << 16;
+                done(SCpnt);
+                return 0;
         }
-        mptscsih_slave_destroy(sdev);
+
+        return mptscsih_qcmd(SCpnt,done);
 }
 
+
 static struct scsi_host_template mptsas_driver_template = {
         .module                         = THIS_MODULE,
         .proc_name                      = "mptsas",
         .proc_info                      = mptscsih_proc_info,
         .name                           = "MPT SPI Host",
         .info                           = mptscsih_info,
-        .queuecommand                   = mptscsih_qcmd,
-        .target_alloc                   = mptscsih_target_alloc,
+        .queuecommand                   = mptsas_qcmd,
+        .target_alloc                   = mptsas_target_alloc,
         .slave_alloc                    = mptsas_slave_alloc,
         .slave_configure                = mptsas_slave_configure,
-        .target_destroy                 = mptscsih_target_destroy,
-        .slave_destroy                  = mptsas_slave_destroy,
+        .target_destroy                 = mptsas_target_destroy,
+        .slave_destroy                  = mptscsih_slave_destroy,
         .change_queue_depth             = mptscsih_change_queue_depth,
         .eh_abort_handler               = mptscsih_abort,
         .eh_device_reset_handler        = mptscsih_dev_reset,
@@ -795,7 +1098,7 @@ mptsas_sas_io_unit_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
 
         port_info->num_phys = buffer->NumPhys;
         port_info->phy_info = kcalloc(port_info->num_phys,
-                sizeof(struct mptsas_phyinfo),GFP_KERNEL);
+                sizeof(*port_info->phy_info),GFP_KERNEL);
         if (!port_info->phy_info) {
                 error = -ENOMEM;
                 goto out_free_consistent;
@@ -811,6 +1114,7 @@ mptsas_sas_io_unit_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                     buffer->PhyData[i].Port;
                 port_info->phy_info[i].negotiated_link_rate =
                     buffer->PhyData[i].NegotiatedLinkRate;
+                port_info->phy_info[i].portinfo = port_info;
         }
 
  out_free_consistent:
@@ -968,7 +1272,7 @@ mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
         CONFIGPARMS cfg;
         SasExpanderPage0_t *buffer;
         dma_addr_t dma_handle;
-        int error;
+        int i, error;
 
         hdr.PageVersion = MPI_SASEXPANDER0_PAGEVERSION;
         hdr.ExtPageLength = 0;
@@ -1013,12 +1317,15 @@ mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
         port_info->num_phys = buffer->NumPhys;
         port_info->handle = le16_to_cpu(buffer->DevHandle);
         port_info->phy_info = kcalloc(port_info->num_phys,
-                sizeof(struct mptsas_phyinfo),GFP_KERNEL);
+                sizeof(*port_info->phy_info),GFP_KERNEL);
         if (!port_info->phy_info) {
                 error = -ENOMEM;
                 goto out_free_consistent;
         }
 
+        for (i = 0; i < port_info->num_phys; i++)
+                port_info->phy_info[i].portinfo = port_info;
+
  out_free_consistent:
         pci_free_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
                             buffer, dma_handle);
@@ -1161,19 +1468,23 @@ static int mptsas_probe_one_phy(struct device *dev,
 {
         MPT_ADAPTER *ioc;
         struct sas_phy *phy;
-        int error;
+        struct sas_port *port;
+        int error = 0;
 
-        if (!dev)
-                return -ENODEV;
+        if (!dev) {
+                error = -ENODEV;
+                goto out;
+        }
 
         if (!phy_info->phy) {
                 phy = sas_phy_alloc(dev, index);
-                if (!phy)
-                        return -ENOMEM;
+                if (!phy) {
+                        error = -ENOMEM;
+                        goto out;
+                }
         } else
                 phy = phy_info->phy;
 
-        phy->port_identifier = phy_info->port_id;
         mptsas_parse_device_info(&phy->identify, &phy_info->identify);
 
         /*
@@ -1265,19 +1576,51 @@ static int mptsas_probe_one_phy(struct device *dev,
                 error = sas_phy_add(phy);
                 if (error) {
                         sas_phy_free(phy);
-                        return error;
+                        goto out;
                 }
                 phy_info->phy = phy;
         }
 
-        if ((phy_info->attached.handle) &&
-            (!phy_info->rphy)) {
+        if (!phy_info->attached.handle ||
+                        !phy_info->port_details)
+                goto out;
+
+        port = mptsas_get_port(phy_info);
+        ioc = phy_to_ioc(phy_info->phy);
+
+        if (phy_info->sas_port_add_phy) {
+
+                if (!port) {
+                        port = sas_port_alloc_num(dev);
+                        if (!port) {
+                                error = -ENOMEM;
+                                goto out;
+                        }
+                        error = sas_port_add(port);
+                        if (error) {
+                                dfailprintk((MYIOC_s_ERR_FMT
+                                        "%s: exit at line=%d\n", ioc->name,
+                                        __FUNCTION__, __LINE__));
+                                goto out;
+                        }
+                        mptsas_set_port(phy_info, port);
+                        dsaswideprintk((KERN_DEBUG
+                            "sas_port_alloc: port=%p dev=%p port_id=%d\n",
+                            port, dev, port->port_identifier));
+                }
+                dsaswideprintk((KERN_DEBUG "sas_port_add_phy: phy_id=%d\n",
+                    phy_info->phy_id));
+                sas_port_add_phy(port, phy_info->phy);
+                phy_info->sas_port_add_phy = 0;
+        }
+
+        if (!mptsas_get_rphy(phy_info) && port && !port->rphy) {
 
                 struct sas_rphy *rphy;
+                struct device *parent;
                 struct sas_identify identify;
 
-                ioc = phy_to_ioc(phy_info->phy);
-
+                parent = dev->parent->parent;
                 /*
                  * Let the hotplug_work thread handle processing
                  * the adding/removing of devices that occur
@@ -1285,36 +1628,63 @@ static int mptsas_probe_one_phy(struct device *dev,
                  */
                 if (ioc->sas_discovery_runtime &&
                         mptsas_is_end_device(&phy_info->attached))
-                        return 0;
+                                goto out;
 
                 mptsas_parse_device_info(&identify, &phy_info->attached);
+                if (scsi_is_host_device(parent)) {
+                        struct mptsas_portinfo *port_info;
+                        int i;
+
+                        mutex_lock(&ioc->sas_topology_mutex);
+                        port_info = mptsas_find_portinfo_by_handle(ioc,
+                                                                   ioc->handle);
+                        mutex_unlock(&ioc->sas_topology_mutex);
+
+                        for (i = 0; i < port_info->num_phys; i++)
+                                if (port_info->phy_info[i].identify.sas_address ==
+                                    identify.sas_address)
+                                        goto out;
+
+                } else if (scsi_is_sas_rphy(parent)) {
+                        struct sas_rphy *parent_rphy = dev_to_rphy(parent);
+                        if (identify.sas_address ==
+                            parent_rphy->identify.sas_address)
+                                goto out;
+                }
+
                 switch (identify.device_type) {
                 case SAS_END_DEVICE:
-                        rphy = sas_end_device_alloc(phy);
+                        rphy = sas_end_device_alloc(port);
                         break;
                 case SAS_EDGE_EXPANDER_DEVICE:
                 case SAS_FANOUT_EXPANDER_DEVICE:
-                        rphy = sas_expander_alloc(phy, identify.device_type);
+                        rphy = sas_expander_alloc(port, identify.device_type);
                         break;
                 default:
                         rphy = NULL;
                         break;
                 }
-                if (!rphy)
-                        return 0; /* non-fatal: an rphy can be added later */
+                if (!rphy) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
+                        goto out;
+                }
 
                 rphy->identify = identify;
-
                 error = sas_rphy_add(rphy);
                 if (error) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
                         sas_rphy_free(rphy);
-                        return error;
+                        goto out;
                 }
-
-                phy_info->rphy = rphy;
+                mptsas_set_rphy(phy_info, rphy);
         }
 
-        return 0;
+ out:
+        return error;
 }
 
 static int
@@ -1333,6 +1703,7 @@ mptsas_probe_hba_phys(MPT_ADAPTER *ioc)
                 goto out_free_port_info;
 
         mutex_lock(&ioc->sas_topology_mutex);
+        ioc->handle = hba->handle;
         port_info = mptsas_find_portinfo_by_handle(ioc, hba->handle);
         if (!port_info) {
                 port_info = hba;
@@ -1342,13 +1713,11 @@ mptsas_probe_hba_phys(MPT_ADAPTER *ioc)
                 for (i = 0; i < hba->num_phys; i++)
                         port_info->phy_info[i].negotiated_link_rate =
                                 hba->phy_info[i].negotiated_link_rate;
-                if (hba->phy_info)
-                        kfree(hba->phy_info);
+                kfree(hba->phy_info);
                 kfree(hba);
                 hba = NULL;
         }
         mutex_unlock(&ioc->sas_topology_mutex);
-        ioc->num_ports = port_info->num_phys;
 
         for (i = 0; i < port_info->num_phys; i++) {
                 mptsas_sas_phy_pg0(ioc, &port_info->phy_info[i],
@@ -1362,18 +1731,19 @@ mptsas_probe_hba_phys(MPT_ADAPTER *ioc)
                     port_info->phy_info[i].phy_id;
                 handle = port_info->phy_info[i].identify.handle;
 
-                if (port_info->phy_info[i].attached.handle) {
+                if (port_info->phy_info[i].attached.handle)
                         mptsas_sas_device_pg0(ioc,
                                 &port_info->phy_info[i].attached,
                                 (MPI_SAS_DEVICE_PGAD_FORM_HANDLE <<
                                  MPI_SAS_DEVICE_PGAD_FORM_SHIFT),
                                 port_info->phy_info[i].attached.handle);
-                }
+        }
 
+        mptsas_setup_wide_ports(ioc, port_info);
+
+        for (i = 0; i < port_info->num_phys; i++, ioc->sas_index++)
                 mptsas_probe_one_phy(&ioc->sh->shost_gendev,
                     &port_info->phy_info[i], ioc->sas_index, 1);
-                ioc->sas_index++;
-        }
 
         return 0;
 
@@ -1387,6 +1757,8 @@ static int
 mptsas_probe_expander_phys(MPT_ADAPTER *ioc, u32 *handle)
 {
         struct mptsas_portinfo *port_info, *p, *ex;
+        struct device *parent;
+        struct sas_rphy *rphy;
         int error = -ENOMEM, i, j;
 
         ex = kzalloc(sizeof(*port_info), GFP_KERNEL);
@@ -1408,16 +1780,13 @@ mptsas_probe_expander_phys(MPT_ADAPTER *ioc, u32 *handle)
                 list_add_tail(&port_info->list, &ioc->sas_topology);
         } else {
                 port_info->handle = ex->handle;
-                if (ex->phy_info)
-                        kfree(ex->phy_info);
+                kfree(ex->phy_info);
                 kfree(ex);
                 ex = NULL;
         }
         mutex_unlock(&ioc->sas_topology_mutex);
 
         for (i = 0; i < port_info->num_phys; i++) {
-                struct device *parent;
-
                 mptsas_sas_expander_pg1(ioc, &port_info->phy_info[i],
                         (MPI_SAS_EXPAND_PGAD_FORM_HANDLE_PHY_NUM <<
                          MPI_SAS_EXPAND_PGAD_FORM_SHIFT), (i << 16) + *handle);
@@ -1441,34 +1810,34 @@ mptsas_probe_expander_phys(MPT_ADAPTER *ioc, u32 *handle)
                         port_info->phy_info[i].attached.phy_id =
                             port_info->phy_info[i].phy_id;
                 }
+        }
 
-                /*
-                 * If we find a parent port handle this expander is
-                 * attached to another expander, else it hangs of the
-                 * HBA phys.
-                 */
-                parent = &ioc->sh->shost_gendev;
+        parent = &ioc->sh->shost_gendev;
+        for (i = 0; i < port_info->num_phys; i++) {
                 mutex_lock(&ioc->sas_topology_mutex);
                 list_for_each_entry(p, &ioc->sas_topology, list) {
                         for (j = 0; j < p->num_phys; j++) {
-                                if (port_info->phy_info[i].identify.handle ==
+                                if (port_info->phy_info[i].identify.handle !=
                                                 p->phy_info[j].attached.handle)
-                                        parent = &p->phy_info[j].rphy->dev;
+                                        continue;
+                                rphy = mptsas_get_rphy(&p->phy_info[j]);
+                                parent = &rphy->dev;
                         }
                 }
                 mutex_unlock(&ioc->sas_topology_mutex);
+        }
 
+        mptsas_setup_wide_ports(ioc, port_info);
+
+        for (i = 0; i < port_info->num_phys; i++, ioc->sas_index++)
                 mptsas_probe_one_phy(parent, &port_info->phy_info[i],
                     ioc->sas_index, 0);
-                ioc->sas_index++;
-        }
 
         return 0;
 
  out_free_port_info:
         if (ex) {
-                if (ex->phy_info)
-                        kfree(ex->phy_info);
+                kfree(ex->phy_info);
                 kfree(ex);
         }
  out:
@@ -1487,7 +1856,12 @@ mptsas_delete_expander_phys(MPT_ADAPTER *ioc)
 {
         struct mptsas_portinfo buffer;
         struct mptsas_portinfo *port_info, *n, *parent;
+        struct mptsas_phyinfo *phy_info;
+        struct scsi_target * starget;
+        VirtTarget * vtarget;
+        struct sas_port * port;
         int i;
+        u64     expander_sas_address;
 
         mutex_lock(&ioc->sas_topology_mutex);
         list_for_each_entry_safe(port_info, n, &ioc->sas_topology, list) {
@@ -1502,6 +1876,25 @@ mptsas_delete_expander_phys(MPT_ADAPTER *ioc)
                      MPI_SAS_EXPAND_PGAD_FORM_SHIFT), port_info->handle)) {
 
                         /*
+                         * Issue target reset to all child end devices
+                         * then mark them deleted to prevent further
+                         * IO going to them.
+                         */
+                        phy_info = port_info->phy_info;
+                        for (i = 0; i < port_info->num_phys; i++, phy_info++) {
+                                starget = mptsas_get_starget(phy_info);
+                                if (!starget)
+                                        continue;
+                                vtarget = starget->hostdata;
+                                if(vtarget->deleted)
+                                        continue;
+                                vtarget->deleted = 1;
+                                mptsas_target_reset(ioc, vtarget);
+                                sas_port_delete(mptsas_get_port(phy_info));
+                                mptsas_port_delete(phy_info->port_details);
+                        }
+
+                        /*
                          * Obtain the port_info instance to the parent port
                          */
                         parent = mptsas_find_portinfo_by_handle(ioc,
@@ -1510,34 +1903,44 @@ mptsas_delete_expander_phys(MPT_ADAPTER *ioc)
                         if (!parent)
                                 goto next_port;
 
+                        expander_sas_address =
+                                port_info->phy_info[0].identify.sas_address;
+
                         /*
                          * Delete rphys in the parent that point
                          * to this expander.  The transport layer will
                          * cleanup all the children.
                          */
-                        for (i = 0; i < parent->num_phys; i++) {
-                                if ((!parent->phy_info[i].rphy) ||
-                                    (parent->phy_info[i].attached.sas_address !=
-                                   port_info->phy_info[i].identify.sas_address))
+                        phy_info = parent->phy_info;
+                        for (i = 0; i < parent->num_phys; i++, phy_info++) {
+                                port = mptsas_get_port(phy_info);
+                                if (!port)
                                         continue;
-                                sas_rphy_delete(parent->phy_info[i].rphy);
-                                memset(&parent->phy_info[i].attached, 0,
-                                    sizeof(struct mptsas_devinfo));
-                                parent->phy_info[i].rphy = NULL;
-                                parent->phy_info[i].starget = NULL;
+                                if (phy_info->attached.sas_address !=
+                                        expander_sas_address)
+                                        continue;
+#ifdef MPT_DEBUG_SAS_WIDE
+                                dev_printk(KERN_DEBUG, &port->dev,
+                                    "delete port (%d)\n", port->port_identifier);
+#endif
+                                sas_port_delete(port);
+                                mptsas_port_delete(phy_info->port_details);
                         }
  next_port:
+
+                        phy_info = port_info->phy_info;
+                        for (i = 0; i < port_info->num_phys; i++, phy_info++)
+                                mptsas_port_delete(phy_info->port_details);
+
                         list_del(&port_info->list);
-                        if (port_info->phy_info)
-                                kfree(port_info->phy_info);
+                        kfree(port_info->phy_info);
                         kfree(port_info);
                 }
                 /*
                 * Free this memory allocated from inside
                 * mptsas_sas_expander_pg0
                 */
-                if (buffer.phy_info)
-                        kfree(buffer.phy_info);
+                kfree(buffer.phy_info);
         }
         mutex_unlock(&ioc->sas_topology_mutex);
 }
@@ -1563,7 +1966,7 @@ mptsas_scan_sas_topology(MPT_ADAPTER *ioc)
         if (!ioc->raid_data.pIocPg2->NumActiveVolumes)
                 goto out;
         for (i=0; i<ioc->raid_data.pIocPg2->NumActiveVolumes; i++) {
-                scsi_add_device(ioc->sh, ioc->num_ports,
+                scsi_add_device(ioc->sh, MPTSAS_RAID_CHANNEL,
                     ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID, 0);
         }
  out:
@@ -1573,60 +1976,59 @@ mptsas_scan_sas_topology(MPT_ADAPTER *ioc)
 /*
  * Work queue thread to handle Runtime discovery
  * Mere purpose is the hot add/delete of expanders
+ *(Mutex UNLOCKED)
  */
 static void
-mptscsih_discovery_work(void * arg)
+__mptsas_discovery_work(MPT_ADAPTER *ioc)
 {
-        struct mptsas_discovery_event *ev = arg;
-        MPT_ADAPTER *ioc = ev->ioc;
         u32 handle = 0xFFFF;
 
-        mutex_lock(&ioc->sas_discovery_mutex);
         ioc->sas_discovery_runtime=1;
         mptsas_delete_expander_phys(ioc);
         mptsas_probe_hba_phys(ioc);
         while (!mptsas_probe_expander_phys(ioc, &handle))
                 ;
-        kfree(ev);
         ioc->sas_discovery_runtime=0;
+}
+
+/*
+ * Work queue thread to handle Runtime discovery
+ * Mere purpose is the hot add/delete of expanders
+ *(Mutex LOCKED)
+ */
+static void
+mptsas_discovery_work(void * arg)
+{
+        struct mptsas_discovery_event *ev = arg;
+        MPT_ADAPTER *ioc = ev->ioc;
+
+        mutex_lock(&ioc->sas_discovery_mutex);
+        __mptsas_discovery_work(ioc);
         mutex_unlock(&ioc->sas_discovery_mutex);
+        kfree(ev);
 }
 
 static struct mptsas_phyinfo *
-mptsas_find_phyinfo_by_parent(MPT_ADAPTER *ioc, u16 parent_handle, u8 phy_id)
+mptsas_find_phyinfo_by_sas_address(MPT_ADAPTER *ioc, u64 sas_address)
 {
         struct mptsas_portinfo *port_info;
-        struct mptsas_devinfo device_info;
         struct mptsas_phyinfo *phy_info = NULL;
-        int i, error;
-
-        /*
-         * Retrieve the parent sas_address
-         */
-        error = mptsas_sas_device_pg0(ioc, &device_info,
-                (MPI_SAS_DEVICE_PGAD_FORM_HANDLE <<
-                 MPI_SAS_DEVICE_PGAD_FORM_SHIFT),
-                parent_handle);
-        if (error)
-                return NULL;
+        int i;
 
-        /*
-         * The phy_info structures are never deallocated during lifetime of
-         * a host, so the code below is safe without additional refcounting.
-         */
         mutex_lock(&ioc->sas_topology_mutex);
         list_for_each_entry(port_info, &ioc->sas_topology, list) {
                 for (i = 0; i < port_info->num_phys; i++) {
-                        if (port_info->phy_info[i].identify.sas_address ==
-                            device_info.sas_address &&
-                            port_info->phy_info[i].phy_id == phy_id) {
-                                phy_info = &port_info->phy_info[i];
-                                break;
-                        }
+                        if (port_info->phy_info[i].attached.sas_address
+                            != sas_address)
+                                continue;
+                        if (!mptsas_is_end_device(
+                                &port_info->phy_info[i].attached))
+                                continue;
+                        phy_info = &port_info->phy_info[i];
+                        break;
                 }
         }
         mutex_unlock(&ioc->sas_topology_mutex);
-
         return phy_info;
 }
 
@@ -1637,21 +2039,19 @@ mptsas_find_phyinfo_by_target(MPT_ADAPTER *ioc, u32 id)
         struct mptsas_phyinfo *phy_info = NULL;
         int i;
 
-        /*
-         * The phy_info structures are never deallocated during lifetime of
-         * a host, so the code below is safe without additional refcounting.
-         */
         mutex_lock(&ioc->sas_topology_mutex);
         list_for_each_entry(port_info, &ioc->sas_topology, list) {
-                for (i = 0; i < port_info->num_phys; i++)
-                        if (mptsas_is_end_device(&port_info->phy_info[i].attached))
-                                if (port_info->phy_info[i].attached.id == id) {
-                                        phy_info = &port_info->phy_info[i];
-                                        break;
-                                }
+                for (i = 0; i < port_info->num_phys; i++) {
+                        if (port_info->phy_info[i].attached.id != id)
+                                continue;
+                        if (!mptsas_is_end_device(
+                                &port_info->phy_info[i].attached))
+                                continue;
+                        phy_info = &port_info->phy_info[i];
+                        break;
+                }
         }
         mutex_unlock(&ioc->sas_topology_mutex);
-
         return phy_info;
 }
 
@@ -1659,7 +2059,7 @@ mptsas_find_phyinfo_by_target(MPT_ADAPTER *ioc, u32 id)
  * Work queue thread to clear the persitency table
  */
 static void
-mptscsih_sas_persist_clear_table(void * arg)
+mptsas_persist_clear_table(void * arg)
 {
         MPT_ADAPTER *ioc = (MPT_ADAPTER *)arg;
 
@@ -1680,7 +2080,6 @@ mptsas_reprobe_target(struct scsi_target *starget, int uld_attach)
                         mptsas_reprobe_lun);
 }
 
-
 /*
  * Work queue thread to handle SAS hotplug events
  */
@@ -1691,14 +2090,17 @@ mptsas_hotplug_work(void *arg)
         MPT_ADAPTER *ioc = ev->ioc;
         struct mptsas_phyinfo *phy_info;
         struct sas_rphy *rphy;
+        struct sas_port *port;
         struct scsi_device *sdev;
+        struct scsi_target * starget;
         struct sas_identify identify;
         char *ds = NULL;
         struct mptsas_devinfo sas_device;
         VirtTarget *vtarget;
+        VirtDevice *vdevice;
 
-        mutex_lock(&ioc->sas_discovery_mutex);
 
+        mutex_lock(&ioc->sas_discovery_mutex);
         switch (ev->event_type) {
         case MPTSAS_DEL_DEVICE:
 
@@ -1707,24 +2109,50 @@ mptsas_hotplug_work(void *arg)
                 /*
                  * Sanity checks, for non-existing phys and remote rphys.
                  */
-                if (!phy_info)
+                if (!phy_info || !phy_info->port_details) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
                         break;
-                if (!phy_info->rphy)
+                }
+                rphy = mptsas_get_rphy(phy_info);
+                if (!rphy) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
                         break;
-                if (phy_info->starget) {
-                        vtarget = phy_info->starget->hostdata;
+                }
+                port = mptsas_get_port(phy_info);
+                if (!port) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
+                        break;
+                }
 
-                        if (!vtarget)
+                starget = mptsas_get_starget(phy_info);
+                if (starget) {
+                        vtarget = starget->hostdata;
+
+                        if (!vtarget) {
+                                dfailprintk((MYIOC_s_ERR_FMT
+                                        "%s: exit at line=%d\n", ioc->name,
+                                        __FUNCTION__, __LINE__));
                                 break;
+                        }
+
                         /*
                          * Handling  RAID components
                          */
                         if (ev->phys_disk_num_valid) {
                                 vtarget->target_id = ev->phys_disk_num;
                                 vtarget->tflags |= MPT_TARGET_FLAGS_RAID_COMPONENT;
-                                mptsas_reprobe_target(vtarget->starget, 1);
+                                mptsas_reprobe_target(starget, 1);
                                 break;
                         }
+
+                        vtarget->deleted = 1;
+                        mptsas_target_reset(ioc, vtarget);
                 }
 
                 if (phy_info->attached.device_info & MPI_SAS_DEVICE_INFO_SSP_TARGET)
@@ -1738,10 +2166,12 @@ mptsas_hotplug_work(void *arg)
                        "removing %s device, channel %d, id %d, phy %d\n",
                        ioc->name, ds, ev->channel, ev->id, phy_info->phy_id);
 
-                sas_rphy_delete(phy_info->rphy);
-                memset(&phy_info->attached, 0, sizeof(struct mptsas_devinfo));
-                phy_info->rphy = NULL;
-                phy_info->starget = NULL;
+#ifdef MPT_DEBUG_SAS_WIDE
+                dev_printk(KERN_DEBUG, &port->dev,
+                    "delete port (%d)\n", port->port_identifier);
+#endif
+                sas_port_delete(port);
+                mptsas_port_delete(phy_info->port_details);
                 break;
         case MPTSAS_ADD_DEVICE:
 
@@ -1753,59 +2183,60 @@ mptsas_hotplug_work(void *arg)
                  */
                 if (mptsas_sas_device_pg0(ioc, &sas_device,
                     (MPI_SAS_DEVICE_PGAD_FORM_BUS_TARGET_ID <<
-                     MPI_SAS_DEVICE_PGAD_FORM_SHIFT), ev->id))
+                     MPI_SAS_DEVICE_PGAD_FORM_SHIFT), ev->id)) {
+                                dfailprintk((MYIOC_s_ERR_FMT
+                                        "%s: exit at line=%d\n", ioc->name,
+                                        __FUNCTION__, __LINE__));
                         break;
+                }
 
-                phy_info = mptsas_find_phyinfo_by_parent(ioc,
-                                sas_device.handle_parent, sas_device.phy_id);
+                ssleep(2);
+                __mptsas_discovery_work(ioc);
 
-                if (!phy_info) {
-                        u32 handle = 0xFFFF;
+                phy_info = mptsas_find_phyinfo_by_sas_address(ioc,
+                                sas_device.sas_address);
 
-                        /*
-                        * Its possible when an expander has been hot added
-                        * containing attached devices, the sas firmware
-                        * may send a RC_ADDED event prior to the
-                        * DISCOVERY STOP event. If that occurs, our
-                        * view of the topology in the driver in respect to this
-                        * expander might of not been setup, and we hit this
-                        * condition.
-                        * Therefore, this code kicks off discovery to
-                        * refresh the data.
-                        * Then again, we check whether the parent phy has
-                        * been created.
-                        */
-                        ioc->sas_discovery_runtime=1;
-                        mptsas_delete_expander_phys(ioc);
-                        mptsas_probe_hba_phys(ioc);
-                        while (!mptsas_probe_expander_phys(ioc, &handle))
-                                ;
-                        ioc->sas_discovery_runtime=0;
-
-                        phy_info = mptsas_find_phyinfo_by_parent(ioc,
-                                sas_device.handle_parent, sas_device.phy_id);
-                        if (!phy_info)
-                                break;
+                if (!phy_info || !phy_info->port_details) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
+                        break;
                 }
 
-                if (phy_info->starget) {
-                        vtarget = phy_info->starget->hostdata;
+                starget = mptsas_get_starget(phy_info);
+                if (starget) {
+                        vtarget = starget->hostdata;
 
-                        if (!vtarget)
+                        if (!vtarget) {
+                                dfailprintk((MYIOC_s_ERR_FMT
+                                        "%s: exit at line=%d\n", ioc->name,
+                                        __FUNCTION__, __LINE__));
                                 break;
+                        }
                         /*
                          * Handling  RAID components
                          */
                         if (vtarget->tflags & MPT_TARGET_FLAGS_RAID_COMPONENT) {
                                 vtarget->tflags &= ~MPT_TARGET_FLAGS_RAID_COMPONENT;
                                 vtarget->target_id = ev->id;
-                                mptsas_reprobe_target(phy_info->starget, 0);
+                                mptsas_reprobe_target(starget, 0);
                         }
                         break;
                 }
 
-                if (phy_info->rphy)
+                if (mptsas_get_rphy(phy_info)) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
+                        break;
+                }
+                port = mptsas_get_port(phy_info);
+                if (!port) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
                         break;
+                }
 
                 memcpy(&phy_info->attached, &sas_device,
                     sizeof(struct mptsas_devinfo));
@@ -1822,59 +2253,48 @@ mptsas_hotplug_work(void *arg)
                        ioc->name, ds, ev->channel, ev->id, ev->phy_id);
 
                 mptsas_parse_device_info(&identify, &phy_info->attached);
-                switch (identify.device_type) {
-                case SAS_END_DEVICE:
-                        rphy = sas_end_device_alloc(phy_info->phy);
-                        break;
-                case SAS_EDGE_EXPANDER_DEVICE:
-                case SAS_FANOUT_EXPANDER_DEVICE:
-                        rphy = sas_expander_alloc(phy_info->phy, identify.device_type);
-                        break;
-                default:
-                        rphy = NULL;
-                        break;
-                }
-                if (!rphy)
+                rphy = sas_end_device_alloc(port);
+                if (!rphy) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
                         break; /* non-fatal: an rphy can be added later */
+                }
 
                 rphy->identify = identify;
                 if (sas_rphy_add(rphy)) {
+                        dfailprintk((MYIOC_s_ERR_FMT
+                                "%s: exit at line=%d\n", ioc->name,
+                                __FUNCTION__, __LINE__));
                         sas_rphy_free(rphy);
                         break;
                 }
-
-                phy_info->rphy = rphy;
+                mptsas_set_rphy(phy_info, rphy);
                 break;
         case MPTSAS_ADD_RAID:
-                sdev = scsi_device_lookup(
-                        ioc->sh,
-                        ioc->num_ports,
-                        ev->id,
-                        0);
+                sdev = scsi_device_lookup(ioc->sh, MPTSAS_RAID_CHANNEL,
+                    ev->id, 0);
                 if (sdev) {
                         scsi_device_put(sdev);
                         break;
                 }
                 printk(MYIOC_s_INFO_FMT
                        "attaching raid volume, channel %d, id %d\n",
-                       ioc->name, ioc->num_ports, ev->id);
-                scsi_add_device(ioc->sh,
-                        ioc->num_ports,
-                        ev->id,
-                        0);
+                       ioc->name, MPTSAS_RAID_CHANNEL, ev->id);
+                scsi_add_device(ioc->sh, MPTSAS_RAID_CHANNEL, ev->id, 0);
                 mpt_findImVolumes(ioc);
                 break;
         case MPTSAS_DEL_RAID:
-                sdev = scsi_device_lookup(
-                        ioc->sh,
-                        ioc->num_ports,
-                        ev->id,
-                        0);
+                sdev = scsi_device_lookup(ioc->sh, MPTSAS_RAID_CHANNEL,
+                    ev->id, 0);
                 if (!sdev)
                         break;
                 printk(MYIOC_s_INFO_FMT
                        "removing raid volume, channel %d, id %d\n",
-                       ioc->name, ioc->num_ports, ev->id);
+                       ioc->name, MPTSAS_RAID_CHANNEL, ev->id);
+                vdevice = sdev->hostdata;
+                vdevice->vtarget->deleted = 1;
+                mptsas_target_reset(ioc, vdevice->vtarget);
                 scsi_remove_device(sdev);
                 scsi_device_put(sdev);
                 mpt_findImVolumes(ioc);
@@ -1884,12 +2304,13 @@ mptsas_hotplug_work(void *arg)
                 break;
         }
 
-        kfree(ev);
         mutex_unlock(&ioc->sas_discovery_mutex);
+        kfree(ev);
+
 }
 
 static void
-mptscsih_send_sas_event(MPT_ADAPTER *ioc,
+mptsas_send_sas_event(MPT_ADAPTER *ioc,
                 EVENT_DATA_SAS_DEVICE_STATUS_CHANGE *sas_event_data)
 {
         struct mptsas_hotplug_event *ev;
@@ -1905,7 +2326,7 @@ mptscsih_send_sas_event(MPT_ADAPTER *ioc,
         switch (sas_event_data->ReasonCode) {
         case MPI_EVENT_SAS_DEV_STAT_RC_ADDED:
         case MPI_EVENT_SAS_DEV_STAT_RC_NOT_RESPONDING:
-                ev = kmalloc(sizeof(*ev), GFP_ATOMIC);
+                ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
                 if (!ev) {
                         printk(KERN_WARNING "mptsas: lost hotplug event\n");
                         break;
@@ -1935,10 +2356,9 @@ mptscsih_send_sas_event(MPT_ADAPTER *ioc,
         /*
          * Persistent table is full.
          */
-                INIT_WORK(&ioc->mptscsih_persistTask,
-                    mptscsih_sas_persist_clear_table,
-                    (void *)ioc);
-                schedule_work(&ioc->mptscsih_persistTask);
+                INIT_WORK(&ioc->sas_persist_task,
+                    mptsas_persist_clear_table, (void *)ioc);
+                schedule_work(&ioc->sas_persist_task);
                 break;
         case MPI_EVENT_SAS_DEV_STAT_RC_SMART_DATA:
         /* TODO */
@@ -1950,7 +2370,7 @@ mptscsih_send_sas_event(MPT_ADAPTER *ioc,
 }
 
 static void
-mptscsih_send_raid_event(MPT_ADAPTER *ioc,
+mptsas_send_raid_event(MPT_ADAPTER *ioc,
                 EVENT_DATA_RAID *raid_event_data)
 {
         struct mptsas_hotplug_event *ev;
@@ -1960,13 +2380,12 @@ mptscsih_send_raid_event(MPT_ADAPTER *ioc,
         if (ioc->bus_type != SAS)
                 return;
 
-        ev = kmalloc(sizeof(*ev), GFP_ATOMIC);
+        ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
         if (!ev) {
                 printk(KERN_WARNING "mptsas: lost hotplug event\n");
                 return;
         }
 
-        memset(ev,0,sizeof(struct mptsas_hotplug_event));
         INIT_WORK(&ev->work, mptsas_hotplug_work, ev);
         ev->ioc = ioc;
         ev->id = raid_event_data->VolumeID;
@@ -2028,7 +2447,7 @@ mptscsih_send_raid_event(MPT_ADAPTER *ioc,
 }
 
 static void
-mptscsih_send_discovery(MPT_ADAPTER *ioc,
+mptsas_send_discovery_event(MPT_ADAPTER *ioc,
         EVENT_DATA_SAS_DISCOVERY *discovery_data)
 {
         struct mptsas_discovery_event *ev;
@@ -2043,11 +2462,10 @@ mptscsih_send_discovery(MPT_ADAPTER *ioc,
         if (discovery_data->DiscoveryStatus)
                 return;
 
-        ev = kmalloc(sizeof(*ev), GFP_ATOMIC);
+        ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
         if (!ev)
                 return;
-        memset(ev,0,sizeof(struct mptsas_discovery_event));
-        INIT_WORK(&ev->work, mptscsih_discovery_work, ev);
+        INIT_WORK(&ev->work, mptsas_discovery_work, ev);
         ev->ioc = ioc;
         schedule_work(&ev->work);
 };
@@ -2075,21 +2493,21 @@ mptsas_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *reply)
 
         switch (event) {
         case MPI_EVENT_SAS_DEVICE_STATUS_CHANGE:
-                mptscsih_send_sas_event(ioc,
+                mptsas_send_sas_event(ioc,
                         (EVENT_DATA_SAS_DEVICE_STATUS_CHANGE *)reply->Data);
                 break;
         case MPI_EVENT_INTEGRATED_RAID:
-                mptscsih_send_raid_event(ioc,
+                mptsas_send_raid_event(ioc,
                         (EVENT_DATA_RAID *)reply->Data);
                 break;
         case MPI_EVENT_PERSISTENT_TABLE_FULL:
-                INIT_WORK(&ioc->mptscsih_persistTask,
-                    mptscsih_sas_persist_clear_table,
+                INIT_WORK(&ioc->sas_persist_task,
+                    mptsas_persist_clear_table,
                     (void *)ioc);
-                schedule_work(&ioc->mptscsih_persistTask);
+                schedule_work(&ioc->sas_persist_task);
                 break;
          case MPI_EVENT_SAS_DISCOVERY:
-                mptscsih_send_discovery(ioc,
+                mptsas_send_discovery_event(ioc,
                         (EVENT_DATA_SAS_DISCOVERY *)reply->Data);
                 break;
         default:
@@ -2279,7 +2697,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         hd->timer.data = (unsigned long) hd;
         hd->timer.function = mptscsih_timer_expired;
 
-        hd->mpt_pq_filter = mpt_pq_filter;
         ioc->sas_data.ptClear = mpt_pt_clear;
 
         if (ioc->sas_data.ptClear==1) {
@@ -2287,12 +2704,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                     ioc, MPI_SAS_OP_CLEAR_ALL_PERSISTENT);
         }
 
-        ddvprintk((MYIOC_s_INFO_FMT
-                "mpt_pq_filter %x mpt_pq_filter %x\n",
-                ioc->name,
-                mpt_pq_filter,
-                mpt_pq_filter));
-
         init_waitqueue_head(&hd->scandv_waitq);
         hd->scandv_wait_done = 0;
         hd->last_queue_full = 0;
@@ -2308,7 +2719,7 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         return 0;
 
-out_mptsas_probe:
+ out_mptsas_probe:
 
         mptscsih_remove(pdev);
         return error;
@@ -2318,6 +2729,7 @@ static void __devexit mptsas_remove(struct pci_dev *pdev)
 {
         MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
         struct mptsas_portinfo *p, *n;
+        int i;
 
         ioc->sas_discovery_ignore_events=1;
         sas_remove_host(ioc->sh);
@@ -2325,8 +2737,9 @@ static void __devexit mptsas_remove(struct pci_dev *pdev)
         mutex_lock(&ioc->sas_topology_mutex);
         list_for_each_entry_safe(p, n, &ioc->sas_topology, list) {
                 list_del(&p->list);
-                if (p->phy_info)
-                        kfree(p->phy_info);
+                for (i = 0 ; i < p->num_phys ; i++)
+                        mptsas_port_delete(p->phy_info[i].port_details);
+                kfree(p->phy_info);
                 kfree(p);
         }
         mutex_unlock(&ioc->sas_topology_mutex);
@@ -2335,17 +2748,15 @@ static void __devexit mptsas_remove(struct pci_dev *pdev)
 }
 
 static struct pci_device_id mptsas_pci_table[] = {
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1064,
-                PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1066,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1064,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1068,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1068,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1064E,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1064E,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1066E,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1068E,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1068E,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1078,
                 PCI_ANY_ID, PCI_ANY_ID },
         {0}     /* Terminating entry */
 };
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 8242b16e3168..30524dc54b16 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -66,6 +66,7 @@
 
 #include "mptbase.h"
 #include "mptscsih.h"
+#include "lsi/mpi_log_sas.h"
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 #define my_NAME         "Fusion MPT SCSI Host driver"
@@ -127,7 +128,7 @@ static void	mptscsih_freeChainBuffers(MPT_ADAPTER *ioc, int req_idx);
 static void     mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR *mf, SCSIIOReply_t *pScsiReply);
 static int      mptscsih_tm_pending_wait(MPT_SCSI_HOST * hd);
 static int      mptscsih_tm_wait_for_completion(MPT_SCSI_HOST * hd, ulong timeout );
-static u32      SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc);
+static int      SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc);
 
 static int      mptscsih_IssueTaskMgmt(MPT_SCSI_HOST *hd, u8 type, u8 channel, u8 target, u8 lun, int ctx2abort, ulong timeout);
 
@@ -497,6 +498,34 @@ nextSGEset:
         return SUCCESS;
 } /* mptscsih_AddSGE() */
 
+static void
+mptscsih_issue_sep_command(MPT_ADAPTER *ioc, VirtTarget *vtarget,
+    U32 SlotStatus)
+{
+        MPT_FRAME_HDR *mf;
+        SEPRequest_t     *SEPMsg;
+
+        if (ioc->bus_type == FC)
+                return;
+
+        if ((mf = mpt_get_msg_frame(ioc->InternalCtx, ioc)) == NULL) {
+                dfailprintk((MYIOC_s_WARN_FMT "%s: no msg frames!!\n",
+                    ioc->name,__FUNCTION__));
+                return;
+        }
+
+        SEPMsg = (SEPRequest_t *)mf;
+        SEPMsg->Function = MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
+        SEPMsg->Bus = vtarget->bus_id;
+        SEPMsg->TargetID = vtarget->target_id;
+        SEPMsg->Action = MPI_SEP_REQ_ACTION_WRITE_STATUS;
+        SEPMsg->SlotStatus = SlotStatus;
+        devtverboseprintk((MYIOC_s_WARN_FMT
+            "Sending SEP cmd=%x id=%d bus=%d\n",
+            ioc->name, SlotStatus, SEPMsg->TargetID, SEPMsg->Bus));
+        mpt_put_msg_frame(ioc->DoneCtx, ioc, mf);
+}
+
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *      mptscsih_io_done - Main SCSI IO callback routine registered to
@@ -520,6 +549,8 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
         SCSIIORequest_t *pScsiReq;
         SCSIIOReply_t   *pScsiReply;
         u16              req_idx, req_idx_MR;
+        VirtDevice       *vdev;
+        VirtTarget       *vtarget;
 
         hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
 
@@ -538,6 +569,7 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
         }
 
         sc = hd->ScsiLookup[req_idx];
+        hd->ScsiLookup[req_idx] = NULL;
         if (sc == NULL) {
                 MPIHeader_t *hdr = (MPIHeader_t *)mf;
 
@@ -553,6 +585,12 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                 return 1;
         }
 
+        if ((unsigned char *)mf != sc->host_scribble) {
+                mptscsih_freeChainBuffers(ioc, req_idx);
+                return 1;
+        }
+
+        sc->host_scribble = NULL;
         sc->result = DID_OK << 16;              /* Set default reply as OK */
         pScsiReq = (SCSIIORequest_t *) mf;
         pScsiReply = (SCSIIOReply_t *) mr;
@@ -640,10 +678,36 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
 
                         if (hd->sel_timeout[pScsiReq->TargetID] < 0xFFFF)
                                 hd->sel_timeout[pScsiReq->TargetID]++;
+
+                        vdev = sc->device->hostdata;
+                        if (!vdev)
+                                break;
+                        vtarget = vdev->vtarget;
+                        if (vtarget->tflags & MPT_TARGET_FLAGS_LED_ON) {
+                                mptscsih_issue_sep_command(ioc, vtarget,
+                                    MPI_SEP_REQ_SLOTSTATUS_UNCONFIGURED);
+                                vtarget->tflags &= ~MPT_TARGET_FLAGS_LED_ON;
+                        }
                         break;
 
-                case MPI_IOCSTATUS_SCSI_TASK_TERMINATED:        /* 0x0048 */
                 case MPI_IOCSTATUS_SCSI_IOC_TERMINATED:         /* 0x004B */
+                        if ( ioc->bus_type == SAS ) {
+                                u16 ioc_status = le16_to_cpu(pScsiReply->IOCStatus);
+                                if (ioc_status & MPI_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) {
+                                        u32 log_info = le32_to_cpu(mr->u.reply.IOCLogInfo);
+                                        log_info &=SAS_LOGINFO_MASK;
+                                        if (log_info == SAS_LOGINFO_NEXUS_LOSS) {
+                                                sc->result = (DID_BUS_BUSY << 16);
+                                                break;
+                                        }
+                                }
+                        }
+
+                        /*
+                         * Allow non-SAS & non-NEXUS_LOSS to drop into below code
+                         */
+
+                case MPI_IOCSTATUS_SCSI_TASK_TERMINATED:        /* 0x0048 */
                 case MPI_IOCSTATUS_SCSI_EXT_TERMINATED:         /* 0x004C */
                         /* Linux handles an unsolicited DID_RESET better
                          * than an unsolicited DID_ABORT.
@@ -658,7 +722,7 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                 sc->result=DID_SOFT_ERROR << 16;
                         else /* Sufficient data transfer occurred */
                                 sc->result = (DID_OK << 16) | scsi_status;
-                        dreplyprintk((KERN_NOTICE 
+                        dreplyprintk((KERN_NOTICE
                             "RESIDUAL_MISMATCH: result=%x on id=%d\n", sc->result, sc->device->id));
                         break;
 
@@ -784,8 +848,6 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                 sc->request_bufflen, sc->sc_data_direction);
         }
 
-        hd->ScsiLookup[req_idx] = NULL;
-
         sc->scsi_done(sc);              /* Issue the command callback */
 
         /* Free Chain buffers */
@@ -827,9 +889,17 @@ mptscsih_flush_running_cmds(MPT_SCSI_HOST *hd)
                         dmfprintk(( "flush: ScsiDone (mf=%p,sc=%p)\n",
                                         mf, SCpnt));
 
+                        /* Free Chain buffers */
+                        mptscsih_freeChainBuffers(ioc, ii);
+
+                        /* Free Message frames */
+                        mpt_free_msg_frame(ioc, mf);
+
+                        if ((unsigned char *)mf != SCpnt->host_scribble)
+                                continue;
+
                         /* Set status, free OS resources (SG DMA buffers)
                          * Do OS callback
-                         * Free driver resources (chain, msg buffers)
                          */
                         if (SCpnt->use_sg) {
                                 pci_unmap_sg(ioc->pcidev,
@@ -845,12 +915,6 @@ mptscsih_flush_running_cmds(MPT_SCSI_HOST *hd)
                         SCpnt->result = DID_RESET << 16;
                         SCpnt->host_scribble = NULL;
 
-                        /* Free Chain buffers */
-                        mptscsih_freeChainBuffers(ioc, ii);
-
-                        /* Free Message frames */
-                        mpt_free_msg_frame(ioc, mf);
-
                         SCpnt->scsi_done(SCpnt);        /* Issue the command callback */
                 }
         }
@@ -887,10 +951,10 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, VirtDevice *vdevice)
                 if ((sc = hd->ScsiLookup[ii]) != NULL) {
 
                         mf = (SCSIIORequest_t *)MPT_INDEX_2_MFPTR(hd->ioc, ii);
-
+                        if (mf == NULL)
+                                continue;
                         dsprintk(( "search_running: found (sc=%p, mf = %p) target %d, lun %d \n",
                                         hd->ScsiLookup[ii], mf, mf->TargetID, mf->LUN[1]));
-
                         if ((mf->TargetID != ((u8)vdevice->vtarget->target_id)) || (mf->LUN[1] != ((u8) vdevice->lun)))
                                 continue;
 
@@ -899,6 +963,8 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, VirtDevice *vdevice)
                         hd->ScsiLookup[ii] = NULL;
                         mptscsih_freeChainBuffers(hd->ioc, ii);
                         mpt_free_msg_frame(hd->ioc, (MPT_FRAME_HDR *)mf);
+                        if ((unsigned char *)mf != sc->host_scribble)
+                                continue;
                         if (sc->use_sg) {
                                 pci_unmap_sg(hd->ioc->pcidev,
                                 (struct scatterlist *) sc->request_buffer,
@@ -1341,8 +1407,8 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
                         goto fail;
         }
 
+        SCpnt->host_scribble = (unsigned char *)mf;
         hd->ScsiLookup[my_idx] = SCpnt;
-        SCpnt->host_scribble = NULL;
 
         mpt_put_msg_frame(hd->ioc->DoneCtx, hd->ioc, mf);
         dmfprintk((MYIOC_s_INFO_FMT "Issued SCSI cmd (%p) mf=%p idx=%d\n",
@@ -1529,6 +1595,12 @@ mptscsih_TMHandler(MPT_SCSI_HOST *hd, u8 type, u8 channel, u8 target, u8 lun, in
                 rc = mpt_HardResetHandler(hd->ioc, CAN_SLEEP);
         }
 
+        /*
+         * Check IOCStatus from TM reply message
+         */
+         if (hd->tm_iocstatus != MPI_IOCSTATUS_SUCCESS)
+                rc = FAILED;
+
         dtmprintk((MYIOC_s_INFO_FMT "TMHandler rc = %d!\n", hd->ioc->name, rc));
 
         return rc;
@@ -1654,6 +1726,7 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
         int              scpnt_idx;
         int              retval;
         VirtDevice       *vdev;
+        ulong            sn = SCpnt->serial_number;
 
         /* If we can't locate our host adapter structure, return FAILED status.
          */
@@ -1707,6 +1780,11 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
                 vdev->vtarget->bus_id, vdev->vtarget->target_id, vdev->lun,
                 ctx2abort, mptscsih_get_tm_timeout(hd->ioc));
 
+        if (SCPNT_TO_LOOKUP_IDX(SCpnt) == scpnt_idx &&
+            SCpnt->serial_number == sn) {
+                retval = FAILED;
+        }
+
         printk (KERN_WARNING MYNAM ": %s: task abort: %s (sc=%p)\n",
                 hd->ioc->name,
                 ((retval == 0) ? "SUCCESS" : "FAILED" ), SCpnt);
@@ -2023,6 +2101,7 @@ mptscsih_taskmgmt_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *m
                 DBG_DUMP_TM_REPLY_FRAME((u32 *)pScsiTmReply);
 
                 iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
+                hd->tm_iocstatus = iocstatus;
                 dtmprintk((MYIOC_s_WARN_FMT "  SCSI TaskMgmt (%d) IOCStatus=%04x IOCLogInfo=%08x\n",
                         ioc->name, tmType, iocstatus, le32_to_cpu(pScsiTmReply->IOCLogInfo)));
                 /* Error?  (anything non-zero?) */
@@ -2401,6 +2480,13 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
                                 ioc->events[idx].data[1] = (sense_data[13] << 8) || sense_data[12];
 
                                 ioc->eventContext++;
+                                if (hd->ioc->pcidev->vendor ==
+                                    PCI_VENDOR_ID_IBM) {
+                                        mptscsih_issue_sep_command(hd->ioc,
+                                            vdev->vtarget, MPI_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
+                                        vdev->vtarget->tflags |=
+                                            MPT_TARGET_FLAGS_LED_ON;
+                                }
                         }
                 }
         } else {
@@ -2409,7 +2495,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
         }
 }
 
-static u32
+static int
 SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc)
 {
         MPT_SCSI_HOST *hd;
diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index 3201de053943..e4cc3dd5fc9f 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -83,10 +83,6 @@ static int mpt_saf_te = MPTSCSIH_SAF_TE;
 module_param(mpt_saf_te, int, 0);
 MODULE_PARM_DESC(mpt_saf_te, " Force enabling SEP Processor: enable=1  (default=MPTSCSIH_SAF_TE=0)");
 
-static int mpt_pq_filter = 0;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter, " Enable peripheral qualifier filter: enable=1  (default=0)");
-
 static void mptspi_write_offset(struct scsi_target *, int);
 static void mptspi_write_width(struct scsi_target *, int);
 static int mptspi_write_spi_device_pg1(struct scsi_target *,
@@ -775,9 +771,9 @@ static struct spi_function_template mptspi_transport_functions = {
  */
 
 static struct pci_device_id mptspi_pci_table[] = {
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_53C1030,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_53C1030,
                 PCI_ANY_ID, PCI_ANY_ID },
-        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_1030_53C1035,
+        { PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_53C1035,
                 PCI_ANY_ID, PCI_ANY_ID },
         {0}     /* Terminating entry */
 };
@@ -1047,14 +1043,12 @@ mptspi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         hd->timer.function = mptscsih_timer_expired;
 
         ioc->spi_data.Saf_Te = mpt_saf_te;
-        hd->mpt_pq_filter = mpt_pq_filter;
 
         hd->negoNvram = MPT_SCSICFG_USE_NVRAM;
         ddvprintk((MYIOC_s_INFO_FMT
-                "saf_te %x mpt_pq_filter %x\n",
+                "saf_te %x\n",
                 ioc->name,
-                mpt_saf_te,
-                mpt_pq_filter));
+                mpt_saf_te));
         ioc->spi_data.noQas = 0;
 
         init_waitqueue_head(&hd->scandv_waitq);
diff --git a/drivers/message/i2o/core.h b/drivers/message/i2o/core.h
index 184974cc734d..dc388a3ff5e0 100644
--- a/drivers/message/i2o/core.h
+++ b/drivers/message/i2o/core.h
@@ -38,6 +38,9 @@ extern struct device_attribute i2o_device_attrs[];
 extern void i2o_device_remove(struct i2o_device *);
 extern int i2o_device_parse_lct(struct i2o_controller *);
 
+int i2o_parm_issue(struct i2o_device *i2o_dev, int cmd, void *oplist,
+                   int oplen, void *reslist, int reslen);
+
 /* IOP */
 extern struct i2o_controller *i2o_iop_alloc(void);
 
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index 89daf67b764d..7d23e082bf26 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -36,9 +36,9 @@
 
 #include <asm/uaccess.h>
 
-#define SG_TABLESIZE            30
+#include "core.h"
 
-extern int i2o_parm_issue(struct i2o_device *, int, void *, int, void *, int);
+#define SG_TABLESIZE            30
 
 static int i2o_cfg_ioctl(struct inode *, struct file *, unsigned int,
                          unsigned long);
diff --git a/drivers/mfd/ucb1x00-core.c b/drivers/mfd/ucb1x00-core.c
index 632bc218c86a..2bf32721eb53 100644
--- a/drivers/mfd/ucb1x00-core.c
+++ b/drivers/mfd/ucb1x00-core.c
@@ -479,7 +479,7 @@ static int ucb1x00_probe(struct mcp *mcp)
         mcp_enable(mcp);
         id = mcp_reg_read(mcp, UCB_ID);
 
-        if (id != UCB_ID_1200 && id != UCB_ID_1300) {
+        if (id != UCB_ID_1200 && id != UCB_ID_1300 && id != UCB_ID_TC35143) {
                 printk(KERN_WARNING "UCB1x00 ID not found: %04x\n", id);
                 goto err_disable;
         }
diff --git a/drivers/mfd/ucb1x00.h b/drivers/mfd/ucb1x00.h
index 9c9a647d8b7b..ca8df8072d43 100644
--- a/drivers/mfd/ucb1x00.h
+++ b/drivers/mfd/ucb1x00.h
@@ -94,6 +94,7 @@
 #define UCB_ID          0x0c
 #define UCB_ID_1200             0x1004
 #define UCB_ID_1300             0x1005
+#define UCB_ID_TC35143          0x9712
 
 #define UCB_MODE        0x0d
 #define UCB_MODE_DYN_VFLAG_ENA  (1 << 12)
diff --git a/drivers/mmc/imxmmc.c b/drivers/mmc/imxmmc.c
index 7ca9e95bdf89..fb6565b98f32 100644
--- a/drivers/mmc/imxmmc.c
+++ b/drivers/mmc/imxmmc.c
@@ -91,6 +91,8 @@ struct imxmci_host {
         int                     dma_allocated;
 
         unsigned char           actual_bus_width;
+
+        int                     prev_cmd_code;
 };
 
 #define IMXMCI_PEND_IRQ_b       0
@@ -248,16 +250,14 @@ static void imxmci_setup_data(struct imxmci_host *host, struct mmc_data *data)
          * partial FIFO fills and reads. The length has to be rounded up to burst size multiple.
          * This is required for SCR read at least.
          */
-        if (datasz < 64) {
+        if (datasz < 512) {
                 host->dma_size = datasz;
                 if (data->flags & MMC_DATA_READ) {
                         host->dma_dir = DMA_FROM_DEVICE;
 
                         /* Hack to enable read SCR */
-                        if(datasz < 16) {
-                                MMC_NOB = 1;
-                                MMC_BLK_LEN = 16;
-                        }
+                        MMC_NOB = 1;
+                        MMC_BLK_LEN = 512;
                 } else {
                         host->dma_dir = DMA_TO_DEVICE;
                 }
@@ -409,6 +409,9 @@ static void imxmci_finish_request(struct imxmci_host *host, struct mmc_request *
 
         spin_unlock_irqrestore(&host->lock, flags);
 
+        if(req && req->cmd)
+                host->prev_cmd_code = req->cmd->opcode;
+
         host->req = NULL;
         host->cmd = NULL;
         host->data = NULL;
@@ -553,7 +556,6 @@ static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
 {
         int i;
         int burst_len;
-        int flush_len;
         int trans_done = 0;
         unsigned int stat = *pstat;
 
@@ -566,44 +568,43 @@ static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
         dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data running STATUS = 0x%x\n",
                 stat);
 
+        udelay(20);     /* required for clocks < 8MHz*/
+
         if(host->dma_dir == DMA_FROM_DEVICE) {
                 imxmci_busy_wait_for_status(host, &stat,
                                 STATUS_APPL_BUFF_FF | STATUS_DATA_TRANS_DONE,
-                                20, "imxmci_cpu_driven_data read");
+                                50, "imxmci_cpu_driven_data read");
 
                 while((stat & (STATUS_APPL_BUFF_FF |  STATUS_DATA_TRANS_DONE)) &&
-                      (host->data_cnt < host->dma_size)) {
-                        if(burst_len >= host->dma_size - host->data_cnt) {
-                                flush_len = burst_len;
-                                burst_len = host->dma_size - host->data_cnt;
-                                flush_len -= burst_len;
-                                host->data_cnt = host->dma_size;
-                                trans_done = 1;
-                        } else {
-                                flush_len = 0;
-                                host->data_cnt += burst_len;
-                        }
+                      (host->data_cnt < 512)) {
+
+                        udelay(20);     /* required for clocks < 8MHz*/
 
                         for(i = burst_len; i>=2 ; i-=2) {
-                                *(host->data_ptr++) = MMC_BUFFER_ACCESS;
-                                udelay(20);     /* required for clocks < 8MHz*/
+                                u16 data;
+                                data = MMC_BUFFER_ACCESS;
+                                udelay(10);     /* required for clocks < 8MHz*/
+                                if(host->data_cnt+2 <= host->dma_size) {
+                                        *(host->data_ptr++) = data;
+                                } else {
+                                        if(host->data_cnt < host->dma_size)
+                                                *(u8*)(host->data_ptr) = data;
+                                }
+                                host->data_cnt += 2;
                         }
 
-                        if(i == 1)
-                                *(u8*)(host->data_ptr) = MMC_BUFFER_ACCESS;
-
                         stat = MMC_STATUS;
 
-                        /* Flush extra bytes from FIFO */
-                        while(flush_len && !(stat & STATUS_DATA_TRANS_DONE)){
-                                i = MMC_BUFFER_ACCESS;
-                                stat = MMC_STATUS;
-                                stat &= ~STATUS_CRC_READ_ERR; /* Stupid but required there */
-                        }
-
-                        dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data read burst %d STATUS = 0x%x\n",
-                                burst_len, stat);
+                        dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data read %d burst %d STATUS = 0x%x\n",
+                                host->data_cnt, burst_len, stat);
                 }
+
+                if((stat & STATUS_DATA_TRANS_DONE) && (host->data_cnt >= 512))
+                        trans_done = 1;
+
+                if(host->dma_size & 0x1ff)
+                        stat &= ~STATUS_CRC_READ_ERR;
+
         } else {
                 imxmci_busy_wait_for_status(host, &stat,
                                 STATUS_APPL_BUFF_FE,
@@ -692,8 +693,8 @@ static void imxmci_tasklet_fnc(unsigned long data)
                        what, stat, MMC_INT_MASK);
                 dev_err(mmc_dev(host->mmc), "CMD_DAT_CONT = 0x%04x, MMC_BLK_LEN = 0x%04x, MMC_NOB = 0x%04x, DMA_CCR = 0x%08x\n",
                        MMC_CMD_DAT_CONT, MMC_BLK_LEN, MMC_NOB, CCR(host->dma));
-                dev_err(mmc_dev(host->mmc), "CMD%d, bus %d-bit, dma_size = 0x%x\n",
-                       host->cmd?host->cmd->opcode:0, 1<<host->actual_bus_width, host->dma_size);
+                dev_err(mmc_dev(host->mmc), "CMD%d, prevCMD%d, bus %d-bit, dma_size = 0x%x\n",
+                       host->cmd?host->cmd->opcode:0, host->prev_cmd_code, 1<<host->actual_bus_width, host->dma_size);
         }
 
         if(!host->present || timeout)
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index 247ff2f23ac9..74eaaee66de0 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -128,7 +128,7 @@ static void mmc_wait_done(struct mmc_request *mrq)
 
 int mmc_wait_for_req(struct mmc_host *host, struct mmc_request *mrq)
 {
-        DECLARE_COMPLETION(complete);
+        DECLARE_COMPLETION_ONSTACK(complete);
 
         mrq->done_data = &complete;
         mrq->done = mmc_wait_done;
@@ -247,6 +247,55 @@ int mmc_wait_for_app_cmd(struct mmc_host *host, unsigned int rca,
 
 EXPORT_SYMBOL(mmc_wait_for_app_cmd);
 
+/**
+ *      mmc_set_data_timeout - set the timeout for a data command
+ *      @data: data phase for command
+ *      @card: the MMC card associated with the data transfer
+ *      @write: flag to differentiate reads from writes
+ */
+void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card,
+                          int write)
+{
+        unsigned int mult;
+
+        /*
+         * SD cards use a 100 multiplier rather than 10
+         */
+        mult = mmc_card_sd(card) ? 100 : 10;
+
+        /*
+         * Scale up the multiplier (and therefore the timeout) by
+         * the r2w factor for writes.
+         */
+        if (write)
+                mult <<= card->csd.r2w_factor;
+
+        data->timeout_ns = card->csd.tacc_ns * mult;
+        data->timeout_clks = card->csd.tacc_clks * mult;
+
+        /*
+         * SD cards also have an upper limit on the timeout.
+         */
+        if (mmc_card_sd(card)) {
+                unsigned int timeout_us, limit_us;
+
+                timeout_us = data->timeout_ns / 1000;
+                timeout_us += data->timeout_clks * 1000 /
+                        (card->host->ios.clock / 1000);
+
+                if (write)
+                        limit_us = 250000;
+                else
+                        limit_us = 100000;
+
+                if (timeout_us > limit_us) {
+                        data->timeout_ns = limit_us * 1000;
+                        data->timeout_clks = 0;
+                }
+        }
+}
+EXPORT_SYMBOL(mmc_set_data_timeout);
+
 static int mmc_select_card(struct mmc_host *host, struct mmc_card *card);
 
 /**
@@ -908,11 +957,9 @@ static void mmc_read_scrs(struct mmc_host *host)
 {
         int err;
         struct mmc_card *card;
-
         struct mmc_request mrq;
         struct mmc_command cmd;
         struct mmc_data data;
-
         struct scatterlist sg;
 
         list_for_each_entry(card, &host->cards, node) {
@@ -947,8 +994,8 @@ static void mmc_read_scrs(struct mmc_host *host)
 
                 memset(&data, 0, sizeof(struct mmc_data));
 
-                data.timeout_ns = card->csd.tacc_ns * 10;
-                data.timeout_clks = card->csd.tacc_clks * 10;
+                mmc_set_data_timeout(&data, card, 0);
+
                 data.blksz_bits = 3;
                 data.blksz = 1 << 3;
                 data.blocks = 1;
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index 115cc21094b9..a0e0dad1b419 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -30,6 +30,7 @@
 #include <linux/mutex.h>
 
 #include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
 #include <linux/mmc/protocol.h>
 
 #include <asm/system.h>
@@ -171,8 +172,6 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
 
                 brq.cmd.arg = req->sector << 9;
                 brq.cmd.flags = MMC_RSP_R1 | MMC_CMD_ADTC;
-                brq.data.timeout_ns = card->csd.tacc_ns * 10;
-                brq.data.timeout_clks = card->csd.tacc_clks * 10;
                 brq.data.blksz_bits = md->block_bits;
                 brq.data.blksz = 1 << md->block_bits;
                 brq.data.blocks = req->nr_sectors >> (md->block_bits - 9);
@@ -180,6 +179,8 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 brq.stop.arg = 0;
                 brq.stop.flags = MMC_RSP_R1B | MMC_CMD_AC;
 
+                mmc_set_data_timeout(&brq.data, card, rq_data_dir(req) != READ);
+
                 if (rq_data_dir(req) == READ) {
                         brq.cmd.opcode = brq.data.blocks > 1 ? MMC_READ_MULTIPLE_BLOCK : MMC_READ_SINGLE_BLOCK;
                         brq.data.flags |= MMC_DATA_READ;
@@ -187,12 +188,6 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                         brq.cmd.opcode = MMC_WRITE_BLOCK;
                         brq.data.flags |= MMC_DATA_WRITE;
                         brq.data.blocks = 1;
-
-                        /*
-                         * Scale up the timeout by the r2w factor
-                         */
-                        brq.data.timeout_ns <<= card->csd.r2w_factor;
-                        brq.data.timeout_clks <<= card->csd.r2w_factor;
                 }
 
                 if (brq.data.blocks > 1) {
@@ -324,52 +319,11 @@ static struct mmc_blk_data *mmc_blk_alloc(struct mmc_card *card)
         md->read_only = mmc_blk_readonly(card);
 
         /*
-         * Figure out a workable block size.  MMC cards have:
-         *  - two block sizes, one for read and one for write.
-         *  - may support partial reads and/or writes
-         *    (allows block sizes smaller than specified)
-         */
-        md->block_bits = card->csd.read_blkbits;
-        if (card->csd.write_blkbits != card->csd.read_blkbits) {
-                if (card->csd.write_blkbits < card->csd.read_blkbits &&
-                    card->csd.read_partial) {
-                        /*
-                         * write block size is smaller than read block
-                         * size, but we support partial reads, so choose
-                         * the smaller write block size.
-                         */
-                        md->block_bits = card->csd.write_blkbits;
-                } else if (card->csd.write_blkbits > card->csd.read_blkbits &&
-                           card->csd.write_partial) {
-                        /*
-                         * read block size is smaller than write block
-                         * size, but we support partial writes.  Use read
-                         * block size.
-                         */
-                } else {
-                        /*
-                         * We don't support this configuration for writes.
-                         */
-                        printk(KERN_ERR "%s: unable to select block size for "
-                                "writing (rb%u wb%u rp%u wp%u)\n",
-                                mmc_card_id(card),
-                                1 << card->csd.read_blkbits,
-                                1 << card->csd.write_blkbits,
-                                card->csd.read_partial,
-                                card->csd.write_partial);
-                        md->read_only = 1;
-                }
-        }
-
-        /*
-         * Refuse to allow block sizes smaller than 512 bytes.
+         * Both SD and MMC specifications state (although a bit
+         * unclearly in the MMC case) that a block size of 512
+         * bytes must always be supported by the card.
          */
-        if (md->block_bits < 9) {
-                printk(KERN_ERR "%s: unable to support block size %u\n",
-                        mmc_card_id(card), 1 << md->block_bits);
-                ret = -EINVAL;
-                goto err_kfree;
-        }
+        md->block_bits = 9;
 
         md->disk = alloc_disk(1 << MMC_SHIFT);
         if (md->disk == NULL) {
diff --git a/drivers/mmc/mmc_queue.c b/drivers/mmc/mmc_queue.c
index 0b9682e9a357..74f8cdeeff0f 100644
--- a/drivers/mmc/mmc_queue.c
+++ b/drivers/mmc/mmc_queue.c
@@ -79,7 +79,8 @@ static int mmc_queue_thread(void *d)
                 spin_lock_irq(q->queue_lock);
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (!blk_queue_plugged(q))
-                        mq->req = req = elv_next_request(q);
+                        req = elv_next_request(q);
+                mq->req = req;
                 spin_unlock_irq(q->queue_lock);
 
                 if (!req) {
diff --git a/drivers/mmc/sdhci.c b/drivers/mmc/sdhci.c
index 893319108ba4..4e21b3b9d330 100644
--- a/drivers/mmc/sdhci.c
+++ b/drivers/mmc/sdhci.c
@@ -565,7 +565,7 @@ static void sdhci_send_command(struct sdhci_host *host, struct mmc_command *cmd)
         if (cmd->data)
                 flags |= SDHCI_CMD_DATA;
 
-        writel(SDHCI_MAKE_CMD(cmd->opcode, flags),
+        writew(SDHCI_MAKE_CMD(cmd->opcode, flags),
                 host->ioaddr + SDHCI_COMMAND);
 }
 
@@ -1193,10 +1193,8 @@ static int __devinit sdhci_probe_slot(struct pci_dev *pdev, int slot)
         version = (version & SDHCI_SPEC_VER_MASK) >> SDHCI_SPEC_VER_SHIFT;
         if (version != 0) {
                 printk(KERN_ERR "%s: Unknown controller version (%d). "
-                        "Cowardly refusing to continue.\n", host->slot_descr,
+                        "You may experience problems.\n", host->slot_descr,
                         version);
-                ret = -ENODEV;
-                goto unmap;
         }
 
         caps = readl(host->ioaddr + SDHCI_CAPABILITIES);
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 8a30ef3ae419..c351c6d1a18a 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -41,7 +41,7 @@
 #include "wbsd.h"
 
 #define DRIVER_NAME "wbsd"
-#define DRIVER_VERSION "1.5"
+#define DRIVER_VERSION "1.6"
 
 #define DBG(x...) \
         pr_debug(DRIVER_NAME ": " x)
@@ -1439,13 +1439,13 @@ static int __devinit wbsd_scan(struct wbsd_host *host)
 
 static int __devinit wbsd_request_region(struct wbsd_host *host, int base)
 {
-        if (io & 0x7)
+        if (base & 0x7)
                 return -EINVAL;
 
         if (!request_region(base, 8, DRIVER_NAME))
                 return -EIO;
 
-        host->base = io;
+        host->base = base;
 
         return 0;
 }
@@ -1773,7 +1773,7 @@ static int __devinit wbsd_init(struct device *dev, int base, int irq, int dma,
         /*
          * Request resources.
          */
-        ret = wbsd_request_resources(host, io, irq, dma);
+        ret = wbsd_request_resources(host, base, irq, dma);
         if (ret) {
                 wbsd_release_resources(host);
                 wbsd_free_mmc(dev);
@@ -1861,6 +1861,7 @@ static void __devexit wbsd_shutdown(struct device *dev, int pnp)
 
 static int __devinit wbsd_probe(struct platform_device *dev)
 {
+        /* Use the module parameters for resources */
         return wbsd_init(&dev->dev, io, irq, dma, 0);
 }
 
diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
index c54e40464d82..603a7951ac9b 100644
--- a/drivers/mtd/devices/doc2000.c
+++ b/drivers/mtd/devices/doc2000.c
@@ -55,10 +55,6 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
                     size_t *retlen, u_char *buf);
 static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
                      size_t *retlen, const u_char *buf);
-static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t *retlen, u_char *buf, u_char *eccbuf, struct nand_oobinfo *oobsel);
-static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
-                         size_t *retlen, const u_char *buf, u_char *eccbuf, struct nand_oobinfo *oobsel);
 static int doc_read_oob(struct mtd_info *mtd, loff_t ofs,
                         struct mtd_oob_ops *ops);
 static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
@@ -615,17 +611,10 @@ EXPORT_SYMBOL_GPL(DoC2k_init);
 static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
                     size_t * retlen, u_char * buf)
 {
-        /* Just a special case of doc_read_ecc */
-        return doc_read_ecc(mtd, from, len, retlen, buf, NULL, NULL);
-}
-
-static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t * retlen, u_char * buf, u_char * eccbuf, struct nand_oobinfo *oobsel)
-{
         struct DiskOnChip *this = mtd->priv;
         void __iomem *docptr = this->virtadr;
         struct Nand *mychip;
-        unsigned char syndrome[6];
+        unsigned char syndrome[6], eccbuf[6];
         volatile char dummy;
         int i, len256 = 0, ret=0;
         size_t left = len;
@@ -673,15 +662,9 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
                 DoC_Address(this, ADDR_COLUMN_PAGE, from, CDSN_CTRL_WP,
                             CDSN_CTRL_ECC_IO);
 
-                if (eccbuf) {
-                        /* Prime the ECC engine */
-                        WriteDOC(DOC_ECC_RESET, docptr, ECCConf);
-                        WriteDOC(DOC_ECC_EN, docptr, ECCConf);
-                } else {
-                        /* disable the ECC engine */
-                        WriteDOC(DOC_ECC_RESET, docptr, ECCConf);
-                        WriteDOC(DOC_ECC_DIS, docptr, ECCConf);
-                }
+                /* Prime the ECC engine */
+                WriteDOC(DOC_ECC_RESET, docptr, ECCConf);
+                WriteDOC(DOC_ECC_EN, docptr, ECCConf);
 
                 /* treat crossing 256-byte sector for 2M x 8bits devices */
                 if (this->page256 && from + len > (from | 0xff) + 1) {
@@ -698,58 +681,59 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
                 /* Let the caller know we completed it */
                 *retlen += len;
 
-                if (eccbuf) {
-                        /* Read the ECC data through the DiskOnChip ECC logic */
-                        /* Note: this will work even with 2M x 8bit devices as   */
-                        /*       they have 8 bytes of OOB per 256 page. mf.      */
-                        DoC_ReadBuf(this, eccbuf, 6);
-
-                        /* Flush the pipeline */
-                        if (DoC_is_Millennium(this)) {
-                                dummy = ReadDOC(docptr, ECCConf);
-                                dummy = ReadDOC(docptr, ECCConf);
-                                i = ReadDOC(docptr, ECCConf);
-                        } else {
-                                dummy = ReadDOC(docptr, 2k_ECCStatus);
-                                dummy = ReadDOC(docptr, 2k_ECCStatus);
-                                i = ReadDOC(docptr, 2k_ECCStatus);
-                        }
+                /* Read the ECC data through the DiskOnChip ECC logic */
+                /* Note: this will work even with 2M x 8bit devices as   */
+                /*       they have 8 bytes of OOB per 256 page. mf.      */
+                DoC_ReadBuf(this, eccbuf, 6);
 
-                        /* Check the ECC Status */
-                        if (i & 0x80) {
-                                int nb_errors;
-                                /* There was an ECC error */
+                /* Flush the pipeline */
+                if (DoC_is_Millennium(this)) {
+                        dummy = ReadDOC(docptr, ECCConf);
+                        dummy = ReadDOC(docptr, ECCConf);
+                        i = ReadDOC(docptr, ECCConf);
+                } else {
+                        dummy = ReadDOC(docptr, 2k_ECCStatus);
+                        dummy = ReadDOC(docptr, 2k_ECCStatus);
+                        i = ReadDOC(docptr, 2k_ECCStatus);
+                }
+
+                /* Check the ECC Status */
+                if (i & 0x80) {
+                        int nb_errors;
+                        /* There was an ECC error */
 #ifdef ECC_DEBUG
-                                printk(KERN_ERR "DiskOnChip ECC Error: Read at %lx\n", (long)from);
+                        printk(KERN_ERR "DiskOnChip ECC Error: Read at %lx\n", (long)from);
 #endif
-                                /* Read the ECC syndrom through the DiskOnChip ECC logic.
-                                   These syndrome will be all ZERO when there is no error */
-                                for (i = 0; i < 6; i++) {
-                                        syndrome[i] =
-                                            ReadDOC(docptr, ECCSyndrome0 + i);
-                                }
-                                nb_errors = doc_decode_ecc(buf, syndrome);
+                        /* Read the ECC syndrom through the DiskOnChip ECC
+                           logic.  These syndrome will be all ZERO when there
+                           is no error */
+                        for (i = 0; i < 6; i++) {
+                                syndrome[i] =
+                                        ReadDOC(docptr, ECCSyndrome0 + i);
+                        }
+                        nb_errors = doc_decode_ecc(buf, syndrome);
 
 #ifdef ECC_DEBUG
-                                printk(KERN_ERR "Errors corrected: %x\n", nb_errors);
+                        printk(KERN_ERR "Errors corrected: %x\n", nb_errors);
 #endif
-                                if (nb_errors < 0) {
-                                        /* We return error, but have actually done the read. Not that
-                                           this can be told to user-space, via sys_read(), but at least
-                                           MTD-aware stuff can know about it by checking *retlen */
-                                        ret = -EIO;
-                                }
+                        if (nb_errors < 0) {
+                                /* We return error, but have actually done the
+                                   read. Not that this can be told to
+                                   user-space, via sys_read(), but at least
+                                   MTD-aware stuff can know about it by
+                                   checking *retlen */
+                                ret = -EIO;
                         }
+                }
 
 #ifdef PSYCHO_DEBUG
-                        printk(KERN_DEBUG "ECC DATA at %lxB: %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
-                                     (long)from, eccbuf[0], eccbuf[1], eccbuf[2],
-                                     eccbuf[3], eccbuf[4], eccbuf[5]);
+                printk(KERN_DEBUG "ECC DATA at %lxB: %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+                       (long)from, eccbuf[0], eccbuf[1], eccbuf[2],
+                       eccbuf[3], eccbuf[4], eccbuf[5]);
 #endif
 
-                        /* disable the ECC engine */
-                        WriteDOC(DOC_ECC_DIS, docptr , ECCConf);
-                }
+                /* disable the ECC engine */
+                WriteDOC(DOC_ECC_DIS, docptr , ECCConf);
 
                 /* according to 11.4.1, we need to wait for the busy line
                  * drop if we read to the end of the page.  */
@@ -771,17 +755,10 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
 static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
                      size_t * retlen, const u_char * buf)
 {
-        char eccbuf[6];
-        return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, NULL);
-}
-
-static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
-                         size_t * retlen, const u_char * buf,
-                         u_char * eccbuf, struct nand_oobinfo *oobsel)
-{
         struct DiskOnChip *this = mtd->priv;
         int di; /* Yes, DI is a hangover from when I was disassembling the binary driver */
         void __iomem *docptr = this->virtadr;
+        unsigned char eccbuf[6];
         volatile char dummy;
         int len256 = 0;
         struct Nand *mychip;
@@ -835,15 +812,9 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
                 DoC_Command(this, NAND_CMD_SEQIN, 0);
                 DoC_Address(this, ADDR_COLUMN_PAGE, to, 0, CDSN_CTRL_ECC_IO);
 
-                if (eccbuf) {
-                        /* Prime the ECC engine */
-                        WriteDOC(DOC_ECC_RESET, docptr, ECCConf);
-                        WriteDOC(DOC_ECC_EN | DOC_ECC_RW, docptr, ECCConf);
-                } else {
-                        /* disable the ECC engine */
-                        WriteDOC(DOC_ECC_RESET, docptr, ECCConf);
-                        WriteDOC(DOC_ECC_DIS, docptr, ECCConf);
-                }
+                /* Prime the ECC engine */
+                WriteDOC(DOC_ECC_RESET, docptr, ECCConf);
+                WriteDOC(DOC_ECC_EN | DOC_ECC_RW, docptr, ECCConf);
 
                 /* treat crossing 256-byte sector for 2M x 8bits devices */
                 if (this->page256 && to + len > (to | 0xff) + 1) {
@@ -873,39 +844,35 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
 
                 DoC_WriteBuf(this, &buf[len256], len - len256);
 
-                if (eccbuf) {
-                        WriteDOC(CDSN_CTRL_ECC_IO | CDSN_CTRL_CE, docptr,
-                                 CDSNControl);
-
-                        if (DoC_is_Millennium(this)) {
-                                WriteDOC(0, docptr, NOP);
-                                WriteDOC(0, docptr, NOP);
-                                WriteDOC(0, docptr, NOP);
-                        } else {
-                                WriteDOC_(0, docptr, this->ioreg);
-                                WriteDOC_(0, docptr, this->ioreg);
-                                WriteDOC_(0, docptr, this->ioreg);
-                        }
+                WriteDOC(CDSN_CTRL_ECC_IO | CDSN_CTRL_CE, docptr, CDSNControl);
 
-                        WriteDOC(CDSN_CTRL_ECC_IO | CDSN_CTRL_FLASH_IO | CDSN_CTRL_CE, docptr,
-                                 CDSNControl);
+                if (DoC_is_Millennium(this)) {
+                        WriteDOC(0, docptr, NOP);
+                        WriteDOC(0, docptr, NOP);
+                        WriteDOC(0, docptr, NOP);
+                } else {
+                        WriteDOC_(0, docptr, this->ioreg);
+                        WriteDOC_(0, docptr, this->ioreg);
+                        WriteDOC_(0, docptr, this->ioreg);
+                }
 
-                        /* Read the ECC data through the DiskOnChip ECC logic */
-                        for (di = 0; di < 6; di++) {
-                                eccbuf[di] = ReadDOC(docptr, ECCSyndrome0 + di);
-                        }
+                WriteDOC(CDSN_CTRL_ECC_IO | CDSN_CTRL_FLASH_IO | CDSN_CTRL_CE, docptr,
+                         CDSNControl);
 
-                        /* Reset the ECC engine */
-                        WriteDOC(DOC_ECC_DIS, docptr, ECCConf);
+                /* Read the ECC data through the DiskOnChip ECC logic */
+                for (di = 0; di < 6; di++) {
+                        eccbuf[di] = ReadDOC(docptr, ECCSyndrome0 + di);
+                }
+
+                /* Reset the ECC engine */
+                WriteDOC(DOC_ECC_DIS, docptr, ECCConf);
 
 #ifdef PSYCHO_DEBUG
-                        printk
-                            ("OOB data at %lx is %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
-                             (long) to, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
-                             eccbuf[4], eccbuf[5]);
+                printk
+                        ("OOB data at %lx is %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+                         (long) to, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
+                         eccbuf[4], eccbuf[5]);
 #endif
-                }
-
                 DoC_Command(this, NAND_CMD_PAGEPROG, 0);
 
                 DoC_Command(this, NAND_CMD_STATUS, CDSN_CTRL_WP);
diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
index 0cf022a69e65..0e2a9326f717 100644
--- a/drivers/mtd/devices/doc2001.c
+++ b/drivers/mtd/devices/doc2001.c
@@ -37,12 +37,6 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
                     size_t *retlen, u_char *buf);
 static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
                      size_t *retlen, const u_char *buf);
-static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t *retlen, u_char *buf, u_char *eccbuf,
-                        struct nand_oobinfo *oobsel);
-static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
-                         size_t *retlen, const u_char *buf, u_char *eccbuf,
-                         struct nand_oobinfo *oobsel);
 static int doc_read_oob(struct mtd_info *mtd, loff_t ofs,
                         struct mtd_oob_ops *ops);
 static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
@@ -397,17 +391,9 @@ EXPORT_SYMBOL_GPL(DoCMil_init);
 static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
                      size_t *retlen, u_char *buf)
 {
-        /* Just a special case of doc_read_ecc */
-        return doc_read_ecc(mtd, from, len, retlen, buf, NULL, NULL);
-}
-
-static int doc_read_ecc (struct mtd_info *mtd, loff_t from, size_t len,
-                         size_t *retlen, u_char *buf, u_char *eccbuf,
-                         struct nand_oobinfo *oobsel)
-{
         int i, ret;
         volatile char dummy;
-        unsigned char syndrome[6];
+        unsigned char syndrome[6], eccbuf[6];
         struct DiskOnChip *this = mtd->priv;
         void __iomem *docptr = this->virtadr;
         struct Nand *mychip = &this->chips[from >> (this->chipshift)];
@@ -437,15 +423,9 @@ static int doc_read_ecc (struct mtd_info *mtd, loff_t from, size_t len,
         DoC_Address(docptr, 3, from, CDSN_CTRL_WP, 0x00);
         DoC_WaitReady(docptr);
 
-        if (eccbuf) {
-                /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
-                WriteDOC (DOC_ECC_RESET, docptr, ECCConf);
-                WriteDOC (DOC_ECC_EN, docptr, ECCConf);
-        } else {
-                /* disable the ECC engine */
-                WriteDOC (DOC_ECC_RESET, docptr, ECCConf);
-                WriteDOC (DOC_ECC_DIS, docptr, ECCConf);
-        }
+        /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
+        WriteDOC (DOC_ECC_RESET, docptr, ECCConf);
+        WriteDOC (DOC_ECC_EN, docptr, ECCConf);
 
         /* Read the data via the internal pipeline through CDSN IO register,
            see Pipelined Read Operations 11.3 */
@@ -465,58 +445,56 @@ static int doc_read_ecc (struct mtd_info *mtd, loff_t from, size_t len,
         *retlen = len;
         ret = 0;
 
-        if (eccbuf) {
-                /* Read the ECC data from Spare Data Area,
-                   see Reed-Solomon EDC/ECC 11.1 */
-                dummy = ReadDOC(docptr, ReadPipeInit);
+        /* Read the ECC data from Spare Data Area,
+           see Reed-Solomon EDC/ECC 11.1 */
+        dummy = ReadDOC(docptr, ReadPipeInit);
 #ifndef USE_MEMCPY
-                for (i = 0; i < 5; i++) {
-                        /* N.B. you have to increase the source address in this way or the
-                           ECC logic will not work properly */
-                        eccbuf[i] = ReadDOC(docptr, Mil_CDSN_IO + i);
-                }
+        for (i = 0; i < 5; i++) {
+                /* N.B. you have to increase the source address in this way or the
+                   ECC logic will not work properly */
+                eccbuf[i] = ReadDOC(docptr, Mil_CDSN_IO + i);
+        }
 #else
-                memcpy_fromio(eccbuf, docptr + DoC_Mil_CDSN_IO, 5);
+        memcpy_fromio(eccbuf, docptr + DoC_Mil_CDSN_IO, 5);
 #endif
-                eccbuf[5] = ReadDOC(docptr, LastDataRead);
+        eccbuf[5] = ReadDOC(docptr, LastDataRead);
 
-                /* Flush the pipeline */
-                dummy = ReadDOC(docptr, ECCConf);
-                dummy = ReadDOC(docptr, ECCConf);
+        /* Flush the pipeline */
+        dummy = ReadDOC(docptr, ECCConf);
+        dummy = ReadDOC(docptr, ECCConf);
 
-                /* Check the ECC Status */
-                if (ReadDOC(docptr, ECCConf) & 0x80) {
-                        int nb_errors;
-                        /* There was an ECC error */
+        /* Check the ECC Status */
+        if (ReadDOC(docptr, ECCConf) & 0x80) {
+                int nb_errors;
+                /* There was an ECC error */
 #ifdef ECC_DEBUG
-                        printk("DiskOnChip ECC Error: Read at %lx\n", (long)from);
+                printk("DiskOnChip ECC Error: Read at %lx\n", (long)from);
 #endif
-                        /* Read the ECC syndrom through the DiskOnChip ECC logic.
-                           These syndrome will be all ZERO when there is no error */
-                        for (i = 0; i < 6; i++) {
-                                syndrome[i] = ReadDOC(docptr, ECCSyndrome0 + i);
-                        }
-                        nb_errors = doc_decode_ecc(buf, syndrome);
+                /* Read the ECC syndrom through the DiskOnChip ECC logic.
+                   These syndrome will be all ZERO when there is no error */
+                for (i = 0; i < 6; i++) {
+                        syndrome[i] = ReadDOC(docptr, ECCSyndrome0 + i);
+                }
+                nb_errors = doc_decode_ecc(buf, syndrome);
 #ifdef ECC_DEBUG
-                        printk("ECC Errors corrected: %x\n", nb_errors);
+                printk("ECC Errors corrected: %x\n", nb_errors);
 #endif
-                        if (nb_errors < 0) {
-                                /* We return error, but have actually done the read. Not that
-                                   this can be told to user-space, via sys_read(), but at least
-                                   MTD-aware stuff can know about it by checking *retlen */
-                                ret = -EIO;
-                        }
+                if (nb_errors < 0) {
+                        /* We return error, but have actually done the read. Not that
+                           this can be told to user-space, via sys_read(), but at least
+                           MTD-aware stuff can know about it by checking *retlen */
+                        ret = -EIO;
                 }
+        }
 
 #ifdef PSYCHO_DEBUG
-                printk("ECC DATA at %lx: %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
-                       (long)from, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
-                       eccbuf[4], eccbuf[5]);
+        printk("ECC DATA at %lx: %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+               (long)from, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
+               eccbuf[4], eccbuf[5]);
 #endif
 
-                /* disable the ECC engine */
-                WriteDOC(DOC_ECC_DIS, docptr , ECCConf);
-        }
+        /* disable the ECC engine */
+        WriteDOC(DOC_ECC_DIS, docptr , ECCConf);
 
         return ret;
 }
@@ -524,15 +502,8 @@ static int doc_read_ecc (struct mtd_info *mtd, loff_t from, size_t len,
 static int doc_write (struct mtd_info *mtd, loff_t to, size_t len,
                       size_t *retlen, const u_char *buf)
 {
-        char eccbuf[6];
-        return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, NULL);
-}
-
-static int doc_write_ecc (struct mtd_info *mtd, loff_t to, size_t len,
-                          size_t *retlen, const u_char *buf, u_char *eccbuf,
-                         struct nand_oobinfo *oobsel)
-{
         int i,ret = 0;
+        char eccbuf[6];
         volatile char dummy;
         struct DiskOnChip *this = mtd->priv;
         void __iomem *docptr = this->virtadr;
@@ -573,15 +544,9 @@ static int doc_write_ecc (struct mtd_info *mtd, loff_t to, size_t len,
         DoC_Address(docptr, 3, to, 0x00, 0x00);
         DoC_WaitReady(docptr);
 
-        if (eccbuf) {
-                /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
-                WriteDOC (DOC_ECC_RESET, docptr, ECCConf);
-                WriteDOC (DOC_ECC_EN | DOC_ECC_RW, docptr, ECCConf);
-        } else {
-                /* disable the ECC engine */
-                WriteDOC (DOC_ECC_RESET, docptr, ECCConf);
-                WriteDOC (DOC_ECC_DIS, docptr, ECCConf);
-        }
+        /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
+        WriteDOC (DOC_ECC_RESET, docptr, ECCConf);
+        WriteDOC (DOC_ECC_EN | DOC_ECC_RW, docptr, ECCConf);
 
         /* Write the data via the internal pipeline through CDSN IO register,
            see Pipelined Write Operations 11.2 */
@@ -596,46 +561,44 @@ static int doc_write_ecc (struct mtd_info *mtd, loff_t to, size_t len,
 #endif
         WriteDOC(0x00, docptr, WritePipeTerm);
 
-        if (eccbuf) {
-                /* Write ECC data to flash, the ECC info is generated by the DiskOnChip ECC logic
-                   see Reed-Solomon EDC/ECC 11.1 */
-                WriteDOC(0, docptr, NOP);
-                WriteDOC(0, docptr, NOP);
-                WriteDOC(0, docptr, NOP);
+        /* Write ECC data to flash, the ECC info is generated by the DiskOnChip ECC logic
+           see Reed-Solomon EDC/ECC 11.1 */
+        WriteDOC(0, docptr, NOP);
+        WriteDOC(0, docptr, NOP);
+        WriteDOC(0, docptr, NOP);
 
-                /* Read the ECC data through the DiskOnChip ECC logic */
-                for (i = 0; i < 6; i++) {
-                        eccbuf[i] = ReadDOC(docptr, ECCSyndrome0 + i);
-                }
+        /* Read the ECC data through the DiskOnChip ECC logic */
+        for (i = 0; i < 6; i++) {
+                eccbuf[i] = ReadDOC(docptr, ECCSyndrome0 + i);
+        }
 
-                /* ignore the ECC engine */
-                WriteDOC(DOC_ECC_DIS, docptr , ECCConf);
+        /* ignore the ECC engine */
+        WriteDOC(DOC_ECC_DIS, docptr , ECCConf);
 
 #ifndef USE_MEMCPY
-                /* Write the ECC data to flash */
-                for (i = 0; i < 6; i++) {
-                        /* N.B. you have to increase the source address in this way or the
-                           ECC logic will not work properly */
-                        WriteDOC(eccbuf[i], docptr, Mil_CDSN_IO + i);
-                }
+        /* Write the ECC data to flash */
+        for (i = 0; i < 6; i++) {
+                /* N.B. you have to increase the source address in this way or the
+                   ECC logic will not work properly */
+                WriteDOC(eccbuf[i], docptr, Mil_CDSN_IO + i);
+        }
 #else
-                memcpy_toio(docptr + DoC_Mil_CDSN_IO, eccbuf, 6);
+        memcpy_toio(docptr + DoC_Mil_CDSN_IO, eccbuf, 6);
 #endif
 
-                /* write the block status BLOCK_USED (0x5555) at the end of ECC data
-                   FIXME: this is only a hack for programming the IPL area for LinuxBIOS
-                   and should be replace with proper codes in user space utilities */
-                WriteDOC(0x55, docptr, Mil_CDSN_IO);
-                WriteDOC(0x55, docptr, Mil_CDSN_IO + 1);
+        /* write the block status BLOCK_USED (0x5555) at the end of ECC data
+           FIXME: this is only a hack for programming the IPL area for LinuxBIOS
+           and should be replace with proper codes in user space utilities */
+        WriteDOC(0x55, docptr, Mil_CDSN_IO);
+        WriteDOC(0x55, docptr, Mil_CDSN_IO + 1);
 
-                WriteDOC(0x00, docptr, WritePipeTerm);
+        WriteDOC(0x00, docptr, WritePipeTerm);
 
 #ifdef PSYCHO_DEBUG
-                printk("OOB data at %lx is %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
-                       (long) to, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
-                       eccbuf[4], eccbuf[5]);
+        printk("OOB data at %lx is %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+               (long) to, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
+               eccbuf[4], eccbuf[5]);
 #endif
-        }
 
         /* Commit the Page Program command and wait for ready
            see Software Requirement 11.4 item 1.*/
diff --git a/drivers/mtd/devices/doc2001plus.c b/drivers/mtd/devices/doc2001plus.c
index 66cb1e50469a..92dbb47f2ac3 100644
--- a/drivers/mtd/devices/doc2001plus.c
+++ b/drivers/mtd/devices/doc2001plus.c
@@ -41,12 +41,6 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, u_char *buf);
 static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
                 size_t *retlen, const u_char *buf);
-static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
-                size_t *retlen, u_char *buf, u_char *eccbuf,
-                struct nand_oobinfo *oobsel);
-static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
-                size_t *retlen, const u_char *buf, u_char *eccbuf,
-                struct nand_oobinfo *oobsel);
 static int doc_read_oob(struct mtd_info *mtd, loff_t ofs,
                         struct mtd_oob_ops *ops);
 static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
@@ -595,18 +589,10 @@ static int doc_dumpblk(struct mtd_info *mtd, loff_t from)
 static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
                     size_t *retlen, u_char *buf)
 {
-        /* Just a special case of doc_read_ecc */
-        return doc_read_ecc(mtd, from, len, retlen, buf, NULL, NULL);
-}
-
-static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t *retlen, u_char *buf, u_char *eccbuf,
-                        struct nand_oobinfo *oobsel)
-{
         int ret, i;
         volatile char dummy;
         loff_t fofs;
-        unsigned char syndrome[6];
+        unsigned char syndrome[6], eccbuf[6];
         struct DiskOnChip *this = mtd->priv;
         void __iomem * docptr = this->virtadr;
         struct Nand *mychip = &this->chips[from >> (this->chipshift)];
@@ -644,56 +630,51 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
         WriteDOC(0, docptr, Mplus_FlashControl);
         DoC_WaitReady(docptr);
 
-        if (eccbuf) {
-                /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
-                WriteDOC(DOC_ECC_RESET, docptr, Mplus_ECCConf);
-                WriteDOC(DOC_ECC_EN, docptr, Mplus_ECCConf);
-        } else {
-                /* disable the ECC engine */
-                WriteDOC(DOC_ECC_RESET, docptr, Mplus_ECCConf);
-        }
+        /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
+        WriteDOC(DOC_ECC_RESET, docptr, Mplus_ECCConf);
+        WriteDOC(DOC_ECC_EN, docptr, Mplus_ECCConf);
 
         /* Let the caller know we completed it */
         *retlen = len;
-        ret = 0;
+        ret = 0;
 
         ReadDOC(docptr, Mplus_ReadPipeInit);
         ReadDOC(docptr, Mplus_ReadPipeInit);
 
-        if (eccbuf) {
-                /* Read the data via the internal pipeline through CDSN IO
-                   register, see Pipelined Read Operations 11.3 */
-                MemReadDOC(docptr, buf, len);
+        /* Read the data via the internal pipeline through CDSN IO
+           register, see Pipelined Read Operations 11.3 */
+        MemReadDOC(docptr, buf, len);
 
-                /* Read the ECC data following raw data */
-                MemReadDOC(docptr, eccbuf, 4);
-                eccbuf[4] = ReadDOC(docptr, Mplus_LastDataRead);
-                eccbuf[5] = ReadDOC(docptr, Mplus_LastDataRead);
+        /* Read the ECC data following raw data */
+        MemReadDOC(docptr, eccbuf, 4);
+        eccbuf[4] = ReadDOC(docptr, Mplus_LastDataRead);
+        eccbuf[5] = ReadDOC(docptr, Mplus_LastDataRead);
 
-                /* Flush the pipeline */
-                dummy = ReadDOC(docptr, Mplus_ECCConf);
-                dummy = ReadDOC(docptr, Mplus_ECCConf);
+        /* Flush the pipeline */
+        dummy = ReadDOC(docptr, Mplus_ECCConf);
+        dummy = ReadDOC(docptr, Mplus_ECCConf);
 
-                /* Check the ECC Status */
-                if (ReadDOC(docptr, Mplus_ECCConf) & 0x80) {
-                        int nb_errors;
-                        /* There was an ECC error */
+        /* Check the ECC Status */
+        if (ReadDOC(docptr, Mplus_ECCConf) & 0x80) {
+                int nb_errors;
+                /* There was an ECC error */
 #ifdef ECC_DEBUG
-                        printk("DiskOnChip ECC Error: Read at %lx\n", (long)from);
+                printk("DiskOnChip ECC Error: Read at %lx\n", (long)from);
 #endif
-                        /* Read the ECC syndrom through the DiskOnChip ECC logic.
-                           These syndrome will be all ZERO when there is no error */
-                        for (i = 0; i < 6; i++)
-                                syndrome[i] = ReadDOC(docptr, Mplus_ECCSyndrome0 + i);
+                /* Read the ECC syndrom through the DiskOnChip ECC logic.
+                   These syndrome will be all ZERO when there is no error */
+                for (i = 0; i < 6; i++)
+                        syndrome[i] = ReadDOC(docptr, Mplus_ECCSyndrome0 + i);
 
-                        nb_errors = doc_decode_ecc(buf, syndrome);
+                nb_errors = doc_decode_ecc(buf, syndrome);
 #ifdef ECC_DEBUG
-                        printk("ECC Errors corrected: %x\n", nb_errors);
+                printk("ECC Errors corrected: %x\n", nb_errors);
 #endif
-                        if (nb_errors < 0) {
-                                /* We return error, but have actually done the read. Not that
-                                   this can be told to user-space, via sys_read(), but at least
-                                   MTD-aware stuff can know about it by checking *retlen */
+                if (nb_errors < 0) {
+                        /* We return error, but have actually done the
+                           read. Not that this can be told to user-space, via
+                           sys_read(), but at least MTD-aware stuff can know
+                           about it by checking *retlen */
 #ifdef ECC_DEBUG
                         printk("%s(%d): Millennium Plus ECC error (from=0x%x:\n",
                                 __FILE__, __LINE__, (int)from);
@@ -707,24 +688,16 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
                                 eccbuf[3], eccbuf[4], eccbuf[5]);
 #endif
                                 ret = -EIO;
-                        }
                 }
+        }
 
 #ifdef PSYCHO_DEBUG
-                printk("ECC DATA at %lx: %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
-                       (long)from, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
-                       eccbuf[4], eccbuf[5]);
+        printk("ECC DATA at %lx: %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+               (long)from, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
+               eccbuf[4], eccbuf[5]);
 #endif
-
-                /* disable the ECC engine */
-                WriteDOC(DOC_ECC_DIS, docptr , Mplus_ECCConf);
-        } else {
-                /* Read the data via the internal pipeline through CDSN IO
-                   register, see Pipelined Read Operations 11.3 */
-                MemReadDOC(docptr, buf, len-2);
-                buf[len-2] = ReadDOC(docptr, Mplus_LastDataRead);
-                buf[len-1] = ReadDOC(docptr, Mplus_LastDataRead);
-        }
+        /* disable the ECC engine */
+        WriteDOC(DOC_ECC_DIS, docptr , Mplus_ECCConf);
 
         /* Disable flash internally */
         WriteDOC(0, docptr, Mplus_FlashSelect);
@@ -735,17 +708,10 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
 static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
                      size_t *retlen, const u_char *buf)
 {
-        char eccbuf[6];
-        return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, NULL);
-}
-
-static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
-                         size_t *retlen, const u_char *buf, u_char *eccbuf,
-                         struct nand_oobinfo *oobsel)
-{
         int i, before, ret = 0;
         loff_t fto;
         volatile char dummy;
+        char eccbuf[6];
         struct DiskOnChip *this = mtd->priv;
         void __iomem * docptr = this->virtadr;
         struct Nand *mychip = &this->chips[to >> (this->chipshift)];
@@ -795,46 +761,42 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
         /* Disable the ECC engine */
         WriteDOC(DOC_ECC_RESET, docptr, Mplus_ECCConf);
 
-        if (eccbuf) {
-                if (before) {
-                        /* Write the block status BLOCK_USED (0x5555) */
-                        WriteDOC(0x55, docptr, Mil_CDSN_IO);
-                        WriteDOC(0x55, docptr, Mil_CDSN_IO);
-                }
-
-                /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
-                WriteDOC(DOC_ECC_EN | DOC_ECC_RW, docptr, Mplus_ECCConf);
+        if (before) {
+                /* Write the block status BLOCK_USED (0x5555) */
+                WriteDOC(0x55, docptr, Mil_CDSN_IO);
+                WriteDOC(0x55, docptr, Mil_CDSN_IO);
         }
 
+        /* init the ECC engine, see Reed-Solomon EDC/ECC 11.1 .*/
+        WriteDOC(DOC_ECC_EN | DOC_ECC_RW, docptr, Mplus_ECCConf);
+
         MemWriteDOC(docptr, (unsigned char *) buf, len);
 
-        if (eccbuf) {
-                /* Write ECC data to flash, the ECC info is generated by
-                   the DiskOnChip ECC logic see Reed-Solomon EDC/ECC 11.1 */
-                DoC_Delay(docptr, 3);
+        /* Write ECC data to flash, the ECC info is generated by
+           the DiskOnChip ECC logic see Reed-Solomon EDC/ECC 11.1 */
+        DoC_Delay(docptr, 3);
 
-                /* Read the ECC data through the DiskOnChip ECC logic */
-                for (i = 0; i < 6; i++)
-                        eccbuf[i] = ReadDOC(docptr, Mplus_ECCSyndrome0 + i);
+        /* Read the ECC data through the DiskOnChip ECC logic */
+        for (i = 0; i < 6; i++)
+                eccbuf[i] = ReadDOC(docptr, Mplus_ECCSyndrome0 + i);
 
-                /* disable the ECC engine */
-                WriteDOC(DOC_ECC_DIS, docptr, Mplus_ECCConf);
+        /* disable the ECC engine */
+        WriteDOC(DOC_ECC_DIS, docptr, Mplus_ECCConf);
 
-                /* Write the ECC data to flash */
-                MemWriteDOC(docptr, eccbuf, 6);
+        /* Write the ECC data to flash */
+        MemWriteDOC(docptr, eccbuf, 6);
 
-                if (!before) {
-                        /* Write the block status BLOCK_USED (0x5555) */
-                        WriteDOC(0x55, docptr, Mil_CDSN_IO+6);
-                        WriteDOC(0x55, docptr, Mil_CDSN_IO+7);
-                }
+        if (!before) {
+                /* Write the block status BLOCK_USED (0x5555) */
+                WriteDOC(0x55, docptr, Mil_CDSN_IO+6);
+                WriteDOC(0x55, docptr, Mil_CDSN_IO+7);
+        }
 
 #ifdef PSYCHO_DEBUG
-                printk("OOB data at %lx is %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
-                       (long) to, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
-                       eccbuf[4], eccbuf[5]);
+        printk("OOB data at %lx is %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+               (long) to, eccbuf[0], eccbuf[1], eccbuf[2], eccbuf[3],
+               eccbuf[4], eccbuf[5]);
 #endif
-        }
 
         WriteDOC(0x00, docptr, Mplus_WritePipeTerm);
         WriteDOC(0x00, docptr, Mplus_WritePipeTerm);
diff --git a/drivers/mtd/nand/ams-delta.c b/drivers/mtd/nand/ams-delta.c
index d7897dc6b3c8..a0ba07c36ee9 100644
--- a/drivers/mtd/nand/ams-delta.c
+++ b/drivers/mtd/nand/ams-delta.c
@@ -130,11 +130,13 @@ static void ams_delta_hwcontrol(struct mtd_info *mtd, int cmd,
         if (ctrl & NAND_CTRL_CHANGE) {
                 unsigned long bits;
 
-                bits = (~ctrl & NAND_NCE) << 2;
-                bits |= (ctrl & NAND_CLE) << 7;
-                bits |= (ctrl & NAND_ALE) << 6;
+                bits = (~ctrl & NAND_NCE) ? AMS_DELTA_LATCH2_NAND_NCE : 0;
+                bits |= (ctrl & NAND_CLE) ? AMS_DELTA_LATCH2_NAND_CLE : 0;
+                bits |= (ctrl & NAND_ALE) ? AMS_DELTA_LATCH2_NAND_ALE : 0;
 
-                ams_delta_latch2_write(0xC2, bits);
+                ams_delta_latch2_write(AMS_DELTA_LATCH2_NAND_CLE |
+                                AMS_DELTA_LATCH2_NAND_ALE |
+                                AMS_DELTA_LATCH2_NAND_NCE, bits);
         }
 
         if (cmd != NAND_CMD_NONE)
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 80a76654d963..0a54d003ef34 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -155,7 +155,7 @@ static u16 nand_read_word(struct mtd_info *mtd)
 /**
  * nand_select_chip - [DEFAULT] control CE line
  * @mtd:        MTD device structure
- * @chip:       chipnumber to select, -1 for deselect
+ * @chipnr:     chipnumber to select, -1 for deselect
  *
  * Default select function for 1 chip devices.
  */
@@ -542,7 +542,6 @@ static void nand_command(struct mtd_info *mtd, unsigned int command,
  * Send command to NAND device. This is the version for the new large page
  * devices We dont have the separate regions as we have in the small page
  * devices.  We must emulate NAND_CMD_READOOB to keep the code compatible.
- *
  */
 static void nand_command_lp(struct mtd_info *mtd, unsigned int command,
                             int column, int page_addr)
@@ -656,7 +655,7 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command,
 
 /**
  * nand_get_device - [GENERIC] Get chip for selected access
- * @this:       the nand chip descriptor
+ * @chip:       the nand chip descriptor
  * @mtd:        MTD device structure
  * @new_state:  the state which is requested
  *
@@ -696,13 +695,12 @@ nand_get_device(struct nand_chip *chip, struct mtd_info *mtd, int new_state)
 /**
  * nand_wait - [DEFAULT]  wait until the command is done
  * @mtd:        MTD device structure
- * @this:       NAND chip structure
+ * @chip:       NAND chip structure
  *
  * Wait for command done. This applies to erase and program only
  * Erase can take up to 400ms and program up to 20ms according to
  * general NAND and SmartMedia specs
- *
-*/
+ */
 static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip)
 {
 
@@ -896,6 +894,7 @@ static int nand_read_page_syndrome(struct mtd_info *mtd, struct nand_chip *chip,
 /**
  * nand_transfer_oob - [Internal] Transfer oob to client buffer
  * @chip:       nand chip structure
+ * @oob:        oob destination address
  * @ops:        oob ops structure
  */
 static uint8_t *nand_transfer_oob(struct nand_chip *chip, uint8_t *oob,
@@ -946,6 +945,7 @@ static uint8_t *nand_transfer_oob(struct nand_chip *chip, uint8_t *oob,
  *
  * @mtd:        MTD device structure
  * @from:       offset to read from
+ * @ops:        oob ops structure
  *
  * Internal function. Called with chip held.
  */
@@ -1093,9 +1093,10 @@ static int nand_read(struct mtd_info *mtd, loff_t from, size_t len,
 
         ret = nand_do_read_ops(mtd, from, &chip->ops);
 
+        *retlen = chip->ops.retlen;
+
         nand_release_device(mtd);
 
-        *retlen = chip->ops.retlen;
         return ret;
 }
 
@@ -1203,7 +1204,7 @@ static int nand_write_oob_syndrome(struct mtd_info *mtd,
                 pos = steps * (eccsize + chunk);
                 steps = 0;
         } else
-                pos = eccsize + chunk;
+                pos = eccsize;
 
         chip->cmdfunc(mtd, NAND_CMD_SEQIN, pos, page);
         for (i = 0; i < steps; i++) {
@@ -1566,7 +1567,7 @@ static uint8_t *nand_fill_oob(struct nand_chip *chip, uint8_t *oob,
                                 bytes = min_t(size_t, len, free->length);
                                 boffs = free->offset;
                         }
-                        memcpy(chip->oob_poi + woffs, oob, bytes);
+                        memcpy(chip->oob_poi + boffs, oob, bytes);
                         oob += bytes;
                 }
                 return oob;
@@ -1691,9 +1692,10 @@ static int nand_write(struct mtd_info *mtd, loff_t to, size_t len,
 
         ret = nand_do_write_ops(mtd, to, &chip->ops);
 
+        *retlen = chip->ops.retlen;
+
         nand_release_device(mtd);
 
-        *retlen = chip->ops.retlen;
         return ret;
 }
 
@@ -1760,7 +1762,7 @@ static int nand_do_write_oob(struct mtd_info *mtd, loff_t to,
 /**
  * nand_write_oob - [MTD Interface] NAND write data and/or out-of-band
  * @mtd:        MTD device structure
- * @from:       offset to read from
+ * @to:         offset to write to
  * @ops:        oob operation description structure
  */
 static int nand_write_oob(struct mtd_info *mtd, loff_t to,
@@ -2055,7 +2057,7 @@ static void nand_sync(struct mtd_info *mtd)
 /**
  * nand_block_isbad - [MTD Interface] Check if block at offset is bad
  * @mtd:        MTD device structure
- * @ofs:        offset relative to mtd start
+ * @offs:       offset relative to mtd start
  */
 static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
 {
diff --git a/drivers/mtd/nand/nand_ecc.c b/drivers/mtd/nand/nand_ecc.c
index 2a163e4084df..dd438ca47d9a 100644
--- a/drivers/mtd/nand/nand_ecc.c
+++ b/drivers/mtd/nand/nand_ecc.c
@@ -65,8 +65,7 @@ static const u_char nand_ecc_precalc_table[] = {
 };
 
 /**
- * nand_calculate_ecc - [NAND Interface] Calculate 3 byte ECC code
- *                      for 256 byte block
+ * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256-byte block
  * @mtd:        MTD block structure
  * @dat:        raw data
  * @ecc_code:   buffer for ECC
diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
index 21743658d150..fbeedc3184e9 100644
--- a/drivers/mtd/nand/sharpsl.c
+++ b/drivers/mtd/nand/sharpsl.c
@@ -237,11 +237,6 @@ static int __init sharpsl_nand_init(void)
                 }
         }
 
-        if (machine_is_husky() || machine_is_borzoi() || machine_is_akita()) {
-                /* Need to use small eraseblock size for backward compatibility */
-                sharpsl_mtd->flags |= MTD_NO_VIRTBLOCKS;
-        }
-
         add_mtd_partitions(sharpsl_mtd, sharpsl_partition_info, nr_partitions);
 
         /* Return happy */
@@ -255,8 +250,6 @@ module_init(sharpsl_nand_init);
  */
 static void __exit sharpsl_nand_cleanup(void)
 {
-        struct nand_chip *this = (struct nand_chip *)&sharpsl_mtd[1];
-
         /* Release resources, unregister device */
         nand_release(sharpsl_mtd);
 
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 4532b17e40ea..aedfddf20cb3 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -1003,7 +1003,8 @@ static int corkscrew_start_xmit(struct sk_buff *skb,
                 /* Calculate the next Tx descriptor entry. */
                 int entry = vp->cur_tx % TX_RING_SIZE;
                 struct boom_tx_desc *prev_entry;
-                unsigned long flags, i;
+                unsigned long flags;
+                int i;
 
                 if (vp->tx_full)        /* No room to transmit with */
                         return 1;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 8ab03b4a885e..80e8ca013e44 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -17,172 +17,6 @@
         410 Severn Ave., Suite 210
         Annapolis MD 21403
 
-        Linux Kernel Additions:
-        
-        0.99H+lk0.9 - David S. Miller - softnet, PCI DMA updates
-        0.99H+lk1.0 - Jeff Garzik <jgarzik@pobox.com>
-                Remove compatibility defines for kernel versions < 2.2.x.
-                Update for new 2.3.x module interface
-        LK1.1.2 (March 19, 2000)
-        * New PCI interface (jgarzik)
-
-    LK1.1.3 25 April 2000, Andrew Morton <andrewm@uow.edu.au>
-    - Merged with 3c575_cb.c
-    - Don't set RxComplete in boomerang interrupt enable reg
-    - spinlock in vortex_timer to protect mdio functions
-    - disable local interrupts around call to vortex_interrupt in
-      vortex_tx_timeout() (So vortex_interrupt can use spin_lock())
-    - Select window 3 in vortex_timer()'s write to Wn3_MAC_Ctrl
-    - In vortex_start_xmit(), move the lock to _after_ we've altered
-      vp->cur_tx and vp->tx_full.  This defeats the race between
-      vortex_start_xmit() and vortex_interrupt which was identified
-      by Bogdan Costescu.
-    - Merged back support for six new cards from various sources
-    - Set vortex_have_pci if pci_module_init returns zero (fixes cardbus
-      insertion oops)
-    - Tell it that 3c905C has NWAY for 100bT autoneg
-    - Fix handling of SetStatusEnd in 'Too much work..' code, as
-      per 2.3.99's 3c575_cb (Dave Hinds).
-    - Split ISR into two for vortex & boomerang
-    - Fix MOD_INC/DEC races
-    - Handle resource allocation failures.
-    - Fix 3CCFE575CT LED polarity
-    - Make tx_interrupt_mitigation the default
-
-    LK1.1.4 25 April 2000, Andrew Morton <andrewm@uow.edu.au>    
-    - Add extra TxReset to vortex_up() to fix 575_cb hotplug initialisation probs.
-    - Put vortex_info_tbl into __devinitdata
-    - In the vortex_error StatsFull HACK, disable stats in vp->intr_enable as well
-      as in the hardware.
-    - Increased the loop counter in issue_and_wait from 2,000 to 4,000.
-
-    LK1.1.5 28 April 2000, andrewm
-    - Added powerpc defines (John Daniel <jdaniel@etresoft.com> said these work...)
-    - Some extra diagnostics
-    - In vortex_error(), reset the Tx on maxCollisions.  Otherwise most
-      chips usually get a Tx timeout.
-    - Added extra_reset module parm
-    - Replaced some inline timer manip with mod_timer
-      (Franois romieu <Francois.Romieu@nic.fr>)
-    - In vortex_up(), don't make Wn3_config initialisation dependent upon has_nway
-      (this came across from 3c575_cb).
-
-    LK1.1.6 06 Jun 2000, andrewm
-    - Backed out the PPC defines.
-    - Use del_timer_sync(), mod_timer().
-    - Fix wrapped ulong comparison in boomerang_rx()
-    - Add IS_TORNADO, use it to suppress 3c905C checksum error msg
-      (Donald Becker, I Lee Hetherington <ilh@sls.lcs.mit.edu>)
-    - Replace union wn3_config with BFINS/BFEXT manipulation for
-      sparc64 (Pete Zaitcev, Peter Jones)
-    - In vortex_error, do_tx_reset and vortex_tx_timeout(Vortex):
-      do a netif_wake_queue() to better recover from errors. (Anders Pedersen,
-      Donald Becker)
-    - Print a warning on out-of-memory (rate limited to 1 per 10 secs)
-    - Added two more Cardbus 575 NICs: 5b57 and 6564 (Paul Wagland)
-
-    LK1.1.7 2 Jul 2000 andrewm
-    - Better handling of shared IRQs
-    - Reset the transmitter on a Tx reclaim error
-    - Fixed crash under OOM during vortex_open() (Mark Hemment)
-    - Fix Rx cessation problem during OOM (help from Mark Hemment)
-    - The spinlocks around the mdio access were blocking interrupts for 300uS.
-      Fix all this to use spin_lock_bh() within mdio_read/write
-    - Only write to TxFreeThreshold if it's a boomerang - other NICs don't
-      have one.
-    - Added 802.3x MAC-layer flow control support
-
-   LK1.1.8 13 Aug 2000 andrewm
-    - Ignore request_region() return value - already reserved if Cardbus.
-    - Merged some additional Cardbus flags from Don's 0.99Qk
-    - Some fixes for 3c556 (Fred Maciel)
-    - Fix for EISA initialisation (Jan Rekorajski)
-    - Renamed MII_XCVR_PWR and EEPROM_230 to align with 3c575_cb and D. Becker's drivers
-    - Fixed MII_XCVR_PWR for 3CCFE575CT
-    - Added INVERT_LED_PWR, used it.
-    - Backed out the extra_reset stuff
-
-   LK1.1.9 12 Sep 2000 andrewm
-    - Backed out the tx_reset_resume flags.  It was a no-op.
-    - In vortex_error, don't reset the Tx on txReclaim errors
-    - In vortex_error, don't reset the Tx on maxCollisions errors.
-      Hence backed out all the DownListPtr logic here.
-    - In vortex_error, give Tornado cards a partial TxReset on
-      maxCollisions (David Hinds).  Defined MAX_COLLISION_RESET for this.
-    - Redid some driver flags and device names based on pcmcia_cs-3.1.20.
-    - Fixed a bug where, if vp->tx_full is set when the interface
-      is downed, it remains set when the interface is upped.  Bad
-      things happen.
-
-   LK1.1.10 17 Sep 2000 andrewm
-    - Added EEPROM_8BIT for 3c555 (Fred Maciel)
-    - Added experimental support for the 3c556B Laptop Hurricane (Louis Gerbarg)
-    - Add HAS_NWAY to "3c900 Cyclone 10Mbps TPO"
-
-   LK1.1.11 13 Nov 2000 andrewm
-    - Dump MOD_INC/DEC_USE_COUNT, use SET_MODULE_OWNER
-
-   LK1.1.12 1 Jan 2001 andrewm (2.4.0-pre1)
-    - Call pci_enable_device before we request our IRQ (Tobias Ringstrom)
-    - Add 3c590 PCI latency timer hack to vortex_probe1 (from 0.99Ra)
-    - Added extended issue_and_wait for the 3c905CX.
-    - Look for an MII on PHY index 24 first (3c905CX oddity).
-    - Add HAS_NWAY to 3cSOHO100-TX (Brett Frankenberger)
-    - Don't free skbs we don't own on oom path in vortex_open().
-
-   LK1.1.13 27 Jan 2001
-    - Added explicit `medialock' flag so we can truly
-      lock the media type down with `options'.
-    - "check ioremap return and some tidbits" (Arnaldo Carvalho de Melo <acme@conectiva.com.br>)
-    - Added and used EEPROM_NORESET for 3c556B PM resumes.
-    - Fixed leakage of vp->rx_ring.
-    - Break out separate HAS_HWCKSM device capability flag.
-    - Kill vp->tx_full (ANK)
-    - Merge zerocopy fragment handling (ANK?)
-
-   LK1.1.14 15 Feb 2001
-    - Enable WOL.  Can be turned on with `enable_wol' module option.
-    - EISA and PCI initialisation fixes (jgarzik, Manfred Spraul)
-    - If a device's internalconfig register reports it has NWAY,
-      use it, even if autoselect is enabled.
-
-   LK1.1.15 6 June 2001 akpm
-    - Prevent double counting of received bytes (Lars Christensen)
-    - Add ethtool support (jgarzik)
-    - Add module parm descriptions (Andrzej M. Krzysztofowicz)
-    - Implemented alloc_etherdev() API
-    - Special-case the 'Tx error 82' message.
-
-   LK1.1.16 18 July 2001 akpm
-    - Make NETIF_F_SG dependent upon nr_free_highpages(), not on CONFIG_HIGHMEM
-    - Lessen verbosity of bootup messages
-    - Fix WOL - use new PM API functions.
-    - Use netif_running() instead of vp->open in suspend/resume.
-    - Don't reset the interface logic on open/close/rmmod.  It upsets
-      autonegotiation, and hence DHCP (from 0.99T).
-    - Back out EEPROM_NORESET flag because of the above (we do it for all
-      NICs).
-    - Correct 3c982 identification string
-    - Rename wait_for_completion() to issue_and_wait() to avoid completion.h
-      clash.
-
-   LK1.1.17 18Dec01 akpm
-    - PCI ID 9805 is a Python-T, not a dual-port Cyclone.  Apparently.
-      And it has NWAY.
-    - Mask our advertised modes (vp->advertising) with our capabilities
-          (MII reg5) when deciding which duplex mode to use.
-    - Add `global_options' as default for options[].  Ditto global_enable_wol,
-      global_full_duplex.
-
-   LK1.1.18 01Jul02 akpm
-    - Fix for undocumented transceiver power-up bit on some 3c566B's
-      (Donald Becker, Rahul Karnik)
-
-    - See http://www.zip.com.au/~akpm/linux/#3c59x-2.3 for more details.
-    - Also see Documentation/networking/vortex.txt
-
-   LK1.1.19 10Nov02 Marc Zyngier <maz@wild-wind.fr.eu.org>
-    - EISA sysfs integration.
 */
 
 /*
@@ -1897,7 +1731,7 @@ vortex_timer(unsigned long data)
                 printk(KERN_DEBUG "dev->watchdog_timeo=%d\n", dev->watchdog_timeo);
         }
 
-        disable_irq(dev->irq);
+        disable_irq_lockdep(dev->irq);
         old_window = ioread16(ioaddr + EL3_CMD) >> 13;
         EL3WINDOW(4);
         media_status = ioread16(ioaddr + Wn4_Media);
@@ -1978,7 +1812,7 @@ leave_media_alone:
                          dev->name, media_tbl[dev->if_port].name);
 
         EL3WINDOW(old_window);
-        enable_irq(dev->irq);
+        enable_irq_lockdep(dev->irq);
         mod_timer(&vp->timer, RUN_AT(next_tick));
         if (vp->deferred)
                 iowrite16(FakeIntr, ioaddr + EL3_CMD);
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 1959654cbec8..1428bb7715af 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -1836,9 +1836,10 @@ static int cp_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 
         if (pdev->vendor == PCI_VENDOR_ID_REALTEK &&
             pdev->device == PCI_DEVICE_ID_REALTEK_8139 && pci_rev < 0x20) {
-                printk(KERN_ERR PFX "pci dev %s (id %04x:%04x rev %02x) is not an 8139C+ compatible chip\n",
-                       pci_name(pdev), pdev->vendor, pdev->device, pci_rev);
-                printk(KERN_ERR PFX "Try the \"8139too\" driver instead.\n");
+                dev_err(&pdev->dev,
+                           "This (id %04x:%04x rev %02x) is not an 8139C+ compatible chip\n",
+                           pdev->vendor, pdev->device, pci_rev);
+                dev_err(&pdev->dev, "Try the \"8139too\" driver instead.\n");
                 return -ENODEV;
         }
 
@@ -1876,14 +1877,13 @@ static int cp_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         pciaddr = pci_resource_start(pdev, 1);
         if (!pciaddr) {
                 rc = -EIO;
-                printk(KERN_ERR PFX "no MMIO resource for pci dev %s\n",
-                       pci_name(pdev));
+                dev_err(&pdev->dev, "no MMIO resource\n");
                 goto err_out_res;
         }
         if (pci_resource_len(pdev, 1) < CP_REGS_SIZE) {
                 rc = -EIO;
-                printk(KERN_ERR PFX "MMIO resource (%llx) too small on pci dev %s\n",
-                       (unsigned long long)pci_resource_len(pdev, 1), pci_name(pdev));
+                dev_err(&pdev->dev, "MMIO resource (%llx) too small\n",
+                       (unsigned long long)pci_resource_len(pdev, 1));
                 goto err_out_res;
         }
 
@@ -1897,14 +1897,15 @@ static int cp_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 
                 rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
                 if (rc) {
-                        printk(KERN_ERR PFX "No usable DMA configuration, "
-                               "aborting.\n");
+                        dev_err(&pdev->dev,
+                                   "No usable DMA configuration, aborting.\n");
                         goto err_out_res;
                 }
                 rc = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
                 if (rc) {
-                        printk(KERN_ERR PFX "No usable consistent DMA configuration, "
-                               "aborting.\n");
+                        dev_err(&pdev->dev,
+                                   "No usable consistent DMA configuration, "
+                                   "aborting.\n");
                         goto err_out_res;
                 }
         }
@@ -1915,9 +1916,9 @@ static int cp_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         regs = ioremap(pciaddr, CP_REGS_SIZE);
         if (!regs) {
                 rc = -EIO;
-                printk(KERN_ERR PFX "Cannot map PCI MMIO (%llx@%llx) on pci dev %s\n",
-                        (unsigned long long)pci_resource_len(pdev, 1),
-                        (unsigned long long)pciaddr, pci_name(pdev));
+                dev_err(&pdev->dev, "Cannot map PCI MMIO (%Lx@%Lx)\n",
+                       (unsigned long long)pci_resource_len(pdev, 1),
+                       (unsigned long long)pciaddr);
                 goto err_out_res;
         }
         dev->base_addr = (unsigned long) regs;
@@ -1986,7 +1987,8 @@ static int cp_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         /* enable busmastering and memory-write-invalidate */
         pci_set_master(pdev);
 
-        if (cp->wol_enabled) cp_set_d3_state (cp);
+        if (cp->wol_enabled)
+                cp_set_d3_state (cp);
 
         return 0;
 
@@ -2011,7 +2013,8 @@ static void cp_remove_one (struct pci_dev *pdev)
         BUG_ON(!dev);
         unregister_netdev(dev);
         iounmap(cp->regs);
-        if (cp->wol_enabled) pci_set_power_state (pdev, PCI_D0);
+        if (cp->wol_enabled)
+                pci_set_power_state (pdev, PCI_D0);
         pci_release_regions(pdev);
         pci_clear_mwi(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 717506b2b13a..e4f4eaff7679 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -768,7 +768,7 @@ static int __devinit rtl8139_init_board (struct pci_dev *pdev,
         /* dev and priv zeroed in alloc_etherdev */
         dev = alloc_etherdev (sizeof (*tp));
         if (dev == NULL) {
-                printk (KERN_ERR PFX "%s: Unable to alloc new net device\n", pci_name(pdev));
+                dev_err(&pdev->dev, "Unable to alloc new net device\n");
                 return -ENOMEM;
         }
         SET_MODULE_OWNER(dev);
@@ -800,31 +800,31 @@ static int __devinit rtl8139_init_board (struct pci_dev *pdev,
 #ifdef USE_IO_OPS
         /* make sure PCI base addr 0 is PIO */
         if (!(pio_flags & IORESOURCE_IO)) {
-                printk (KERN_ERR PFX "%s: region #0 not a PIO resource, aborting\n", pci_name(pdev));
+                dev_err(&pdev->dev, "region #0 not a PIO resource, aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
         /* check for weird/broken PCI region reporting */
         if (pio_len < RTL_MIN_IO_SIZE) {
-                printk (KERN_ERR PFX "%s: Invalid PCI I/O region size(s), aborting\n", pci_name(pdev));
+                dev_err(&pdev->dev, "Invalid PCI I/O region size(s), aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
 #else
         /* make sure PCI base addr 1 is MMIO */
         if (!(mmio_flags & IORESOURCE_MEM)) {
-                printk (KERN_ERR PFX "%s: region #1 not an MMIO resource, aborting\n", pci_name(pdev));
+                dev_err(&pdev->dev, "region #1 not an MMIO resource, aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
         if (mmio_len < RTL_MIN_IO_SIZE) {
-                printk (KERN_ERR PFX "%s: Invalid PCI mem region size(s), aborting\n", pci_name(pdev));
+                dev_err(&pdev->dev, "Invalid PCI mem region size(s), aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
 #endif
 
-        rc = pci_request_regions (pdev, "8139too");
+        rc = pci_request_regions (pdev, DRV_NAME);
         if (rc)
                 goto err_out;
         disable_dev_on_err = 1;
@@ -835,7 +835,7 @@ static int __devinit rtl8139_init_board (struct pci_dev *pdev,
 #ifdef USE_IO_OPS
         ioaddr = ioport_map(pio_start, pio_len);
         if (!ioaddr) {
-                printk (KERN_ERR PFX "%s: cannot map PIO, aborting\n", pci_name(pdev));
+                dev_err(&pdev->dev, "cannot map PIO, aborting\n");
                 rc = -EIO;
                 goto err_out;
         }
@@ -846,7 +846,7 @@ static int __devinit rtl8139_init_board (struct pci_dev *pdev,
         /* ioremap MMIO region */
         ioaddr = pci_iomap(pdev, 1, 0);
         if (ioaddr == NULL) {
-                printk (KERN_ERR PFX "%s: cannot remap MMIO, aborting\n", pci_name(pdev));
+                dev_err(&pdev->dev, "cannot remap MMIO, aborting\n");
                 rc = -EIO;
                 goto err_out;
         }
@@ -860,8 +860,7 @@ static int __devinit rtl8139_init_board (struct pci_dev *pdev,
 
         /* check for missing/broken hardware */
         if (RTL_R32 (TxConfig) == 0xFFFFFFFF) {
-                printk (KERN_ERR PFX "%s: Chip not responding, ignoring board\n",
-                        pci_name(pdev));
+                dev_err(&pdev->dev, "Chip not responding, ignoring board\n");
                 rc = -EIO;
                 goto err_out;
         }
@@ -875,9 +874,10 @@ static int __devinit rtl8139_init_board (struct pci_dev *pdev,
                 }
 
         /* if unknown chip, assume array element #0, original RTL-8139 in this case */
-        printk (KERN_DEBUG PFX "%s: unknown chip version, assuming RTL-8139\n",
-                pci_name(pdev));
-        printk (KERN_DEBUG PFX "%s: TxConfig = 0x%lx\n", pci_name(pdev), RTL_R32 (TxConfig));
+        dev_printk (KERN_DEBUG, &pdev->dev,
+                    "unknown chip version, assuming RTL-8139\n");
+        dev_printk (KERN_DEBUG, &pdev->dev,
+                    "TxConfig = 0x%lx\n", RTL_R32 (TxConfig));
         tp->chipset = 0;
 
 match:
@@ -954,9 +954,11 @@ static int __devinit rtl8139_init_one (struct pci_dev *pdev,
 
         if (pdev->vendor == PCI_VENDOR_ID_REALTEK &&
             pdev->device == PCI_DEVICE_ID_REALTEK_8139 && pci_rev >= 0x20) {
-                printk(KERN_INFO PFX "pci dev %s (id %04x:%04x rev %02x) is an enhanced 8139C+ chip\n",
-                       pci_name(pdev), pdev->vendor, pdev->device, pci_rev);
-                printk(KERN_INFO PFX "Use the \"8139cp\" driver for improved performance and stability.\n");
+                dev_info(&pdev->dev,
+                           "This (id %04x:%04x rev %02x) is an enhanced 8139C+ chip\n",
+                           pdev->vendor, pdev->device, pci_rev);
+                dev_info(&pdev->dev,
+                           "Use the \"8139cp\" driver for improved performance and stability.\n");
         }
 
         i = rtl8139_init_board (pdev, &dev);
@@ -1707,6 +1709,7 @@ static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
         void __iomem *ioaddr = tp->mmio_addr;
         unsigned int entry;
         unsigned int len = skb->len;
+        unsigned long flags;
 
         /* Calculate the next Tx descriptor entry. */
         entry = tp->cur_tx % NUM_TX_DESC;
@@ -1723,7 +1726,7 @@ static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
                 return 0;
         }
 
-        spin_lock_irq(&tp->lock);
+        spin_lock_irqsave(&tp->lock, flags);
         RTL_W32_F (TxStatus0 + (entry * sizeof (u32)),
                    tp->tx_flag | max(len, (unsigned int)ETH_ZLEN));
 
@@ -1734,7 +1737,7 @@ static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
 
         if ((tp->cur_tx - NUM_TX_DESC) == tp->dirty_tx)
                 netif_stop_queue (dev);
-        spin_unlock_irq(&tp->lock);
+        spin_unlock_irqrestore(&tp->lock, flags);
 
         if (netif_msg_tx_queued(tp))
                 printk (KERN_DEBUG "%s: Queued Tx packet size %u to slot %d.\n",
diff --git a/drivers/net/82596.c b/drivers/net/82596.c
index 7e2ca9571467..257d3bce3993 100644
--- a/drivers/net/82596.c
+++ b/drivers/net/82596.c
@@ -899,7 +899,7 @@ memory_squeeze:
 }
 
 
-static inline void i596_cleanup_cmd(struct net_device *dev, struct i596_private *lp)
+static void i596_cleanup_cmd(struct net_device *dev, struct i596_private *lp)
 {
         struct i596_cmd *ptr;
 
@@ -932,7 +932,8 @@ static inline void i596_cleanup_cmd(struct net_device *dev, struct i596_private
         lp->scb.cmd = I596_NULL;
 }
 
-static inline void i596_reset(struct net_device *dev, struct i596_private *lp, int ioaddr)
+static void i596_reset(struct net_device *dev, struct i596_private *lp,
+                        int ioaddr)
 {
         unsigned long flags;
 
@@ -1578,7 +1579,7 @@ static int debug = -1;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "i82596 debug mask");
 
-int init_module(void)
+int __init init_module(void)
 {
         if (debug >= 0)
                 i596_debug = debug;
@@ -1588,7 +1589,7 @@ int init_module(void)
         return 0;
 }
 
-void cleanup_module(void)
+void __exit cleanup_module(void)
 {
         unregister_netdev(dev_82596);
 #ifdef __mc68000__
diff --git a/drivers/net/8390.c b/drivers/net/8390.c
index 86be96af9c8f..d2935ae39814 100644
--- a/drivers/net/8390.c
+++ b/drivers/net/8390.c
@@ -249,7 +249,7 @@ void ei_tx_timeout(struct net_device *dev)
 
         /* Ugly but a reset can be slow, yet must be protected */
                 
-        disable_irq_nosync(dev->irq);
+        disable_irq_nosync_lockdep(dev->irq);
         spin_lock(&ei_local->page_lock);
                 
         /* Try to restart the card.  Perhaps the user has fixed something. */
@@ -257,7 +257,7 @@ void ei_tx_timeout(struct net_device *dev)
         NS8390_init(dev, 1);
                 
         spin_unlock(&ei_local->page_lock);
-        enable_irq(dev->irq);
+        enable_irq_lockdep(dev->irq);
         netif_wake_queue(dev);
 }
     
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 39189903e355..a2bd8119270e 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1724,6 +1724,20 @@ config VIA_RHINE_MMIO
 
           If unsure, say Y.
 
+config VIA_RHINE_NAPI
+        bool "Use Rx Polling (NAPI)"
+        depends on VIA_RHINE
+        help
+          NAPI is a new driver API designed to reduce CPU and interrupt load
+          when the driver is receiving lots of packets from the card.
+
+          If your estimated Rx load is 10kpps or more, or if the card will be
+          deployed on potentially unfriendly networks (e.g. in a firewall),
+          then say Y here.
+
+          See <file:Documentation/networking/NAPI_HOWTO.txt> for more
+          information.
+
 config LAN_SAA9730
         bool "Philips SAA9730 Ethernet support (EXPERIMENTAL)"
         depends on NET_PCI && EXPERIMENTAL && MIPS
@@ -2219,6 +2233,33 @@ config GFAR_NAPI
         bool "NAPI Support"
         depends on GIANFAR
 
+config UCC_GETH
+        tristate "Freescale QE UCC GETH"
+        depends on QUICC_ENGINE && UCC_FAST
+        help
+          This driver supports the Gigabit Ethernet mode of QE UCC.
+          QE can be found on MPC836x CPUs.
+
+config UGETH_NAPI
+        bool "NAPI Support"
+        depends on UCC_GETH
+
+config UGETH_MAGIC_PACKET
+        bool "Magic Packet detection support"
+        depends on UCC_GETH
+
+config UGETH_FILTERING
+        bool "Mac address filtering support"
+        depends on UCC_GETH
+
+config UGETH_TX_ON_DEMOND
+        bool "Transmit on Demond support"
+        depends on UCC_GETH
+
+config UGETH_HAS_GIGA
+        bool
+        depends on UCC_GETH && MPC836x
+
 config MV643XX_ETH
         tristate "MV-643XX Ethernet support"
         depends on MOMENCO_OCELOT_C || MOMENCO_JAGUAR_ATX || MV64360 || MOMENCO_OCELOT_3 || PPC_MULTIPLATFORM
@@ -2352,7 +2393,7 @@ config MYRI10GE
           you will need a newer firmware image.
           You may get this image or more information, at:
 
-          <http://www.myri.com/Myri-10G/>
+          <http://www.myri.com/scs/download-Myri10GE.html>
 
           To compile this driver as a module, choose M here and read
           <file:Documentation/networking/net-modules.txt>.  The module
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index c91e95126f78..8427bf9dec9d 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -18,6 +18,9 @@ gianfar_driver-objs := gianfar.o \
                 gianfar_mii.o \
                 gianfar_sysfs.o
 
+obj-$(CONFIG_UCC_GETH) += ucc_geth_driver.o
+ucc_geth_driver-objs := ucc_geth.o ucc_geth_phy.o
+
 #
 # link order important here
 #
diff --git a/drivers/net/ac3200.c b/drivers/net/ac3200.c
index 7952dc6d77e3..0fbbcb75af69 100644
--- a/drivers/net/ac3200.c
+++ b/drivers/net/ac3200.c
@@ -370,8 +370,7 @@ MODULE_PARM_DESC(mem, "Memory base address(es)");
 MODULE_DESCRIPTION("Ansel AC3200 EISA ethernet driver");
 MODULE_LICENSE("GPL");
 
-int
-init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/appletalk/Kconfig b/drivers/net/appletalk/Kconfig
index b14e89004c3a..0a0e0cd81a23 100644
--- a/drivers/net/appletalk/Kconfig
+++ b/drivers/net/appletalk/Kconfig
@@ -29,7 +29,7 @@ config ATALK
           even politically correct people are allowed to say Y here.
 
 config DEV_APPLETALK
-        bool "Appletalk interfaces support"
+        tristate "Appletalk interfaces support"
         depends on ATALK
         help
           AppleTalk is the protocol that Apple computers can use to communicate
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 1d01ac0000e4..ae7f828344d9 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -1030,7 +1030,7 @@ module_param(io, int, 0);
 module_param(irq, int, 0);
 module_param(board_type, int, 0);
 
-int init_module(void)
+int __init init_module(void)
 {
         if (io == 0)
                 printk(KERN_WARNING "%s: You shouldn't autoprobe with insmod\n",
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 5d7929c79bce..4ca061c2d5b2 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -901,7 +901,7 @@ MODULE_PARM_DESC(io, "AT1700/FMV18X I/O base address");
 MODULE_PARM_DESC(irq, "AT1700/FMV18X IRQ number");
 MODULE_PARM_DESC(net_debug, "AT1700/FMV18X debug level (0-6)");
 
-int init_module(void)
+int __init init_module(void)
 {
         if (io == 0)
                 printk("at1700: You should not use auto-probing with insmod!\n");
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index cd98d31dee8c..bea0fc0ede2f 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -2120,13 +2120,14 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         err = pci_enable_device(pdev);
         if (err) {
-                printk(KERN_ERR PFX "Cannot enable PCI device, "
+                dev_err(&pdev->dev, "Cannot enable PCI device, "
                        "aborting.\n");
                 return err;
         }
 
         if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-                printk(KERN_ERR PFX "Cannot find proper PCI device "
+                dev_err(&pdev->dev,
+                        "Cannot find proper PCI device "
                        "base address, aborting.\n");
                 err = -ENODEV;
                 goto err_out_disable_pdev;
@@ -2134,8 +2135,8 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         err = pci_request_regions(pdev, DRV_MODULE_NAME);
         if (err) {
-                printk(KERN_ERR PFX "Cannot obtain PCI resources, "
-                       "aborting.\n");
+                dev_err(&pdev->dev,
+                        "Cannot obtain PCI resources, aborting.\n");
                 goto err_out_disable_pdev;
         }
 
@@ -2143,15 +2144,13 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         err = pci_set_dma_mask(pdev, (u64) B44_DMA_MASK);
         if (err) {
-                printk(KERN_ERR PFX "No usable DMA configuration, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "No usable DMA configuration, aborting.\n");
                 goto err_out_free_res;
         }
 
         err = pci_set_consistent_dma_mask(pdev, (u64) B44_DMA_MASK);
         if (err) {
-                printk(KERN_ERR PFX "No usable DMA configuration, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "No usable DMA configuration, aborting.\n");
                 goto err_out_free_res;
         }
 
@@ -2160,7 +2159,7 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         dev = alloc_etherdev(sizeof(*bp));
         if (!dev) {
-                printk(KERN_ERR PFX "Etherdev alloc failed, aborting.\n");
+                dev_err(&pdev->dev, "Etherdev alloc failed, aborting.\n");
                 err = -ENOMEM;
                 goto err_out_free_res;
         }
@@ -2181,8 +2180,7 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         bp->regs = ioremap(b44reg_base, b44reg_len);
         if (bp->regs == 0UL) {
-                printk(KERN_ERR PFX "Cannot map device registers, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot map device registers, aborting.\n");
                 err = -ENOMEM;
                 goto err_out_free_dev;
         }
@@ -2212,8 +2210,8 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         err = b44_get_invariants(bp);
         if (err) {
-                printk(KERN_ERR PFX "Problem fetching invariants of chip, "
-                       "aborting.\n");
+                dev_err(&pdev->dev,
+                        "Problem fetching invariants of chip, aborting.\n");
                 goto err_out_iounmap;
         }
 
@@ -2233,8 +2231,7 @@ static int __devinit b44_init_one(struct pci_dev *pdev,
 
         err = register_netdev(dev);
         if (err) {
-                printk(KERN_ERR PFX "Cannot register net device, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
                 goto err_out_iounmap;
         }
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 4f4db5ae503b..652eb05a6c2d 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -56,8 +56,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.4.43"
-#define DRV_MODULE_RELDATE      "June 28, 2006"
+#define DRV_MODULE_VERSION      "1.4.44"
+#define DRV_MODULE_RELDATE      "August 10, 2006"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -209,8 +209,10 @@ MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
 static inline u32 bnx2_tx_avail(struct bnx2 *bp)
 {
-        u32 diff = TX_RING_IDX(bp->tx_prod) - TX_RING_IDX(bp->tx_cons);
+        u32 diff;
 
+        smp_mb();
+        diff = TX_RING_IDX(bp->tx_prod) - TX_RING_IDX(bp->tx_cons);
         if (diff > MAX_TX_DESC_CNT)
                 diff = (diff & MAX_TX_DESC_CNT) - 1;
         return (bp->tx_ring_size - diff);
@@ -1569,7 +1571,7 @@ bnx2_alloc_rx_skb(struct bnx2 *bp, u16 index)
         struct rx_bd *rxbd = &bp->rx_desc_ring[RX_RING(index)][RX_IDX(index)];
         unsigned long align;
 
-        skb = dev_alloc_skb(bp->rx_buf_size);
+        skb = netdev_alloc_skb(bp->dev, bp->rx_buf_size);
         if (skb == NULL) {
                 return -ENOMEM;
         }
@@ -1578,7 +1580,6 @@ bnx2_alloc_rx_skb(struct bnx2 *bp, u16 index)
                 skb_reserve(skb, 8 - align);
         }
 
-        skb->dev = bp->dev;
         mapping = pci_map_single(bp->pdev, skb->data, bp->rx_buf_use_size,
                 PCI_DMA_FROMDEVICE);
 
@@ -1639,7 +1640,7 @@ bnx2_tx_int(struct bnx2 *bp)
                 skb = tx_buf->skb;
 #ifdef BCM_TSO 
                 /* partial BD completions possible with TSO packets */
-                if (skb_shinfo(skb)->gso_size) {
+                if (skb_is_gso(skb)) {
                         u16 last_idx, last_ring_idx;
 
                         last_idx = sw_cons +
@@ -1686,15 +1687,20 @@ bnx2_tx_int(struct bnx2 *bp)
         }
 
         bp->tx_cons = sw_cons;
+        /* Need to make the tx_cons update visible to bnx2_start_xmit()
+         * before checking for netif_queue_stopped().  Without the
+         * memory barrier, there is a small possibility that bnx2_start_xmit()
+         * will miss it and cause the queue to be stopped forever.
+         */
+        smp_mb();
 
-        if (unlikely(netif_queue_stopped(bp->dev))) {
-                spin_lock(&bp->tx_lock);
+        if (unlikely(netif_queue_stopped(bp->dev)) &&
+                     (bnx2_tx_avail(bp) > bp->tx_wake_thresh)) {
+                netif_tx_lock(bp->dev);
                 if ((netif_queue_stopped(bp->dev)) &&
-                    (bnx2_tx_avail(bp) > MAX_SKB_FRAGS)) {
-
+                    (bnx2_tx_avail(bp) > bp->tx_wake_thresh))
                         netif_wake_queue(bp->dev);
-                }
-                spin_unlock(&bp->tx_lock);
+                netif_tx_unlock(bp->dev);
         }
 }
 
@@ -1786,7 +1792,7 @@ bnx2_rx_int(struct bnx2 *bp, int budget)
                 if ((bp->dev->mtu > 1500) && (len <= RX_COPY_THRESH)) {
                         struct sk_buff *new_skb;
 
-                        new_skb = dev_alloc_skb(len + 2);
+                        new_skb = netdev_alloc_skb(bp->dev, len + 2);
                         if (new_skb == NULL)
                                 goto reuse_rx;
 
@@ -1797,7 +1803,6 @@ bnx2_rx_int(struct bnx2 *bp, int budget)
 
                         skb_reserve(new_skb, 2);
                         skb_put(new_skb, len);
-                        new_skb->dev = bp->dev;
 
                         bnx2_reuse_rx_skb(bp, skb,
                                 sw_ring_cons, sw_ring_prod);
@@ -3503,6 +3508,8 @@ bnx2_init_tx_ring(struct bnx2 *bp)
         struct tx_bd *txbd;
         u32 val;
 
+        bp->tx_wake_thresh = bp->tx_ring_size / 2;
+
         txbd = &bp->tx_desc_ring[MAX_TX_DESC_CNT];
                 
         txbd->tx_bd_haddr_hi = (u64) bp->tx_desc_mapping >> 32;
@@ -3952,7 +3959,7 @@ bnx2_run_loopback(struct bnx2 *bp, int loopback_mode)
                 return -EINVAL;
 
         pkt_size = 1514;
-        skb = dev_alloc_skb(pkt_size);
+        skb = netdev_alloc_skb(bp->dev, pkt_size);
         if (!skb)
                 return -ENOMEM;
         packet = skb_put(skb, pkt_size);
@@ -4390,10 +4397,8 @@ bnx2_vlan_rx_kill_vid(struct net_device *dev, uint16_t vid)
 #endif
 
 /* Called with netif_tx_lock.
- * hard_start_xmit is pseudo-lockless - a lock is only required when
- * the tx queue is full. This way, we get the benefit of lockless
- * operations most of the time without the complexities to handle
- * netif_stop_queue/wake_queue race conditions.
+ * bnx2_tx_int() runs without netif_tx_lock unless it needs to call
+ * netif_wake_queue().
  */
 static int
 bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -4512,12 +4517,9 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dev->trans_start = jiffies;
 
         if (unlikely(bnx2_tx_avail(bp) <= MAX_SKB_FRAGS)) {
-                spin_lock(&bp->tx_lock);
                 netif_stop_queue(dev);
-                
-                if (bnx2_tx_avail(bp) > MAX_SKB_FRAGS)
+                if (bnx2_tx_avail(bp) > bp->tx_wake_thresh)
                         netif_wake_queue(dev);
-                spin_unlock(&bp->tx_lock);
         }
 
         return NETDEV_TX_OK;
@@ -5575,20 +5577,20 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         /* enable device (incl. PCI PM wakeup), and bus-mastering */
         rc = pci_enable_device(pdev);
         if (rc) {
-                printk(KERN_ERR PFX "Cannot enable PCI device, aborting.");
+                dev_err(&pdev->dev, "Cannot enable PCI device, aborting.");
                 goto err_out;
         }
 
         if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-                printk(KERN_ERR PFX "Cannot find PCI device base address, "
-                       "aborting.\n");
+                dev_err(&pdev->dev,
+                        "Cannot find PCI device base address, aborting.\n");
                 rc = -ENODEV;
                 goto err_out_disable;
         }
 
         rc = pci_request_regions(pdev, DRV_MODULE_NAME);
         if (rc) {
-                printk(KERN_ERR PFX "Cannot obtain PCI resources, aborting.\n");
+                dev_err(&pdev->dev, "Cannot obtain PCI resources, aborting.\n");
                 goto err_out_disable;
         }
 
@@ -5596,15 +5598,15 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
         bp->pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
         if (bp->pm_cap == 0) {
-                printk(KERN_ERR PFX "Cannot find power management capability, "
-                               "aborting.\n");
+                dev_err(&pdev->dev,
+                        "Cannot find power management capability, aborting.\n");
                 rc = -EIO;
                 goto err_out_release;
         }
 
         bp->pcix_cap = pci_find_capability(pdev, PCI_CAP_ID_PCIX);
         if (bp->pcix_cap == 0) {
-                printk(KERN_ERR PFX "Cannot find PCIX capability, aborting.\n");
+                dev_err(&pdev->dev, "Cannot find PCIX capability, aborting.\n");
                 rc = -EIO;
                 goto err_out_release;
         }
@@ -5612,14 +5614,14 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         if (pci_set_dma_mask(pdev, DMA_64BIT_MASK) == 0) {
                 bp->flags |= USING_DAC_FLAG;
                 if (pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK) != 0) {
-                        printk(KERN_ERR PFX "pci_set_consistent_dma_mask "
-                               "failed, aborting.\n");
+                        dev_err(&pdev->dev,
+                                "pci_set_consistent_dma_mask failed, aborting.\n");
                         rc = -EIO;
                         goto err_out_release;
                 }
         }
         else if (pci_set_dma_mask(pdev, DMA_32BIT_MASK) != 0) {
-                printk(KERN_ERR PFX "System does not support DMA, aborting.\n");
+                dev_err(&pdev->dev, "System does not support DMA, aborting.\n");
                 rc = -EIO;
                 goto err_out_release;
         }
@@ -5628,7 +5630,6 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->pdev = pdev;
 
         spin_lock_init(&bp->phy_lock);
-        spin_lock_init(&bp->tx_lock);
         INIT_WORK(&bp->reset_task, bnx2_reset_task, bp);
 
         dev->base_addr = dev->mem_start = pci_resource_start(pdev, 0);
@@ -5639,7 +5640,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->regview = ioremap_nocache(dev->base_addr, mem_len);
 
         if (!bp->regview) {
-                printk(KERN_ERR PFX "Cannot map register space, aborting.\n");
+                dev_err(&pdev->dev, "Cannot map register space, aborting.\n");
                 rc = -ENOMEM;
                 goto err_out_release;
         }
@@ -5711,8 +5712,8 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         else if ((CHIP_ID(bp) == CHIP_ID_5706_A1) &&
                 !(bp->flags & PCIX_FLAG)) {
 
-                printk(KERN_ERR PFX "5706 A1 can only be used in a PCIX bus, "
-                       "aborting.\n");
+                dev_err(&pdev->dev,
+                        "5706 A1 can only be used in a PCIX bus, aborting.\n");
                 goto err_out_unmap;
         }
 
@@ -5733,7 +5734,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
         if ((reg & BNX2_DEV_INFO_SIGNATURE_MAGIC_MASK) !=
             BNX2_DEV_INFO_SIGNATURE_MAGIC) {
-                printk(KERN_ERR PFX "Firmware not running, aborting.\n");
+                dev_err(&pdev->dev, "Firmware not running, aborting.\n");
                 rc = -ENODEV;
                 goto err_out_unmap;
         }
@@ -5751,7 +5752,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->mac_addr[5] = (u8) reg;
 
         bp->tx_ring_size = MAX_TX_DESC_CNT;
-        bnx2_set_rx_ring_size(bp, 100);
+        bnx2_set_rx_ring_size(bp, 255);
 
         bp->rx_csum = 1;
 
@@ -5895,7 +5896,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 #endif
 
         if ((rc = register_netdev(dev))) {
-                printk(KERN_ERR PFX "Cannot register net device\n");
+                dev_err(&pdev->dev, "Cannot register net device\n");
                 if (bp->regview)
                         iounmap(bp->regview);
                 pci_release_regions(pdev);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 658c5ee95c73..fe804763c607 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -3890,10 +3890,6 @@ struct bnx2 {
         u32             tx_prod_bseq __attribute__((aligned(L1_CACHE_BYTES)));
         u16             tx_prod;
 
-        struct tx_bd    *tx_desc_ring;
-        struct sw_bd    *tx_buf_ring;
-        int             tx_ring_size;
-
         u16             tx_cons __attribute__((aligned(L1_CACHE_BYTES)));
         u16             hw_tx_cons;
 
@@ -3916,9 +3912,11 @@ struct bnx2 {
         struct sw_bd            *rx_buf_ring;
         struct rx_bd            *rx_desc_ring[MAX_RX_RINGS];
 
-        /* Only used to synchronize netif_stop_queue/wake_queue when tx */
-        /* ring is full */
-        spinlock_t              tx_lock;
+        /* TX constants */
+        struct tx_bd    *tx_desc_ring;
+        struct sw_bd    *tx_buf_ring;
+        int             tx_ring_size;
+        u32             tx_wake_thresh;
 
         /* End of fields used in the performance code paths. */
 
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index d33130f64700..a31544ccb3c4 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -4887,13 +4887,12 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
 
         err = pci_enable_device(pdev);
         if (err) {
-                printk(KERN_ERR PFX "Cannot enable PCI device, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot enable PCI device, aborting.\n");
                 return err;
         }
 
         if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-                printk(KERN_ERR PFX "Cannot find proper PCI device "
+                dev_err(&pdev->dev, "Cannot find proper PCI device "
                        "base address, aborting.\n");
                 err = -ENODEV;
                 goto err_out_disable_pdev;
@@ -4901,7 +4900,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
 
         dev = alloc_etherdev(sizeof(*cp));
         if (!dev) {
-                printk(KERN_ERR PFX "Etherdev alloc failed, aborting.\n");
+                dev_err(&pdev->dev, "Etherdev alloc failed, aborting.\n");
                 err = -ENOMEM;
                 goto err_out_disable_pdev;
         }
@@ -4910,8 +4909,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
 
         err = pci_request_regions(pdev, dev->name);
         if (err) {
-                printk(KERN_ERR PFX "Cannot obtain PCI resources, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot obtain PCI resources, aborting.\n");
                 goto err_out_free_netdev;
         }
         pci_set_master(pdev);
@@ -4941,7 +4939,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
                 if (pci_write_config_byte(pdev, 
                                           PCI_CACHE_LINE_SIZE, 
                                           cas_cacheline_size)) {
-                        printk(KERN_ERR PFX "Could not set PCI cache "
+                        dev_err(&pdev->dev, "Could not set PCI cache "
                                "line size\n");
                         goto err_write_cacheline;
                 }
@@ -4955,7 +4953,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
                 err = pci_set_consistent_dma_mask(pdev,
                                                   DMA_64BIT_MASK);
                 if (err < 0) {
-                        printk(KERN_ERR PFX "Unable to obtain 64-bit DMA "
+                        dev_err(&pdev->dev, "Unable to obtain 64-bit DMA "
                                "for consistent allocations\n");
                         goto err_out_free_res;
                 }
@@ -4963,7 +4961,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
         } else {
                 err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
                 if (err) {
-                        printk(KERN_ERR PFX "No usable DMA configuration, "
+                        dev_err(&pdev->dev, "No usable DMA configuration, "
                                "aborting.\n");
                         goto err_out_free_res;
                 }
@@ -5023,8 +5021,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
         /* give us access to cassini registers */
         cp->regs = pci_iomap(pdev, 0, casreg_len);
         if (cp->regs == 0UL) {
-                printk(KERN_ERR PFX "Cannot map device registers, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot map device registers, aborting.\n");
                 goto err_out_free_res;
         }
         cp->casreg_len = casreg_len;
@@ -5040,8 +5037,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
                 pci_alloc_consistent(pdev, sizeof(struct cas_init_block),
                                      &cp->block_dvma);
         if (!cp->init_block) {
-                printk(KERN_ERR PFX "Cannot allocate init block, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot allocate init block, aborting.\n");
                 goto err_out_iounmap;
         }
 
@@ -5085,8 +5081,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
                 dev->features |= NETIF_F_HIGHDMA;
 
         if (register_netdev(dev)) {
-                printk(KERN_ERR PFX "Cannot register net device, "
-                       "aborting.\n");
+                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
                 goto err_out_free_consistent;
         }
 
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 87f94d939ff8..61b3754f50ff 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1417,7 +1417,7 @@ int t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct cpl_tx_pkt *cpl;
 
 #ifdef NETIF_F_TSO
-        if (skb_shinfo(skb)->gso_size) {
+        if (skb_is_gso(skb)) {
                 int eth_type;
                 struct cpl_tx_pkt_lso *hdr;
 
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 47eecce35fa4..2dcca79b1f6a 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1905,8 +1905,7 @@ MODULE_LICENSE("GPL");
 
 */
 
-int
-init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev = alloc_etherdev(sizeof(struct net_local));
         struct net_local *lp;
diff --git a/drivers/net/declance.c b/drivers/net/declance.c
index 2038ca7e49ce..6ad5796121c8 100644
--- a/drivers/net/declance.c
+++ b/drivers/net/declance.c
@@ -703,8 +703,8 @@ static irqreturn_t lance_dma_merr_int(const int irq, void *dev_id,
         return IRQ_HANDLED;
 }
 
-static irqreturn_t
-lance_interrupt(const int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t lance_interrupt(const int irq, void *dev_id,
+                                   struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
         struct lance_private *lp = netdev_priv(dev);
@@ -1253,7 +1253,7 @@ static int __init dec_lance_init(const int type, const int slot)
         return 0;
 
 err_out_free_dev:
-        kfree(dev);
+        free_netdev(dev);
 
 err_out:
         return ret;
@@ -1299,6 +1299,7 @@ static void __exit dec_lance_cleanup(void)
         while (root_lance_dev) {
                 struct net_device *dev = root_lance_dev;
                 struct lance_private *lp = netdev_priv(dev);
+
                 unregister_netdev(dev);
 #ifdef CONFIG_TC
                 if (lp->slot >= 0)
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 4b6ddb70f921..402961e68c89 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -9,49 +9,10 @@
     the Free Software Foundation; either version 2 of the License, or
     (at your option) any later version.
 */
-/*
-    Rev         Date            Description
-    ==========================================================================
-    0.01        2001/05/03      Created DL2000-based linux driver
-    0.02        2001/05/21      Added VLAN and hardware checksum support.
-    1.00        2001/06/26      Added jumbo frame support.
-    1.01        2001/08/21      Added two parameters, rx_coalesce and rx_timeout.
-    1.02        2001/10/08      Supported fiber media.
-                                Added flow control parameters.
-    1.03        2001/10/12      Changed the default media to 1000mbps_fd for 
-                                the fiber devices.
-    1.04        2001/11/08      Fixed Tx stopped when tx very busy.
-    1.05        2001/11/22      Fixed Tx stopped when unidirectional tx busy.
-    1.06        2001/12/13      Fixed disconnect bug at 10Mbps mode.
-                                Fixed tx_full flag incorrect.
-                                Added tx_coalesce paramter.
-    1.07        2002/01/03      Fixed miscount of RX frame error.
-    1.08        2002/01/17      Fixed the multicast bug.
-    1.09        2002/03/07      Move rx-poll-now to re-fill loop.       
-                                Added rio_timer() to watch rx buffers. 
-    1.10        2002/04/16      Fixed miscount of carrier error.
-    1.11        2002/05/23      Added ISR schedule scheme
-                                Fixed miscount of rx frame error for DGE-550SX.
-                                Fixed VLAN bug.
-    1.12        2002/06/13      Lock tx_coalesce=1 on 10/100Mbps mode.
-    1.13        2002/08/13      1. Fix disconnection (many tx:carrier/rx:frame
-                                   errs) with some mainboards.
-                                2. Use definition "DRV_NAME" "DRV_VERSION" 
-                                   "DRV_RELDATE" for flexibility.       
-    1.14        2002/08/14      Support ethtool.        
-    1.15        2002/08/27      Changed the default media to Auto-Negotiation
-                                for the fiber devices.    
-    1.16        2002/09/04      More power down time for fiber devices auto-
-                                negotiation.
-                                Fix disconnect bug after ifup and ifdown.
-    1.17        2002/10/03      Fix RMON statistics overflow. 
-                                Always use I/O mapping to access eeprom, 
-                                avoid system freezing with some chipsets.
 
-*/
 #define DRV_NAME        "D-Link DL2000-based linux driver"
-#define DRV_VERSION     "v1.17b"
-#define DRV_RELDATE     "2006/03/10"
+#define DRV_VERSION     "v1.18"
+#define DRV_RELDATE     "2006/06/27"
 #include "dl2k.h"
 #include <linux/dma-mapping.h>
 
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 1b758b707134..a860ebbbf815 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -339,6 +339,17 @@ static void dm9000_timeout(struct net_device *dev)
         spin_unlock_irqrestore(&db->lock,flags);
 }
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/*
+ *Used by netconsole
+ */
+static void dm9000_poll_controller(struct net_device *dev)
+{
+        disable_irq(dev->irq);
+        dm9000_interrupt(dev->irq,dev,NULL);
+        enable_irq(dev->irq);
+}
+#endif
 
 /* dm9000_release_board
  *
@@ -366,8 +377,8 @@ dm9000_release_board(struct platform_device *pdev, struct board_info *db)
                 kfree(db->data_req);
         }
 
-        if (db->addr_res != NULL) {
-                release_resource(db->addr_res);
+        if (db->addr_req != NULL) {
+                release_resource(db->addr_req);
                 kfree(db->addr_req);
         }
 }
@@ -538,6 +549,9 @@ dm9000_probe(struct platform_device *pdev)
         ndev->stop               = &dm9000_stop;
         ndev->get_stats          = &dm9000_get_stats;
         ndev->set_multicast_list = &dm9000_hash_table;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        ndev->poll_controller    = &dm9000_poll_controller;
+#endif
 
 #ifdef DM9000_PROGRAM_EEPROM
         program_eeprom(db);
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 36d511729f71..2146cf74425e 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -132,6 +132,7 @@ static int __init dummy_init_module(void)
         for (i = 0; i < numdummies && !err; i++)
                 err = dummy_init_one(i); 
         if (err) { 
+                i--;
                 while (--i >= 0)
                         dummy_free_one(i);
         }
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 91ef5f2fd768..ce850f1078b5 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -173,8 +173,11 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
 static int debug = 3;
+static int eeprom_bad_csum_allow = 0;
 module_param(debug, int, 0);
+module_param(eeprom_bad_csum_allow, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
+MODULE_PARM_DESC(eeprom_bad_csum_allow, "Allow bad eeprom checksums");
 #define DPRINTK(nlevel, klevel, fmt, args...) \
         (void)((NETIF_MSG_##nlevel & nic->msg_enable) && \
         printk(KERN_##klevel PFX "%s: %s: " fmt, nic->netdev->name, \
@@ -756,7 +759,8 @@ static int e100_eeprom_load(struct nic *nic)
         checksum = le16_to_cpu(0xBABA - checksum);
         if(checksum != nic->eeprom[nic->eeprom_wc - 1]) {
                 DPRINTK(PROBE, ERR, "EEPROM corrupted\n");
-                return -EAGAIN;
+                if (!eeprom_bad_csum_allow)
+                        return -EAGAIN;
         }
 
         return 0;
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 3042d33e2d4d..d304297c496c 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -68,7 +68,6 @@
 #ifdef NETIF_F_TSO
 #include <net/checksum.h>
 #endif
-#include <linux/workqueue.h>
 #include <linux/mii.h>
 #include <linux/ethtool.h>
 #include <linux/if_vlan.h>
@@ -111,6 +110,9 @@ struct e1000_adapter;
 #define E1000_MIN_RXD                       80
 #define E1000_MAX_82544_RXD               4096
 
+/* this is the size past which hardware will drop packets when setting LPE=0 */
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
+
 /* Supported Rx Buffer Sizes */
 #define E1000_RXBUFFER_128   128    /* Used for packet split */
 #define E1000_RXBUFFER_256   256    /* Used for packet split */
@@ -143,6 +145,7 @@ struct e1000_adapter;
 
 #define AUTO_ALL_MODES            0
 #define E1000_EEPROM_82544_APM    0x0004
+#define E1000_EEPROM_ICH8_APME    0x0004
 #define E1000_EEPROM_APME         0x0400
 
 #ifndef E1000_MASTER_SLAVE
@@ -254,7 +257,6 @@ struct e1000_adapter {
         spinlock_t tx_queue_lock;
 #endif
         atomic_t irq_sem;
-        struct work_struct watchdog_task;
         struct work_struct reset_task;
         uint8_t fc_autoneg;
 
@@ -339,8 +341,14 @@ struct e1000_adapter {
 #ifdef NETIF_F_TSO
         boolean_t tso_force;
 #endif
+        boolean_t smart_power_down;     /* phy smart power down */
+        unsigned long flags;
 };
 
+enum e1000_state_t {
+        __E1000_DRIVER_TESTING,
+        __E1000_RESETTING,
+};
 
 /*  e1000_main.c  */
 extern char e1000_driver_name[];
@@ -348,6 +356,7 @@ extern char e1000_driver_version[];
 int e1000_up(struct e1000_adapter *adapter);
 void e1000_down(struct e1000_adapter *adapter);
 void e1000_reset(struct e1000_adapter *adapter);
+void e1000_reinit_locked(struct e1000_adapter *adapter);
 int e1000_setup_all_tx_resources(struct e1000_adapter *adapter);
 void e1000_free_all_tx_resources(struct e1000_adapter *adapter);
 int e1000_setup_all_rx_resources(struct e1000_adapter *adapter);
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index d19664891768..88a82ba88f57 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -109,7 +109,8 @@ e1000_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
                                    SUPPORTED_1000baseT_Full|
                                    SUPPORTED_Autoneg |
                                    SUPPORTED_TP);
-
+                if (hw->phy_type == e1000_phy_ife)
+                        ecmd->supported &= ~SUPPORTED_1000baseT_Full;
                 ecmd->advertising = ADVERTISED_TP;
 
                 if (hw->autoneg == 1) {
@@ -203,11 +204,9 @@ e1000_set_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
 
         /* reset the link */
 
-        if (netif_running(adapter->netdev)) {
-                e1000_down(adapter);
-                e1000_reset(adapter);
-                e1000_up(adapter);
-        } else
+        if (netif_running(adapter->netdev))
+                e1000_reinit_locked(adapter);
+        else
                 e1000_reset(adapter);
 
         return 0;
@@ -254,10 +253,9 @@ e1000_set_pauseparam(struct net_device *netdev,
         hw->original_fc = hw->fc;
 
         if (adapter->fc_autoneg == AUTONEG_ENABLE) {
-                if (netif_running(adapter->netdev)) {
-                        e1000_down(adapter);
-                        e1000_up(adapter);
-                } else
+                if (netif_running(adapter->netdev))
+                        e1000_reinit_locked(adapter);
+                else
                         e1000_reset(adapter);
         } else
                 return ((hw->media_type == e1000_media_type_fiber) ?
@@ -279,10 +277,9 @@ e1000_set_rx_csum(struct net_device *netdev, uint32_t data)
         struct e1000_adapter *adapter = netdev_priv(netdev);
         adapter->rx_csum = data;
 
-        if (netif_running(netdev)) {
-                e1000_down(adapter);
-                e1000_up(adapter);
-        } else
+        if (netif_running(netdev))
+                e1000_reinit_locked(adapter);
+        else
                 e1000_reset(adapter);
         return 0;
 }
@@ -577,6 +574,7 @@ e1000_get_drvinfo(struct net_device *netdev,
         case e1000_82572:
         case e1000_82573:
         case e1000_80003es2lan:
+        case e1000_ich8lan:
                 sprintf(firmware_version, "%d.%d-%d",
                         (eeprom_data & 0xF000) >> 12,
                         (eeprom_data & 0x0FF0) >> 4,
@@ -631,6 +629,9 @@ e1000_set_ringparam(struct net_device *netdev,
         tx_ring_size = sizeof(struct e1000_tx_ring) * adapter->num_tx_queues;
         rx_ring_size = sizeof(struct e1000_rx_ring) * adapter->num_rx_queues;
 
+        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+                msleep(1);
+
         if (netif_running(adapter->netdev))
                 e1000_down(adapter);
 
@@ -691,9 +692,11 @@ e1000_set_ringparam(struct net_device *netdev,
                 adapter->rx_ring = rx_new;
                 adapter->tx_ring = tx_new;
                 if ((err = e1000_up(adapter)))
-                        return err;
+                        goto err_setup;
         }
 
+        clear_bit(__E1000_RESETTING, &adapter->flags);
+
         return 0;
 err_setup_tx:
         e1000_free_all_rx_resources(adapter);
@@ -701,6 +704,8 @@ err_setup_rx:
         adapter->rx_ring = rx_old;
         adapter->tx_ring = tx_old;
         e1000_up(adapter);
+err_setup:
+        clear_bit(__E1000_RESETTING, &adapter->flags);
         return err;
 }
 
@@ -754,6 +759,7 @@ e1000_reg_test(struct e1000_adapter *adapter, uint64_t *data)
                 toggle = 0x7FFFF3FF;
                 break;
         case e1000_82573:
+        case e1000_ich8lan:
                 toggle = 0x7FFFF033;
                 break;
         default:
@@ -773,11 +779,12 @@ e1000_reg_test(struct e1000_adapter *adapter, uint64_t *data)
         }
         /* restore previous status */
         E1000_WRITE_REG(&adapter->hw, STATUS, before);
-
-        REG_PATTERN_TEST(FCAL, 0xFFFFFFFF, 0xFFFFFFFF);
-        REG_PATTERN_TEST(FCAH, 0x0000FFFF, 0xFFFFFFFF);
-        REG_PATTERN_TEST(FCT, 0x0000FFFF, 0xFFFFFFFF);
-        REG_PATTERN_TEST(VET, 0x0000FFFF, 0xFFFFFFFF);
+        if (adapter->hw.mac_type != e1000_ich8lan) {
+                REG_PATTERN_TEST(FCAL, 0xFFFFFFFF, 0xFFFFFFFF);
+                REG_PATTERN_TEST(FCAH, 0x0000FFFF, 0xFFFFFFFF);
+                REG_PATTERN_TEST(FCT, 0x0000FFFF, 0xFFFFFFFF);
+                REG_PATTERN_TEST(VET, 0x0000FFFF, 0xFFFFFFFF);
+        }
         REG_PATTERN_TEST(RDTR, 0x0000FFFF, 0xFFFFFFFF);
         REG_PATTERN_TEST(RDBAH, 0xFFFFFFFF, 0xFFFFFFFF);
         REG_PATTERN_TEST(RDLEN, 0x000FFF80, 0x000FFFFF);
@@ -790,20 +797,22 @@ e1000_reg_test(struct e1000_adapter *adapter, uint64_t *data)
         REG_PATTERN_TEST(TDLEN, 0x000FFF80, 0x000FFFFF);
 
         REG_SET_AND_CHECK(RCTL, 0xFFFFFFFF, 0x00000000);
-        REG_SET_AND_CHECK(RCTL, 0x06DFB3FE, 0x003FFFFB);
+        before = (adapter->hw.mac_type == e1000_ich8lan ?
+                        0x06C3B33E : 0x06DFB3FE);
+        REG_SET_AND_CHECK(RCTL, before, 0x003FFFFB);
         REG_SET_AND_CHECK(TCTL, 0xFFFFFFFF, 0x00000000);
 
         if (adapter->hw.mac_type >= e1000_82543) {
 
-                REG_SET_AND_CHECK(RCTL, 0x06DFB3FE, 0xFFFFFFFF);
+                REG_SET_AND_CHECK(RCTL, before, 0xFFFFFFFF);
                 REG_PATTERN_TEST(RDBAL, 0xFFFFFFF0, 0xFFFFFFFF);
-                REG_PATTERN_TEST(TXCW, 0xC000FFFF, 0x0000FFFF);
+                if (adapter->hw.mac_type != e1000_ich8lan)
+                        REG_PATTERN_TEST(TXCW, 0xC000FFFF, 0x0000FFFF);
                 REG_PATTERN_TEST(TDBAL, 0xFFFFFFF0, 0xFFFFFFFF);
                 REG_PATTERN_TEST(TIDV, 0x0000FFFF, 0x0000FFFF);
-
-                for (i = 0; i < E1000_RAR_ENTRIES; i++) {
-                        REG_PATTERN_TEST(RA + ((i << 1) << 2), 0xFFFFFFFF,
-                                         0xFFFFFFFF);
+                value = (adapter->hw.mac_type == e1000_ich8lan ?
+                                E1000_RAR_ENTRIES_ICH8LAN : E1000_RAR_ENTRIES);
+                for (i = 0; i < value; i++) {
                         REG_PATTERN_TEST(RA + (((i << 1) + 1) << 2), 0x8003FFFF,
                                          0xFFFFFFFF);
                 }
@@ -817,7 +826,9 @@ e1000_reg_test(struct e1000_adapter *adapter, uint64_t *data)
 
         }
 
-        for (i = 0; i < E1000_MC_TBL_SIZE; i++)
+        value = (adapter->hw.mac_type == e1000_ich8lan ?
+                        E1000_MC_TBL_SIZE_ICH8LAN : E1000_MC_TBL_SIZE);
+        for (i = 0; i < value; i++)
                 REG_PATTERN_TEST(MTA + (i << 2), 0xFFFFFFFF, 0xFFFFFFFF);
 
         *data = 0;
@@ -889,6 +900,8 @@ e1000_intr_test(struct e1000_adapter *adapter, uint64_t *data)
         /* Test each interrupt */
         for (; i < 10; i++) {
 
+                if (adapter->hw.mac_type == e1000_ich8lan && i == 8)
+                        continue;
                 /* Interrupt to test */
                 mask = 1 << i;
 
@@ -1246,18 +1259,33 @@ e1000_integrated_phy_loopback(struct e1000_adapter *adapter)
         } else if (adapter->hw.phy_type == e1000_phy_gg82563) {
                 e1000_write_phy_reg(&adapter->hw,
                                     GG82563_PHY_KMRN_MODE_CTRL,
-                                    0x1CE);
+                                    0x1CC);
         }
-        /* force 1000, set loopback */
-        e1000_write_phy_reg(&adapter->hw, PHY_CTRL, 0x4140);
 
-        /* Now set up the MAC to the same speed/duplex as the PHY. */
         ctrl_reg = E1000_READ_REG(&adapter->hw, CTRL);
-        ctrl_reg &= ~E1000_CTRL_SPD_SEL; /* Clear the speed sel bits */
-        ctrl_reg |= (E1000_CTRL_FRCSPD | /* Set the Force Speed Bit */
-                     E1000_CTRL_FRCDPX | /* Set the Force Duplex Bit */
-                     E1000_CTRL_SPD_1000 |/* Force Speed to 1000 */
-                     E1000_CTRL_FD);     /* Force Duplex to FULL */
+
+        if (adapter->hw.phy_type == e1000_phy_ife) {
+                /* force 100, set loopback */
+                e1000_write_phy_reg(&adapter->hw, PHY_CTRL, 0x6100);
+
+                /* Now set up the MAC to the same speed/duplex as the PHY. */
+                ctrl_reg &= ~E1000_CTRL_SPD_SEL; /* Clear the speed sel bits */
+                ctrl_reg |= (E1000_CTRL_FRCSPD | /* Set the Force Speed Bit */
+                             E1000_CTRL_FRCDPX | /* Set the Force Duplex Bit */
+                             E1000_CTRL_SPD_100 |/* Force Speed to 100 */
+                             E1000_CTRL_FD);     /* Force Duplex to FULL */
+        } else {
+                /* force 1000, set loopback */
+                e1000_write_phy_reg(&adapter->hw, PHY_CTRL, 0x4140);
+
+                /* Now set up the MAC to the same speed/duplex as the PHY. */
+                ctrl_reg = E1000_READ_REG(&adapter->hw, CTRL);
+                ctrl_reg &= ~E1000_CTRL_SPD_SEL; /* Clear the speed sel bits */
+                ctrl_reg |= (E1000_CTRL_FRCSPD | /* Set the Force Speed Bit */
+                             E1000_CTRL_FRCDPX | /* Set the Force Duplex Bit */
+                             E1000_CTRL_SPD_1000 |/* Force Speed to 1000 */
+                             E1000_CTRL_FD);     /* Force Duplex to FULL */
+        }
 
         if (adapter->hw.media_type == e1000_media_type_copper &&
            adapter->hw.phy_type == e1000_phy_m88) {
@@ -1317,6 +1345,7 @@ e1000_set_phy_loopback(struct e1000_adapter *adapter)
         case e1000_82572:
         case e1000_82573:
         case e1000_80003es2lan:
+        case e1000_ich8lan:
                 return e1000_integrated_phy_loopback(adapter);
                 break;
 
@@ -1568,6 +1597,7 @@ e1000_diag_test(struct net_device *netdev,
         struct e1000_adapter *adapter = netdev_priv(netdev);
         boolean_t if_running = netif_running(netdev);
 
+        set_bit(__E1000_DRIVER_TESTING, &adapter->flags);
         if (eth_test->flags == ETH_TEST_FL_OFFLINE) {
                 /* Offline tests */
 
@@ -1582,7 +1612,8 @@ e1000_diag_test(struct net_device *netdev,
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
                 if (if_running)
-                        e1000_down(adapter);
+                        /* indicate we're in test mode */
+                        dev_close(netdev);
                 else
                         e1000_reset(adapter);
 
@@ -1607,8 +1638,9 @@ e1000_diag_test(struct net_device *netdev,
                 adapter->hw.autoneg = autoneg;
 
                 e1000_reset(adapter);
+                clear_bit(__E1000_DRIVER_TESTING, &adapter->flags);
                 if (if_running)
-                        e1000_up(adapter);
+                        dev_open(netdev);
         } else {
                 /* Online tests */
                 if (e1000_link_test(adapter, &data[4]))
@@ -1619,6 +1651,8 @@ e1000_diag_test(struct net_device *netdev,
                 data[1] = 0;
                 data[2] = 0;
                 data[3] = 0;
+
+                clear_bit(__E1000_DRIVER_TESTING, &adapter->flags);
         }
         msleep_interruptible(4 * 1000);
 }
@@ -1778,21 +1812,18 @@ e1000_phys_id(struct net_device *netdev, uint32_t data)
                 mod_timer(&adapter->blink_timer, jiffies);
                 msleep_interruptible(data * 1000);
                 del_timer_sync(&adapter->blink_timer);
-        } else if (adapter->hw.mac_type < e1000_82573) {
-                E1000_WRITE_REG(&adapter->hw, LEDCTL,
-                        (E1000_LEDCTL_LED2_BLINK_RATE |
-                         E1000_LEDCTL_LED0_BLINK | E1000_LEDCTL_LED2_BLINK |
-                         (E1000_LEDCTL_MODE_LED_ON << E1000_LEDCTL_LED2_MODE_SHIFT) |
-                         (E1000_LEDCTL_MODE_LINK_ACTIVITY << E1000_LEDCTL_LED0_MODE_SHIFT) |
-                         (E1000_LEDCTL_MODE_LED_OFF << E1000_LEDCTL_LED1_MODE_SHIFT)));
+        } else if (adapter->hw.phy_type == e1000_phy_ife) {
+                if (!adapter->blink_timer.function) {
+                        init_timer(&adapter->blink_timer);
+                        adapter->blink_timer.function = e1000_led_blink_callback;
+                        adapter->blink_timer.data = (unsigned long) adapter;
+                }
+                mod_timer(&adapter->blink_timer, jiffies);
                 msleep_interruptible(data * 1000);
+                del_timer_sync(&adapter->blink_timer);
+                e1000_write_phy_reg(&(adapter->hw), IFE_PHY_SPECIAL_CONTROL_LED, 0);
         } else {
-                E1000_WRITE_REG(&adapter->hw, LEDCTL,
-                        (E1000_LEDCTL_LED2_BLINK_RATE |
-                         E1000_LEDCTL_LED1_BLINK | E1000_LEDCTL_LED2_BLINK |
-                         (E1000_LEDCTL_MODE_LED_ON << E1000_LEDCTL_LED2_MODE_SHIFT) |
-                         (E1000_LEDCTL_MODE_LINK_ACTIVITY << E1000_LEDCTL_LED1_MODE_SHIFT) |
-                         (E1000_LEDCTL_MODE_LED_OFF << E1000_LEDCTL_LED0_MODE_SHIFT)));
+                e1000_blink_led_start(&adapter->hw);
                 msleep_interruptible(data * 1000);
         }
 
@@ -1807,10 +1838,8 @@ static int
 e1000_nway_reset(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
-        if (netif_running(netdev)) {
-                e1000_down(adapter);
-                e1000_up(adapter);
-        }
+        if (netif_running(netdev))
+                e1000_reinit_locked(adapter);
         return 0;
 }
 
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 3959039b16ec..b3b919116e0f 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -101,9 +101,37 @@ static void e1000_write_reg_io(struct e1000_hw *hw, uint32_t offset,
 
 #define E1000_WRITE_REG_IO(a, reg, val) \
             e1000_write_reg_io((a), E1000_##reg, val)
-static int32_t e1000_configure_kmrn_for_10_100(struct e1000_hw *hw);
+static int32_t e1000_configure_kmrn_for_10_100(struct e1000_hw *hw,
+                                               uint16_t duplex);
 static int32_t e1000_configure_kmrn_for_1000(struct e1000_hw *hw);
 
+static int32_t e1000_erase_ich8_4k_segment(struct e1000_hw *hw,
+                                           uint32_t segment);
+static int32_t e1000_get_software_flag(struct e1000_hw *hw);
+static int32_t e1000_get_software_semaphore(struct e1000_hw *hw);
+static int32_t e1000_init_lcd_from_nvm(struct e1000_hw *hw);
+static int32_t e1000_kumeran_lock_loss_workaround(struct e1000_hw *hw);
+static int32_t e1000_read_eeprom_ich8(struct e1000_hw *hw, uint16_t offset,
+                                      uint16_t words, uint16_t *data);
+static int32_t e1000_read_ich8_byte(struct e1000_hw *hw, uint32_t index,
+                                    uint8_t* data);
+static int32_t e1000_read_ich8_word(struct e1000_hw *hw, uint32_t index,
+                                    uint16_t *data);
+static int32_t e1000_read_kmrn_reg(struct e1000_hw *hw, uint32_t reg_addr,
+                                   uint16_t *data);
+static void e1000_release_software_flag(struct e1000_hw *hw);
+static void e1000_release_software_semaphore(struct e1000_hw *hw);
+static int32_t e1000_set_pci_ex_no_snoop(struct e1000_hw *hw,
+                                         uint32_t no_snoop);
+static int32_t e1000_verify_write_ich8_byte(struct e1000_hw *hw,
+                                            uint32_t index, uint8_t byte);
+static int32_t e1000_write_eeprom_ich8(struct e1000_hw *hw, uint16_t offset,
+                                       uint16_t words, uint16_t *data);
+static int32_t e1000_write_ich8_byte(struct e1000_hw *hw, uint32_t index,
+                                     uint8_t data);
+static int32_t e1000_write_kmrn_reg(struct e1000_hw *hw, uint32_t reg_addr,
+                                    uint16_t data);
+
 /* IGP cable length table */
 static const
 uint16_t e1000_igp_cable_length_table[IGP01E1000_AGC_LENGTH_TABLE_SIZE] =
@@ -156,6 +184,14 @@ e1000_set_phy_type(struct e1000_hw *hw)
             hw->phy_type = e1000_phy_igp;
             break;
         }
+    case IGP03E1000_E_PHY_ID:
+        hw->phy_type = e1000_phy_igp_3;
+        break;
+    case IFE_E_PHY_ID:
+    case IFE_PLUS_E_PHY_ID:
+    case IFE_C_E_PHY_ID:
+        hw->phy_type = e1000_phy_ife;
+        break;
     case GG82563_E_PHY_ID:
         if (hw->mac_type == e1000_80003es2lan) {
             hw->phy_type = e1000_phy_gg82563;
@@ -332,6 +368,7 @@ e1000_set_mac_type(struct e1000_hw *hw)
         break;
     case E1000_DEV_ID_82541EI:
     case E1000_DEV_ID_82541EI_MOBILE:
+    case E1000_DEV_ID_82541ER_LOM:
         hw->mac_type = e1000_82541;
         break;
     case E1000_DEV_ID_82541ER:
@@ -341,6 +378,7 @@ e1000_set_mac_type(struct e1000_hw *hw)
         hw->mac_type = e1000_82541_rev_2;
         break;
     case E1000_DEV_ID_82547EI:
+    case E1000_DEV_ID_82547EI_MOBILE:
         hw->mac_type = e1000_82547;
         break;
     case E1000_DEV_ID_82547GI:
@@ -354,6 +392,7 @@ e1000_set_mac_type(struct e1000_hw *hw)
     case E1000_DEV_ID_82572EI_COPPER:
     case E1000_DEV_ID_82572EI_FIBER:
     case E1000_DEV_ID_82572EI_SERDES:
+    case E1000_DEV_ID_82572EI:
         hw->mac_type = e1000_82572;
         break;
     case E1000_DEV_ID_82573E:
@@ -361,16 +400,29 @@ e1000_set_mac_type(struct e1000_hw *hw)
     case E1000_DEV_ID_82573L:
         hw->mac_type = e1000_82573;
         break;
+    case E1000_DEV_ID_80003ES2LAN_COPPER_SPT:
+    case E1000_DEV_ID_80003ES2LAN_SERDES_SPT:
     case E1000_DEV_ID_80003ES2LAN_COPPER_DPT:
     case E1000_DEV_ID_80003ES2LAN_SERDES_DPT:
         hw->mac_type = e1000_80003es2lan;
         break;
+    case E1000_DEV_ID_ICH8_IGP_M_AMT:
+    case E1000_DEV_ID_ICH8_IGP_AMT:
+    case E1000_DEV_ID_ICH8_IGP_C:
+    case E1000_DEV_ID_ICH8_IFE:
+    case E1000_DEV_ID_ICH8_IGP_M:
+        hw->mac_type = e1000_ich8lan;
+        break;
     default:
         /* Should never have loaded on this device */
         return -E1000_ERR_MAC_TYPE;
     }
 
     switch(hw->mac_type) {
+    case e1000_ich8lan:
+        hw->swfwhw_semaphore_present = TRUE;
+        hw->asf_firmware_present = TRUE;
+        break;
     case e1000_80003es2lan:
         hw->swfw_sync_present = TRUE;
         /* fall through */
@@ -423,6 +475,7 @@ e1000_set_media_type(struct e1000_hw *hw)
         case e1000_82542_rev2_1:
             hw->media_type = e1000_media_type_fiber;
             break;
+        case e1000_ich8lan:
         case e1000_82573:
             /* The STATUS_TBIMODE bit is reserved or reused for the this
              * device.
@@ -527,6 +580,14 @@ e1000_reset_hw(struct e1000_hw *hw)
         } while(timeout);
     }
 
+    /* Workaround for ICH8 bit corruption issue in FIFO memory */
+    if (hw->mac_type == e1000_ich8lan) {
+        /* Set Tx and Rx buffer allocation to 8k apiece. */
+        E1000_WRITE_REG(hw, PBA, E1000_PBA_8K);
+        /* Set Packet Buffer Size to 16k. */
+        E1000_WRITE_REG(hw, PBS, E1000_PBS_16K);
+    }
+
     /* Issue a global reset to the MAC.  This will reset the chip's
      * transmit, receive, DMA, and link units.  It will not effect
      * the current PCI configuration.  The global reset bit is self-
@@ -550,6 +611,20 @@ e1000_reset_hw(struct e1000_hw *hw)
             /* Reset is performed on a shadow of the control register */
             E1000_WRITE_REG(hw, CTRL_DUP, (ctrl | E1000_CTRL_RST));
             break;
+        case e1000_ich8lan:
+            if (!hw->phy_reset_disable &&
+                e1000_check_phy_reset_block(hw) == E1000_SUCCESS) {
+                /* e1000_ich8lan PHY HW reset requires MAC CORE reset
+                 * at the same time to make sure the interface between
+                 * MAC and the external PHY is reset.
+                 */
+                ctrl |= E1000_CTRL_PHY_RST;
+            }
+
+            e1000_get_software_flag(hw);
+            E1000_WRITE_REG(hw, CTRL, (ctrl | E1000_CTRL_RST));
+            msec_delay(5);
+            break;
         default:
             E1000_WRITE_REG(hw, CTRL, (ctrl | E1000_CTRL_RST));
             break;
@@ -591,6 +666,7 @@ e1000_reset_hw(struct e1000_hw *hw)
             /* fall through */
         case e1000_82571:
         case e1000_82572:
+        case e1000_ich8lan:
         case e1000_80003es2lan:
             ret_val = e1000_get_auto_rd_done(hw);
             if(ret_val)
@@ -633,6 +709,12 @@ e1000_reset_hw(struct e1000_hw *hw)
             e1000_pci_set_mwi(hw);
     }
 
+    if (hw->mac_type == e1000_ich8lan) {
+        uint32_t kab = E1000_READ_REG(hw, KABGTXD);
+        kab |= E1000_KABGTXD_BGSQLBIAS;
+        E1000_WRITE_REG(hw, KABGTXD, kab);
+    }
+
     return E1000_SUCCESS;
 }
 
@@ -675,9 +757,12 @@ e1000_init_hw(struct e1000_hw *hw)
 
     /* Disabling VLAN filtering. */
     DEBUGOUT("Initializing the IEEE VLAN\n");
-    if (hw->mac_type < e1000_82545_rev_3)
-        E1000_WRITE_REG(hw, VET, 0);
-    e1000_clear_vfta(hw);
+    /* VET hardcoded to standard value and VFTA removed in ICH8 LAN */
+    if (hw->mac_type != e1000_ich8lan) {
+        if (hw->mac_type < e1000_82545_rev_3)
+            E1000_WRITE_REG(hw, VET, 0);
+        e1000_clear_vfta(hw);
+    }
 
     /* For 82542 (rev 2.0), disable MWI and put the receiver into reset */
     if(hw->mac_type == e1000_82542_rev2_0) {
@@ -705,8 +790,14 @@ e1000_init_hw(struct e1000_hw *hw)
     /* Zero out the Multicast HASH table */
     DEBUGOUT("Zeroing the MTA\n");
     mta_size = E1000_MC_TBL_SIZE;
-    for(i = 0; i < mta_size; i++)
+    if (hw->mac_type == e1000_ich8lan)
+        mta_size = E1000_MC_TBL_SIZE_ICH8LAN;
+    for(i = 0; i < mta_size; i++) {
         E1000_WRITE_REG_ARRAY(hw, MTA, i, 0);
+        /* use write flush to prevent Memory Write Block (MWB) from
+         * occuring when accessing our register space */
+        E1000_WRITE_FLUSH(hw);
+    }
 
     /* Set the PCI priority bit correctly in the CTRL register.  This
      * determines if the adapter gives priority to receives, or if it
@@ -744,6 +835,10 @@ e1000_init_hw(struct e1000_hw *hw)
         break;
     }
 
+    /* More time needed for PHY to initialize */
+    if (hw->mac_type == e1000_ich8lan)
+        msec_delay(15);
+
     /* Call a subroutine to configure the link and setup flow control. */
     ret_val = e1000_setup_link(hw);
 
@@ -757,6 +852,7 @@ e1000_init_hw(struct e1000_hw *hw)
         case e1000_82571:
         case e1000_82572:
         case e1000_82573:
+        case e1000_ich8lan:
         case e1000_80003es2lan:
             ctrl |= E1000_TXDCTL_COUNT_DESC;
             break;
@@ -795,6 +891,7 @@ e1000_init_hw(struct e1000_hw *hw)
         /* Fall through */
     case e1000_82571:
     case e1000_82572:
+    case e1000_ich8lan:
         ctrl = E1000_READ_REG(hw, TXDCTL1);
         ctrl = (ctrl & ~E1000_TXDCTL_WTHRESH) | E1000_TXDCTL_FULL_TX_DESC_WB;
         if(hw->mac_type >= e1000_82571)
@@ -818,6 +915,11 @@ e1000_init_hw(struct e1000_hw *hw)
      */
     e1000_clear_hw_cntrs(hw);
 
+    /* ICH8 No-snoop bits are opposite polarity.
+     * Set to snoop by default after reset. */
+    if (hw->mac_type == e1000_ich8lan)
+        e1000_set_pci_ex_no_snoop(hw, PCI_EX_82566_SNOOP_ALL);
+
     if (hw->device_id == E1000_DEV_ID_82546GB_QUAD_COPPER ||
         hw->device_id == E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3) {
         ctrl_ext = E1000_READ_REG(hw, CTRL_EXT);
@@ -905,6 +1007,7 @@ e1000_setup_link(struct e1000_hw *hw)
      */
     if (hw->fc == e1000_fc_default) {
         switch (hw->mac_type) {
+        case e1000_ich8lan:
         case e1000_82573:
             hw->fc = e1000_fc_full;
             break;
@@ -971,9 +1074,12 @@ e1000_setup_link(struct e1000_hw *hw)
      */
     DEBUGOUT("Initializing the Flow Control address, type and timer regs\n");
 
-    E1000_WRITE_REG(hw, FCAL, FLOW_CONTROL_ADDRESS_LOW);
-    E1000_WRITE_REG(hw, FCAH, FLOW_CONTROL_ADDRESS_HIGH);
-    E1000_WRITE_REG(hw, FCT, FLOW_CONTROL_TYPE);
+    /* FCAL/H and FCT are hardcoded to standard values in e1000_ich8lan. */
+    if (hw->mac_type != e1000_ich8lan) {
+        E1000_WRITE_REG(hw, FCT, FLOW_CONTROL_TYPE);
+        E1000_WRITE_REG(hw, FCAH, FLOW_CONTROL_ADDRESS_HIGH);
+        E1000_WRITE_REG(hw, FCAL, FLOW_CONTROL_ADDRESS_LOW);
+    }
 
     E1000_WRITE_REG(hw, FCTTV, hw->fc_pause_time);
 
@@ -1237,12 +1343,13 @@ e1000_copper_link_igp_setup(struct e1000_hw *hw)
 
     /* Wait 10ms for MAC to configure PHY from eeprom settings */
     msec_delay(15);
-
+    if (hw->mac_type != e1000_ich8lan) {
     /* Configure activity LED after PHY reset */
     led_ctrl = E1000_READ_REG(hw, LEDCTL);
     led_ctrl &= IGP_ACTIVITY_LED_MASK;
     led_ctrl |= (IGP_ACTIVITY_LED_ENABLE | IGP_LED3_MODE);
     E1000_WRITE_REG(hw, LEDCTL, led_ctrl);
+    }
 
     /* disable lplu d3 during driver init */
     ret_val = e1000_set_d3_lplu_state(hw, FALSE);
@@ -1478,8 +1585,7 @@ e1000_copper_link_ggp_setup(struct e1000_hw *hw)
             if (ret_val)
                 return ret_val;
 
-            /* Enable Pass False Carrier on the PHY */
-            phy_data |= GG82563_KMCR_PASS_FALSE_CARRIER;
+            phy_data &= ~GG82563_KMCR_PASS_FALSE_CARRIER;
 
             ret_val = e1000_write_phy_reg(hw, GG82563_PHY_KMRN_MODE_CTRL,
                                           phy_data);
@@ -1561,28 +1667,40 @@ e1000_copper_link_mgp_setup(struct e1000_hw *hw)
     phy_data &= ~M88E1000_PSCR_POLARITY_REVERSAL;
     if(hw->disable_polarity_correction == 1)
         phy_data |= M88E1000_PSCR_POLARITY_REVERSAL;
-        ret_val = e1000_write_phy_reg(hw, M88E1000_PHY_SPEC_CTRL, phy_data);
-        if(ret_val)
-            return ret_val;
-
-    /* Force TX_CLK in the Extended PHY Specific Control Register
-     * to 25MHz clock.
-     */
-    ret_val = e1000_read_phy_reg(hw, M88E1000_EXT_PHY_SPEC_CTRL, &phy_data);
-    if(ret_val)
+    ret_val = e1000_write_phy_reg(hw, M88E1000_PHY_SPEC_CTRL, phy_data);
+    if (ret_val)
         return ret_val;
 
-    phy_data |= M88E1000_EPSCR_TX_CLK_25;
-
     if (hw->phy_revision < M88E1011_I_REV_4) {
-        /* Configure Master and Slave downshift values */
-        phy_data &= ~(M88E1000_EPSCR_MASTER_DOWNSHIFT_MASK |
+        /* Force TX_CLK in the Extended PHY Specific Control Register
+         * to 25MHz clock.
+         */
+        ret_val = e1000_read_phy_reg(hw, M88E1000_EXT_PHY_SPEC_CTRL, &phy_data);
+        if (ret_val)
+            return ret_val;
+
+        phy_data |= M88E1000_EPSCR_TX_CLK_25;
+
+        if ((hw->phy_revision == E1000_REVISION_2) &&
+            (hw->phy_id == M88E1111_I_PHY_ID)) {
+            /* Vidalia Phy, set the downshift counter to 5x */
+            phy_data &= ~(M88EC018_EPSCR_DOWNSHIFT_COUNTER_MASK);
+            phy_data |= M88EC018_EPSCR_DOWNSHIFT_COUNTER_5X;
+            ret_val = e1000_write_phy_reg(hw,
+                                        M88E1000_EXT_PHY_SPEC_CTRL, phy_data);
+            if (ret_val)
+                return ret_val;
+        } else {
+            /* Configure Master and Slave downshift values */
+            phy_data &= ~(M88E1000_EPSCR_MASTER_DOWNSHIFT_MASK |
                               M88E1000_EPSCR_SLAVE_DOWNSHIFT_MASK);
-        phy_data |= (M88E1000_EPSCR_MASTER_DOWNSHIFT_1X |
+            phy_data |= (M88E1000_EPSCR_MASTER_DOWNSHIFT_1X |
                              M88E1000_EPSCR_SLAVE_DOWNSHIFT_1X);
-        ret_val = e1000_write_phy_reg(hw, M88E1000_EXT_PHY_SPEC_CTRL, phy_data);
-        if(ret_val)
-            return ret_val;
+            ret_val = e1000_write_phy_reg(hw,
+                                        M88E1000_EXT_PHY_SPEC_CTRL, phy_data);
+            if (ret_val)
+               return ret_val;
+        }
     }
 
     /* SW Reset the PHY so all changes take effect */
@@ -1620,6 +1738,10 @@ e1000_copper_link_autoneg(struct e1000_hw *hw)
     if(hw->autoneg_advertised == 0)
         hw->autoneg_advertised = AUTONEG_ADVERTISE_SPEED_DEFAULT;
 
+    /* IFE phy only supports 10/100 */
+    if (hw->phy_type == e1000_phy_ife)
+        hw->autoneg_advertised &= AUTONEG_ADVERTISE_10_100_ALL;
+
     DEBUGOUT("Reconfiguring auto-neg advertisement params\n");
     ret_val = e1000_phy_setup_autoneg(hw);
     if(ret_val) {
@@ -1717,6 +1839,26 @@ e1000_setup_copper_link(struct e1000_hw *hw)
 
     DEBUGFUNC("e1000_setup_copper_link");
 
+    switch (hw->mac_type) {
+    case e1000_80003es2lan:
+    case e1000_ich8lan:
+        /* Set the mac to wait the maximum time between each
+         * iteration and increase the max iterations when
+         * polling the phy; this fixes erroneous timeouts at 10Mbps. */
+        ret_val = e1000_write_kmrn_reg(hw, GG82563_REG(0x34, 4), 0xFFFF);
+        if (ret_val)
+            return ret_val;
+        ret_val = e1000_read_kmrn_reg(hw, GG82563_REG(0x34, 9), &reg_data);
+        if (ret_val)
+            return ret_val;
+        reg_data |= 0x3F;
+        ret_val = e1000_write_kmrn_reg(hw, GG82563_REG(0x34, 9), reg_data);
+        if (ret_val)
+            return ret_val;
+    default:
+        break;
+    }
+
     /* Check if it is a valid PHY and set PHY mode if necessary. */
     ret_val = e1000_copper_link_preconfig(hw);
     if(ret_val)
@@ -1724,10 +1866,8 @@ e1000_setup_copper_link(struct e1000_hw *hw)
 
     switch (hw->mac_type) {
     case e1000_80003es2lan:
-        ret_val = e1000_read_kmrn_reg(hw, E1000_KUMCTRLSTA_OFFSET_INB_CTRL,
-                                      &reg_data);
-        if (ret_val)
-            return ret_val;
+        /* Kumeran registers are written-only */
+        reg_data = E1000_KUMCTRLSTA_INB_CTRL_LINK_STATUS_TX_TIMEOUT_DEFAULT;
         reg_data |= E1000_KUMCTRLSTA_INB_CTRL_DIS_PADDING;
         ret_val = e1000_write_kmrn_reg(hw, E1000_KUMCTRLSTA_OFFSET_INB_CTRL,
                                        reg_data);
@@ -1739,6 +1879,7 @@ e1000_setup_copper_link(struct e1000_hw *hw)
     }
 
     if (hw->phy_type == e1000_phy_igp ||
+        hw->phy_type == e1000_phy_igp_3 ||
         hw->phy_type == e1000_phy_igp_2) {
         ret_val = e1000_copper_link_igp_setup(hw);
         if(ret_val)
@@ -1803,7 +1944,7 @@ e1000_setup_copper_link(struct e1000_hw *hw)
 * hw - Struct containing variables accessed by shared code
 ******************************************************************************/
 static int32_t
-e1000_configure_kmrn_for_10_100(struct e1000_hw *hw)
+e1000_configure_kmrn_for_10_100(struct e1000_hw *hw, uint16_t duplex)
 {
     int32_t ret_val = E1000_SUCCESS;
     uint32_t tipg;
@@ -1823,6 +1964,18 @@ e1000_configure_kmrn_for_10_100(struct e1000_hw *hw)
     tipg |= DEFAULT_80003ES2LAN_TIPG_IPGT_10_100;
     E1000_WRITE_REG(hw, TIPG, tipg);
 
+    ret_val = e1000_read_phy_reg(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data);
+
+    if (ret_val)
+        return ret_val;
+
+    if (duplex == HALF_DUPLEX)
+        reg_data |= GG82563_KMCR_PASS_FALSE_CARRIER;
+    else
+        reg_data &= ~GG82563_KMCR_PASS_FALSE_CARRIER;
+
+    ret_val = e1000_write_phy_reg(hw, GG82563_PHY_KMRN_MODE_CTRL, reg_data);
+
     return ret_val;
 }
 
@@ -1847,6 +2000,14 @@ e1000_configure_kmrn_for_1000(struct e1000_hw *hw)
     tipg |= DEFAULT_80003ES2LAN_TIPG_IPGT_1000;
     E1000_WRITE_REG(hw, TIPG, tipg);
 
+    ret_val = e1000_read_phy_reg(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data);
+
+    if (ret_val)
+        return ret_val;
+
+    reg_data &= ~GG82563_KMCR_PASS_FALSE_CARRIER;
+    ret_val = e1000_write_phy_reg(hw, GG82563_PHY_KMRN_MODE_CTRL, reg_data);
+
     return ret_val;
 }
 
@@ -1869,10 +2030,13 @@ e1000_phy_setup_autoneg(struct e1000_hw *hw)
     if(ret_val)
         return ret_val;
 
-    /* Read the MII 1000Base-T Control Register (Address 9). */
-    ret_val = e1000_read_phy_reg(hw, PHY_1000T_CTRL, &mii_1000t_ctrl_reg);
-    if(ret_val)
-        return ret_val;
+    if (hw->phy_type != e1000_phy_ife) {
+        /* Read the MII 1000Base-T Control Register (Address 9). */
+        ret_val = e1000_read_phy_reg(hw, PHY_1000T_CTRL, &mii_1000t_ctrl_reg);
+        if (ret_val)
+            return ret_val;
+    } else
+        mii_1000t_ctrl_reg=0;
 
     /* Need to parse both autoneg_advertised and fc and set up
      * the appropriate PHY registers.  First we will parse for
@@ -1923,6 +2087,9 @@ e1000_phy_setup_autoneg(struct e1000_hw *hw)
     if(hw->autoneg_advertised & ADVERTISE_1000_FULL) {
         DEBUGOUT("Advertise 1000mb Full duplex\n");
         mii_1000t_ctrl_reg |= CR_1000T_FD_CAPS;
+        if (hw->phy_type == e1000_phy_ife) {
+            DEBUGOUT("e1000_phy_ife is a 10/100 PHY. Gigabit speed is not supported.\n");
+        }
     }
 
     /* Check for a software override of the flow control settings, and
@@ -1984,9 +2151,11 @@ e1000_phy_setup_autoneg(struct e1000_hw *hw)
 
     DEBUGOUT1("Auto-Neg Advertising %x\n", mii_autoneg_adv_reg);
 
-    ret_val = e1000_write_phy_reg(hw, PHY_1000T_CTRL, mii_1000t_ctrl_reg);
-    if(ret_val)
-        return ret_val;
+    if (hw->phy_type != e1000_phy_ife) {
+        ret_val = e1000_write_phy_reg(hw, PHY_1000T_CTRL, mii_1000t_ctrl_reg);
+        if (ret_val)
+            return ret_val;
+    }
 
     return E1000_SUCCESS;
 }
@@ -2089,6 +2258,18 @@ e1000_phy_force_speed_duplex(struct e1000_hw *hw)
 
         /* Need to reset the PHY or these changes will be ignored */
         mii_ctrl_reg |= MII_CR_RESET;
+    /* Disable MDI-X support for 10/100 */
+    } else if (hw->phy_type == e1000_phy_ife) {
+        ret_val = e1000_read_phy_reg(hw, IFE_PHY_MDIX_CONTROL, &phy_data);
+        if (ret_val)
+            return ret_val;
+
+        phy_data &= ~IFE_PMC_AUTO_MDIX;
+        phy_data &= ~IFE_PMC_FORCE_MDIX;
+
+        ret_val = e1000_write_phy_reg(hw, IFE_PHY_MDIX_CONTROL, phy_data);
+        if (ret_val)
+            return ret_val;
     } else {
         /* Clear Auto-Crossover to force MDI manually.  IGP requires MDI
          * forced whenever speed or duplex are forced.
@@ -2721,8 +2902,12 @@ e1000_check_for_link(struct e1000_hw *hw)
          */
         if(hw->tbi_compatibility_en) {
             uint16_t speed, duplex;
-            e1000_get_speed_and_duplex(hw, &speed, &duplex);
-            if(speed != SPEED_1000) {
+            ret_val = e1000_get_speed_and_duplex(hw, &speed, &duplex);
+            if (ret_val) {
+                DEBUGOUT("Error getting link speed and duplex\n");
+                return ret_val;
+            }
+            if (speed != SPEED_1000) {
                 /* If link speed is not set to gigabit speed, we do not need
                  * to enable TBI compatibility.
                  */
@@ -2889,7 +3074,13 @@ e1000_get_speed_and_duplex(struct e1000_hw *hw,
         if (*speed == SPEED_1000)
             ret_val = e1000_configure_kmrn_for_1000(hw);
         else
-            ret_val = e1000_configure_kmrn_for_10_100(hw);
+            ret_val = e1000_configure_kmrn_for_10_100(hw, *duplex);
+        if (ret_val)
+            return ret_val;
+    }
+
+    if ((hw->phy_type == e1000_phy_igp_3) && (*speed == SPEED_1000)) {
+        ret_val = e1000_kumeran_lock_loss_workaround(hw);
         if (ret_val)
             return ret_val;
     }
@@ -3069,7 +3260,7 @@ e1000_shift_in_mdi_bits(struct e1000_hw *hw)
     return data;
 }
 
-int32_t
+static int32_t
 e1000_swfw_sync_acquire(struct e1000_hw *hw, uint16_t mask)
 {
     uint32_t swfw_sync = 0;
@@ -3079,6 +3270,9 @@ e1000_swfw_sync_acquire(struct e1000_hw *hw, uint16_t mask)
 
     DEBUGFUNC("e1000_swfw_sync_acquire");
 
+    if (hw->swfwhw_semaphore_present)
+        return e1000_get_software_flag(hw);
+
     if (!hw->swfw_sync_present)
         return e1000_get_hw_eeprom_semaphore(hw);
 
@@ -3110,7 +3304,7 @@ e1000_swfw_sync_acquire(struct e1000_hw *hw, uint16_t mask)
     return E1000_SUCCESS;
 }
 
-void
+static void
 e1000_swfw_sync_release(struct e1000_hw *hw, uint16_t mask)
 {
     uint32_t swfw_sync;
@@ -3118,6 +3312,11 @@ e1000_swfw_sync_release(struct e1000_hw *hw, uint16_t mask)
 
     DEBUGFUNC("e1000_swfw_sync_release");
 
+    if (hw->swfwhw_semaphore_present) {
+        e1000_release_software_flag(hw);
+        return;
+    }
+
     if (!hw->swfw_sync_present) {
         e1000_put_hw_eeprom_semaphore(hw);
         return;
@@ -3160,7 +3359,8 @@ e1000_read_phy_reg(struct e1000_hw *hw,
     if (e1000_swfw_sync_acquire(hw, swfw))
         return -E1000_ERR_SWFW_SYNC;
 
-    if((hw->phy_type == e1000_phy_igp ||
+    if ((hw->phy_type == e1000_phy_igp ||
+        hw->phy_type == e1000_phy_igp_3 ||
         hw->phy_type == e1000_phy_igp_2) &&
        (reg_addr > MAX_PHY_MULTI_PAGE_REG)) {
         ret_val = e1000_write_phy_reg_ex(hw, IGP01E1000_PHY_PAGE_SELECT,
@@ -3299,7 +3499,8 @@ e1000_write_phy_reg(struct e1000_hw *hw,
     if (e1000_swfw_sync_acquire(hw, swfw))
         return -E1000_ERR_SWFW_SYNC;
 
-    if((hw->phy_type == e1000_phy_igp ||
+    if ((hw->phy_type == e1000_phy_igp ||
+        hw->phy_type == e1000_phy_igp_3 ||
         hw->phy_type == e1000_phy_igp_2) &&
        (reg_addr > MAX_PHY_MULTI_PAGE_REG)) {
         ret_val = e1000_write_phy_reg_ex(hw, IGP01E1000_PHY_PAGE_SELECT,
@@ -3401,7 +3602,7 @@ e1000_write_phy_reg_ex(struct e1000_hw *hw,
     return E1000_SUCCESS;
 }
 
-int32_t
+static int32_t
 e1000_read_kmrn_reg(struct e1000_hw *hw,
                     uint32_t reg_addr,
                     uint16_t *data)
@@ -3434,7 +3635,7 @@ e1000_read_kmrn_reg(struct e1000_hw *hw,
     return E1000_SUCCESS;
 }
 
-int32_t
+static int32_t
 e1000_write_kmrn_reg(struct e1000_hw *hw,
                      uint32_t reg_addr,
                      uint16_t data)
@@ -3514,7 +3715,7 @@ e1000_phy_hw_reset(struct e1000_hw *hw)
         E1000_WRITE_FLUSH(hw);
 
         if (hw->mac_type >= e1000_82571)
-            msec_delay(10);
+            msec_delay_irq(10);
         e1000_swfw_sync_release(hw, swfw);
     } else {
         /* Read the Extended Device Control Register, assert the PHY_RESET_DIR
@@ -3544,6 +3745,12 @@ e1000_phy_hw_reset(struct e1000_hw *hw)
     ret_val = e1000_get_phy_cfg_done(hw);
     e1000_release_software_semaphore(hw);
 
+        if ((hw->mac_type == e1000_ich8lan) &&
+            (hw->phy_type == e1000_phy_igp_3)) {
+            ret_val = e1000_init_lcd_from_nvm(hw);
+            if (ret_val)
+                return ret_val;
+        }
     return ret_val;
 }
 
@@ -3572,9 +3779,11 @@ e1000_phy_reset(struct e1000_hw *hw)
     case e1000_82541_rev_2:
     case e1000_82571:
     case e1000_82572:
+    case e1000_ich8lan:
         ret_val = e1000_phy_hw_reset(hw);
         if(ret_val)
             return ret_val;
+
         break;
     default:
         ret_val = e1000_read_phy_reg(hw, PHY_CTRL, &phy_data);
@@ -3597,11 +3806,120 @@ e1000_phy_reset(struct e1000_hw *hw)
 }
 
 /******************************************************************************
+* Work-around for 82566 power-down: on D3 entry-
+* 1) disable gigabit link
+* 2) write VR power-down enable
+* 3) read it back
+* if successful continue, else issue LCD reset and repeat
+*
+* hw - struct containing variables accessed by shared code
+******************************************************************************/
+void
+e1000_phy_powerdown_workaround(struct e1000_hw *hw)
+{
+    int32_t reg;
+    uint16_t phy_data;
+    int32_t retry = 0;
+
+    DEBUGFUNC("e1000_phy_powerdown_workaround");
+
+    if (hw->phy_type != e1000_phy_igp_3)
+        return;
+
+    do {
+        /* Disable link */
+        reg = E1000_READ_REG(hw, PHY_CTRL);
+        E1000_WRITE_REG(hw, PHY_CTRL, reg | E1000_PHY_CTRL_GBE_DISABLE |
+                        E1000_PHY_CTRL_NOND0A_GBE_DISABLE);
+
+        /* Write VR power-down enable */
+        e1000_read_phy_reg(hw, IGP3_VR_CTRL, &phy_data);
+        e1000_write_phy_reg(hw, IGP3_VR_CTRL, phy_data |
+                            IGP3_VR_CTRL_MODE_SHUT);
+
+        /* Read it back and test */
+        e1000_read_phy_reg(hw, IGP3_VR_CTRL, &phy_data);
+        if ((phy_data & IGP3_VR_CTRL_MODE_SHUT) || retry)
+            break;
+
+        /* Issue PHY reset and repeat at most one more time */
+        reg = E1000_READ_REG(hw, CTRL);
+        E1000_WRITE_REG(hw, CTRL, reg | E1000_CTRL_PHY_RST);
+        retry++;
+    } while (retry);
+
+    return;
+
+}
+
+/******************************************************************************
+* Work-around for 82566 Kumeran PCS lock loss:
+* On link status change (i.e. PCI reset, speed change) and link is up and
+* speed is gigabit-
+* 0) if workaround is optionally disabled do nothing
+* 1) wait 1ms for Kumeran link to come up
+* 2) check Kumeran Diagnostic register PCS lock loss bit
+* 3) if not set the link is locked (all is good), otherwise...
+* 4) reset the PHY
+* 5) repeat up to 10 times
+* Note: this is only called for IGP3 copper when speed is 1gb.
+*
+* hw - struct containing variables accessed by shared code
+******************************************************************************/
+static int32_t
+e1000_kumeran_lock_loss_workaround(struct e1000_hw *hw)
+{
+    int32_t ret_val;
+    int32_t reg;
+    int32_t cnt;
+    uint16_t phy_data;
+
+    if (hw->kmrn_lock_loss_workaround_disabled)
+        return E1000_SUCCESS;
+
+    /* Make sure link is up before proceeding. If not just return.
+     * Attempting this while link is negotiating fouls up link
+     * stability */
+    ret_val = e1000_read_phy_reg(hw, PHY_STATUS, &phy_data);
+    ret_val = e1000_read_phy_reg(hw, PHY_STATUS, &phy_data);
+
+    if (phy_data & MII_SR_LINK_STATUS) {
+        for (cnt = 0; cnt < 10; cnt++) {
+            /* read once to clear */
+            ret_val = e1000_read_phy_reg(hw, IGP3_KMRN_DIAG, &phy_data);
+            if (ret_val)
+                return ret_val;
+            /* and again to get new status */
+            ret_val = e1000_read_phy_reg(hw, IGP3_KMRN_DIAG, &phy_data);
+            if (ret_val)
+                return ret_val;
+
+            /* check for PCS lock */
+            if (!(phy_data & IGP3_KMRN_DIAG_PCS_LOCK_LOSS))
+                return E1000_SUCCESS;
+
+            /* Issue PHY reset */
+            e1000_phy_hw_reset(hw);
+            msec_delay_irq(5);
+        }
+        /* Disable GigE link negotiation */
+        reg = E1000_READ_REG(hw, PHY_CTRL);
+        E1000_WRITE_REG(hw, PHY_CTRL, reg | E1000_PHY_CTRL_GBE_DISABLE |
+                        E1000_PHY_CTRL_NOND0A_GBE_DISABLE);
+
+        /* unable to acquire PCS lock */
+        return E1000_ERR_PHY;
+    }
+
+    return E1000_SUCCESS;
+}
+
+/******************************************************************************
 * Probes the expected PHY address for known PHY IDs
 *
 * hw - Struct containing variables accessed by shared code
 ******************************************************************************/
-static int32_t
+int32_t
 e1000_detect_gig_phy(struct e1000_hw *hw)
 {
     int32_t phy_init_status, ret_val;
@@ -3613,8 +3931,8 @@ e1000_detect_gig_phy(struct e1000_hw *hw)
     /* The 82571 firmware may still be configuring the PHY.  In this
      * case, we cannot access the PHY until the configuration is done.  So
      * we explicitly set the PHY values. */
-    if(hw->mac_type == e1000_82571 ||
-       hw->mac_type == e1000_82572) {
+    if (hw->mac_type == e1000_82571 ||
+        hw->mac_type == e1000_82572) {
         hw->phy_id = IGP01E1000_I_PHY_ID;
         hw->phy_type = e1000_phy_igp_2;
         return E1000_SUCCESS;
@@ -3631,7 +3949,7 @@ e1000_detect_gig_phy(struct e1000_hw *hw)
 
     /* Read the PHY ID Registers to identify which PHY is onboard. */
     ret_val = e1000_read_phy_reg(hw, PHY_ID1, &phy_id_high);
-    if(ret_val)
+    if (ret_val)
         return ret_val;
 
     hw->phy_id = (uint32_t) (phy_id_high << 16);
@@ -3669,6 +3987,12 @@ e1000_detect_gig_phy(struct e1000_hw *hw)
     case e1000_80003es2lan:
         if (hw->phy_id == GG82563_E_PHY_ID) match = TRUE;
         break;
+    case e1000_ich8lan:
+        if (hw->phy_id == IGP03E1000_E_PHY_ID) match = TRUE;
+        if (hw->phy_id == IFE_E_PHY_ID) match = TRUE;
+        if (hw->phy_id == IFE_PLUS_E_PHY_ID) match = TRUE;
+        if (hw->phy_id == IFE_C_E_PHY_ID) match = TRUE;
+        break;
     default:
         DEBUGOUT1("Invalid MAC type %d\n", hw->mac_type);
         return -E1000_ERR_CONFIG;
@@ -3784,6 +4108,53 @@ e1000_phy_igp_get_info(struct e1000_hw *hw,
 }
 
 /******************************************************************************
+* Get PHY information from various PHY registers for ife PHY only.
+*
+* hw - Struct containing variables accessed by shared code
+* phy_info - PHY information structure
+******************************************************************************/
+static int32_t
+e1000_phy_ife_get_info(struct e1000_hw *hw,
+                       struct e1000_phy_info *phy_info)
+{
+    int32_t ret_val;
+    uint16_t phy_data, polarity;
+
+    DEBUGFUNC("e1000_phy_ife_get_info");
+
+    phy_info->downshift = (e1000_downshift)hw->speed_downgraded;
+    phy_info->extended_10bt_distance = e1000_10bt_ext_dist_enable_normal;
+
+    ret_val = e1000_read_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL, &phy_data);
+    if (ret_val)
+        return ret_val;
+    phy_info->polarity_correction =
+                        (phy_data & IFE_PSC_AUTO_POLARITY_DISABLE) >>
+                        IFE_PSC_AUTO_POLARITY_DISABLE_SHIFT;
+
+    if (phy_info->polarity_correction == e1000_polarity_reversal_enabled) {
+        ret_val = e1000_check_polarity(hw, &polarity);
+        if (ret_val)
+            return ret_val;
+    } else {
+        /* Polarity is forced. */
+        polarity = (phy_data & IFE_PSC_FORCE_POLARITY) >>
+                       IFE_PSC_FORCE_POLARITY_SHIFT;
+    }
+    phy_info->cable_polarity = polarity;
+
+    ret_val = e1000_read_phy_reg(hw, IFE_PHY_MDIX_CONTROL, &phy_data);
+    if (ret_val)
+        return ret_val;
+
+    phy_info->mdix_mode =
+                     (phy_data & (IFE_PMC_AUTO_MDIX | IFE_PMC_FORCE_MDIX)) >>
+                     IFE_PMC_MDIX_MODE_SHIFT;
+
+    return E1000_SUCCESS;
+}
+
+/******************************************************************************
 * Get PHY information from various PHY registers fot m88 PHY only.
 *
 * hw - Struct containing variables accessed by shared code
@@ -3898,9 +4269,12 @@ e1000_phy_get_info(struct e1000_hw *hw,
         return -E1000_ERR_CONFIG;
     }
 
-    if(hw->phy_type == e1000_phy_igp ||
+    if (hw->phy_type == e1000_phy_igp ||
+        hw->phy_type == e1000_phy_igp_3 ||
         hw->phy_type == e1000_phy_igp_2)
         return e1000_phy_igp_get_info(hw, phy_info);
+    else if (hw->phy_type == e1000_phy_ife)
+        return e1000_phy_ife_get_info(hw, phy_info);
     else
         return e1000_phy_m88_get_info(hw, phy_info);
 }
@@ -4049,6 +4423,35 @@ e1000_init_eeprom_params(struct e1000_hw *hw)
         eeprom->use_eerd = TRUE;
         eeprom->use_eewr = FALSE;
         break;
+    case e1000_ich8lan:
+    {
+        int32_t  i = 0;
+        uint32_t flash_size = E1000_READ_ICH8_REG(hw, ICH8_FLASH_GFPREG);
+
+        eeprom->type = e1000_eeprom_ich8;
+        eeprom->use_eerd = FALSE;
+        eeprom->use_eewr = FALSE;
+        eeprom->word_size = E1000_SHADOW_RAM_WORDS;
+
+        /* Zero the shadow RAM structure. But don't load it from NVM
+         * so as to save time for driver init */
+        if (hw->eeprom_shadow_ram != NULL) {
+            for (i = 0; i < E1000_SHADOW_RAM_WORDS; i++) {
+                hw->eeprom_shadow_ram[i].modified = FALSE;
+                hw->eeprom_shadow_ram[i].eeprom_word = 0xFFFF;
+            }
+        }
+
+        hw->flash_base_addr = (flash_size & ICH8_GFPREG_BASE_MASK) *
+                              ICH8_FLASH_SECTOR_SIZE;
+
+        hw->flash_bank_size = ((flash_size >> 16) & ICH8_GFPREG_BASE_MASK) + 1;
+        hw->flash_bank_size -= (flash_size & ICH8_GFPREG_BASE_MASK);
+        hw->flash_bank_size *= ICH8_FLASH_SECTOR_SIZE;
+        hw->flash_bank_size /= 2 * sizeof(uint16_t);
+
+        break;
+    }
     default:
         break;
     }
@@ -4469,7 +4872,10 @@ e1000_read_eeprom(struct e1000_hw *hw,
         return ret_val;
     }
 
-    if(eeprom->type == e1000_eeprom_spi) {
+    if (eeprom->type == e1000_eeprom_ich8)
+        return e1000_read_eeprom_ich8(hw, offset, words, data);
+
+    if (eeprom->type == e1000_eeprom_spi) {
         uint16_t word_in;
         uint8_t read_opcode = EEPROM_READ_OPCODE_SPI;
 
@@ -4636,7 +5042,10 @@ e1000_is_onboard_nvm_eeprom(struct e1000_hw *hw)
 
     DEBUGFUNC("e1000_is_onboard_nvm_eeprom");
 
-    if(hw->mac_type == e1000_82573) {
+    if (hw->mac_type == e1000_ich8lan)
+        return FALSE;
+
+    if (hw->mac_type == e1000_82573) {
         eecd = E1000_READ_REG(hw, EECD);
 
         /* Isolate bits 15 & 16 */
@@ -4686,8 +5095,22 @@ e1000_validate_eeprom_checksum(struct e1000_hw *hw)
         }
     }
 
-    for(i = 0; i < (EEPROM_CHECKSUM_REG + 1); i++) {
-        if(e1000_read_eeprom(hw, i, 1, &eeprom_data) < 0) {
+    if (hw->mac_type == e1000_ich8lan) {
+        /* Drivers must allocate the shadow ram structure for the
+         * EEPROM checksum to be updated.  Otherwise, this bit as well
+         * as the checksum must both be set correctly for this
+         * validation to pass.
+         */
+        e1000_read_eeprom(hw, 0x19, 1, &eeprom_data);
+        if ((eeprom_data & 0x40) == 0) {
+            eeprom_data |= 0x40;
+            e1000_write_eeprom(hw, 0x19, 1, &eeprom_data);
+            e1000_update_eeprom_checksum(hw);
+        }
+    }
+
+    for (i = 0; i < (EEPROM_CHECKSUM_REG + 1); i++) {
+        if (e1000_read_eeprom(hw, i, 1, &eeprom_data) < 0) {
             DEBUGOUT("EEPROM Read Error\n");
             return -E1000_ERR_EEPROM;
         }
@@ -4713,6 +5136,7 @@ e1000_validate_eeprom_checksum(struct e1000_hw *hw)
 int32_t
 e1000_update_eeprom_checksum(struct e1000_hw *hw)
 {
+    uint32_t ctrl_ext;
     uint16_t checksum = 0;
     uint16_t i, eeprom_data;
 
@@ -4731,6 +5155,14 @@ e1000_update_eeprom_checksum(struct e1000_hw *hw)
         return -E1000_ERR_EEPROM;
     } else if (hw->eeprom.type == e1000_eeprom_flash) {
         e1000_commit_shadow_ram(hw);
+    } else if (hw->eeprom.type == e1000_eeprom_ich8) {
+        e1000_commit_shadow_ram(hw);
+        /* Reload the EEPROM, or else modifications will not appear
+         * until after next adapter reset. */
+        ctrl_ext = E1000_READ_REG(hw, CTRL_EXT);
+        ctrl_ext |= E1000_CTRL_EXT_EE_RST;
+        E1000_WRITE_REG(hw, CTRL_EXT, ctrl_ext);
+        msec_delay(10);
     }
     return E1000_SUCCESS;
 }
@@ -4770,6 +5202,9 @@ e1000_write_eeprom(struct e1000_hw *hw,
     if(eeprom->use_eewr == TRUE)
         return e1000_write_eeprom_eewr(hw, offset, words, data);
 
+    if (eeprom->type == e1000_eeprom_ich8)
+        return e1000_write_eeprom_ich8(hw, offset, words, data);
+
     /* Prepare the EEPROM for writing  */
     if (e1000_acquire_eeprom(hw) != E1000_SUCCESS)
         return -E1000_ERR_EEPROM;
@@ -4957,11 +5392,17 @@ e1000_commit_shadow_ram(struct e1000_hw *hw)
     uint32_t flop = 0;
     uint32_t i = 0;
     int32_t error = E1000_SUCCESS;
-
-    /* The flop register will be used to determine if flash type is STM */
-    flop = E1000_READ_REG(hw, FLOP);
+    uint32_t old_bank_offset = 0;
+    uint32_t new_bank_offset = 0;
+    uint32_t sector_retries = 0;
+    uint8_t low_byte = 0;
+    uint8_t high_byte = 0;
+    uint8_t temp_byte = 0;
+    boolean_t sector_write_failed = FALSE;
 
     if (hw->mac_type == e1000_82573) {
+        /* The flop register will be used to determine if flash type is STM */
+        flop = E1000_READ_REG(hw, FLOP);
         for (i=0; i < attempts; i++) {
             eecd = E1000_READ_REG(hw, EECD);
             if ((eecd & E1000_EECD_FLUPD) == 0) {
@@ -4995,6 +5436,106 @@ e1000_commit_shadow_ram(struct e1000_hw *hw)
         }
     }
 
+    if (hw->mac_type == e1000_ich8lan && hw->eeprom_shadow_ram != NULL) {
+        /* We're writing to the opposite bank so if we're on bank 1,
+         * write to bank 0 etc.  We also need to erase the segment that
+         * is going to be written */
+        if (!(E1000_READ_REG(hw, EECD) & E1000_EECD_SEC1VAL)) {
+            new_bank_offset = hw->flash_bank_size * 2;
+            old_bank_offset = 0;
+            e1000_erase_ich8_4k_segment(hw, 1);
+        } else {
+            old_bank_offset = hw->flash_bank_size * 2;
+            new_bank_offset = 0;
+            e1000_erase_ich8_4k_segment(hw, 0);
+        }
+
+        do {
+            sector_write_failed = FALSE;
+            /* Loop for every byte in the shadow RAM,
+             * which is in units of words. */
+            for (i = 0; i < E1000_SHADOW_RAM_WORDS; i++) {
+                /* Determine whether to write the value stored
+                 * in the other NVM bank or a modified value stored
+                 * in the shadow RAM */
+                if (hw->eeprom_shadow_ram[i].modified == TRUE) {
+                    low_byte = (uint8_t)hw->eeprom_shadow_ram[i].eeprom_word;
+                    e1000_read_ich8_byte(hw, (i << 1) + old_bank_offset,
+                                         &temp_byte);
+                    udelay(100);
+                    error = e1000_verify_write_ich8_byte(hw,
+                                                 (i << 1) + new_bank_offset,
+                                                 low_byte);
+                    if (error != E1000_SUCCESS)
+                        sector_write_failed = TRUE;
+                    high_byte =
+                        (uint8_t)(hw->eeprom_shadow_ram[i].eeprom_word >> 8);
+                    e1000_read_ich8_byte(hw, (i << 1) + old_bank_offset + 1,
+                                         &temp_byte);
+                    udelay(100);
+                } else {
+                    e1000_read_ich8_byte(hw, (i << 1) + old_bank_offset,
+                                         &low_byte);
+                    udelay(100);
+                    error = e1000_verify_write_ich8_byte(hw,
+                                 (i << 1) + new_bank_offset, low_byte);
+                    if (error != E1000_SUCCESS)
+                        sector_write_failed = TRUE;
+                    e1000_read_ich8_byte(hw, (i << 1) + old_bank_offset + 1,
+                                         &high_byte);
+                }
+
+                /* If the word is 0x13, then make sure the signature bits
+                 * (15:14) are 11b until the commit has completed.
+                 * This will allow us to write 10b which indicates the
+                 * signature is valid.  We want to do this after the write
+                 * has completed so that we don't mark the segment valid
+                 * while the write is still in progress */
+                if (i == E1000_ICH8_NVM_SIG_WORD)
+                    high_byte = E1000_ICH8_NVM_SIG_MASK | high_byte;
+
+                error = e1000_verify_write_ich8_byte(hw,
+                             (i << 1) + new_bank_offset + 1, high_byte);
+                if (error != E1000_SUCCESS)
+                    sector_write_failed = TRUE;
+
+                if (sector_write_failed == FALSE) {
+                    /* Clear the now not used entry in the cache */
+                    hw->eeprom_shadow_ram[i].modified = FALSE;
+                    hw->eeprom_shadow_ram[i].eeprom_word = 0xFFFF;
+                }
+            }
+
+            /* Don't bother writing the segment valid bits if sector
+             * programming failed. */
+            if (sector_write_failed == FALSE) {
+                /* Finally validate the new segment by setting bit 15:14
+                 * to 10b in word 0x13 , this can be done without an
+                 * erase as well since these bits are 11 to start with
+                 * and we need to change bit 14 to 0b */
+                e1000_read_ich8_byte(hw,
+                    E1000_ICH8_NVM_SIG_WORD * 2 + 1 + new_bank_offset,
+                    &high_byte);
+                high_byte &= 0xBF;
+                error = e1000_verify_write_ich8_byte(hw,
+                            E1000_ICH8_NVM_SIG_WORD * 2 + 1 + new_bank_offset,
+                            high_byte);
+                if (error != E1000_SUCCESS)
+                    sector_write_failed = TRUE;
+
+                /* And invalidate the previously valid segment by setting
+                 * its signature word (0x13) high_byte to 0b. This can be
+                 * done without an erase because flash erase sets all bits
+                 * to 1's. We can write 1's to 0's without an erase */
+                error = e1000_verify_write_ich8_byte(hw,
+                            E1000_ICH8_NVM_SIG_WORD * 2 + 1 + old_bank_offset,
+                            0);
+                if (error != E1000_SUCCESS)
+                    sector_write_failed = TRUE;
+            }
+        } while (++sector_retries < 10 && sector_write_failed == TRUE);
+    }
+
     return error;
 }
 
@@ -5102,15 +5643,19 @@ e1000_init_rx_addrs(struct e1000_hw *hw)
      * the other port. */
     if ((hw->mac_type == e1000_82571) && (hw->laa_is_present == TRUE))
         rar_num -= 1;
+    if (hw->mac_type == e1000_ich8lan)
+        rar_num = E1000_RAR_ENTRIES_ICH8LAN;
+
     /* Zero out the other 15 receive addresses. */
     DEBUGOUT("Clearing RAR[1-15]\n");
     for(i = 1; i < rar_num; i++) {
         E1000_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
+        E1000_WRITE_FLUSH(hw);
         E1000_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0);
+        E1000_WRITE_FLUSH(hw);
     }
 }
 
-#if 0
 /******************************************************************************
  * Updates the MAC's list of multicast addresses.
  *
@@ -5125,6 +5670,7 @@ e1000_init_rx_addrs(struct e1000_hw *hw)
  * for the first 15 multicast addresses, and hashes the rest into the
  * multicast table.
  *****************************************************************************/
+#if 0
 void
 e1000_mc_addr_list_update(struct e1000_hw *hw,
                           uint8_t *mc_addr_list,
@@ -5145,6 +5691,8 @@ e1000_mc_addr_list_update(struct e1000_hw *hw,
     /* Clear RAR[1-15] */
     DEBUGOUT(" Clearing RAR[1-15]\n");
     num_rar_entry = E1000_RAR_ENTRIES;
+    if (hw->mac_type == e1000_ich8lan)
+        num_rar_entry = E1000_RAR_ENTRIES_ICH8LAN;
     /* Reserve a spot for the Locally Administered Address to work around
      * an 82571 issue in which a reset on one port will reload the MAC on
      * the other port. */
@@ -5153,14 +5701,19 @@ e1000_mc_addr_list_update(struct e1000_hw *hw,
 
     for(i = rar_used_count; i < num_rar_entry; i++) {
         E1000_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
+        E1000_WRITE_FLUSH(hw);
         E1000_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0);
+        E1000_WRITE_FLUSH(hw);
     }
 
     /* Clear the MTA */
     DEBUGOUT(" Clearing MTA\n");
     num_mta_entry = E1000_NUM_MTA_REGISTERS;
+    if (hw->mac_type == e1000_ich8lan)
+        num_mta_entry = E1000_NUM_MTA_REGISTERS_ICH8LAN;
     for(i = 0; i < num_mta_entry; i++) {
         E1000_WRITE_REG_ARRAY(hw, MTA, i, 0);
+        E1000_WRITE_FLUSH(hw);
     }
 
     /* Add the new addresses */
@@ -5217,24 +5770,46 @@ e1000_hash_mc_addr(struct e1000_hw *hw,
      * LSB                 MSB
      */
     case 0:
-        /* [47:36] i.e. 0x563 for above example address */
-        hash_value = ((mc_addr[4] >> 4) | (((uint16_t) mc_addr[5]) << 4));
+        if (hw->mac_type == e1000_ich8lan) {
+            /* [47:38] i.e. 0x158 for above example address */
+            hash_value = ((mc_addr[4] >> 6) | (((uint16_t) mc_addr[5]) << 2));
+        } else {
+            /* [47:36] i.e. 0x563 for above example address */
+            hash_value = ((mc_addr[4] >> 4) | (((uint16_t) mc_addr[5]) << 4));
+        }
         break;
     case 1:
-        /* [46:35] i.e. 0xAC6 for above example address */
-        hash_value = ((mc_addr[4] >> 3) | (((uint16_t) mc_addr[5]) << 5));
+        if (hw->mac_type == e1000_ich8lan) {
+            /* [46:37] i.e. 0x2B1 for above example address */
+            hash_value = ((mc_addr[4] >> 5) | (((uint16_t) mc_addr[5]) << 3));
+        } else {
+            /* [46:35] i.e. 0xAC6 for above example address */
+            hash_value = ((mc_addr[4] >> 3) | (((uint16_t) mc_addr[5]) << 5));
+        }
         break;
     case 2:
-        /* [45:34] i.e. 0x5D8 for above example address */
-        hash_value = ((mc_addr[4] >> 2) | (((uint16_t) mc_addr[5]) << 6));
+        if (hw->mac_type == e1000_ich8lan) {
+            /*[45:36] i.e. 0x163 for above example address */
+            hash_value = ((mc_addr[4] >> 4) | (((uint16_t) mc_addr[5]) << 4));
+        } else {
+            /* [45:34] i.e. 0x5D8 for above example address */
+            hash_value = ((mc_addr[4] >> 2) | (((uint16_t) mc_addr[5]) << 6));
+        }
         break;
     case 3:
-        /* [43:32] i.e. 0x634 for above example address */
-        hash_value = ((mc_addr[4]) | (((uint16_t) mc_addr[5]) << 8));
+        if (hw->mac_type == e1000_ich8lan) {
+            /* [43:34] i.e. 0x18D for above example address */
+            hash_value = ((mc_addr[4] >> 2) | (((uint16_t) mc_addr[5]) << 6));
+        } else {
+            /* [43:32] i.e. 0x634 for above example address */
+            hash_value = ((mc_addr[4]) | (((uint16_t) mc_addr[5]) << 8));
+        }
         break;
     }
 
     hash_value &= 0xFFF;
+    if (hw->mac_type == e1000_ich8lan)
+        hash_value &= 0x3FF;
 
     return hash_value;
 }
@@ -5262,6 +5837,8 @@ e1000_mta_set(struct e1000_hw *hw,
      * register are determined by the lower 5 bits of the value.
      */
     hash_reg = (hash_value >> 5) & 0x7F;
+    if (hw->mac_type == e1000_ich8lan)
+        hash_reg &= 0x1F;
     hash_bit = hash_value & 0x1F;
 
     mta = E1000_READ_REG_ARRAY(hw, MTA, hash_reg);
@@ -5275,9 +5852,12 @@ e1000_mta_set(struct e1000_hw *hw,
     if((hw->mac_type == e1000_82544) && ((hash_reg & 0x1) == 1)) {
         temp = E1000_READ_REG_ARRAY(hw, MTA, (hash_reg - 1));
         E1000_WRITE_REG_ARRAY(hw, MTA, hash_reg, mta);
+        E1000_WRITE_FLUSH(hw);
         E1000_WRITE_REG_ARRAY(hw, MTA, (hash_reg - 1), temp);
+        E1000_WRITE_FLUSH(hw);
     } else {
         E1000_WRITE_REG_ARRAY(hw, MTA, hash_reg, mta);
+        E1000_WRITE_FLUSH(hw);
     }
 }
 
@@ -5334,7 +5914,9 @@ e1000_rar_set(struct e1000_hw *hw,
     }
 
     E1000_WRITE_REG_ARRAY(hw, RA, (index << 1), rar_low);
+    E1000_WRITE_FLUSH(hw);
     E1000_WRITE_REG_ARRAY(hw, RA, ((index << 1) + 1), rar_high);
+    E1000_WRITE_FLUSH(hw);
 }
 
 /******************************************************************************
@@ -5351,12 +5933,18 @@ e1000_write_vfta(struct e1000_hw *hw,
 {
     uint32_t temp;
 
-    if((hw->mac_type == e1000_82544) && ((offset & 0x1) == 1)) {
+    if (hw->mac_type == e1000_ich8lan)
+        return;
+
+    if ((hw->mac_type == e1000_82544) && ((offset & 0x1) == 1)) {
         temp = E1000_READ_REG_ARRAY(hw, VFTA, (offset - 1));
         E1000_WRITE_REG_ARRAY(hw, VFTA, offset, value);
+        E1000_WRITE_FLUSH(hw);
         E1000_WRITE_REG_ARRAY(hw, VFTA, (offset - 1), temp);
+        E1000_WRITE_FLUSH(hw);
     } else {
         E1000_WRITE_REG_ARRAY(hw, VFTA, offset, value);
+        E1000_WRITE_FLUSH(hw);
     }
 }
 
@@ -5373,6 +5961,9 @@ e1000_clear_vfta(struct e1000_hw *hw)
     uint32_t vfta_offset = 0;
     uint32_t vfta_bit_in_reg = 0;
 
+    if (hw->mac_type == e1000_ich8lan)
+        return;
+
     if (hw->mac_type == e1000_82573) {
         if (hw->mng_cookie.vlan_id != 0) {
             /* The VFTA is a 4096b bit-field, each identifying a single VLAN
@@ -5392,6 +5983,7 @@ e1000_clear_vfta(struct e1000_hw *hw)
          * manageability unit */
         vfta_value = (offset == vfta_offset) ? vfta_bit_in_reg : 0;
         E1000_WRITE_REG_ARRAY(hw, VFTA, offset, vfta_value);
+        E1000_WRITE_FLUSH(hw);
     }
 }
 
@@ -5421,9 +6013,18 @@ e1000_id_led_init(struct e1000_hw * hw)
         DEBUGOUT("EEPROM Read Error\n");
         return -E1000_ERR_EEPROM;
     }
-    if((eeprom_data== ID_LED_RESERVED_0000) ||
-       (eeprom_data == ID_LED_RESERVED_FFFF)) eeprom_data = ID_LED_DEFAULT;
-    for(i = 0; i < 4; i++) {
+
+    if ((hw->mac_type == e1000_82573) &&
+        (eeprom_data == ID_LED_RESERVED_82573))
+        eeprom_data = ID_LED_DEFAULT_82573;
+    else if ((eeprom_data == ID_LED_RESERVED_0000) ||
+            (eeprom_data == ID_LED_RESERVED_FFFF)) {
+        if (hw->mac_type == e1000_ich8lan)
+            eeprom_data = ID_LED_DEFAULT_ICH8LAN;
+        else
+            eeprom_data = ID_LED_DEFAULT;
+    }
+    for (i = 0; i < 4; i++) {
         temp = (eeprom_data >> (i << 2)) & led_mask;
         switch(temp) {
         case ID_LED_ON1_DEF2:
@@ -5519,6 +6120,44 @@ e1000_setup_led(struct e1000_hw *hw)
 }
 
 /******************************************************************************
+ * Used on 82571 and later Si that has LED blink bits.
+ * Callers must use their own timer and should have already called
+ * e1000_id_led_init()
+ * Call e1000_cleanup led() to stop blinking
+ *
+ * hw - Struct containing variables accessed by shared code
+ *****************************************************************************/
+int32_t
+e1000_blink_led_start(struct e1000_hw *hw)
+{
+    int16_t  i;
+    uint32_t ledctl_blink = 0;
+
+    DEBUGFUNC("e1000_id_led_blink_on");
+
+    if (hw->mac_type < e1000_82571) {
+        /* Nothing to do */
+        return E1000_SUCCESS;
+    }
+    if (hw->media_type == e1000_media_type_fiber) {
+        /* always blink LED0 for PCI-E fiber */
+        ledctl_blink = E1000_LEDCTL_LED0_BLINK |
+                     (E1000_LEDCTL_MODE_LED_ON << E1000_LEDCTL_LED0_MODE_SHIFT);
+    } else {
+        /* set the blink bit for each LED that's "on" (0x0E) in ledctl_mode2 */
+        ledctl_blink = hw->ledctl_mode2;
+        for (i=0; i < 4; i++)
+            if (((hw->ledctl_mode2 >> (i * 8)) & 0xFF) ==
+                E1000_LEDCTL_MODE_LED_ON)
+                ledctl_blink |= (E1000_LEDCTL_LED0_BLINK << (i * 8));
+    }
+
+    E1000_WRITE_REG(hw, LEDCTL, ledctl_blink);
+
+    return E1000_SUCCESS;
+}
+
+/******************************************************************************
  * Restores the saved state of the SW controlable LED.
  *
  * hw - Struct containing variables accessed by shared code
@@ -5548,6 +6187,10 @@ e1000_cleanup_led(struct e1000_hw *hw)
             return ret_val;
         /* Fall Through */
     default:
+        if (hw->phy_type == e1000_phy_ife) {
+            e1000_write_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL_LED, 0);
+            break;
+        }
         /* Restore LEDCTL settings */
         E1000_WRITE_REG(hw, LEDCTL, hw->ledctl_default);
         break;
@@ -5592,7 +6235,10 @@ e1000_led_on(struct e1000_hw *hw)
             /* Clear SW Defineable Pin 0 to turn on the LED */
             ctrl &= ~E1000_CTRL_SWDPIN0;
             ctrl |= E1000_CTRL_SWDPIO0;
-        } else if(hw->media_type == e1000_media_type_copper) {
+        } else if (hw->phy_type == e1000_phy_ife) {
+            e1000_write_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL_LED,
+                 (IFE_PSCL_PROBE_MODE | IFE_PSCL_PROBE_LEDS_ON));
+        } else if (hw->media_type == e1000_media_type_copper) {
             E1000_WRITE_REG(hw, LEDCTL, hw->ledctl_mode2);
             return E1000_SUCCESS;
         }
@@ -5640,7 +6286,10 @@ e1000_led_off(struct e1000_hw *hw)
             /* Set SW Defineable Pin 0 to turn off the LED */
             ctrl |= E1000_CTRL_SWDPIN0;
             ctrl |= E1000_CTRL_SWDPIO0;
-        } else if(hw->media_type == e1000_media_type_copper) {
+        } else if (hw->phy_type == e1000_phy_ife) {
+            e1000_write_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL_LED,
+                 (IFE_PSCL_PROBE_MODE | IFE_PSCL_PROBE_LEDS_OFF));
+        } else if (hw->media_type == e1000_media_type_copper) {
             E1000_WRITE_REG(hw, LEDCTL, hw->ledctl_mode1);
             return E1000_SUCCESS;
         }
@@ -5678,12 +6327,16 @@ e1000_clear_hw_cntrs(struct e1000_hw *hw)
     temp = E1000_READ_REG(hw, XOFFRXC);
     temp = E1000_READ_REG(hw, XOFFTXC);
     temp = E1000_READ_REG(hw, FCRUC);
+
+    if (hw->mac_type != e1000_ich8lan) {
     temp = E1000_READ_REG(hw, PRC64);
     temp = E1000_READ_REG(hw, PRC127);
     temp = E1000_READ_REG(hw, PRC255);
     temp = E1000_READ_REG(hw, PRC511);
     temp = E1000_READ_REG(hw, PRC1023);
     temp = E1000_READ_REG(hw, PRC1522);
+    }
+
     temp = E1000_READ_REG(hw, GPRC);
     temp = E1000_READ_REG(hw, BPRC);
     temp = E1000_READ_REG(hw, MPRC);
@@ -5703,12 +6356,16 @@ e1000_clear_hw_cntrs(struct e1000_hw *hw)
     temp = E1000_READ_REG(hw, TOTH);
     temp = E1000_READ_REG(hw, TPR);
     temp = E1000_READ_REG(hw, TPT);
+
+    if (hw->mac_type != e1000_ich8lan) {
     temp = E1000_READ_REG(hw, PTC64);
     temp = E1000_READ_REG(hw, PTC127);
     temp = E1000_READ_REG(hw, PTC255);
     temp = E1000_READ_REG(hw, PTC511);
     temp = E1000_READ_REG(hw, PTC1023);
     temp = E1000_READ_REG(hw, PTC1522);
+    }
+
     temp = E1000_READ_REG(hw, MPTC);
     temp = E1000_READ_REG(hw, BPTC);
 
@@ -5731,6 +6388,9 @@ e1000_clear_hw_cntrs(struct e1000_hw *hw)
 
     temp = E1000_READ_REG(hw, IAC);
     temp = E1000_READ_REG(hw, ICRXOC);
+
+    if (hw->mac_type == e1000_ich8lan) return;
+
     temp = E1000_READ_REG(hw, ICRXPTC);
     temp = E1000_READ_REG(hw, ICRXATC);
     temp = E1000_READ_REG(hw, ICTXPTC);
@@ -5911,6 +6571,7 @@ e1000_get_bus_info(struct e1000_hw *hw)
         hw->bus_width = e1000_bus_width_pciex_1;
         break;
     case e1000_82571:
+    case e1000_ich8lan:
     case e1000_80003es2lan:
         hw->bus_type = e1000_bus_type_pci_express;
         hw->bus_speed = e1000_bus_speed_2500;
@@ -5948,8 +6609,6 @@ e1000_get_bus_info(struct e1000_hw *hw)
         break;
     }
 }
-
-#if 0
 /******************************************************************************
  * Reads a value from one of the devices registers using port I/O (as opposed
  * memory mapped I/O). Only 82544 and newer devices support port I/O.
@@ -5957,6 +6616,7 @@ e1000_get_bus_info(struct e1000_hw *hw)
  * hw - Struct containing variables accessed by shared code
  * offset - offset to read from
  *****************************************************************************/
+#if 0
 uint32_t
 e1000_read_reg_io(struct e1000_hw *hw,
                   uint32_t offset)
@@ -6012,8 +6672,6 @@ e1000_get_cable_length(struct e1000_hw *hw,
 {
     int32_t ret_val;
     uint16_t agc_value = 0;
-    uint16_t cur_agc, min_agc = IGP01E1000_AGC_LENGTH_TABLE_SIZE;
-    uint16_t max_agc = 0;
     uint16_t i, phy_data;
     uint16_t cable_length;
 
@@ -6086,6 +6744,8 @@ e1000_get_cable_length(struct e1000_hw *hw,
             break;
         }
     } else if(hw->phy_type == e1000_phy_igp) { /* For IGP PHY */
+        uint16_t cur_agc_value;
+        uint16_t min_agc_value = IGP01E1000_AGC_LENGTH_TABLE_SIZE;
         uint16_t agc_reg_array[IGP01E1000_PHY_CHANNEL_NUM] =
                                                          {IGP01E1000_PHY_AGC_A,
                                                           IGP01E1000_PHY_AGC_B,
@@ -6098,23 +6758,23 @@ e1000_get_cable_length(struct e1000_hw *hw,
             if(ret_val)
                 return ret_val;
 
-            cur_agc = phy_data >> IGP01E1000_AGC_LENGTH_SHIFT;
+            cur_agc_value = phy_data >> IGP01E1000_AGC_LENGTH_SHIFT;
 
-            /* Array bound check. */
-            if((cur_agc >= IGP01E1000_AGC_LENGTH_TABLE_SIZE - 1) ||
-               (cur_agc == 0))
+            /* Value bound check. */
+            if ((cur_agc_value >= IGP01E1000_AGC_LENGTH_TABLE_SIZE - 1) ||
+                (cur_agc_value == 0))
                 return -E1000_ERR_PHY;
 
-            agc_value += cur_agc;
+            agc_value += cur_agc_value;
 
             /* Update minimal AGC value. */
-            if(min_agc > cur_agc)
-                min_agc = cur_agc;
+            if (min_agc_value > cur_agc_value)
+                min_agc_value = cur_agc_value;
         }
 
         /* Remove the minimal AGC result for length < 50m */
-        if(agc_value < IGP01E1000_PHY_CHANNEL_NUM * e1000_igp_cable_length_50) {
-            agc_value -= min_agc;
+        if (agc_value < IGP01E1000_PHY_CHANNEL_NUM * e1000_igp_cable_length_50) {
+            agc_value -= min_agc_value;
 
             /* Get the average length of the remaining 3 channels */
             agc_value /= (IGP01E1000_PHY_CHANNEL_NUM - 1);
@@ -6130,7 +6790,10 @@ e1000_get_cable_length(struct e1000_hw *hw,
                        IGP01E1000_AGC_RANGE) : 0;
         *max_length = e1000_igp_cable_length_table[agc_value] +
                       IGP01E1000_AGC_RANGE;
-    } else if (hw->phy_type == e1000_phy_igp_2) {
+    } else if (hw->phy_type == e1000_phy_igp_2 ||
+               hw->phy_type == e1000_phy_igp_3) {
+        uint16_t cur_agc_index, max_agc_index = 0;
+        uint16_t min_agc_index = IGP02E1000_AGC_LENGTH_TABLE_SIZE - 1;
         uint16_t agc_reg_array[IGP02E1000_PHY_CHANNEL_NUM] =
                                                          {IGP02E1000_PHY_AGC_A,
                                                           IGP02E1000_PHY_AGC_B,
@@ -6145,19 +6808,27 @@ e1000_get_cable_length(struct e1000_hw *hw,
             /* Getting bits 15:9, which represent the combination of course and
              * fine gain values.  The result is a number that can be put into
              * the lookup table to obtain the approximate cable length. */
-            cur_agc = (phy_data >> IGP02E1000_AGC_LENGTH_SHIFT) &
-                      IGP02E1000_AGC_LENGTH_MASK;
+            cur_agc_index = (phy_data >> IGP02E1000_AGC_LENGTH_SHIFT) &
+                            IGP02E1000_AGC_LENGTH_MASK;
 
-            /* Remove min & max AGC values from calculation. */
-            if (e1000_igp_2_cable_length_table[min_agc] > e1000_igp_2_cable_length_table[cur_agc])
-                min_agc = cur_agc;
-            if (e1000_igp_2_cable_length_table[max_agc] < e1000_igp_2_cable_length_table[cur_agc])
-                max_agc = cur_agc;
+            /* Array index bound check. */
+            if ((cur_agc_index >= IGP02E1000_AGC_LENGTH_TABLE_SIZE) ||
+                (cur_agc_index == 0))
+                return -E1000_ERR_PHY;
 
-            agc_value += e1000_igp_2_cable_length_table[cur_agc];
+            /* Remove min & max AGC values from calculation. */
+            if (e1000_igp_2_cable_length_table[min_agc_index] >
+                e1000_igp_2_cable_length_table[cur_agc_index])
+                min_agc_index = cur_agc_index;
+            if (e1000_igp_2_cable_length_table[max_agc_index] <
+                e1000_igp_2_cable_length_table[cur_agc_index])
+                max_agc_index = cur_agc_index;
+
+            agc_value += e1000_igp_2_cable_length_table[cur_agc_index];
         }
 
-        agc_value -= (e1000_igp_2_cable_length_table[min_agc] + e1000_igp_2_cable_length_table[max_agc]);
+        agc_value -= (e1000_igp_2_cable_length_table[min_agc_index] +
+                      e1000_igp_2_cable_length_table[max_agc_index]);
         agc_value /= (IGP02E1000_PHY_CHANNEL_NUM - 2);
 
         /* Calculate cable length with the error range of +/- 10 meters. */
@@ -6203,7 +6874,8 @@ e1000_check_polarity(struct e1000_hw *hw,
             return ret_val;
         *polarity = (phy_data & M88E1000_PSSR_REV_POLARITY) >>
                     M88E1000_PSSR_REV_POLARITY_SHIFT;
-    } else if(hw->phy_type == e1000_phy_igp ||
+    } else if (hw->phy_type == e1000_phy_igp ||
+              hw->phy_type == e1000_phy_igp_3 ||
               hw->phy_type == e1000_phy_igp_2) {
         /* Read the Status register to check the speed */
         ret_val = e1000_read_phy_reg(hw, IGP01E1000_PHY_PORT_STATUS,
@@ -6229,6 +6901,13 @@ e1000_check_polarity(struct e1000_hw *hw,
              * 100 Mbps this bit is always 0) */
             *polarity = phy_data & IGP01E1000_PSSR_POLARITY_REVERSED;
         }
+    } else if (hw->phy_type == e1000_phy_ife) {
+        ret_val = e1000_read_phy_reg(hw, IFE_PHY_EXTENDED_STATUS_CONTROL,
+                                     &phy_data);
+        if (ret_val)
+            return ret_val;
+        *polarity = (phy_data & IFE_PESC_POLARITY_REVERSED) >>
+                           IFE_PESC_POLARITY_REVERSED_SHIFT;
     }
     return E1000_SUCCESS;
 }
@@ -6256,7 +6935,8 @@ e1000_check_downshift(struct e1000_hw *hw)
 
     DEBUGFUNC("e1000_check_downshift");
 
-    if(hw->phy_type == e1000_phy_igp ||
+    if (hw->phy_type == e1000_phy_igp ||
+        hw->phy_type == e1000_phy_igp_3 ||
         hw->phy_type == e1000_phy_igp_2) {
         ret_val = e1000_read_phy_reg(hw, IGP01E1000_PHY_LINK_HEALTH,
                                      &phy_data);
@@ -6273,6 +6953,9 @@ e1000_check_downshift(struct e1000_hw *hw)
 
         hw->speed_downgraded = (phy_data & M88E1000_PSSR_DOWNSHIFT) >>
                                M88E1000_PSSR_DOWNSHIFT_SHIFT;
+    } else if (hw->phy_type == e1000_phy_ife) {
+        /* e1000_phy_ife supports 10/100 speed only */
+        hw->speed_downgraded = FALSE;
     }
 
     return E1000_SUCCESS;
@@ -6317,7 +7000,9 @@ e1000_config_dsp_after_link_change(struct e1000_hw *hw,
 
         if(speed == SPEED_1000) {
 
-            e1000_get_cable_length(hw, &min_length, &max_length);
+            ret_val = e1000_get_cable_length(hw, &min_length, &max_length);
+            if (ret_val)
+                return ret_val;
 
             if((hw->dsp_config_state == e1000_dsp_config_enabled) &&
                 min_length >= e1000_igp_cable_length_50) {
@@ -6525,20 +7210,27 @@ static int32_t
 e1000_set_d3_lplu_state(struct e1000_hw *hw,
                         boolean_t active)
 {
+    uint32_t phy_ctrl = 0;
     int32_t ret_val;
     uint16_t phy_data;
     DEBUGFUNC("e1000_set_d3_lplu_state");
 
-    if(hw->phy_type != e1000_phy_igp && hw->phy_type != e1000_phy_igp_2)
+    if (hw->phy_type != e1000_phy_igp && hw->phy_type != e1000_phy_igp_2
+        && hw->phy_type != e1000_phy_igp_3)
         return E1000_SUCCESS;
 
     /* During driver activity LPLU should not be used or it will attain link
      * from the lowest speeds starting from 10Mbps. The capability is used for
      * Dx transitions and states */
-    if(hw->mac_type == e1000_82541_rev_2 || hw->mac_type == e1000_82547_rev_2) {
+    if (hw->mac_type == e1000_82541_rev_2 || hw->mac_type == e1000_82547_rev_2) {
         ret_val = e1000_read_phy_reg(hw, IGP01E1000_GMII_FIFO, &phy_data);
-        if(ret_val)
+        if (ret_val)
             return ret_val;
+    } else if (hw->mac_type == e1000_ich8lan) {
+        /* MAC writes into PHY register based on the state transition
+         * and start auto-negotiation. SW driver can overwrite the settings
+         * in CSR PHY power control E1000_PHY_CTRL register. */
+        phy_ctrl = E1000_READ_REG(hw, PHY_CTRL);
     } else {
         ret_val = e1000_read_phy_reg(hw, IGP02E1000_PHY_POWER_MGMT, &phy_data);
         if(ret_val)
@@ -6553,11 +7245,16 @@ e1000_set_d3_lplu_state(struct e1000_hw *hw,
             if(ret_val)
                 return ret_val;
         } else {
+            if (hw->mac_type == e1000_ich8lan) {
+                phy_ctrl &= ~E1000_PHY_CTRL_NOND0A_LPLU;
+                E1000_WRITE_REG(hw, PHY_CTRL, phy_ctrl);
+            } else {
                 phy_data &= ~IGP02E1000_PM_D3_LPLU;
                 ret_val = e1000_write_phy_reg(hw, IGP02E1000_PHY_POWER_MGMT,
                                               phy_data);
                 if (ret_val)
                     return ret_val;
+            }
         }
 
         /* LPLU and SmartSpeed are mutually exclusive.  LPLU is used during
@@ -6593,17 +7290,22 @@ e1000_set_d3_lplu_state(struct e1000_hw *hw,
               (hw->autoneg_advertised == AUTONEG_ADVERTISE_10_100_ALL)) {
 
         if(hw->mac_type == e1000_82541_rev_2 ||
-           hw->mac_type == e1000_82547_rev_2) {
+            hw->mac_type == e1000_82547_rev_2) {
             phy_data |= IGP01E1000_GMII_FLEX_SPD;
             ret_val = e1000_write_phy_reg(hw, IGP01E1000_GMII_FIFO, phy_data);
             if(ret_val)
                 return ret_val;
         } else {
+            if (hw->mac_type == e1000_ich8lan) {
+                phy_ctrl |= E1000_PHY_CTRL_NOND0A_LPLU;
+                E1000_WRITE_REG(hw, PHY_CTRL, phy_ctrl);
+            } else {
                 phy_data |= IGP02E1000_PM_D3_LPLU;
                 ret_val = e1000_write_phy_reg(hw, IGP02E1000_PHY_POWER_MGMT,
                                               phy_data);
                 if (ret_val)
                     return ret_val;
+            }
         }
 
         /* When LPLU is enabled we should disable SmartSpeed */
@@ -6638,6 +7340,7 @@ static int32_t
 e1000_set_d0_lplu_state(struct e1000_hw *hw,
                         boolean_t active)
 {
+    uint32_t phy_ctrl = 0;
     int32_t ret_val;
     uint16_t phy_data;
     DEBUGFUNC("e1000_set_d0_lplu_state");
@@ -6645,15 +7348,24 @@ e1000_set_d0_lplu_state(struct e1000_hw *hw,
     if(hw->mac_type <= e1000_82547_rev_2)
         return E1000_SUCCESS;
 
+    if (hw->mac_type == e1000_ich8lan) {
+        phy_ctrl = E1000_READ_REG(hw, PHY_CTRL);
+    } else {
         ret_val = e1000_read_phy_reg(hw, IGP02E1000_PHY_POWER_MGMT, &phy_data);
         if(ret_val)
             return ret_val;
+    }
 
     if (!active) {
+        if (hw->mac_type == e1000_ich8lan) {
+            phy_ctrl &= ~E1000_PHY_CTRL_D0A_LPLU;
+            E1000_WRITE_REG(hw, PHY_CTRL, phy_ctrl);
+        } else {
             phy_data &= ~IGP02E1000_PM_D0_LPLU;
             ret_val = e1000_write_phy_reg(hw, IGP02E1000_PHY_POWER_MGMT, phy_data);
             if (ret_val)
                 return ret_val;
+        }
 
         /* LPLU and SmartSpeed are mutually exclusive.  LPLU is used during
          * Dx states where the power conservation is most important.  During
@@ -6686,10 +7398,15 @@ e1000_set_d0_lplu_state(struct e1000_hw *hw,
 
     } else {
 
+        if (hw->mac_type == e1000_ich8lan) {
+            phy_ctrl |= E1000_PHY_CTRL_D0A_LPLU;
+            E1000_WRITE_REG(hw, PHY_CTRL, phy_ctrl);
+        } else {
             phy_data |= IGP02E1000_PM_D0_LPLU;
             ret_val = e1000_write_phy_reg(hw, IGP02E1000_PHY_POWER_MGMT, phy_data);
             if (ret_val)
                 return ret_val;
+        }
 
         /* When LPLU is enabled we should disable SmartSpeed */
         ret_val = e1000_read_phy_reg(hw, IGP01E1000_PHY_PORT_CONFIG, &phy_data);
@@ -6928,8 +7645,10 @@ e1000_mng_write_cmd_header(struct e1000_hw * hw,
 
     length >>= 2;
     /* The device driver writes the relevant command block into the ram area. */
-    for (i = 0; i < length; i++)
+    for (i = 0; i < length; i++) {
         E1000_WRITE_REG_ARRAY_DWORD(hw, HOST_IF, i, *((uint32_t *) hdr + i));
+        E1000_WRITE_FLUSH(hw);
+    }
 
     return E1000_SUCCESS;
 }
@@ -6961,15 +7680,18 @@ e1000_mng_write_commit(
  * returns  - TRUE when the mode is IAMT or FALSE.
  ****************************************************************************/
 boolean_t
-e1000_check_mng_mode(
-    struct e1000_hw *hw)
+e1000_check_mng_mode(struct e1000_hw *hw)
 {
     uint32_t fwsm;
 
     fwsm = E1000_READ_REG(hw, FWSM);
 
-    if((fwsm & E1000_FWSM_MODE_MASK) ==
-        (E1000_MNG_IAMT_MODE << E1000_FWSM_MODE_SHIFT))
+    if (hw->mac_type == e1000_ich8lan) {
+        if ((fwsm & E1000_FWSM_MODE_MASK) ==
+            (E1000_MNG_ICH_IAMT_MODE << E1000_FWSM_MODE_SHIFT))
+            return TRUE;
+    } else if ((fwsm & E1000_FWSM_MODE_MASK) ==
+               (E1000_MNG_IAMT_MODE << E1000_FWSM_MODE_SHIFT))
         return TRUE;
 
     return FALSE;
@@ -7209,7 +7931,6 @@ e1000_set_pci_express_master_disable(struct e1000_hw *hw)
     E1000_WRITE_REG(hw, CTRL, ctrl);
 }
 
-#if 0
 /***************************************************************************
  *
  * Enables PCI-Express master access.
@@ -7219,6 +7940,7 @@ e1000_set_pci_express_master_disable(struct e1000_hw *hw)
  * returns: - none.
  *
  ***************************************************************************/
+#if 0
 void
 e1000_enable_pciex_master(struct e1000_hw *hw)
 {
@@ -7299,8 +8021,10 @@ e1000_get_auto_rd_done(struct e1000_hw *hw)
     case e1000_82572:
     case e1000_82573:
     case e1000_80003es2lan:
-        while(timeout) {
-            if (E1000_READ_REG(hw, EECD) & E1000_EECD_AUTO_RD) break;
+    case e1000_ich8lan:
+        while (timeout) {
+            if (E1000_READ_REG(hw, EECD) & E1000_EECD_AUTO_RD)
+                break;
             else msec_delay(1);
             timeout--;
         }
@@ -7340,7 +8064,7 @@ e1000_get_phy_cfg_done(struct e1000_hw *hw)
 
     switch (hw->mac_type) {
     default:
-        msec_delay(10);
+        msec_delay_irq(10);
         break;
     case e1000_80003es2lan:
         /* Separate *_CFG_DONE_* bit for each port */
@@ -7457,7 +8181,7 @@ e1000_put_hw_eeprom_semaphore(struct e1000_hw *hw)
  *            E1000_SUCCESS at any other case.
  *
  ***************************************************************************/
-int32_t
+static int32_t
 e1000_get_software_semaphore(struct e1000_hw *hw)
 {
     int32_t timeout = hw->eeprom.word_size + 1;
@@ -7492,7 +8216,7 @@ e1000_get_software_semaphore(struct e1000_hw *hw)
  * hw: Struct containing variables accessed by shared code
  *
  ***************************************************************************/
-void
+static void
 e1000_release_software_semaphore(struct e1000_hw *hw)
 {
     uint32_t swsm;
@@ -7523,6 +8247,13 @@ int32_t
 e1000_check_phy_reset_block(struct e1000_hw *hw)
 {
     uint32_t manc = 0;
+    uint32_t fwsm = 0;
+
+    if (hw->mac_type == e1000_ich8lan) {
+        fwsm = E1000_READ_REG(hw, FWSM);
+        return (fwsm & E1000_FWSM_RSPCIPHY) ? E1000_SUCCESS
+                                            : E1000_BLK_PHY_RESET;
+    }
 
     if (hw->mac_type > e1000_82547_rev_2)
         manc = E1000_READ_REG(hw, MANC);
@@ -7549,6 +8280,8 @@ e1000_arc_subsystem_valid(struct e1000_hw *hw)
         if((fwsm & E1000_FWSM_MODE_MASK) != 0)
             return TRUE;
         break;
+    case e1000_ich8lan:
+        return TRUE;
     default:
         break;
     }
@@ -7556,4 +8289,854 @@ e1000_arc_subsystem_valid(struct e1000_hw *hw)
 }
 
 
+/******************************************************************************
+ * Configure PCI-Ex no-snoop
+ *
+ * hw - Struct containing variables accessed by shared code.
+ * no_snoop - Bitmap of no-snoop events.
+ *
+ * returns: E1000_SUCCESS
+ *
+ *****************************************************************************/
+static int32_t
+e1000_set_pci_ex_no_snoop(struct e1000_hw *hw, uint32_t no_snoop)
+{
+    uint32_t gcr_reg = 0;
+
+    DEBUGFUNC("e1000_set_pci_ex_no_snoop");
+
+    if (hw->bus_type == e1000_bus_type_unknown)
+        e1000_get_bus_info(hw);
+
+    if (hw->bus_type != e1000_bus_type_pci_express)
+        return E1000_SUCCESS;
+
+    if (no_snoop) {
+        gcr_reg = E1000_READ_REG(hw, GCR);
+        gcr_reg &= ~(PCI_EX_NO_SNOOP_ALL);
+        gcr_reg |= no_snoop;
+        E1000_WRITE_REG(hw, GCR, gcr_reg);
+    }
+    if (hw->mac_type == e1000_ich8lan) {
+        uint32_t ctrl_ext;
+
+        E1000_WRITE_REG(hw, GCR, PCI_EX_82566_SNOOP_ALL);
+
+        ctrl_ext = E1000_READ_REG(hw, CTRL_EXT);
+        ctrl_ext |= E1000_CTRL_EXT_RO_DIS;
+        E1000_WRITE_REG(hw, CTRL_EXT, ctrl_ext);
+    }
+
+    return E1000_SUCCESS;
+}
+
+/***************************************************************************
+ *
+ * Get software semaphore FLAG bit (SWFLAG).
+ * SWFLAG is used to synchronize the access to all shared resource between
+ * SW, FW and HW.
+ *
+ * hw: Struct containing variables accessed by shared code
+ *
+ ***************************************************************************/
+static int32_t
+e1000_get_software_flag(struct e1000_hw *hw)
+{
+    int32_t timeout = PHY_CFG_TIMEOUT;
+    uint32_t extcnf_ctrl;
+
+    DEBUGFUNC("e1000_get_software_flag");
+
+    if (hw->mac_type == e1000_ich8lan) {
+        while (timeout) {
+            extcnf_ctrl = E1000_READ_REG(hw, EXTCNF_CTRL);
+            extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+            E1000_WRITE_REG(hw, EXTCNF_CTRL, extcnf_ctrl);
+
+            extcnf_ctrl = E1000_READ_REG(hw, EXTCNF_CTRL);
+            if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
+                break;
+            msec_delay_irq(1);
+            timeout--;
+        }
+
+        if (!timeout) {
+            DEBUGOUT("FW or HW locks the resource too long.\n");
+            return -E1000_ERR_CONFIG;
+        }
+    }
+
+    return E1000_SUCCESS;
+}
+
+/***************************************************************************
+ *
+ * Release software semaphore FLAG bit (SWFLAG).
+ * SWFLAG is used to synchronize the access to all shared resource between
+ * SW, FW and HW.
+ *
+ * hw: Struct containing variables accessed by shared code
+ *
+ ***************************************************************************/
+static void
+e1000_release_software_flag(struct e1000_hw *hw)
+{
+    uint32_t extcnf_ctrl;
+
+    DEBUGFUNC("e1000_release_software_flag");
+
+    if (hw->mac_type == e1000_ich8lan) {
+        extcnf_ctrl= E1000_READ_REG(hw, EXTCNF_CTRL);
+        extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
+        E1000_WRITE_REG(hw, EXTCNF_CTRL, extcnf_ctrl);
+    }
+
+    return;
+}
+
+/***************************************************************************
+ *
+ * Disable dynamic power down mode in ife PHY.
+ * It can be used to workaround band-gap problem.
+ *
+ * hw: Struct containing variables accessed by shared code
+ *
+ ***************************************************************************/
+#if 0
+int32_t
+e1000_ife_disable_dynamic_power_down(struct e1000_hw *hw)
+{
+    uint16_t phy_data;
+    int32_t ret_val = E1000_SUCCESS;
+
+    DEBUGFUNC("e1000_ife_disable_dynamic_power_down");
+
+    if (hw->phy_type == e1000_phy_ife) {
+        ret_val = e1000_read_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL, &phy_data);
+        if (ret_val)
+            return ret_val;
+
+        phy_data |=  IFE_PSC_DISABLE_DYNAMIC_POWER_DOWN;
+        ret_val = e1000_write_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL, phy_data);
+    }
+
+    return ret_val;
+}
+#endif  /*  0  */
+
+/***************************************************************************
+ *
+ * Enable dynamic power down mode in ife PHY.
+ * It can be used to workaround band-gap problem.
+ *
+ * hw: Struct containing variables accessed by shared code
+ *
+ ***************************************************************************/
+#if 0
+int32_t
+e1000_ife_enable_dynamic_power_down(struct e1000_hw *hw)
+{
+    uint16_t phy_data;
+    int32_t ret_val = E1000_SUCCESS;
+
+    DEBUGFUNC("e1000_ife_enable_dynamic_power_down");
+
+    if (hw->phy_type == e1000_phy_ife) {
+        ret_val = e1000_read_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL, &phy_data);
+        if (ret_val)
+            return ret_val;
+
+        phy_data &=  ~IFE_PSC_DISABLE_DYNAMIC_POWER_DOWN;
+        ret_val = e1000_write_phy_reg(hw, IFE_PHY_SPECIAL_CONTROL, phy_data);
+    }
+
+    return ret_val;
+}
+#endif  /*  0  */
+
+/******************************************************************************
+ * Reads a 16 bit word or words from the EEPROM using the ICH8's flash access
+ * register.
+ *
+ * hw - Struct containing variables accessed by shared code
+ * offset - offset of word in the EEPROM to read
+ * data - word read from the EEPROM
+ * words - number of words to read
+ *****************************************************************************/
+static int32_t
+e1000_read_eeprom_ich8(struct e1000_hw *hw, uint16_t offset, uint16_t words,
+                       uint16_t *data)
+{
+    int32_t  error = E1000_SUCCESS;
+    uint32_t flash_bank = 0;
+    uint32_t act_offset = 0;
+    uint32_t bank_offset = 0;
+    uint16_t word = 0;
+    uint16_t i = 0;
+
+    /* We need to know which is the valid flash bank.  In the event
+     * that we didn't allocate eeprom_shadow_ram, we may not be
+     * managing flash_bank.  So it cannot be trusted and needs
+     * to be updated with each read.
+     */
+    /* Value of bit 22 corresponds to the flash bank we're on. */
+    flash_bank = (E1000_READ_REG(hw, EECD) & E1000_EECD_SEC1VAL) ? 1 : 0;
+
+    /* Adjust offset appropriately if we're on bank 1 - adjust for word size */
+    bank_offset = flash_bank * (hw->flash_bank_size * 2);
+
+    error = e1000_get_software_flag(hw);
+    if (error != E1000_SUCCESS)
+        return error;
+
+    for (i = 0; i < words; i++) {
+        if (hw->eeprom_shadow_ram != NULL &&
+            hw->eeprom_shadow_ram[offset+i].modified == TRUE) {
+            data[i] = hw->eeprom_shadow_ram[offset+i].eeprom_word;
+        } else {
+            /* The NVM part needs a byte offset, hence * 2 */
+            act_offset = bank_offset + ((offset + i) * 2);
+            error = e1000_read_ich8_word(hw, act_offset, &word);
+            if (error != E1000_SUCCESS)
+                break;
+            data[i] = word;
+        }
+    }
+
+    e1000_release_software_flag(hw);
+
+    return error;
+}
+
+/******************************************************************************
+ * Writes a 16 bit word or words to the EEPROM using the ICH8's flash access
+ * register.  Actually, writes are written to the shadow ram cache in the hw
+ * structure hw->e1000_shadow_ram.  e1000_commit_shadow_ram flushes this to
+ * the NVM, which occurs when the NVM checksum is updated.
+ *
+ * hw - Struct containing variables accessed by shared code
+ * offset - offset of word in the EEPROM to write
+ * words - number of words to write
+ * data - words to write to the EEPROM
+ *****************************************************************************/
+static int32_t
+e1000_write_eeprom_ich8(struct e1000_hw *hw, uint16_t offset, uint16_t words,
+                        uint16_t *data)
+{
+    uint32_t i = 0;
+    int32_t error = E1000_SUCCESS;
+
+    error = e1000_get_software_flag(hw);
+    if (error != E1000_SUCCESS)
+        return error;
+
+    /* A driver can write to the NVM only if it has eeprom_shadow_ram
+     * allocated.  Subsequent reads to the modified words are read from
+     * this cached structure as well.  Writes will only go into this
+     * cached structure unless it's followed by a call to
+     * e1000_update_eeprom_checksum() where it will commit the changes
+     * and clear the "modified" field.
+     */
+    if (hw->eeprom_shadow_ram != NULL) {
+        for (i = 0; i < words; i++) {
+            if ((offset + i) < E1000_SHADOW_RAM_WORDS) {
+                hw->eeprom_shadow_ram[offset+i].modified = TRUE;
+                hw->eeprom_shadow_ram[offset+i].eeprom_word = data[i];
+            } else {
+                error = -E1000_ERR_EEPROM;
+                break;
+            }
+        }
+    } else {
+        /* Drivers have the option to not allocate eeprom_shadow_ram as long
+         * as they don't perform any NVM writes.  An attempt in doing so
+         * will result in this error.
+         */
+        error = -E1000_ERR_EEPROM;
+    }
+
+    e1000_release_software_flag(hw);
+
+    return error;
+}
+
+/******************************************************************************
+ * This function does initial flash setup so that a new read/write/erase cycle
+ * can be started.
+ *
+ * hw - The pointer to the hw structure
+ ****************************************************************************/
+static int32_t
+e1000_ich8_cycle_init(struct e1000_hw *hw)
+{
+    union ich8_hws_flash_status hsfsts;
+    int32_t error = E1000_ERR_EEPROM;
+    int32_t i     = 0;
+
+    DEBUGFUNC("e1000_ich8_cycle_init");
+
+    hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+
+    /* May be check the Flash Des Valid bit in Hw status */
+    if (hsfsts.hsf_status.fldesvalid == 0) {
+        DEBUGOUT("Flash descriptor invalid.  SW Sequencing must be used.");
+        return error;
+    }
+
+    /* Clear FCERR in Hw status by writing 1 */
+    /* Clear DAEL in Hw status by writing a 1 */
+    hsfsts.hsf_status.flcerr = 1;
+    hsfsts.hsf_status.dael = 1;
+
+    E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFSTS, hsfsts.regval);
+
+    /* Either we should have a hardware SPI cycle in progress bit to check
+     * against, in order to start a new cycle or FDONE bit should be changed
+     * in the hardware so that it is 1 after harware reset, which can then be
+     * used as an indication whether a cycle is in progress or has been
+     * completed .. we should also have some software semaphore mechanism to
+     * guard FDONE or the cycle in progress bit so that two threads access to
+     * those bits can be sequentiallized or a way so that 2 threads dont
+     * start the cycle at the same time */
+
+    if (hsfsts.hsf_status.flcinprog == 0) {
+        /* There is no cycle running at present, so we can start a cycle */
+        /* Begin by setting Flash Cycle Done. */
+        hsfsts.hsf_status.flcdone = 1;
+        E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFSTS, hsfsts.regval);
+        error = E1000_SUCCESS;
+    } else {
+        /* otherwise poll for sometime so the current cycle has a chance
+         * to end before giving up. */
+        for (i = 0; i < ICH8_FLASH_COMMAND_TIMEOUT; i++) {
+            hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+            if (hsfsts.hsf_status.flcinprog == 0) {
+                error = E1000_SUCCESS;
+                break;
+            }
+            udelay(1);
+        }
+        if (error == E1000_SUCCESS) {
+            /* Successful in waiting for previous cycle to timeout,
+             * now set the Flash Cycle Done. */
+            hsfsts.hsf_status.flcdone = 1;
+            E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFSTS, hsfsts.regval);
+        } else {
+            DEBUGOUT("Flash controller busy, cannot get access");
+        }
+    }
+    return error;
+}
+
+/******************************************************************************
+ * This function starts a flash cycle and waits for its completion
+ *
+ * hw - The pointer to the hw structure
+ ****************************************************************************/
+static int32_t
+e1000_ich8_flash_cycle(struct e1000_hw *hw, uint32_t timeout)
+{
+    union ich8_hws_flash_ctrl hsflctl;
+    union ich8_hws_flash_status hsfsts;
+    int32_t error = E1000_ERR_EEPROM;
+    uint32_t i = 0;
+
+    /* Start a cycle by writing 1 in Flash Cycle Go in Hw Flash Control */
+    hsflctl.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFCTL);
+    hsflctl.hsf_ctrl.flcgo = 1;
+    E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFCTL, hsflctl.regval);
+
+    /* wait till FDONE bit is set to 1 */
+    do {
+        hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+        if (hsfsts.hsf_status.flcdone == 1)
+            break;
+        udelay(1);
+        i++;
+    } while (i < timeout);
+    if (hsfsts.hsf_status.flcdone == 1 && hsfsts.hsf_status.flcerr == 0) {
+        error = E1000_SUCCESS;
+    }
+    return error;
+}
+
+/******************************************************************************
+ * Reads a byte or word from the NVM using the ICH8 flash access registers.
+ *
+ * hw - The pointer to the hw structure
+ * index - The index of the byte or word to read.
+ * size - Size of data to read, 1=byte 2=word
+ * data - Pointer to the word to store the value read.
+ *****************************************************************************/
+static int32_t
+e1000_read_ich8_data(struct e1000_hw *hw, uint32_t index,
+                     uint32_t size, uint16_t* data)
+{
+    union ich8_hws_flash_status hsfsts;
+    union ich8_hws_flash_ctrl hsflctl;
+    uint32_t flash_linear_address;
+    uint32_t flash_data = 0;
+    int32_t error = -E1000_ERR_EEPROM;
+    int32_t count = 0;
+
+    DEBUGFUNC("e1000_read_ich8_data");
+
+    if (size < 1  || size > 2 || data == 0x0 ||
+        index > ICH8_FLASH_LINEAR_ADDR_MASK)
+        return error;
+
+    flash_linear_address = (ICH8_FLASH_LINEAR_ADDR_MASK & index) +
+                           hw->flash_base_addr;
+
+    do {
+        udelay(1);
+        /* Steps */
+        error = e1000_ich8_cycle_init(hw);
+        if (error != E1000_SUCCESS)
+            break;
+
+        hsflctl.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFCTL);
+        /* 0b/1b corresponds to 1 or 2 byte size, respectively. */
+        hsflctl.hsf_ctrl.fldbcount = size - 1;
+        hsflctl.hsf_ctrl.flcycle = ICH8_CYCLE_READ;
+        E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFCTL, hsflctl.regval);
+
+        /* Write the last 24 bits of index into Flash Linear address field in
+         * Flash Address */
+        /* TODO: TBD maybe check the index against the size of flash */
+
+        E1000_WRITE_ICH8_REG(hw, ICH8_FLASH_FADDR, flash_linear_address);
+
+        error = e1000_ich8_flash_cycle(hw, ICH8_FLASH_COMMAND_TIMEOUT);
+
+        /* Check if FCERR is set to 1, if set to 1, clear it and try the whole
+         * sequence a few more times, else read in (shift in) the Flash Data0,
+         * the order is least significant byte first msb to lsb */
+        if (error == E1000_SUCCESS) {
+            flash_data = E1000_READ_ICH8_REG(hw, ICH8_FLASH_FDATA0);
+            if (size == 1) {
+                *data = (uint8_t)(flash_data & 0x000000FF);
+            } else if (size == 2) {
+                *data = (uint16_t)(flash_data & 0x0000FFFF);
+            }
+            break;
+        } else {
+            /* If we've gotten here, then things are probably completely hosed,
+             * but if the error condition is detected, it won't hurt to give
+             * it another try...ICH8_FLASH_CYCLE_REPEAT_COUNT times.
+             */
+            hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+            if (hsfsts.hsf_status.flcerr == 1) {
+                /* Repeat for some time before giving up. */
+                continue;
+            } else if (hsfsts.hsf_status.flcdone == 0) {
+                DEBUGOUT("Timeout error - flash cycle did not complete.");
+                break;
+            }
+        }
+    } while (count++ < ICH8_FLASH_CYCLE_REPEAT_COUNT);
+
+    return error;
+}
+
+/******************************************************************************
+ * Writes One /two bytes to the NVM using the ICH8 flash access registers.
+ *
+ * hw - The pointer to the hw structure
+ * index - The index of the byte/word to read.
+ * size - Size of data to read, 1=byte 2=word
+ * data - The byte(s) to write to the NVM.
+ *****************************************************************************/
+static int32_t
+e1000_write_ich8_data(struct e1000_hw *hw, uint32_t index, uint32_t size,
+                      uint16_t data)
+{
+    union ich8_hws_flash_status hsfsts;
+    union ich8_hws_flash_ctrl hsflctl;
+    uint32_t flash_linear_address;
+    uint32_t flash_data = 0;
+    int32_t error = -E1000_ERR_EEPROM;
+    int32_t count = 0;
+
+    DEBUGFUNC("e1000_write_ich8_data");
+
+    if (size < 1  || size > 2 || data > size * 0xff ||
+        index > ICH8_FLASH_LINEAR_ADDR_MASK)
+        return error;
+
+    flash_linear_address = (ICH8_FLASH_LINEAR_ADDR_MASK & index) +
+                           hw->flash_base_addr;
+
+    do {
+        udelay(1);
+        /* Steps */
+        error = e1000_ich8_cycle_init(hw);
+        if (error != E1000_SUCCESS)
+            break;
+
+        hsflctl.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFCTL);
+        /* 0b/1b corresponds to 1 or 2 byte size, respectively. */
+        hsflctl.hsf_ctrl.fldbcount = size -1;
+        hsflctl.hsf_ctrl.flcycle = ICH8_CYCLE_WRITE;
+        E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFCTL, hsflctl.regval);
+
+        /* Write the last 24 bits of index into Flash Linear address field in
+         * Flash Address */
+        E1000_WRITE_ICH8_REG(hw, ICH8_FLASH_FADDR, flash_linear_address);
+
+        if (size == 1)
+            flash_data = (uint32_t)data & 0x00FF;
+        else
+            flash_data = (uint32_t)data;
+
+        E1000_WRITE_ICH8_REG(hw, ICH8_FLASH_FDATA0, flash_data);
+
+        /* check if FCERR is set to 1 , if set to 1, clear it and try the whole
+         * sequence a few more times else done */
+        error = e1000_ich8_flash_cycle(hw, ICH8_FLASH_COMMAND_TIMEOUT);
+        if (error == E1000_SUCCESS) {
+            break;
+        } else {
+            /* If we're here, then things are most likely completely hosed,
+             * but if the error condition is detected, it won't hurt to give
+             * it another try...ICH8_FLASH_CYCLE_REPEAT_COUNT times.
+             */
+            hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+            if (hsfsts.hsf_status.flcerr == 1) {
+                /* Repeat for some time before giving up. */
+                continue;
+            } else if (hsfsts.hsf_status.flcdone == 0) {
+                DEBUGOUT("Timeout error - flash cycle did not complete.");
+                break;
+            }
+        }
+    } while (count++ < ICH8_FLASH_CYCLE_REPEAT_COUNT);
+
+    return error;
+}
+
+/******************************************************************************
+ * Reads a single byte from the NVM using the ICH8 flash access registers.
+ *
+ * hw - pointer to e1000_hw structure
+ * index - The index of the byte to read.
+ * data - Pointer to a byte to store the value read.
+ *****************************************************************************/
+static int32_t
+e1000_read_ich8_byte(struct e1000_hw *hw, uint32_t index, uint8_t* data)
+{
+    int32_t status = E1000_SUCCESS;
+    uint16_t word = 0;
+
+    status = e1000_read_ich8_data(hw, index, 1, &word);
+    if (status == E1000_SUCCESS) {
+        *data = (uint8_t)word;
+    }
+
+    return status;
+}
+
+/******************************************************************************
+ * Writes a single byte to the NVM using the ICH8 flash access registers.
+ * Performs verification by reading back the value and then going through
+ * a retry algorithm before giving up.
+ *
+ * hw - pointer to e1000_hw structure
+ * index - The index of the byte to write.
+ * byte - The byte to write to the NVM.
+ *****************************************************************************/
+static int32_t
+e1000_verify_write_ich8_byte(struct e1000_hw *hw, uint32_t index, uint8_t byte)
+{
+    int32_t error = E1000_SUCCESS;
+    int32_t program_retries;
+    uint8_t temp_byte;
+
+    e1000_write_ich8_byte(hw, index, byte);
+    udelay(100);
+
+    for (program_retries = 0; program_retries < 100; program_retries++) {
+        e1000_read_ich8_byte(hw, index, &temp_byte);
+        if (temp_byte == byte)
+            break;
+        udelay(10);
+        e1000_write_ich8_byte(hw, index, byte);
+        udelay(100);
+    }
+    if (program_retries == 100)
+        error = E1000_ERR_EEPROM;
+
+    return error;
+}
+
+/******************************************************************************
+ * Writes a single byte to the NVM using the ICH8 flash access registers.
+ *
+ * hw - pointer to e1000_hw structure
+ * index - The index of the byte to read.
+ * data - The byte to write to the NVM.
+ *****************************************************************************/
+static int32_t
+e1000_write_ich8_byte(struct e1000_hw *hw, uint32_t index, uint8_t data)
+{
+    int32_t status = E1000_SUCCESS;
+    uint16_t word = (uint16_t)data;
+
+    status = e1000_write_ich8_data(hw, index, 1, word);
+
+    return status;
+}
+
+/******************************************************************************
+ * Reads a word from the NVM using the ICH8 flash access registers.
+ *
+ * hw - pointer to e1000_hw structure
+ * index - The starting byte index of the word to read.
+ * data - Pointer to a word to store the value read.
+ *****************************************************************************/
+static int32_t
+e1000_read_ich8_word(struct e1000_hw *hw, uint32_t index, uint16_t *data)
+{
+    int32_t status = E1000_SUCCESS;
+    status = e1000_read_ich8_data(hw, index, 2, data);
+    return status;
+}
+
+/******************************************************************************
+ * Writes a word to the NVM using the ICH8 flash access registers.
+ *
+ * hw - pointer to e1000_hw structure
+ * index - The starting byte index of the word to read.
+ * data - The word to write to the NVM.
+ *****************************************************************************/
+#if 0
+int32_t
+e1000_write_ich8_word(struct e1000_hw *hw, uint32_t index, uint16_t data)
+{
+    int32_t status = E1000_SUCCESS;
+    status = e1000_write_ich8_data(hw, index, 2, data);
+    return status;
+}
+#endif  /*  0  */
+
+/******************************************************************************
+ * Erases the bank specified. Each bank is a 4k block. Segments are 0 based.
+ * segment N is 4096 * N + flash_reg_addr.
+ *
+ * hw - pointer to e1000_hw structure
+ * segment - 0 for first segment, 1 for second segment, etc.
+ *****************************************************************************/
+static int32_t
+e1000_erase_ich8_4k_segment(struct e1000_hw *hw, uint32_t segment)
+{
+    union ich8_hws_flash_status hsfsts;
+    union ich8_hws_flash_ctrl hsflctl;
+    uint32_t flash_linear_address;
+    int32_t  count = 0;
+    int32_t  error = E1000_ERR_EEPROM;
+    int32_t  iteration, seg_size;
+    int32_t  sector_size;
+    int32_t  j = 0;
+    int32_t  error_flag = 0;
+
+    hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+
+    /* Determine HW Sector size: Read BERASE bits of Hw flash Status register */
+    /* 00: The Hw sector is 256 bytes, hence we need to erase 16
+     *     consecutive sectors.  The start index for the nth Hw sector can be
+     *     calculated as = segment * 4096 + n * 256
+     * 01: The Hw sector is 4K bytes, hence we need to erase 1 sector.
+     *     The start index for the nth Hw sector can be calculated
+     *     as = segment * 4096
+     * 10: Error condition
+     * 11: The Hw sector size is much bigger than the size asked to
+     *     erase...error condition */
+    if (hsfsts.hsf_status.berasesz == 0x0) {
+        /* Hw sector size 256 */
+        sector_size = seg_size = ICH8_FLASH_SEG_SIZE_256;
+        iteration = ICH8_FLASH_SECTOR_SIZE / ICH8_FLASH_SEG_SIZE_256;
+    } else if (hsfsts.hsf_status.berasesz == 0x1) {
+        sector_size = seg_size = ICH8_FLASH_SEG_SIZE_4K;
+        iteration = 1;
+    } else if (hsfsts.hsf_status.berasesz == 0x3) {
+        sector_size = seg_size = ICH8_FLASH_SEG_SIZE_64K;
+        iteration = 1;
+    } else {
+        return error;
+    }
+
+    for (j = 0; j < iteration ; j++) {
+        do {
+            count++;
+            /* Steps */
+            error = e1000_ich8_cycle_init(hw);
+            if (error != E1000_SUCCESS) {
+                error_flag = 1;
+                break;
+            }
+
+            /* Write a value 11 (block Erase) in Flash Cycle field in Hw flash
+             * Control */
+            hsflctl.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFCTL);
+            hsflctl.hsf_ctrl.flcycle = ICH8_CYCLE_ERASE;
+            E1000_WRITE_ICH8_REG16(hw, ICH8_FLASH_HSFCTL, hsflctl.regval);
+
+            /* Write the last 24 bits of an index within the block into Flash
+             * Linear address field in Flash Address.  This probably needs to
+             * be calculated here based off the on-chip segment size and the
+             * software segment size assumed (4K) */
+            /* TBD */
+            flash_linear_address = segment * sector_size + j * seg_size;
+            flash_linear_address &= ICH8_FLASH_LINEAR_ADDR_MASK;
+            flash_linear_address += hw->flash_base_addr;
+
+            E1000_WRITE_ICH8_REG(hw, ICH8_FLASH_FADDR, flash_linear_address);
+
+            error = e1000_ich8_flash_cycle(hw, 1000000);
+            /* Check if FCERR is set to 1.  If 1, clear it and try the whole
+             * sequence a few more times else Done */
+            if (error == E1000_SUCCESS) {
+                break;
+            } else {
+                hsfsts.regval = E1000_READ_ICH8_REG16(hw, ICH8_FLASH_HSFSTS);
+                if (hsfsts.hsf_status.flcerr == 1) {
+                    /* repeat for some time before giving up */
+                    continue;
+                } else if (hsfsts.hsf_status.flcdone == 0) {
+                    error_flag = 1;
+                    break;
+                }
+            }
+        } while ((count < ICH8_FLASH_CYCLE_REPEAT_COUNT) && !error_flag);
+        if (error_flag == 1)
+            break;
+    }
+    if (error_flag != 1)
+        error = E1000_SUCCESS;
+    return error;
+}
+
+/******************************************************************************
+ *
+ * Reverse duplex setting without breaking the link.
+ *
+ * hw: Struct containing variables accessed by shared code
+ *
+ *****************************************************************************/
+#if 0
+int32_t
+e1000_duplex_reversal(struct e1000_hw *hw)
+{
+    int32_t ret_val;
+    uint16_t phy_data;
+
+    if (hw->phy_type != e1000_phy_igp_3)
+        return E1000_SUCCESS;
+
+    ret_val = e1000_read_phy_reg(hw, PHY_CTRL, &phy_data);
+    if (ret_val)
+        return ret_val;
+
+    phy_data ^= MII_CR_FULL_DUPLEX;
+
+    ret_val = e1000_write_phy_reg(hw, PHY_CTRL, phy_data);
+    if (ret_val)
+        return ret_val;
+
+    ret_val = e1000_read_phy_reg(hw, IGP3E1000_PHY_MISC_CTRL, &phy_data);
+    if (ret_val)
+        return ret_val;
+
+    phy_data |= IGP3_PHY_MISC_DUPLEX_MANUAL_SET;
+    ret_val = e1000_write_phy_reg(hw, IGP3E1000_PHY_MISC_CTRL, phy_data);
+
+    return ret_val;
+}
+#endif  /*  0  */
+
+static int32_t
+e1000_init_lcd_from_nvm_config_region(struct e1000_hw *hw,
+                                      uint32_t cnf_base_addr, uint32_t cnf_size)
+{
+    uint32_t ret_val = E1000_SUCCESS;
+    uint16_t word_addr, reg_data, reg_addr;
+    uint16_t i;
+
+    /* cnf_base_addr is in DWORD */
+    word_addr = (uint16_t)(cnf_base_addr << 1);
+
+    /* cnf_size is returned in size of dwords */
+    for (i = 0; i < cnf_size; i++) {
+        ret_val = e1000_read_eeprom(hw, (word_addr + i*2), 1, &reg_data);
+        if (ret_val)
+            return ret_val;
+
+        ret_val = e1000_read_eeprom(hw, (word_addr + i*2 + 1), 1, &reg_addr);
+        if (ret_val)
+            return ret_val;
+
+        ret_val = e1000_get_software_flag(hw);
+        if (ret_val != E1000_SUCCESS)
+            return ret_val;
+
+        ret_val = e1000_write_phy_reg_ex(hw, (uint32_t)reg_addr, reg_data);
+
+        e1000_release_software_flag(hw);
+    }
+
+    return ret_val;
+}
+
+
+static int32_t
+e1000_init_lcd_from_nvm(struct e1000_hw *hw)
+{
+    uint32_t reg_data, cnf_base_addr, cnf_size, ret_val, loop;
+
+    if (hw->phy_type != e1000_phy_igp_3)
+          return E1000_SUCCESS;
+
+    /* Check if SW needs configure the PHY */
+    reg_data = E1000_READ_REG(hw, FEXTNVM);
+    if (!(reg_data & FEXTNVM_SW_CONFIG))
+        return E1000_SUCCESS;
+
+    /* Wait for basic configuration completes before proceeding*/
+    loop = 0;
+    do {
+        reg_data = E1000_READ_REG(hw, STATUS) & E1000_STATUS_LAN_INIT_DONE;
+        udelay(100);
+        loop++;
+    } while ((!reg_data) && (loop < 50));
+
+    /* Clear the Init Done bit for the next init event */
+    reg_data = E1000_READ_REG(hw, STATUS);
+    reg_data &= ~E1000_STATUS_LAN_INIT_DONE;
+    E1000_WRITE_REG(hw, STATUS, reg_data);
+
+    /* Make sure HW does not configure LCD from PHY extended configuration
+       before SW configuration */
+    reg_data = E1000_READ_REG(hw, EXTCNF_CTRL);
+    if ((reg_data & E1000_EXTCNF_CTRL_LCD_WRITE_ENABLE) == 0x0000) {
+        reg_data = E1000_READ_REG(hw, EXTCNF_SIZE);
+        cnf_size = reg_data & E1000_EXTCNF_SIZE_EXT_PCIE_LENGTH;
+        cnf_size >>= 16;
+        if (cnf_size) {
+            reg_data = E1000_READ_REG(hw, EXTCNF_CTRL);
+            cnf_base_addr = reg_data & E1000_EXTCNF_CTRL_EXT_CNF_POINTER;
+            /* cnf_base_addr is in DWORD */
+            cnf_base_addr >>= 16;
+
+            /* Configure LCD from extended configuration region. */
+            ret_val = e1000_init_lcd_from_nvm_config_region(hw, cnf_base_addr,
+                                                            cnf_size);
+            if (ret_val)
+                return ret_val;
+        }
+    }
+
+    return E1000_SUCCESS;
+}
+
+
 
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index 467c9ed944f8..375b95518c31 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -62,6 +62,7 @@ typedef enum {
     e1000_82572,
     e1000_82573,
     e1000_80003es2lan,
+    e1000_ich8lan,
     e1000_num_macs
 } e1000_mac_type;
 
@@ -70,6 +71,7 @@ typedef enum {
     e1000_eeprom_spi,
     e1000_eeprom_microwire,
     e1000_eeprom_flash,
+    e1000_eeprom_ich8,
     e1000_eeprom_none, /* No NVM support */
     e1000_num_eeprom_types
 } e1000_eeprom_type;
@@ -98,6 +100,11 @@ typedef enum {
     e1000_fc_default = 0xFF
 } e1000_fc_type;
 
+struct e1000_shadow_ram {
+    uint16_t    eeprom_word;
+    boolean_t   modified;
+};
+
 /* PCI bus types */
 typedef enum {
     e1000_bus_type_unknown = 0,
@@ -218,6 +225,8 @@ typedef enum {
     e1000_phy_igp,
     e1000_phy_igp_2,
     e1000_phy_gg82563,
+    e1000_phy_igp_3,
+    e1000_phy_ife,
     e1000_phy_undefined = 0xFF
 } e1000_phy_type;
 
@@ -313,10 +322,9 @@ int32_t e1000_read_phy_reg(struct e1000_hw *hw, uint32_t reg_addr, uint16_t *phy
 int32_t e1000_write_phy_reg(struct e1000_hw *hw, uint32_t reg_addr, uint16_t data);
 int32_t e1000_phy_hw_reset(struct e1000_hw *hw);
 int32_t e1000_phy_reset(struct e1000_hw *hw);
+void e1000_phy_powerdown_workaround(struct e1000_hw *hw);
 int32_t e1000_phy_get_info(struct e1000_hw *hw, struct e1000_phy_info *phy_info);
 int32_t e1000_validate_mdi_setting(struct e1000_hw *hw);
-int32_t e1000_read_kmrn_reg(struct e1000_hw *hw, uint32_t reg_addr, uint16_t *data);
-int32_t e1000_write_kmrn_reg(struct e1000_hw *hw, uint32_t reg_addr, uint16_t data);
 
 /* EEPROM Functions */
 int32_t e1000_init_eeprom_params(struct e1000_hw *hw);
@@ -331,6 +339,7 @@ uint32_t e1000_enable_mng_pass_thru(struct e1000_hw *hw);
 #define E1000_MNG_DHCP_COOKIE_OFFSET    0x6F0   /* Cookie offset */
 #define E1000_MNG_DHCP_COOKIE_LENGTH    0x10    /* Cookie length */
 #define E1000_MNG_IAMT_MODE             0x3
+#define E1000_MNG_ICH_IAMT_MODE         0x2
 #define E1000_IAMT_SIGNATURE            0x544D4149 /* Intel(R) Active Management Technology signature */
 
 #define E1000_MNG_DHCP_COOKIE_STATUS_PARSING_SUPPORT 0x1 /* DHCP parsing enabled */
@@ -386,11 +395,8 @@ int32_t e1000_update_eeprom_checksum(struct e1000_hw *hw);
 int32_t e1000_write_eeprom(struct e1000_hw *hw, uint16_t reg, uint16_t words, uint16_t *data);
 int32_t e1000_read_part_num(struct e1000_hw *hw, uint32_t * part_num);
 int32_t e1000_read_mac_addr(struct e1000_hw * hw);
-int32_t e1000_swfw_sync_acquire(struct e1000_hw *hw, uint16_t mask);
-void e1000_swfw_sync_release(struct e1000_hw *hw, uint16_t mask);
 
 /* Filters (multicast, vlan, receive) */
-void e1000_mc_addr_list_update(struct e1000_hw *hw, uint8_t * mc_addr_list, uint32_t mc_addr_count, uint32_t pad, uint32_t rar_used_count);
 uint32_t e1000_hash_mc_addr(struct e1000_hw *hw, uint8_t * mc_addr);
 void e1000_mta_set(struct e1000_hw *hw, uint32_t hash_value);
 void e1000_rar_set(struct e1000_hw *hw, uint8_t * mc_addr, uint32_t rar_index);
@@ -401,6 +407,7 @@ int32_t e1000_setup_led(struct e1000_hw *hw);
 int32_t e1000_cleanup_led(struct e1000_hw *hw);
 int32_t e1000_led_on(struct e1000_hw *hw);
 int32_t e1000_led_off(struct e1000_hw *hw);
+int32_t e1000_blink_led_start(struct e1000_hw *hw);
 
 /* Adaptive IFS Functions */
 
@@ -414,15 +421,16 @@ void e1000_pci_clear_mwi(struct e1000_hw *hw);
 void e1000_read_pci_cfg(struct e1000_hw *hw, uint32_t reg, uint16_t * value);
 void e1000_write_pci_cfg(struct e1000_hw *hw, uint32_t reg, uint16_t * value);
 /* Port I/O is only supported on 82544 and newer */
-uint32_t e1000_io_read(struct e1000_hw *hw, unsigned long port);
-uint32_t e1000_read_reg_io(struct e1000_hw *hw, uint32_t offset);
 void e1000_io_write(struct e1000_hw *hw, unsigned long port, uint32_t value);
-void e1000_enable_pciex_master(struct e1000_hw *hw);
 int32_t e1000_disable_pciex_master(struct e1000_hw *hw);
-int32_t e1000_get_software_semaphore(struct e1000_hw *hw);
-void e1000_release_software_semaphore(struct e1000_hw *hw);
 int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 
+
+#define E1000_READ_REG_IO(a, reg) \
+    e1000_read_reg_io((a), E1000_##reg)
+#define E1000_WRITE_REG_IO(a, reg, val) \
+    e1000_write_reg_io((a), E1000_##reg, val)
+
 /* PCI Device IDs */
 #define E1000_DEV_ID_82542               0x1000
 #define E1000_DEV_ID_82543GC_FIBER       0x1001
@@ -446,6 +454,7 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82546EB_QUAD_COPPER 0x101D
 #define E1000_DEV_ID_82541EI             0x1013
 #define E1000_DEV_ID_82541EI_MOBILE      0x1018
+#define E1000_DEV_ID_82541ER_LOM         0x1014
 #define E1000_DEV_ID_82541ER             0x1078
 #define E1000_DEV_ID_82547GI             0x1075
 #define E1000_DEV_ID_82541GI             0x1076
@@ -457,18 +466,28 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82546GB_PCIE        0x108A
 #define E1000_DEV_ID_82546GB_QUAD_COPPER 0x1099
 #define E1000_DEV_ID_82547EI             0x1019
+#define E1000_DEV_ID_82547EI_MOBILE      0x101A
 #define E1000_DEV_ID_82571EB_COPPER      0x105E
 #define E1000_DEV_ID_82571EB_FIBER       0x105F
 #define E1000_DEV_ID_82571EB_SERDES      0x1060
 #define E1000_DEV_ID_82572EI_COPPER      0x107D
 #define E1000_DEV_ID_82572EI_FIBER       0x107E
 #define E1000_DEV_ID_82572EI_SERDES      0x107F
+#define E1000_DEV_ID_82572EI             0x10B9
 #define E1000_DEV_ID_82573E              0x108B
 #define E1000_DEV_ID_82573E_IAMT         0x108C
 #define E1000_DEV_ID_82573L              0x109A
 #define E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3 0x10B5
 #define E1000_DEV_ID_80003ES2LAN_COPPER_DPT     0x1096
 #define E1000_DEV_ID_80003ES2LAN_SERDES_DPT     0x1098
+#define E1000_DEV_ID_80003ES2LAN_COPPER_SPT     0x10BA
+#define E1000_DEV_ID_80003ES2LAN_SERDES_SPT     0x10BB
+
+#define E1000_DEV_ID_ICH8_IGP_M_AMT      0x1049
+#define E1000_DEV_ID_ICH8_IGP_AMT        0x104A
+#define E1000_DEV_ID_ICH8_IGP_C          0x104B
+#define E1000_DEV_ID_ICH8_IFE            0x104C
+#define E1000_DEV_ID_ICH8_IGP_M          0x104D
 
 
 #define NODE_ADDRESS_SIZE 6
@@ -539,6 +558,14 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
     E1000_IMS_RXSEQ  |    \
     E1000_IMS_LSC)
 
+/* Additional interrupts need to be handled for e1000_ich8lan:
+    DSW = The FW changed the status of the DISSW bit in FWSM
+    PHYINT = The LAN connected device generates an interrupt
+    EPRST = Manageability reset event */
+#define IMS_ICH8LAN_ENABLE_MASK (\
+    E1000_IMS_DSW   | \
+    E1000_IMS_PHYINT | \
+    E1000_IMS_EPRST)
 
 /* Number of high/low register pairs in the RAR. The RAR (Receive Address
  * Registers) holds the directed and multicast addresses that we monitor. We
@@ -546,6 +573,7 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
  * E1000_RAR_ENTRIES - 1 multicast addresses.
  */
 #define E1000_RAR_ENTRIES 15
+#define E1000_RAR_ENTRIES_ICH8LAN  7
 
 #define MIN_NUMBER_OF_DESCRIPTORS 8
 #define MAX_NUMBER_OF_DESCRIPTORS 0xFFF8
@@ -767,6 +795,9 @@ struct e1000_data_desc {
 #define E1000_MC_TBL_SIZE          128  /* Multicast Filter Table (4096 bits) */
 #define E1000_VLAN_FILTER_TBL_SIZE 128  /* VLAN Filter Table (4096 bits) */
 
+#define E1000_NUM_UNICAST_ICH8LAN  7
+#define E1000_MC_TBL_SIZE_ICH8LAN  32
+
 
 /* Receive Address Register */
 struct e1000_rar {
@@ -776,6 +807,7 @@ struct e1000_rar {
 
 /* Number of entries in the Multicast Table Array (MTA). */
 #define E1000_NUM_MTA_REGISTERS 128
+#define E1000_NUM_MTA_REGISTERS_ICH8LAN 32
 
 /* IPv4 Address Table Entry */
 struct e1000_ipv4_at_entry {
@@ -786,6 +818,7 @@ struct e1000_ipv4_at_entry {
 /* Four wakeup IP addresses are supported */
 #define E1000_WAKEUP_IP_ADDRESS_COUNT_MAX 4
 #define E1000_IP4AT_SIZE                  E1000_WAKEUP_IP_ADDRESS_COUNT_MAX
+#define E1000_IP4AT_SIZE_ICH8LAN          3
 #define E1000_IP6AT_SIZE                  1
 
 /* IPv6 Address Table Entry */
@@ -844,6 +877,7 @@ struct e1000_ffvt_entry {
 #define E1000_FLA      0x0001C  /* Flash Access - RW */
 #define E1000_MDIC     0x00020  /* MDI Control - RW */
 #define E1000_SCTL     0x00024  /* SerDes Control - RW */
+#define E1000_FEXTNVM  0x00028  /* Future Extended NVM register */
 #define E1000_FCAL     0x00028  /* Flow Control Address Low - RW */
 #define E1000_FCAH     0x0002C  /* Flow Control Address High -RW */
 #define E1000_FCT      0x00030  /* Flow Control Type - RW */
@@ -872,6 +906,8 @@ struct e1000_ffvt_entry {
 #define E1000_LEDCTL   0x00E00  /* LED Control - RW */
 #define E1000_EXTCNF_CTRL  0x00F00  /* Extended Configuration Control */
 #define E1000_EXTCNF_SIZE  0x00F08  /* Extended Configuration Size */
+#define E1000_PHY_CTRL     0x00F10  /* PHY Control Register in CSR */
+#define FEXTNVM_SW_CONFIG  0x0001
 #define E1000_PBA      0x01000  /* Packet Buffer Allocation - RW */
 #define E1000_PBS      0x01008  /* Packet Buffer Size */
 #define E1000_EEMNGCTL 0x01010  /* MNG EEprom Control */
@@ -899,11 +935,13 @@ struct e1000_ffvt_entry {
 #define E1000_RDH0     E1000_RDH   /* RX Desc Head (0) - RW */
 #define E1000_RDT0     E1000_RDT   /* RX Desc Tail (0) - RW */
 #define E1000_RDTR0    E1000_RDTR  /* RX Delay Timer (0) - RW */
-#define E1000_RXDCTL   0x02828  /* RX Descriptor Control - RW */
+#define E1000_RXDCTL   0x02828  /* RX Descriptor Control queue 0 - RW */
+#define E1000_RXDCTL1  0x02928  /* RX Descriptor Control queue 1 - RW */
 #define E1000_RADV     0x0282C  /* RX Interrupt Absolute Delay Timer - RW */
 #define E1000_RSRPD    0x02C00  /* RX Small Packet Detect - RW */
 #define E1000_RAID     0x02C08  /* Receive Ack Interrupt Delay - RW */
 #define E1000_TXDMAC   0x03000  /* TX DMA Control - RW */
+#define E1000_KABGTXD  0x03004  /* AFE Band Gap Transmit Ref Data */
 #define E1000_TDFH     0x03410  /* TX Data FIFO Head - RW */
 #define E1000_TDFT     0x03418  /* TX Data FIFO Tail - RW */
 #define E1000_TDFHS    0x03420  /* TX Data FIFO Head Saved - RW */
@@ -1050,6 +1088,7 @@ struct e1000_ffvt_entry {
 #define E1000_82542_FLA      E1000_FLA
 #define E1000_82542_MDIC     E1000_MDIC
 #define E1000_82542_SCTL     E1000_SCTL
+#define E1000_82542_FEXTNVM  E1000_FEXTNVM
 #define E1000_82542_FCAL     E1000_FCAL
 #define E1000_82542_FCAH     E1000_FCAH
 #define E1000_82542_FCT      E1000_FCT
@@ -1073,6 +1112,19 @@ struct e1000_ffvt_entry {
 #define E1000_82542_RDLEN0   E1000_82542_RDLEN
 #define E1000_82542_RDH0     E1000_82542_RDH
 #define E1000_82542_RDT0     E1000_82542_RDT
+#define E1000_82542_SRRCTL(_n) (0x280C + ((_n) << 8)) /* Split and Replication
+                                                       * RX Control - RW */
+#define E1000_82542_DCA_RXCTRL(_n) (0x02814 + ((_n) << 8))
+#define E1000_82542_RDBAH3   0x02B04 /* RX Desc Base High Queue 3 - RW */
+#define E1000_82542_RDBAL3   0x02B00 /* RX Desc Low Queue 3 - RW */
+#define E1000_82542_RDLEN3   0x02B08 /* RX Desc Length Queue 3 - RW */
+#define E1000_82542_RDH3     0x02B10 /* RX Desc Head Queue 3 - RW */
+#define E1000_82542_RDT3     0x02B18 /* RX Desc Tail Queue 3 - RW */
+#define E1000_82542_RDBAL2   0x02A00 /* RX Desc Base Low Queue 2 - RW */
+#define E1000_82542_RDBAH2   0x02A04 /* RX Desc Base High Queue 2 - RW */
+#define E1000_82542_RDLEN2   0x02A08 /* RX Desc Length Queue 2 - RW */
+#define E1000_82542_RDH2     0x02A10 /* RX Desc Head Queue 2 - RW */
+#define E1000_82542_RDT2     0x02A18 /* RX Desc Tail Queue 2 - RW */
 #define E1000_82542_RDTR1    0x00130
 #define E1000_82542_RDBAL1   0x00138
 #define E1000_82542_RDBAH1   0x0013C
@@ -1110,11 +1162,14 @@ struct e1000_ffvt_entry {
 #define E1000_82542_FLOP     E1000_FLOP
 #define E1000_82542_EXTCNF_CTRL  E1000_EXTCNF_CTRL
 #define E1000_82542_EXTCNF_SIZE  E1000_EXTCNF_SIZE
+#define E1000_82542_PHY_CTRL E1000_PHY_CTRL
 #define E1000_82542_ERT      E1000_ERT
 #define E1000_82542_RXDCTL   E1000_RXDCTL
+#define E1000_82542_RXDCTL1  E1000_RXDCTL1
 #define E1000_82542_RADV     E1000_RADV
 #define E1000_82542_RSRPD    E1000_RSRPD
 #define E1000_82542_TXDMAC   E1000_TXDMAC
+#define E1000_82542_KABGTXD  E1000_KABGTXD
 #define E1000_82542_TDFHS    E1000_TDFHS
 #define E1000_82542_TDFTS    E1000_TDFTS
 #define E1000_82542_TDFPC    E1000_TDFPC
@@ -1310,13 +1365,16 @@ struct e1000_hw_stats {
 
 /* Structure containing variables used by the shared code (e1000_hw.c) */
 struct e1000_hw {
-    uint8_t __iomem *hw_addr;
+    uint8_t *hw_addr;
     uint8_t *flash_address;
     e1000_mac_type mac_type;
     e1000_phy_type phy_type;
     uint32_t phy_init_script;
     e1000_media_type media_type;
     void *back;
+    struct e1000_shadow_ram *eeprom_shadow_ram;
+    uint32_t flash_bank_size;
+    uint32_t flash_base_addr;
     e1000_fc_type fc;
     e1000_bus_speed bus_speed;
     e1000_bus_width bus_width;
@@ -1328,6 +1386,7 @@ struct e1000_hw {
     uint32_t asf_firmware_present;
     uint32_t eeprom_semaphore_present;
     uint32_t swfw_sync_present;
+    uint32_t swfwhw_semaphore_present;
     unsigned long io_base;
     uint32_t phy_id;
     uint32_t phy_revision;
@@ -1387,6 +1446,7 @@ struct e1000_hw {
     boolean_t in_ifs_mode;
     boolean_t mng_reg_access_disabled;
     boolean_t leave_av_bit_off;
+    boolean_t kmrn_lock_loss_workaround_disabled;
 };
 
 
@@ -1435,6 +1495,7 @@ struct e1000_hw {
 #define E1000_CTRL_RTE      0x20000000  /* Routing tag enable */
 #define E1000_CTRL_VME      0x40000000  /* IEEE VLAN mode enable */
 #define E1000_CTRL_PHY_RST  0x80000000  /* PHY Reset */
+#define E1000_CTRL_SW2FW_INT 0x02000000  /* Initiate an interrupt to manageability engine */
 
 /* Device Status */
 #define E1000_STATUS_FD         0x00000001      /* Full duplex.0=half,1=full */
@@ -1449,6 +1510,8 @@ struct e1000_hw {
 #define E1000_STATUS_SPEED_10   0x00000000      /* Speed 10Mb/s */
 #define E1000_STATUS_SPEED_100  0x00000040      /* Speed 100Mb/s */
 #define E1000_STATUS_SPEED_1000 0x00000080      /* Speed 1000Mb/s */
+#define E1000_STATUS_LAN_INIT_DONE 0x00000200   /* Lan Init Completion
+                                                   by EEPROM/Flash */
 #define E1000_STATUS_ASDV       0x00000300      /* Auto speed detect value */
 #define E1000_STATUS_DOCK_CI    0x00000800      /* Change in Dock/Undock state. Clear on write '0'. */
 #define E1000_STATUS_GIO_MASTER_ENABLE 0x00080000 /* Status of Master requests. */
@@ -1506,6 +1569,10 @@ struct e1000_hw {
 #define E1000_STM_OPCODE     0xDB00
 #define E1000_HICR_FW_RESET  0xC0
 
+#define E1000_SHADOW_RAM_WORDS     2048
+#define E1000_ICH8_NVM_SIG_WORD    0x13
+#define E1000_ICH8_NVM_SIG_MASK    0xC0
+
 /* EEPROM Read */
 #define E1000_EERD_START      0x00000001 /* Start Read */
 #define E1000_EERD_DONE       0x00000010 /* Read Done */
@@ -1551,7 +1618,6 @@ struct e1000_hw {
 #define E1000_CTRL_EXT_WR_WMARK_320   0x01000000
 #define E1000_CTRL_EXT_WR_WMARK_384   0x02000000
 #define E1000_CTRL_EXT_WR_WMARK_448   0x03000000
-#define E1000_CTRL_EXT_CANC           0x04000000  /* Interrupt delay cancellation */
 #define E1000_CTRL_EXT_DRV_LOAD       0x10000000  /* Driver loaded bit for FW */
 #define E1000_CTRL_EXT_IAME           0x08000000  /* Interrupt acknowledge Auto-mask */
 #define E1000_CTRL_EXT_INT_TIMER_CLR  0x20000000  /* Clear Interrupt timers after IMS clear */
@@ -1591,12 +1657,31 @@ struct e1000_hw {
 #define E1000_KUMCTRLSTA_FIFO_CTRL_TX_BYPASS   0x00000800
 
 /* In-Band Control */
+#define E1000_KUMCTRLSTA_INB_CTRL_LINK_STATUS_TX_TIMEOUT_DEFAULT    0x00000500
 #define E1000_KUMCTRLSTA_INB_CTRL_DIS_PADDING  0x00000010
 
 /* Half-Duplex Control */
 #define E1000_KUMCTRLSTA_HD_CTRL_10_100_DEFAULT 0x00000004
 #define E1000_KUMCTRLSTA_HD_CTRL_1000_DEFAULT  0x00000000
 
+#define E1000_KUMCTRLSTA_OFFSET_K0S_CTRL       0x0000001E
+
+#define E1000_KUMCTRLSTA_DIAG_FELPBK           0x2000
+#define E1000_KUMCTRLSTA_DIAG_NELPBK           0x1000
+
+#define E1000_KUMCTRLSTA_K0S_100_EN            0x2000
+#define E1000_KUMCTRLSTA_K0S_GBE_EN            0x1000
+#define E1000_KUMCTRLSTA_K0S_ENTRY_LATENCY_MASK   0x0003
+
+#define E1000_KABGTXD_BGSQLBIAS                0x00050000
+
+#define E1000_PHY_CTRL_SPD_EN                  0x00000001
+#define E1000_PHY_CTRL_D0A_LPLU                0x00000002
+#define E1000_PHY_CTRL_NOND0A_LPLU             0x00000004
+#define E1000_PHY_CTRL_NOND0A_GBE_DISABLE      0x00000008
+#define E1000_PHY_CTRL_GBE_DISABLE             0x00000040
+#define E1000_PHY_CTRL_B2B_EN                  0x00000080
+
 /* LED Control */
 #define E1000_LEDCTL_LED0_MODE_MASK       0x0000000F
 #define E1000_LEDCTL_LED0_MODE_SHIFT      0
@@ -1666,6 +1751,9 @@ struct e1000_hw {
 #define E1000_ICR_RXD_FIFO_PAR1 0x01000000 /* queue 1 Rx descriptor FIFO parity error */
 #define E1000_ICR_TXD_FIFO_PAR1 0x02000000 /* queue 1 Tx descriptor FIFO parity error */
 #define E1000_ICR_ALL_PARITY    0x03F00000 /* all parity error bits */
+#define E1000_ICR_DSW           0x00000020 /* FW changed the status of DISSW bit in the FWSM */
+#define E1000_ICR_PHYINT        0x00001000 /* LAN connected device generates an interrupt */
+#define E1000_ICR_EPRST         0x00100000 /* ME handware reset occurs */
 
 /* Interrupt Cause Set */
 #define E1000_ICS_TXDW      E1000_ICR_TXDW      /* Transmit desc written back */
@@ -1692,6 +1780,9 @@ struct e1000_hw {
 #define E1000_ICS_PB_PAR        E1000_ICR_PB_PAR        /* packet buffer parity error */
 #define E1000_ICS_RXD_FIFO_PAR1 E1000_ICR_RXD_FIFO_PAR1 /* queue 1 Rx descriptor FIFO parity error */
 #define E1000_ICS_TXD_FIFO_PAR1 E1000_ICR_TXD_FIFO_PAR1 /* queue 1 Tx descriptor FIFO parity error */
+#define E1000_ICS_DSW       E1000_ICR_DSW
+#define E1000_ICS_PHYINT    E1000_ICR_PHYINT
+#define E1000_ICS_EPRST     E1000_ICR_EPRST
 
 /* Interrupt Mask Set */
 #define E1000_IMS_TXDW      E1000_ICR_TXDW      /* Transmit desc written back */
@@ -1718,6 +1809,9 @@ struct e1000_hw {
 #define E1000_IMS_PB_PAR        E1000_ICR_PB_PAR        /* packet buffer parity error */
 #define E1000_IMS_RXD_FIFO_PAR1 E1000_ICR_RXD_FIFO_PAR1 /* queue 1 Rx descriptor FIFO parity error */
 #define E1000_IMS_TXD_FIFO_PAR1 E1000_ICR_TXD_FIFO_PAR1 /* queue 1 Tx descriptor FIFO parity error */
+#define E1000_IMS_DSW       E1000_ICR_DSW
+#define E1000_IMS_PHYINT    E1000_ICR_PHYINT
+#define E1000_IMS_EPRST     E1000_ICR_EPRST
 
 /* Interrupt Mask Clear */
 #define E1000_IMC_TXDW      E1000_ICR_TXDW      /* Transmit desc written back */
@@ -1744,6 +1838,9 @@ struct e1000_hw {
 #define E1000_IMC_PB_PAR        E1000_ICR_PB_PAR        /* packet buffer parity error */
 #define E1000_IMC_RXD_FIFO_PAR1 E1000_ICR_RXD_FIFO_PAR1 /* queue 1 Rx descriptor FIFO parity error */
 #define E1000_IMC_TXD_FIFO_PAR1 E1000_ICR_TXD_FIFO_PAR1 /* queue 1 Tx descriptor FIFO parity error */
+#define E1000_IMC_DSW       E1000_ICR_DSW
+#define E1000_IMC_PHYINT    E1000_ICR_PHYINT
+#define E1000_IMC_EPRST     E1000_ICR_EPRST
 
 /* Receive Control */
 #define E1000_RCTL_RST            0x00000001    /* Software reset */
@@ -1918,9 +2015,10 @@ struct e1000_hw {
 #define E1000_MRQC_RSS_FIELD_MASK           0xFFFF0000
 #define E1000_MRQC_RSS_FIELD_IPV4_TCP       0x00010000
 #define E1000_MRQC_RSS_FIELD_IPV4           0x00020000
-#define E1000_MRQC_RSS_FIELD_IPV6_TCP       0x00040000
+#define E1000_MRQC_RSS_FIELD_IPV6_TCP_EX    0x00040000
 #define E1000_MRQC_RSS_FIELD_IPV6_EX        0x00080000
 #define E1000_MRQC_RSS_FIELD_IPV6           0x00100000
+#define E1000_MRQC_RSS_FIELD_IPV6_TCP       0x00200000
 
 /* Definitions for power management and wakeup registers */
 /* Wake Up Control */
@@ -2010,6 +2108,15 @@ struct e1000_hw {
 #define E1000_FWSM_MODE_SHIFT            1
 #define E1000_FWSM_FW_VALID     0x00008000 /* FW established a valid mode */
 
+#define E1000_FWSM_RSPCIPHY        0x00000040 /* Reset PHY on PCI reset */
+#define E1000_FWSM_DISSW           0x10000000 /* FW disable SW Write Access */
+#define E1000_FWSM_SKUSEL_MASK     0x60000000 /* LAN SKU select */
+#define E1000_FWSM_SKUEL_SHIFT     29
+#define E1000_FWSM_SKUSEL_EMB      0x0 /* Embedded SKU */
+#define E1000_FWSM_SKUSEL_CONS     0x1 /* Consumer SKU */
+#define E1000_FWSM_SKUSEL_PERF_100 0x2 /* Perf & Corp 10/100 SKU */
+#define E1000_FWSM_SKUSEL_PERF_GBE 0x3 /* Perf & Copr GbE SKU */
+
 /* FFLT Debug Register */
 #define E1000_FFLT_DBG_INVC     0x00100000 /* Invalid /C/ code handling */
 
@@ -2082,6 +2189,8 @@ struct e1000_host_command_info {
                              E1000_GCR_TXDSCW_NO_SNOOP      | \
                              E1000_GCR_TXDSCR_NO_SNOOP)
 
+#define PCI_EX_82566_SNOOP_ALL PCI_EX_NO_SNOOP_ALL
+
 #define E1000_GCR_L1_ACT_WITHOUT_L0S_RX 0x08000000
 /* Function Active and Power State to MNG */
 #define E1000_FACTPS_FUNC0_POWER_STATE_MASK         0x00000003
@@ -2140,8 +2249,10 @@ struct e1000_host_command_info {
 #define EEPROM_PHY_CLASS_WORD         0x0007
 #define EEPROM_INIT_CONTROL1_REG      0x000A
 #define EEPROM_INIT_CONTROL2_REG      0x000F
+#define EEPROM_SWDEF_PINS_CTRL_PORT_1 0x0010
 #define EEPROM_INIT_CONTROL3_PORT_B   0x0014
 #define EEPROM_INIT_3GIO_3            0x001A
+#define EEPROM_SWDEF_PINS_CTRL_PORT_0 0x0020
 #define EEPROM_INIT_CONTROL3_PORT_A   0x0024
 #define EEPROM_CFG                    0x0012
 #define EEPROM_FLASH_VERSION          0x0032
@@ -2153,10 +2264,16 @@ struct e1000_host_command_info {
 /* Word definitions for ID LED Settings */
 #define ID_LED_RESERVED_0000 0x0000
 #define ID_LED_RESERVED_FFFF 0xFFFF
+#define ID_LED_RESERVED_82573  0xF746
+#define ID_LED_DEFAULT_82573   0x1811
 #define ID_LED_DEFAULT       ((ID_LED_OFF1_ON2 << 12) | \
                               (ID_LED_OFF1_OFF2 << 8) | \
                               (ID_LED_DEF1_DEF2 << 4) | \
                               (ID_LED_DEF1_DEF2))
+#define ID_LED_DEFAULT_ICH8LAN  ((ID_LED_DEF1_DEF2 << 12) | \
+                                 (ID_LED_DEF1_OFF2 <<  8) | \
+                                 (ID_LED_DEF1_ON2  <<  4) | \
+                                 (ID_LED_DEF1_DEF2))
 #define ID_LED_DEF1_DEF2     0x1
 #define ID_LED_DEF1_ON2      0x2
 #define ID_LED_DEF1_OFF2     0x3
@@ -2191,6 +2308,11 @@ struct e1000_host_command_info {
 #define EEPROM_WORD0F_ASM_DIR    0x2000
 #define EEPROM_WORD0F_ANE        0x0800
 #define EEPROM_WORD0F_SWPDIO_EXT 0x00F0
+#define EEPROM_WORD0F_LPLU       0x0001
+
+/* Mask bits for fields in Word 0x10/0x20 of the EEPROM */
+#define EEPROM_WORD1020_GIGA_DISABLE         0x0010
+#define EEPROM_WORD1020_GIGA_DISABLE_NON_D0A 0x0008
 
 /* Mask bits for fields in Word 0x1a of the EEPROM */
 #define EEPROM_WORD1A_ASPM_MASK  0x000C
@@ -2265,23 +2387,29 @@ struct e1000_host_command_info {
 #define E1000_EXTCNF_CTRL_D_UD_OWNER        0x00000010
 #define E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP 0x00000020
 #define E1000_EXTCNF_CTRL_MDIO_HW_OWNERSHIP 0x00000040
-#define E1000_EXTCNF_CTRL_EXT_CNF_POINTER   0x1FFF0000
+#define E1000_EXTCNF_CTRL_EXT_CNF_POINTER   0x0FFF0000
 
 #define E1000_EXTCNF_SIZE_EXT_PHY_LENGTH    0x000000FF
 #define E1000_EXTCNF_SIZE_EXT_DOCK_LENGTH   0x0000FF00
 #define E1000_EXTCNF_SIZE_EXT_PCIE_LENGTH   0x00FF0000
+#define E1000_EXTCNF_CTRL_LCD_WRITE_ENABLE  0x00000001
+#define E1000_EXTCNF_CTRL_SWFLAG            0x00000020
 
 /* PBA constants */
+#define E1000_PBA_8K 0x0008    /* 8KB, default Rx allocation */
 #define E1000_PBA_12K 0x000C    /* 12KB, default Rx allocation */
 #define E1000_PBA_16K 0x0010    /* 16KB, default TX allocation */
 #define E1000_PBA_22K 0x0016
 #define E1000_PBA_24K 0x0018
 #define E1000_PBA_30K 0x001E
 #define E1000_PBA_32K 0x0020
+#define E1000_PBA_34K 0x0022
 #define E1000_PBA_38K 0x0026
 #define E1000_PBA_40K 0x0028
 #define E1000_PBA_48K 0x0030    /* 48KB, default RX allocation */
 
+#define E1000_PBS_16K E1000_PBA_16K
+
 /* Flow Control Constants */
 #define FLOW_CONTROL_ADDRESS_LOW  0x00C28001
 #define FLOW_CONTROL_ADDRESS_HIGH 0x00000100
@@ -2336,7 +2464,7 @@ struct e1000_host_command_info {
 /* Number of milliseconds we wait for Eeprom auto read bit done after MAC reset */
 #define AUTO_READ_DONE_TIMEOUT      10
 /* Number of milliseconds we wait for PHY configuration done after MAC reset */
-#define PHY_CFG_TIMEOUT             40
+#define PHY_CFG_TIMEOUT             100
 
 #define E1000_TX_BUFFER_SIZE ((uint32_t)1514)
 
@@ -2764,6 +2892,17 @@ struct e1000_host_command_info {
 #define M88E1000_EPSCR_TX_CLK_25      0x0070 /* 25  MHz TX_CLK */
 #define M88E1000_EPSCR_TX_CLK_0       0x0000 /* NO  TX_CLK */
 
+/* M88EC018 Rev 2 specific DownShift settings */
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_MASK  0x0E00
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_1X    0x0000
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_2X    0x0200
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_3X    0x0400
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_4X    0x0600
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_5X    0x0800
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_6X    0x0A00
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_7X    0x0C00
+#define M88EC018_EPSCR_DOWNSHIFT_COUNTER_8X    0x0E00
+
 /* IGP01E1000 Specific Port Config Register - R/W */
 #define IGP01E1000_PSCFR_AUTO_MDIX_PAR_DETECT  0x0010
 #define IGP01E1000_PSCFR_PRE_EN                0x0020
@@ -2990,6 +3129,221 @@ struct e1000_host_command_info {
 #define L1LXT971A_PHY_ID   0x001378E0
 #define GG82563_E_PHY_ID   0x01410CA0
 
+
+/* Bits...
+ * 15-5: page
+ * 4-0: register offset
+ */
+#define PHY_PAGE_SHIFT        5
+#define PHY_REG(page, reg)    \
+        (((page) << PHY_PAGE_SHIFT) | ((reg) & MAX_PHY_REG_ADDRESS))
+
+#define IGP3_PHY_PORT_CTRL           \
+        PHY_REG(769, 17) /* Port General Configuration */
+#define IGP3_PHY_RATE_ADAPT_CTRL \
+        PHY_REG(769, 25) /* Rate Adapter Control Register */
+
+#define IGP3_KMRN_FIFO_CTRL_STATS \
+        PHY_REG(770, 16) /* KMRN FIFO's control/status register */
+#define IGP3_KMRN_POWER_MNG_CTRL \
+        PHY_REG(770, 17) /* KMRN Power Management Control Register */
+#define IGP3_KMRN_INBAND_CTRL \
+        PHY_REG(770, 18) /* KMRN Inband Control Register */
+#define IGP3_KMRN_DIAG \
+        PHY_REG(770, 19) /* KMRN Diagnostic register */
+#define IGP3_KMRN_DIAG_PCS_LOCK_LOSS 0x0002 /* RX PCS is not synced */
+#define IGP3_KMRN_ACK_TIMEOUT \
+        PHY_REG(770, 20) /* KMRN Acknowledge Timeouts register */
+
+#define IGP3_VR_CTRL \
+        PHY_REG(776, 18) /* Voltage regulator control register */
+#define IGP3_VR_CTRL_MODE_SHUT       0x0200 /* Enter powerdown, shutdown VRs */
+
+#define IGP3_CAPABILITY \
+        PHY_REG(776, 19) /* IGP3 Capability Register */
+
+/* Capabilities for SKU Control  */
+#define IGP3_CAP_INITIATE_TEAM       0x0001 /* Able to initiate a team */
+#define IGP3_CAP_WFM                 0x0002 /* Support WoL and PXE */
+#define IGP3_CAP_ASF                 0x0004 /* Support ASF */
+#define IGP3_CAP_LPLU                0x0008 /* Support Low Power Link Up */
+#define IGP3_CAP_DC_AUTO_SPEED       0x0010 /* Support AC/DC Auto Link Speed */
+#define IGP3_CAP_SPD                 0x0020 /* Support Smart Power Down */
+#define IGP3_CAP_MULT_QUEUE          0x0040 /* Support 2 tx & 2 rx queues */
+#define IGP3_CAP_RSS                 0x0080 /* Support RSS */
+#define IGP3_CAP_8021PQ              0x0100 /* Support 802.1Q & 802.1p */
+#define IGP3_CAP_AMT_CB              0x0200 /* Support active manageability and circuit breaker */
+
+#define IGP3_PPC_JORDAN_EN           0x0001
+#define IGP3_PPC_JORDAN_GIGA_SPEED   0x0002
+
+#define IGP3_KMRN_PMC_EE_IDLE_LINK_DIS         0x0001
+#define IGP3_KMRN_PMC_K0S_ENTRY_LATENCY_MASK   0x001E
+#define IGP3_KMRN_PMC_K0S_MODE1_EN_GIGA        0x0020
+#define IGP3_KMRN_PMC_K0S_MODE1_EN_100         0x0040
+
+#define IGP3E1000_PHY_MISC_CTRL                0x1B   /* Misc. Ctrl register */
+#define IGP3_PHY_MISC_DUPLEX_MANUAL_SET        0x1000 /* Duplex Manual Set */
+
+#define IGP3_KMRN_EXT_CTRL  PHY_REG(770, 18)
+#define IGP3_KMRN_EC_DIS_INBAND    0x0080
+
+#define IGP03E1000_E_PHY_ID  0x02A80390
+#define IFE_E_PHY_ID         0x02A80330 /* 10/100 PHY */
+#define IFE_PLUS_E_PHY_ID    0x02A80320
+#define IFE_C_E_PHY_ID       0x02A80310
+
+#define IFE_PHY_EXTENDED_STATUS_CONTROL   0x10  /* 100BaseTx Extended Status, Control and Address */
+#define IFE_PHY_SPECIAL_CONTROL           0x11  /* 100BaseTx PHY special control register */
+#define IFE_PHY_RCV_FALSE_CARRIER         0x13  /* 100BaseTx Receive False Carrier Counter */
+#define IFE_PHY_RCV_DISCONNECT            0x14  /* 100BaseTx Receive Disconnet Counter */
+#define IFE_PHY_RCV_ERROT_FRAME           0x15  /* 100BaseTx Receive Error Frame Counter */
+#define IFE_PHY_RCV_SYMBOL_ERR            0x16  /* Receive Symbol Error Counter */
+#define IFE_PHY_PREM_EOF_ERR              0x17  /* 100BaseTx Receive Premature End Of Frame Error Counter */
+#define IFE_PHY_RCV_EOF_ERR               0x18  /* 10BaseT Receive End Of Frame Error Counter */
+#define IFE_PHY_TX_JABBER_DETECT          0x19  /* 10BaseT Transmit Jabber Detect Counter */
+#define IFE_PHY_EQUALIZER                 0x1A  /* PHY Equalizer Control and Status */
+#define IFE_PHY_SPECIAL_CONTROL_LED       0x1B  /* PHY special control and LED configuration */
+#define IFE_PHY_MDIX_CONTROL              0x1C  /* MDI/MDI-X Control register */
+#define IFE_PHY_HWI_CONTROL               0x1D  /* Hardware Integrity Control (HWI) */
+
+#define IFE_PESC_REDUCED_POWER_DOWN_DISABLE  0x2000  /* Defaut 1 = Disable auto reduced power down */
+#define IFE_PESC_100BTX_POWER_DOWN           0x0400  /* Indicates the power state of 100BASE-TX */
+#define IFE_PESC_10BTX_POWER_DOWN            0x0200  /* Indicates the power state of 10BASE-T */
+#define IFE_PESC_POLARITY_REVERSED           0x0100  /* Indicates 10BASE-T polarity */
+#define IFE_PESC_PHY_ADDR_MASK               0x007C  /* Bit 6:2 for sampled PHY address */
+#define IFE_PESC_SPEED                       0x0002  /* Auto-negotiation speed result 1=100Mbs, 0=10Mbs */
+#define IFE_PESC_DUPLEX                      0x0001  /* Auto-negotiation duplex result 1=Full, 0=Half */
+#define IFE_PESC_POLARITY_REVERSED_SHIFT     8
+
+#define IFE_PSC_DISABLE_DYNAMIC_POWER_DOWN   0x0100  /* 1 = Dyanmic Power Down disabled */
+#define IFE_PSC_FORCE_POLARITY               0x0020  /* 1=Reversed Polarity, 0=Normal */
+#define IFE_PSC_AUTO_POLARITY_DISABLE        0x0010  /* 1=Auto Polarity Disabled, 0=Enabled */
+#define IFE_PSC_JABBER_FUNC_DISABLE          0x0001  /* 1=Jabber Disabled, 0=Normal Jabber Operation */
+#define IFE_PSC_FORCE_POLARITY_SHIFT         5
+#define IFE_PSC_AUTO_POLARITY_DISABLE_SHIFT  4
+
+#define IFE_PMC_AUTO_MDIX                    0x0080  /* 1=enable MDI/MDI-X feature, default 0=disabled */
+#define IFE_PMC_FORCE_MDIX                   0x0040  /* 1=force MDIX-X, 0=force MDI */
+#define IFE_PMC_MDIX_STATUS                  0x0020  /* 1=MDI-X, 0=MDI */
+#define IFE_PMC_AUTO_MDIX_COMPLETE           0x0010  /* Resolution algorthm is completed */
+#define IFE_PMC_MDIX_MODE_SHIFT              6
+#define IFE_PHC_MDIX_RESET_ALL_MASK          0x0000  /* Disable auto MDI-X */
+
+#define IFE_PHC_HWI_ENABLE                   0x8000  /* Enable the HWI feature */
+#define IFE_PHC_ABILITY_CHECK                0x4000  /* 1= Test Passed, 0=failed */
+#define IFE_PHC_TEST_EXEC                    0x2000  /* PHY launch test pulses on the wire */
+#define IFE_PHC_HIGHZ                        0x0200  /* 1 = Open Circuit */
+#define IFE_PHC_LOWZ                         0x0400  /* 1 = Short Circuit */
+#define IFE_PHC_LOW_HIGH_Z_MASK              0x0600  /* Mask for indication type of problem on the line */
+#define IFE_PHC_DISTANCE_MASK                0x01FF  /* Mask for distance to the cable problem, in 80cm granularity */
+#define IFE_PHC_RESET_ALL_MASK               0x0000  /* Disable HWI */
+#define IFE_PSCL_PROBE_MODE                  0x0020  /* LED Probe mode */
+#define IFE_PSCL_PROBE_LEDS_OFF              0x0006  /* Force LEDs 0 and 2 off */
+#define IFE_PSCL_PROBE_LEDS_ON               0x0007  /* Force LEDs 0 and 2 on */
+
+#define ICH8_FLASH_COMMAND_TIMEOUT           500   /* 500 ms , should be adjusted */
+#define ICH8_FLASH_CYCLE_REPEAT_COUNT        10    /* 10 cycles , should be adjusted */
+#define ICH8_FLASH_SEG_SIZE_256              256
+#define ICH8_FLASH_SEG_SIZE_4K               4096
+#define ICH8_FLASH_SEG_SIZE_64K              65536
+
+#define ICH8_CYCLE_READ                      0x0
+#define ICH8_CYCLE_RESERVED                  0x1
+#define ICH8_CYCLE_WRITE                     0x2
+#define ICH8_CYCLE_ERASE                     0x3
+
+#define ICH8_FLASH_GFPREG   0x0000
+#define ICH8_FLASH_HSFSTS   0x0004
+#define ICH8_FLASH_HSFCTL   0x0006
+#define ICH8_FLASH_FADDR    0x0008
+#define ICH8_FLASH_FDATA0   0x0010
+#define ICH8_FLASH_FRACC    0x0050
+#define ICH8_FLASH_FREG0    0x0054
+#define ICH8_FLASH_FREG1    0x0058
+#define ICH8_FLASH_FREG2    0x005C
+#define ICH8_FLASH_FREG3    0x0060
+#define ICH8_FLASH_FPR0     0x0074
+#define ICH8_FLASH_FPR1     0x0078
+#define ICH8_FLASH_SSFSTS   0x0090
+#define ICH8_FLASH_SSFCTL   0x0092
+#define ICH8_FLASH_PREOP    0x0094
+#define ICH8_FLASH_OPTYPE   0x0096
+#define ICH8_FLASH_OPMENU   0x0098
+
+#define ICH8_FLASH_REG_MAPSIZE      0x00A0
+#define ICH8_FLASH_SECTOR_SIZE      4096
+#define ICH8_GFPREG_BASE_MASK       0x1FFF
+#define ICH8_FLASH_LINEAR_ADDR_MASK 0x00FFFFFF
+
+/* ICH8 GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
+/* Offset 04h HSFSTS */
+union ich8_hws_flash_status {
+    struct ich8_hsfsts {
+#ifdef E1000_BIG_ENDIAN
+        uint16_t reserved2      :6;
+        uint16_t fldesvalid     :1;
+        uint16_t flockdn        :1;
+        uint16_t flcdone        :1;
+        uint16_t flcerr         :1;
+        uint16_t dael           :1;
+        uint16_t berasesz       :2;
+        uint16_t flcinprog      :1;
+        uint16_t reserved1      :2;
+#else
+        uint16_t flcdone        :1;   /* bit 0 Flash Cycle Done */
+        uint16_t flcerr         :1;   /* bit 1 Flash Cycle Error */
+        uint16_t dael           :1;   /* bit 2 Direct Access error Log */
+        uint16_t berasesz       :2;   /* bit 4:3 Block/Sector Erase Size */
+        uint16_t flcinprog      :1;   /* bit 5 flash SPI cycle in Progress */
+        uint16_t reserved1      :2;   /* bit 13:6 Reserved */
+        uint16_t reserved2      :6;   /* bit 13:6 Reserved */
+        uint16_t fldesvalid     :1;   /* bit 14 Flash Descriptor Valid */
+        uint16_t flockdn        :1;   /* bit 15 Flash Configuration Lock-Down */
+#endif
+    } hsf_status;
+    uint16_t regval;
+};
+
+/* ICH8 GbE Flash Hardware Sequencing Flash control Register bit breakdown */
+/* Offset 06h FLCTL */
+union ich8_hws_flash_ctrl {
+    struct ich8_hsflctl {
+#ifdef E1000_BIG_ENDIAN
+        uint16_t fldbcount      :2;
+        uint16_t flockdn        :6;
+        uint16_t flcgo          :1;
+        uint16_t flcycle        :2;
+        uint16_t reserved       :5;
+#else
+        uint16_t flcgo          :1;   /* 0 Flash Cycle Go */
+        uint16_t flcycle        :2;   /* 2:1 Flash Cycle */
+        uint16_t reserved       :5;   /* 7:3 Reserved  */
+        uint16_t fldbcount      :2;   /* 9:8 Flash Data Byte Count */
+        uint16_t flockdn        :6;   /* 15:10 Reserved */
+#endif
+    } hsf_ctrl;
+    uint16_t regval;
+};
+
+/* ICH8 Flash Region Access Permissions */
+union ich8_hws_flash_regacc {
+    struct ich8_flracc {
+#ifdef E1000_BIG_ENDIAN
+        uint32_t gmwag          :8;
+        uint32_t gmrag          :8;
+        uint32_t grwa           :8;
+        uint32_t grra           :8;
+#else
+        uint32_t grra           :8;   /* 0:7 GbE region Read Access */
+        uint32_t grwa           :8;   /* 8:15 GbE region Write Access */
+        uint32_t gmrag          :8;   /* 23:16 GbE Master Read Access Grant  */
+        uint32_t gmwag          :8;   /* 31:24 GbE Master Write Access Grant */
+#endif
+    } hsf_flregacc;
+    uint16_t regval;
+};
+
 /* Miscellaneous PHY bit definitions. */
 #define PHY_PREAMBLE        0xFFFFFFFF
 #define PHY_SOF             0x01
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index f77624f5f17b..98ef9f85482f 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -36,7 +36,7 @@ static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION "7.0.38-k4"DRIVERNAPI
+#define DRV_VERSION "7.1.9-k4"DRIVERNAPI
 char e1000_driver_version[] = DRV_VERSION;
 static char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -73,6 +73,11 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x1026),
         INTEL_E1000_ETHERNET_DEVICE(0x1027),
         INTEL_E1000_ETHERNET_DEVICE(0x1028),
+        INTEL_E1000_ETHERNET_DEVICE(0x1049),
+        INTEL_E1000_ETHERNET_DEVICE(0x104A),
+        INTEL_E1000_ETHERNET_DEVICE(0x104B),
+        INTEL_E1000_ETHERNET_DEVICE(0x104C),
+        INTEL_E1000_ETHERNET_DEVICE(0x104D),
         INTEL_E1000_ETHERNET_DEVICE(0x105E),
         INTEL_E1000_ETHERNET_DEVICE(0x105F),
         INTEL_E1000_ETHERNET_DEVICE(0x1060),
@@ -96,6 +101,8 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x109A),
         INTEL_E1000_ETHERNET_DEVICE(0x10B5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B9),
+        INTEL_E1000_ETHERNET_DEVICE(0x10BA),
+        INTEL_E1000_ETHERNET_DEVICE(0x10BB),
         /* required last entry */
         {0,}
 };
@@ -133,7 +140,6 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter,
 static void e1000_set_multi(struct net_device *netdev);
 static void e1000_update_phy_info(unsigned long data);
 static void e1000_watchdog(unsigned long data);
-static void e1000_watchdog_task(struct e1000_adapter *adapter);
 static void e1000_82547_tx_fifo_stall(unsigned long data);
 static int e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
 static struct net_device_stats * e1000_get_stats(struct net_device *netdev);
@@ -178,8 +184,8 @@ static void e1000_vlan_rx_add_vid(struct net_device *netdev, uint16_t vid);
 static void e1000_vlan_rx_kill_vid(struct net_device *netdev, uint16_t vid);
 static void e1000_restore_vlan(struct e1000_adapter *adapter);
 
-#ifdef CONFIG_PM
 static int e1000_suspend(struct pci_dev *pdev, pm_message_t state);
+#ifdef CONFIG_PM
 static int e1000_resume(struct pci_dev *pdev);
 #endif
 static void e1000_shutdown(struct pci_dev *pdev);
@@ -206,8 +212,8 @@ static struct pci_driver e1000_driver = {
         .probe    = e1000_probe,
         .remove   = __devexit_p(e1000_remove),
         /* Power Managment Hooks */
-#ifdef CONFIG_PM
         .suspend  = e1000_suspend,
+#ifdef CONFIG_PM
         .resume   = e1000_resume,
 #endif
         .shutdown = e1000_shutdown,
@@ -261,6 +267,44 @@ e1000_exit_module(void)
 
 module_exit(e1000_exit_module);
 
+static int e1000_request_irq(struct e1000_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        int flags, err = 0;
+
+        flags = IRQF_SHARED;
+#ifdef CONFIG_PCI_MSI
+        if (adapter->hw.mac_type > e1000_82547_rev_2) {
+                adapter->have_msi = TRUE;
+                if ((err = pci_enable_msi(adapter->pdev))) {
+                        DPRINTK(PROBE, ERR,
+                         "Unable to allocate MSI interrupt Error: %d\n", err);
+                        adapter->have_msi = FALSE;
+                }
+        }
+        if (adapter->have_msi)
+                flags &= ~IRQF_SHARED;
+#endif
+        if ((err = request_irq(adapter->pdev->irq, &e1000_intr, flags,
+                               netdev->name, netdev)))
+                DPRINTK(PROBE, ERR,
+                        "Unable to allocate interrupt Error: %d\n", err);
+
+        return err;
+}
+
+static void e1000_free_irq(struct e1000_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        free_irq(adapter->pdev->irq, netdev);
+
+#ifdef CONFIG_PCI_MSI
+        if (adapter->have_msi)
+                pci_disable_msi(adapter->pdev);
+#endif
+}
+
 /**
  * e1000_irq_disable - Mask off interrupt generation on the NIC
  * @adapter: board private structure
@@ -329,6 +373,7 @@ e1000_release_hw_control(struct e1000_adapter *adapter)
 {
         uint32_t ctrl_ext;
         uint32_t swsm;
+        uint32_t extcnf;
 
         /* Let firmware taken over control of h/w */
         switch (adapter->hw.mac_type) {
@@ -343,6 +388,11 @@ e1000_release_hw_control(struct e1000_adapter *adapter)
                 swsm = E1000_READ_REG(&adapter->hw, SWSM);
                 E1000_WRITE_REG(&adapter->hw, SWSM,
                                 swsm & ~E1000_SWSM_DRV_LOAD);
+        case e1000_ich8lan:
+                extcnf = E1000_READ_REG(&adapter->hw, CTRL_EXT);
+                E1000_WRITE_REG(&adapter->hw, CTRL_EXT,
+                                extcnf & ~E1000_CTRL_EXT_DRV_LOAD);
+                break;
         default:
                 break;
         }
@@ -364,6 +414,7 @@ e1000_get_hw_control(struct e1000_adapter *adapter)
 {
         uint32_t ctrl_ext;
         uint32_t swsm;
+        uint32_t extcnf;
         /* Let firmware know the driver has taken over */
         switch (adapter->hw.mac_type) {
         case e1000_82571:
@@ -378,6 +429,11 @@ e1000_get_hw_control(struct e1000_adapter *adapter)
                 E1000_WRITE_REG(&adapter->hw, SWSM,
                                 swsm | E1000_SWSM_DRV_LOAD);
                 break;
+        case e1000_ich8lan:
+                extcnf = E1000_READ_REG(&adapter->hw, EXTCNF_CTRL);
+                E1000_WRITE_REG(&adapter->hw, EXTCNF_CTRL,
+                                extcnf | E1000_EXTCNF_CTRL_SWFLAG);
+                break;
         default:
                 break;
         }
@@ -387,18 +443,10 @@ int
 e1000_up(struct e1000_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
-        int i, err;
+        int i;
 
         /* hardware has been reset, we need to reload some things */
 
-        /* Reset the PHY if it was previously powered down */
-        if (adapter->hw.media_type == e1000_media_type_copper) {
-                uint16_t mii_reg;
-                e1000_read_phy_reg(&adapter->hw, PHY_CTRL, &mii_reg);
-                if (mii_reg & MII_CR_POWER_DOWN)
-                        e1000_phy_hw_reset(&adapter->hw);
-        }
-
         e1000_set_multi(netdev);
 
         e1000_restore_vlan(adapter);
@@ -415,24 +463,6 @@ e1000_up(struct e1000_adapter *adapter)
                                       E1000_DESC_UNUSED(ring));
         }
 
-#ifdef CONFIG_PCI_MSI
-        if (adapter->hw.mac_type > e1000_82547_rev_2) {
-                adapter->have_msi = TRUE;
-                if ((err = pci_enable_msi(adapter->pdev))) {
-                        DPRINTK(PROBE, ERR,
-                         "Unable to allocate MSI interrupt Error: %d\n", err);
-                        adapter->have_msi = FALSE;
-                }
-        }
-#endif
-        if ((err = request_irq(adapter->pdev->irq, &e1000_intr,
-                              IRQF_SHARED | IRQF_SAMPLE_RANDOM,
-                              netdev->name, netdev))) {
-                DPRINTK(PROBE, ERR,
-                    "Unable to allocate interrupt Error: %d\n", err);
-                return err;
-        }
-
         adapter->tx_queue_len = netdev->tx_queue_len;
 
         mod_timer(&adapter->watchdog_timer, jiffies);
@@ -445,21 +475,60 @@ e1000_up(struct e1000_adapter *adapter)
         return 0;
 }
 
+/**
+ * e1000_power_up_phy - restore link in case the phy was powered down
+ * @adapter: address of board private structure
+ *
+ * The phy may be powered down to save power and turn off link when the
+ * driver is unloaded and wake on lan is not enabled (among others)
+ * *** this routine MUST be followed by a call to e1000_reset ***
+ *
+ **/
+
+static void e1000_power_up_phy(struct e1000_adapter *adapter)
+{
+        uint16_t mii_reg = 0;
+
+        /* Just clear the power down bit to wake the phy back up */
+        if (adapter->hw.media_type == e1000_media_type_copper) {
+                /* according to the manual, the phy will retain its
+                 * settings across a power-down/up cycle */
+                e1000_read_phy_reg(&adapter->hw, PHY_CTRL, &mii_reg);
+                mii_reg &= ~MII_CR_POWER_DOWN;
+                e1000_write_phy_reg(&adapter->hw, PHY_CTRL, mii_reg);
+        }
+}
+
+static void e1000_power_down_phy(struct e1000_adapter *adapter)
+{
+        boolean_t mng_mode_enabled = (adapter->hw.mac_type >= e1000_82571) &&
+                                      e1000_check_mng_mode(&adapter->hw);
+        /* Power down the PHY so no link is implied when interface is down
+         * The PHY cannot be powered down if any of the following is TRUE
+         * (a) WoL is enabled
+         * (b) AMT is active
+         * (c) SoL/IDER session is active */
+        if (!adapter->wol && adapter->hw.mac_type >= e1000_82540 &&
+            adapter->hw.mac_type != e1000_ich8lan &&
+            adapter->hw.media_type == e1000_media_type_copper &&
+            !(E1000_READ_REG(&adapter->hw, MANC) & E1000_MANC_SMBUS_EN) &&
+            !mng_mode_enabled &&
+            !e1000_check_phy_reset_block(&adapter->hw)) {
+                uint16_t mii_reg = 0;
+                e1000_read_phy_reg(&adapter->hw, PHY_CTRL, &mii_reg);
+                mii_reg |= MII_CR_POWER_DOWN;
+                e1000_write_phy_reg(&adapter->hw, PHY_CTRL, mii_reg);
+                mdelay(1);
+        }
+}
+
 void
 e1000_down(struct e1000_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
-        boolean_t mng_mode_enabled = (adapter->hw.mac_type >= e1000_82571) &&
-                                     e1000_check_mng_mode(&adapter->hw);
 
         e1000_irq_disable(adapter);
 
-        free_irq(adapter->pdev->irq, netdev);
-#ifdef CONFIG_PCI_MSI
-        if (adapter->hw.mac_type > e1000_82547_rev_2 &&
-           adapter->have_msi == TRUE)
-                pci_disable_msi(adapter->pdev);
-#endif
         del_timer_sync(&adapter->tx_fifo_stall_timer);
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
@@ -476,23 +545,17 @@ e1000_down(struct e1000_adapter *adapter)
         e1000_reset(adapter);
         e1000_clean_all_tx_rings(adapter);
         e1000_clean_all_rx_rings(adapter);
+}
 
-        /* Power down the PHY so no link is implied when interface is down *
-         * The PHY cannot be powered down if any of the following is TRUE *
-         * (a) WoL is enabled
-         * (b) AMT is active
-         * (c) SoL/IDER session is active */
-        if (!adapter->wol && adapter->hw.mac_type >= e1000_82540 &&
-           adapter->hw.media_type == e1000_media_type_copper &&
-           !(E1000_READ_REG(&adapter->hw, MANC) & E1000_MANC_SMBUS_EN) &&
-           !mng_mode_enabled &&
-           !e1000_check_phy_reset_block(&adapter->hw)) {
-                uint16_t mii_reg;
-                e1000_read_phy_reg(&adapter->hw, PHY_CTRL, &mii_reg);
-                mii_reg |= MII_CR_POWER_DOWN;
-                e1000_write_phy_reg(&adapter->hw, PHY_CTRL, mii_reg);
-                mdelay(1);
-        }
+void
+e1000_reinit_locked(struct e1000_adapter *adapter)
+{
+        WARN_ON(in_interrupt());
+        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+                msleep(1);
+        e1000_down(adapter);
+        e1000_up(adapter);
+        clear_bit(__E1000_RESETTING, &adapter->flags);
 }
 
 void
@@ -518,6 +581,9 @@ e1000_reset(struct e1000_adapter *adapter)
         case e1000_82573:
                 pba = E1000_PBA_12K;
                 break;
+        case e1000_ich8lan:
+                pba = E1000_PBA_8K;
+                break;
         default:
                 pba = E1000_PBA_48K;
                 break;
@@ -542,6 +608,12 @@ e1000_reset(struct e1000_adapter *adapter)
         /* Set the FC high water mark to 90% of the FIFO size.
          * Required to clear last 3 LSB */
         fc_high_water_mark = ((pba * 9216)/10) & 0xFFF8;
+        /* We can't use 90% on small FIFOs because the remainder
+         * would be less than 1 full frame.  In this case, we size
+         * it to allow at least a full frame above the high water
+         *  mark. */
+        if (pba < E1000_PBA_16K)
+                fc_high_water_mark = (pba * 1024) - 1600;
 
         adapter->hw.fc_high_water = fc_high_water_mark;
         adapter->hw.fc_low_water = fc_high_water_mark - 8;
@@ -564,6 +636,23 @@ e1000_reset(struct e1000_adapter *adapter)
 
         e1000_reset_adaptive(&adapter->hw);
         e1000_phy_get_info(&adapter->hw, &adapter->phy_info);
+
+        if (!adapter->smart_power_down &&
+            (adapter->hw.mac_type == e1000_82571 ||
+             adapter->hw.mac_type == e1000_82572)) {
+                uint16_t phy_data = 0;
+                /* speed up time to link by disabling smart power down, ignore
+                 * the return value of this function because there is nothing
+                 * different we would do if it failed */
+                e1000_read_phy_reg(&adapter->hw, IGP02E1000_PHY_POWER_MGMT,
+                                   &phy_data);
+                phy_data &= ~IGP02E1000_PM_SPD;
+                e1000_write_phy_reg(&adapter->hw, IGP02E1000_PHY_POWER_MGMT,
+                                    phy_data);
+        }
+
+        if (adapter->hw.mac_type < e1000_ich8lan)
+        /* FIXME: this code is duplicate and wrong for PCI Express */
         if (adapter->en_mng_pt) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 manc |= (E1000_MANC_ARP_EN | E1000_MANC_EN_MNG2HOST);
@@ -590,6 +679,7 @@ e1000_probe(struct pci_dev *pdev,
         struct net_device *netdev;
         struct e1000_adapter *adapter;
         unsigned long mmio_start, mmio_len;
+        unsigned long flash_start, flash_len;
 
         static int cards_found = 0;
         static int e1000_ksp3_port_a = 0; /* global ksp3 port a indication */
@@ -599,10 +689,12 @@ e1000_probe(struct pci_dev *pdev,
         if ((err = pci_enable_device(pdev)))
                 return err;
 
-        if (!(err = pci_set_dma_mask(pdev, DMA_64BIT_MASK))) {
+        if (!(err = pci_set_dma_mask(pdev, DMA_64BIT_MASK)) &&
+            !(err = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK))) {
                 pci_using_dac = 1;
         } else {
-                if ((err = pci_set_dma_mask(pdev, DMA_32BIT_MASK))) {
+                if ((err = pci_set_dma_mask(pdev, DMA_32BIT_MASK)) &&
+                    (err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK))) {
                         E1000_ERR("No usable DMA configuration, aborting\n");
                         return err;
                 }
@@ -682,6 +774,19 @@ e1000_probe(struct pci_dev *pdev,
         if ((err = e1000_sw_init(adapter)))
                 goto err_sw_init;
 
+        /* Flash BAR mapping must happen after e1000_sw_init
+         * because it depends on mac_type */
+        if ((adapter->hw.mac_type == e1000_ich8lan) &&
+           (pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
+                flash_start = pci_resource_start(pdev, 1);
+                flash_len = pci_resource_len(pdev, 1);
+                adapter->hw.flash_address = ioremap(flash_start, flash_len);
+                if (!adapter->hw.flash_address) {
+                        err = -EIO;
+                        goto err_flashmap;
+                }
+        }
+
         if ((err = e1000_check_phy_reset_block(&adapter->hw)))
                 DPRINTK(PROBE, INFO, "PHY reset is blocked due to SOL/IDER session.\n");
 
@@ -700,6 +805,8 @@ e1000_probe(struct pci_dev *pdev,
                                    NETIF_F_HW_VLAN_TX |
                                    NETIF_F_HW_VLAN_RX |
                                    NETIF_F_HW_VLAN_FILTER;
+                if (adapter->hw.mac_type == e1000_ich8lan)
+                        netdev->features &= ~NETIF_F_HW_VLAN_FILTER;
         }
 
 #ifdef NETIF_F_TSO
@@ -715,11 +822,17 @@ e1000_probe(struct pci_dev *pdev,
         if (pci_using_dac)
                 netdev->features |= NETIF_F_HIGHDMA;
 
-        /* hard_start_xmit is safe against parallel locking */
         netdev->features |= NETIF_F_LLTX;
 
         adapter->en_mng_pt = e1000_enable_mng_pass_thru(&adapter->hw);
 
+        /* initialize eeprom parameters */
+
+        if (e1000_init_eeprom_params(&adapter->hw)) {
+                E1000_ERR("EEPROM initialization failed\n");
+                return -EIO;
+        }
+
         /* before reading the EEPROM, reset the controller to
          * put the device in a known good starting state */
 
@@ -758,9 +871,6 @@ e1000_probe(struct pci_dev *pdev,
         adapter->watchdog_timer.function = &e1000_watchdog;
         adapter->watchdog_timer.data = (unsigned long) adapter;
 
-        INIT_WORK(&adapter->watchdog_task,
-                (void (*)(void *))e1000_watchdog_task, adapter);
-
         init_timer(&adapter->phy_info_timer);
         adapter->phy_info_timer.function = &e1000_update_phy_info;
         adapter->phy_info_timer.data = (unsigned long) adapter;
@@ -790,6 +900,11 @@ e1000_probe(struct pci_dev *pdev,
                         EEPROM_INIT_CONTROL2_REG, 1, &eeprom_data);
                 eeprom_apme_mask = E1000_EEPROM_82544_APM;
                 break;
+        case e1000_ich8lan:
+                e1000_read_eeprom(&adapter->hw,
+                        EEPROM_INIT_CONTROL1_REG, 1, &eeprom_data);
+                eeprom_apme_mask = E1000_EEPROM_ICH8_APME;
+                break;
         case e1000_82546:
         case e1000_82546_rev_3:
         case e1000_82571:
@@ -849,6 +964,9 @@ e1000_probe(struct pci_dev *pdev,
         return 0;
 
 err_register:
+        if (adapter->hw.flash_address)
+                iounmap(adapter->hw.flash_address);
+err_flashmap:
 err_sw_init:
 err_eeprom:
         iounmap(adapter->hw.hw_addr);
@@ -882,6 +1000,7 @@ e1000_remove(struct pci_dev *pdev)
         flush_scheduled_work();
 
         if (adapter->hw.mac_type >= e1000_82540 &&
+           adapter->hw.mac_type != e1000_ich8lan &&
            adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 if (manc & E1000_MANC_SMBUS_EN) {
@@ -910,6 +1029,8 @@ e1000_remove(struct pci_dev *pdev)
 #endif
 
         iounmap(adapter->hw.hw_addr);
+        if (adapter->hw.flash_address)
+                iounmap(adapter->hw.flash_address);
         pci_release_regions(pdev);
 
         free_netdev(netdev);
@@ -947,7 +1068,7 @@ e1000_sw_init(struct e1000_adapter *adapter)
 
         pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
 
-        adapter->rx_buffer_len = MAXIMUM_ETHERNET_FRAME_SIZE;
+        adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
         adapter->rx_ps_bsize0 = E1000_RXBUFFER_128;
         hw->max_frame_size = netdev->mtu +
                              ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
@@ -960,13 +1081,6 @@ e1000_sw_init(struct e1000_adapter *adapter)
                 return -EIO;
         }
 
-        /* initialize eeprom parameters */
-
-        if (e1000_init_eeprom_params(hw)) {
-                E1000_ERR("EEPROM initialization failed\n");
-                return -EIO;
-        }
-
         switch (hw->mac_type) {
         default:
                 break;
@@ -1078,6 +1192,10 @@ e1000_open(struct net_device *netdev)
         struct e1000_adapter *adapter = netdev_priv(netdev);
         int err;
 
+        /* disallow open during test */
+        if (test_bit(__E1000_DRIVER_TESTING, &adapter->flags))
+                return -EBUSY;
+
         /* allocate transmit descriptors */
 
         if ((err = e1000_setup_all_tx_resources(adapter)))
@@ -1088,6 +1206,12 @@ e1000_open(struct net_device *netdev)
         if ((err = e1000_setup_all_rx_resources(adapter)))
                 goto err_setup_rx;
 
+        err = e1000_request_irq(adapter);
+        if (err)
+                goto err_up;
+
+        e1000_power_up_phy(adapter);
+
         if ((err = e1000_up(adapter)))
                 goto err_up;
         adapter->mng_vlan_id = E1000_MNG_VLAN_NONE;
@@ -1131,7 +1255,10 @@ e1000_close(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
 
+        WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
         e1000_down(adapter);
+        e1000_power_down_phy(adapter);
+        e1000_free_irq(adapter);
 
         e1000_free_all_tx_resources(adapter);
         e1000_free_all_rx_resources(adapter);
@@ -1189,8 +1316,7 @@ e1000_setup_tx_resources(struct e1000_adapter *adapter,
         int size;
 
         size = sizeof(struct e1000_buffer) * txdr->count;
-
-        txdr->buffer_info = vmalloc_node(size, pcibus_to_node(pdev->bus));
+        txdr->buffer_info = vmalloc(size);
         if (!txdr->buffer_info) {
                 DPRINTK(PROBE, ERR,
                 "Unable to allocate memory for the transmit descriptor ring\n");
@@ -1302,13 +1428,13 @@ e1000_configure_tx(struct e1000_adapter *adapter)
                 tdba = adapter->tx_ring[0].dma;
                 tdlen = adapter->tx_ring[0].count *
                         sizeof(struct e1000_tx_desc);
-                E1000_WRITE_REG(hw, TDBAL, (tdba & 0x00000000ffffffffULL));
-                E1000_WRITE_REG(hw, TDBAH, (tdba >> 32));
                 E1000_WRITE_REG(hw, TDLEN, tdlen);
-                E1000_WRITE_REG(hw, TDH, 0);
+                E1000_WRITE_REG(hw, TDBAH, (tdba >> 32));
+                E1000_WRITE_REG(hw, TDBAL, (tdba & 0x00000000ffffffffULL));
                 E1000_WRITE_REG(hw, TDT, 0);
-                adapter->tx_ring[0].tdh = E1000_TDH;
-                adapter->tx_ring[0].tdt = E1000_TDT;
+                E1000_WRITE_REG(hw, TDH, 0);
+                adapter->tx_ring[0].tdh = ((hw->mac_type >= e1000_82543) ? E1000_TDH : E1000_82542_TDH);
+                adapter->tx_ring[0].tdt = ((hw->mac_type >= e1000_82543) ? E1000_TDT : E1000_82542_TDT);
                 break;
         }
 
@@ -1418,7 +1544,7 @@ e1000_setup_rx_resources(struct e1000_adapter *adapter,
         int size, desc_len;
 
         size = sizeof(struct e1000_buffer) * rxdr->count;
-        rxdr->buffer_info = vmalloc_node(size, pcibus_to_node(pdev->bus));
+        rxdr->buffer_info = vmalloc(size);
         if (!rxdr->buffer_info) {
                 DPRINTK(PROBE, ERR,
                 "Unable to allocate memory for the receive descriptor ring\n");
@@ -1560,9 +1686,6 @@ e1000_setup_rctl(struct e1000_adapter *adapter)
                 E1000_RCTL_LBM_NO | E1000_RCTL_RDMTS_HALF |
                 (adapter->hw.mc_filter_type << E1000_RCTL_MO_SHIFT);
 
-        if (adapter->hw.mac_type > e1000_82543)
-                rctl |= E1000_RCTL_SECRC;
-
         if (adapter->hw.tbi_compatibility_on == 1)
                 rctl |= E1000_RCTL_SBP;
         else
@@ -1628,7 +1751,7 @@ e1000_setup_rctl(struct e1000_adapter *adapter)
                 rfctl |= E1000_RFCTL_IPV6_DIS;
                 E1000_WRITE_REG(&adapter->hw, RFCTL, rfctl);
 
-                rctl |= E1000_RCTL_DTYP_PS | E1000_RCTL_SECRC;
+                rctl |= E1000_RCTL_DTYP_PS;
 
                 psrctl |= adapter->rx_ps_bsize0 >>
                         E1000_PSRCTL_BSIZE0_SHIFT;
@@ -1712,13 +1835,13 @@ e1000_configure_rx(struct e1000_adapter *adapter)
         case 1:
         default:
                 rdba = adapter->rx_ring[0].dma;
-                E1000_WRITE_REG(hw, RDBAL, (rdba & 0x00000000ffffffffULL));
-                E1000_WRITE_REG(hw, RDBAH, (rdba >> 32));
                 E1000_WRITE_REG(hw, RDLEN, rdlen);
-                E1000_WRITE_REG(hw, RDH, 0);
+                E1000_WRITE_REG(hw, RDBAH, (rdba >> 32));
+                E1000_WRITE_REG(hw, RDBAL, (rdba & 0x00000000ffffffffULL));
                 E1000_WRITE_REG(hw, RDT, 0);
-                adapter->rx_ring[0].rdh = E1000_RDH;
-                adapter->rx_ring[0].rdt = E1000_RDT;
+                E1000_WRITE_REG(hw, RDH, 0);
+                adapter->rx_ring[0].rdh = ((hw->mac_type >= e1000_82543) ? E1000_RDH : E1000_82542_RDH);
+                adapter->rx_ring[0].rdt = ((hw->mac_type >= e1000_82543) ? E1000_RDT : E1000_82542_RDT);
                 break;
         }
 
@@ -1741,9 +1864,6 @@ e1000_configure_rx(struct e1000_adapter *adapter)
                 E1000_WRITE_REG(hw, RXCSUM, rxcsum);
         }
 
-        if (hw->mac_type == e1000_82573)
-                E1000_WRITE_REG(hw, ERT, 0x0100);
-
         /* Enable Receives */
         E1000_WRITE_REG(hw, RCTL, rctl);
 }
@@ -2083,6 +2203,12 @@ e1000_set_multi(struct net_device *netdev)
         uint32_t rctl;
         uint32_t hash_value;
         int i, rar_entries = E1000_RAR_ENTRIES;
+        int mta_reg_count = (hw->mac_type == e1000_ich8lan) ?
+                                E1000_NUM_MTA_REGISTERS_ICH8LAN :
+                                E1000_NUM_MTA_REGISTERS;
+
+        if (adapter->hw.mac_type == e1000_ich8lan)
+                rar_entries = E1000_RAR_ENTRIES_ICH8LAN;
 
         /* reserve RAR[14] for LAA over-write work-around */
         if (adapter->hw.mac_type == e1000_82571)
@@ -2121,14 +2247,18 @@ e1000_set_multi(struct net_device *netdev)
                         mc_ptr = mc_ptr->next;
                 } else {
                         E1000_WRITE_REG_ARRAY(hw, RA, i << 1, 0);
+                        E1000_WRITE_FLUSH(hw);
                         E1000_WRITE_REG_ARRAY(hw, RA, (i << 1) + 1, 0);
+                        E1000_WRITE_FLUSH(hw);
                 }
         }
 
         /* clear the old settings from the multicast hash table */
 
-        for (i = 0; i < E1000_NUM_MTA_REGISTERS; i++)
+        for (i = 0; i < mta_reg_count; i++) {
                 E1000_WRITE_REG_ARRAY(hw, MTA, i, 0);
+                E1000_WRITE_FLUSH(hw);
+        }
 
         /* load any remaining addresses into the hash table */
 
@@ -2201,19 +2331,19 @@ static void
 e1000_watchdog(unsigned long data)
 {
         struct e1000_adapter *adapter = (struct e1000_adapter *) data;
-
-        /* Do the rest outside of interrupt context */
-        schedule_work(&adapter->watchdog_task);
-}
-
-static void
-e1000_watchdog_task(struct e1000_adapter *adapter)
-{
         struct net_device *netdev = adapter->netdev;
         struct e1000_tx_ring *txdr = adapter->tx_ring;
         uint32_t link, tctl;
-
-        e1000_check_for_link(&adapter->hw);
+        int32_t ret_val;
+
+        ret_val = e1000_check_for_link(&adapter->hw);
+        if ((ret_val == E1000_ERR_PHY) &&
+            (adapter->hw.phy_type == e1000_phy_igp_3) &&
+            (E1000_READ_REG(&adapter->hw, CTRL) & E1000_PHY_CTRL_GBE_DISABLE)) {
+                /* See e1000_kumeran_lock_loss_workaround() */
+                DPRINTK(LINK, INFO,
+                        "Gigabit has been disabled, downgrading speed\n");
+        }
         if (adapter->hw.mac_type == e1000_82573) {
                 e1000_enable_tx_pkt_filtering(&adapter->hw);
                 if (adapter->mng_vlan_id != adapter->hw.mng_cookie.vlan_id)
@@ -2394,7 +2524,7 @@ e1000_tso(struct e1000_adapter *adapter, struct e1000_tx_ring *tx_ring,
         uint8_t ipcss, ipcso, tucss, tucso, hdr_len;
         int err;
 
-        if (skb_shinfo(skb)->gso_size) {
+        if (skb_is_gso(skb)) {
                 if (skb_header_cloned(skb)) {
                         err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
                         if (err)
@@ -2519,7 +2649,7 @@ e1000_tx_map(struct e1000_adapter *adapter, struct e1000_tx_ring *tx_ring,
                  * tso gets written back prematurely before the data is fully
                  * DMA'd to the controller */
                 if (!skb->data_len && tx_ring->last_tx_tso &&
-                    !skb_shinfo(skb)->gso_size) {
+                    !skb_is_gso(skb)) {
                         tx_ring->last_tx_tso = 0;
                         size -= 4;
                 }
@@ -2779,9 +2909,10 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                         case e1000_82571:
                         case e1000_82572:
                         case e1000_82573:
+                        case e1000_ich8lan:
                                 pull_size = min((unsigned int)4, skb->data_len);
                                 if (!__pskb_pull_tail(skb, pull_size)) {
-                                        printk(KERN_ERR
+                                        DPRINTK(DRV, ERR,
                                                 "__pskb_pull_tail failed.\n");
                                         dev_kfree_skb_any(skb);
                                         return NETDEV_TX_OK;
@@ -2806,8 +2937,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
 #ifdef NETIF_F_TSO
         /* Controller Erratum workaround */
-        if (!skb->data_len && tx_ring->last_tx_tso &&
-            !skb_shinfo(skb)->gso_size)
+        if (!skb->data_len && tx_ring->last_tx_tso && !skb_is_gso(skb))
                 count++;
 #endif
 
@@ -2919,8 +3049,7 @@ e1000_reset_task(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
 
-        e1000_down(adapter);
-        e1000_up(adapter);
+        e1000_reinit_locked(adapter);
 }
 
 /**
@@ -2964,6 +3093,7 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
         /* Adapter-specific max frame size limits. */
         switch (adapter->hw.mac_type) {
         case e1000_undefined ... e1000_82542_rev2_1:
+        case e1000_ich8lan:
                 if (max_frame > MAXIMUM_ETHERNET_FRAME_SIZE) {
                         DPRINTK(PROBE, ERR, "Jumbo Frames not supported.\n");
                         return -EINVAL;
@@ -2997,7 +3127,7 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 break;
         }
 
-        /* NOTE: dev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+        /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
          * means we reserve 2 more, this pushes us to allocate from the next
          * larger slab size
          * i.e. RXBUFFER_2048 --> size-4096 slab */
@@ -3018,7 +3148,6 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 adapter->rx_buffer_len = E1000_RXBUFFER_16384;
 
         /* adjust allocation if LPE protects us, and we aren't using SBP */
-#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
         if (!adapter->hw.tbi_compatibility_on &&
             ((max_frame == MAXIMUM_ETHERNET_FRAME_SIZE) ||
              (max_frame == MAXIMUM_ETHERNET_VLAN_SIZE)))
@@ -3026,10 +3155,8 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
 
         netdev->mtu = new_mtu;
 
-        if (netif_running(netdev)) {
-                e1000_down(adapter);
-                e1000_up(adapter);
-        }
+        if (netif_running(netdev))
+                e1000_reinit_locked(adapter);
 
         adapter->hw.max_frame_size = max_frame;
 
@@ -3074,12 +3201,15 @@ e1000_update_stats(struct e1000_adapter *adapter)
         adapter->stats.bprc += E1000_READ_REG(hw, BPRC);
         adapter->stats.mprc += E1000_READ_REG(hw, MPRC);
         adapter->stats.roc += E1000_READ_REG(hw, ROC);
+
+        if (adapter->hw.mac_type != e1000_ich8lan) {
         adapter->stats.prc64 += E1000_READ_REG(hw, PRC64);
         adapter->stats.prc127 += E1000_READ_REG(hw, PRC127);
         adapter->stats.prc255 += E1000_READ_REG(hw, PRC255);
         adapter->stats.prc511 += E1000_READ_REG(hw, PRC511);
         adapter->stats.prc1023 += E1000_READ_REG(hw, PRC1023);
         adapter->stats.prc1522 += E1000_READ_REG(hw, PRC1522);
+        }
 
         adapter->stats.symerrs += E1000_READ_REG(hw, SYMERRS);
         adapter->stats.mpc += E1000_READ_REG(hw, MPC);
@@ -3107,12 +3237,16 @@ e1000_update_stats(struct e1000_adapter *adapter)
         adapter->stats.totl += E1000_READ_REG(hw, TOTL);
         adapter->stats.toth += E1000_READ_REG(hw, TOTH);
         adapter->stats.tpr += E1000_READ_REG(hw, TPR);
+
+        if (adapter->hw.mac_type != e1000_ich8lan) {
         adapter->stats.ptc64 += E1000_READ_REG(hw, PTC64);
         adapter->stats.ptc127 += E1000_READ_REG(hw, PTC127);
         adapter->stats.ptc255 += E1000_READ_REG(hw, PTC255);
         adapter->stats.ptc511 += E1000_READ_REG(hw, PTC511);
         adapter->stats.ptc1023 += E1000_READ_REG(hw, PTC1023);
         adapter->stats.ptc1522 += E1000_READ_REG(hw, PTC1522);
+        }
+
         adapter->stats.mptc += E1000_READ_REG(hw, MPTC);
         adapter->stats.bptc += E1000_READ_REG(hw, BPTC);
 
@@ -3134,6 +3268,8 @@ e1000_update_stats(struct e1000_adapter *adapter)
         if (hw->mac_type > e1000_82547_rev_2) {
                 adapter->stats.iac += E1000_READ_REG(hw, IAC);
                 adapter->stats.icrxoc += E1000_READ_REG(hw, ICRXOC);
+
+                if (adapter->hw.mac_type != e1000_ich8lan) {
                 adapter->stats.icrxptc += E1000_READ_REG(hw, ICRXPTC);
                 adapter->stats.icrxatc += E1000_READ_REG(hw, ICRXATC);
                 adapter->stats.ictxptc += E1000_READ_REG(hw, ICTXPTC);
@@ -3141,6 +3277,7 @@ e1000_update_stats(struct e1000_adapter *adapter)
                 adapter->stats.ictxqec += E1000_READ_REG(hw, ICTXQEC);
                 adapter->stats.ictxqmtc += E1000_READ_REG(hw, ICTXQMTC);
                 adapter->stats.icrxdmtc += E1000_READ_REG(hw, ICRXDMTC);
+                }
         }
 
         /* Fill out the OS statistics structure */
@@ -3249,8 +3386,8 @@ e1000_intr(int irq, void *data, struct pt_regs *regs)
                 E1000_WRITE_REG(hw, IMC, ~0);
                 E1000_WRITE_FLUSH(hw);
         }
-        if (likely(netif_rx_schedule_prep(&adapter->polling_netdev[0])))
-                __netif_rx_schedule(&adapter->polling_netdev[0]);
+        if (likely(netif_rx_schedule_prep(netdev)))
+                __netif_rx_schedule(netdev);
         else
                 e1000_irq_enable(adapter);
 #else
@@ -3293,34 +3430,26 @@ e1000_clean(struct net_device *poll_dev, int *budget)
 {
         struct e1000_adapter *adapter;
         int work_to_do = min(*budget, poll_dev->quota);
-        int tx_cleaned = 0, i = 0, work_done = 0;
+        int tx_cleaned = 0, work_done = 0;
 
         /* Must NOT use netdev_priv macro here. */
         adapter = poll_dev->priv;
 
         /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(adapter->netdev))
+        if (!netif_carrier_ok(poll_dev))
                 goto quit_polling;
 
-        while (poll_dev != &adapter->polling_netdev[i]) {
-                i++;
-                BUG_ON(i == adapter->num_rx_queues);
+        /* e1000_clean is called per-cpu.  This lock protects
+         * tx_ring[0] from being cleaned by multiple cpus
+         * simultaneously.  A failure obtaining the lock means
+         * tx_ring[0] is currently being cleaned anyway. */
+        if (spin_trylock(&adapter->tx_queue_lock)) {
+                tx_cleaned = e1000_clean_tx_irq(adapter,
+                                                &adapter->tx_ring[0]);
+                spin_unlock(&adapter->tx_queue_lock);
         }
 
-        if (likely(adapter->num_tx_queues == 1)) {
-                /* e1000_clean is called per-cpu.  This lock protects
-                 * tx_ring[0] from being cleaned by multiple cpus
-                 * simultaneously.  A failure obtaining the lock means
-                 * tx_ring[0] is currently being cleaned anyway. */
-                if (spin_trylock(&adapter->tx_queue_lock)) {
-                        tx_cleaned = e1000_clean_tx_irq(adapter,
-                                                        &adapter->tx_ring[0]);
-                        spin_unlock(&adapter->tx_queue_lock);
-                }
-        } else
-                tx_cleaned = e1000_clean_tx_irq(adapter, &adapter->tx_ring[i]);
-
-        adapter->clean_rx(adapter, &adapter->rx_ring[i],
+        adapter->clean_rx(adapter, &adapter->rx_ring[0],
                           &work_done, work_to_do);
 
         *budget -= work_done;
@@ -3328,7 +3457,7 @@ e1000_clean(struct net_device *poll_dev, int *budget)
 
         /* If no Tx and not enough Rx work done, exit the polling mode */
         if ((!tx_cleaned && (work_done == 0)) ||
-           !netif_running(adapter->netdev)) {
+           !netif_running(poll_dev)) {
 quit_polling:
                 netif_rx_complete(poll_dev);
                 e1000_irq_enable(adapter);
@@ -3543,11 +3672,15 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 length = le16_to_cpu(rx_desc->length);
 
+                /* adjust length to remove Ethernet CRC */
+                length -= 4;
+
                 if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
                         /* All receives must fit into a single buffer */
                         E1000_DBG("%s: Receive packet consumed multiple"
                                   " buffers\n", netdev->name);
-                        dev_kfree_skb_irq(skb);
+                        /* recycle */
+                        buffer_info-> skb = skb;
                         goto next_desc;
                 }
 
@@ -3575,7 +3708,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
 #define E1000_CB_LENGTH 256
                 if (length < E1000_CB_LENGTH) {
                         struct sk_buff *new_skb =
-                            dev_alloc_skb(length + NET_IP_ALIGN);
+                            netdev_alloc_skb(netdev, length + NET_IP_ALIGN);
                         if (new_skb) {
                                 skb_reserve(new_skb, NET_IP_ALIGN);
                                 new_skb->dev = netdev;
@@ -3675,7 +3808,6 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
         buffer_info = &rx_ring->buffer_info[i];
 
         while (staterr & E1000_RXD_STAT_DD) {
-                buffer_info = &rx_ring->buffer_info[i];
                 ps_page = &rx_ring->ps_page[i];
                 ps_page_dma = &rx_ring->ps_page_dma[i];
 #ifdef CONFIG_E1000_NAPI
@@ -3747,8 +3879,9 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         pci_dma_sync_single_for_device(pdev,
                                 ps_page_dma->ps_page_dma[0],
                                 PAGE_SIZE, PCI_DMA_FROMDEVICE);
+                        /* remove the CRC */
+                        l1 -= 4;
                         skb_put(skb, l1);
-                        length += l1;
                         goto copydone;
                 } /* if */
                 }
@@ -3767,6 +3900,10 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         skb->truesize += length;
                 }
 
+                /* strip the ethernet crc, problem is we're using pages now so
+                 * this whole operation can get a little cpu intensive */
+                pskb_trim(skb, skb->len - 4);
+
 copydone:
                 e1000_rx_checksum(adapter, staterr,
                                   le16_to_cpu(rx_desc->wb.lower.hi_dword.csum_ip.csum), skb);
@@ -3842,7 +3979,7 @@ e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
 
         while (cleaned_count--) {
                 if (!(skb = buffer_info->skb))
-                        skb = dev_alloc_skb(bufsz);
+                        skb = netdev_alloc_skb(netdev, bufsz);
                 else {
                         skb_trim(skb, 0);
                         goto map_skb;
@@ -3860,7 +3997,7 @@ e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                         DPRINTK(RX_ERR, ERR, "skb align check failed: %u bytes "
                                              "at %p\n", bufsz, skb->data);
                         /* Try again, without freeing the previous */
-                        skb = dev_alloc_skb(bufsz);
+                        skb = netdev_alloc_skb(netdev, bufsz);
                         /* Failed allocation, critical failure */
                         if (!skb) {
                                 dev_kfree_skb(oldskb);
@@ -3984,7 +4121,8 @@ e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                                 rx_desc->read.buffer_addr[j+1] = ~0;
                 }
 
-                skb = dev_alloc_skb(adapter->rx_ps_bsize0 + NET_IP_ALIGN);
+                skb = netdev_alloc_skb(netdev,
+                                       adapter->rx_ps_bsize0 + NET_IP_ALIGN);
 
                 if (unlikely(!skb)) {
                         adapter->alloc_rx_buff_failed++;
@@ -4180,10 +4318,9 @@ e1000_mii_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
                                                 return retval;
                                         }
                                 }
-                                if (netif_running(adapter->netdev)) {
-                                        e1000_down(adapter);
-                                        e1000_up(adapter);
-                                } else
+                                if (netif_running(adapter->netdev))
+                                        e1000_reinit_locked(adapter);
+                                else
                                         e1000_reset(adapter);
                                 break;
                         case M88E1000_PHY_SPEC_CTRL:
@@ -4200,10 +4337,9 @@ e1000_mii_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
                         case PHY_CTRL:
                                 if (mii_reg & MII_CR_POWER_DOWN)
                                         break;
-                                if (netif_running(adapter->netdev)) {
-                                        e1000_down(adapter);
-                                        e1000_up(adapter);
-                                } else
+                                if (netif_running(adapter->netdev))
+                                        e1000_reinit_locked(adapter);
+                                else
                                         e1000_reset(adapter);
                                 break;
                         }
@@ -4250,11 +4386,13 @@ e1000_write_pci_cfg(struct e1000_hw *hw, uint32_t reg, uint16_t *value)
         pci_write_config_word(adapter->pdev, reg, *value);
 }
 
+#if 0
 uint32_t
 e1000_io_read(struct e1000_hw *hw, unsigned long port)
 {
         return inl(port);
 }
+#endif  /*  0  */
 
 void
 e1000_io_write(struct e1000_hw *hw, unsigned long port, uint32_t value)
@@ -4277,18 +4415,21 @@ e1000_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
                 ctrl |= E1000_CTRL_VME;
                 E1000_WRITE_REG(&adapter->hw, CTRL, ctrl);
 
+                if (adapter->hw.mac_type != e1000_ich8lan) {
                 /* enable VLAN receive filtering */
                 rctl = E1000_READ_REG(&adapter->hw, RCTL);
                 rctl |= E1000_RCTL_VFE;
                 rctl &= ~E1000_RCTL_CFIEN;
                 E1000_WRITE_REG(&adapter->hw, RCTL, rctl);
                 e1000_update_mng_vlan(adapter);
+                }
         } else {
                 /* disable VLAN tag insert/strip */
                 ctrl = E1000_READ_REG(&adapter->hw, CTRL);
                 ctrl &= ~E1000_CTRL_VME;
                 E1000_WRITE_REG(&adapter->hw, CTRL, ctrl);
 
+                if (adapter->hw.mac_type != e1000_ich8lan) {
                 /* disable VLAN filtering */
                 rctl = E1000_READ_REG(&adapter->hw, RCTL);
                 rctl &= ~E1000_RCTL_VFE;
@@ -4297,6 +4438,7 @@ e1000_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
                         e1000_vlan_rx_kill_vid(netdev, adapter->mng_vlan_id);
                         adapter->mng_vlan_id = E1000_MNG_VLAN_NONE;
                 }
+                }
         }
 
         e1000_irq_enable(adapter);
@@ -4458,12 +4600,16 @@ e1000_suspend(struct pci_dev *pdev, pm_message_t state)
         struct e1000_adapter *adapter = netdev_priv(netdev);
         uint32_t ctrl, ctrl_ext, rctl, manc, status;
         uint32_t wufc = adapter->wol;
+#ifdef CONFIG_PM
         int retval = 0;
+#endif
 
         netif_device_detach(netdev);
 
-        if (netif_running(netdev))
+        if (netif_running(netdev)) {
+                WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
                 e1000_down(adapter);
+        }
 
 #ifdef CONFIG_PM
         /* Implement our own version of pci_save_state(pdev) because pci-
@@ -4521,7 +4667,9 @@ e1000_suspend(struct pci_dev *pdev, pm_message_t state)
                 pci_enable_wake(pdev, PCI_D3cold, 0);
         }
 
+        /* FIXME: this code is incorrect for PCI Express */
         if (adapter->hw.mac_type >= e1000_82540 &&
+           adapter->hw.mac_type != e1000_ich8lan &&
            adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 if (manc & E1000_MANC_SMBUS_EN) {
@@ -4532,6 +4680,9 @@ e1000_suspend(struct pci_dev *pdev, pm_message_t state)
                 }
         }
 
+        if (adapter->hw.phy_type == e1000_phy_igp_3)
+                e1000_phy_powerdown_workaround(&adapter->hw);
+
         /* Release control of h/w to f/w.  If f/w is AMT enabled, this
          * would have already happened in close and is redundant. */
         e1000_release_hw_control(adapter);
@@ -4567,7 +4718,9 @@ e1000_resume(struct pci_dev *pdev)
 
         netif_device_attach(netdev);
 
+        /* FIXME: this code is incorrect for PCI Express */
         if (adapter->hw.mac_type >= e1000_82540 &&
+           adapter->hw.mac_type != e1000_ich8lan &&
            adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 manc &= ~(E1000_MANC_ARP_EN);
@@ -4601,6 +4754,7 @@ static void
 e1000_netpoll(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
+
         disable_irq(adapter->pdev->irq);
         e1000_intr(adapter->pdev->irq, netdev, NULL);
         e1000_clean_tx_irq(adapter, adapter->tx_ring);
diff --git a/drivers/net/e1000/e1000_osdep.h b/drivers/net/e1000/e1000_osdep.h
index 048d052be29d..2d3e8b06cab0 100644
--- a/drivers/net/e1000/e1000_osdep.h
+++ b/drivers/net/e1000/e1000_osdep.h
@@ -127,4 +127,17 @@ typedef enum {
 
 #define E1000_WRITE_FLUSH(a) E1000_READ_REG(a, STATUS)
 
+#define E1000_WRITE_ICH8_REG(a, reg, value) ( \
+    writel((value), ((a)->flash_address + reg)))
+
+#define E1000_READ_ICH8_REG(a, reg) ( \
+    readl((a)->flash_address + reg))
+
+#define E1000_WRITE_ICH8_REG16(a, reg, value) ( \
+    writew((value), ((a)->flash_address + reg)))
+
+#define E1000_READ_ICH8_REG16(a, reg) ( \
+    readw((a)->flash_address + reg))
+
+
 #endif /* _E1000_OSDEP_H_ */
diff --git a/drivers/net/e1000/e1000_param.c b/drivers/net/e1000/e1000_param.c
index e55f8969a0fb..0ef413172c68 100644
--- a/drivers/net/e1000/e1000_param.c
+++ b/drivers/net/e1000/e1000_param.c
@@ -45,6 +45,16 @@
  */
 
 #define E1000_PARAM_INIT { [0 ... E1000_MAX_NIC] = OPTION_UNSET }
+/* Module Parameters are always initialized to -1, so that the driver
+ * can tell the difference between no user specified value or the
+ * user asking for the default value.
+ * The true default values are loaded in when e1000_check_options is called.
+ *
+ * This is a GCC extension to ANSI C.
+ * See the item "Labeled Elements in Initializers" in the section
+ * "Extensions to the C Language Family" of the GCC documentation.
+ */
+
 #define E1000_PARAM(X, desc) \
         static int __devinitdata X[E1000_MAX_NIC+1] = E1000_PARAM_INIT; \
         static int num_##X = 0; \
@@ -183,6 +193,24 @@ E1000_PARAM(RxAbsIntDelay, "Receive Absolute Interrupt Delay");
 
 E1000_PARAM(InterruptThrottleRate, "Interrupt Throttling Rate");
 
+/* Enable Smart Power Down of the PHY
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 0 (disabled)
+ */
+
+E1000_PARAM(SmartPowerDownEnable, "Enable PHY smart power down");
+
+/* Enable Kumeran Lock Loss workaround
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 1 (enabled)
+ */
+
+E1000_PARAM(KumeranLockLoss, "Enable Kumeran lock loss workaround");
+
 #define AUTONEG_ADV_DEFAULT  0x2F
 #define AUTONEG_ADV_MASK     0x2F
 #define FLOW_CONTROL_DEFAULT FLOW_CONTROL_FULL
@@ -296,6 +324,7 @@ e1000_check_options(struct e1000_adapter *adapter)
                 DPRINTK(PROBE, NOTICE,
                        "Warning: no configuration for board #%i\n", bd);
                 DPRINTK(PROBE, NOTICE, "Using defaults for all values\n");
+                bd = E1000_MAX_NIC;
         }
 
         { /* Transmit Descriptor Count */
@@ -313,14 +342,9 @@ e1000_check_options(struct e1000_adapter *adapter)
                 opt.arg.r.max = mac_type < e1000_82544 ?
                         E1000_MAX_TXD : E1000_MAX_82544_TXD;
 
-                if (num_TxDescriptors > bd) {
-                        tx_ring->count = TxDescriptors[bd];
-                        e1000_validate_option(&tx_ring->count, &opt, adapter);
-                        E1000_ROUNDUP(tx_ring->count,
-                                                REQ_TX_DESCRIPTOR_MULTIPLE);
-                } else {
-                        tx_ring->count = opt.def;
-                }
+                tx_ring->count = TxDescriptors[bd];
+                e1000_validate_option(&tx_ring->count, &opt, adapter);
+                E1000_ROUNDUP(tx_ring->count, REQ_TX_DESCRIPTOR_MULTIPLE);
                 for (i = 0; i < adapter->num_tx_queues; i++)
                         tx_ring[i].count = tx_ring->count;
         }
@@ -339,14 +363,9 @@ e1000_check_options(struct e1000_adapter *adapter)
                 opt.arg.r.max = mac_type < e1000_82544 ? E1000_MAX_RXD :
                         E1000_MAX_82544_RXD;
 
-                if (num_RxDescriptors > bd) {
-                        rx_ring->count = RxDescriptors[bd];
-                        e1000_validate_option(&rx_ring->count, &opt, adapter);
-                        E1000_ROUNDUP(rx_ring->count,
-                                                REQ_RX_DESCRIPTOR_MULTIPLE);
-                } else {
-                        rx_ring->count = opt.def;
-                }
+                rx_ring->count = RxDescriptors[bd];
+                e1000_validate_option(&rx_ring->count, &opt, adapter);
+                E1000_ROUNDUP(rx_ring->count, REQ_RX_DESCRIPTOR_MULTIPLE);
                 for (i = 0; i < adapter->num_rx_queues; i++)
                         rx_ring[i].count = rx_ring->count;
         }
@@ -358,13 +377,9 @@ e1000_check_options(struct e1000_adapter *adapter)
                         .def  = OPTION_ENABLED
                 };
 
-                if (num_XsumRX > bd) {
-                        int rx_csum = XsumRX[bd];
-                        e1000_validate_option(&rx_csum, &opt, adapter);
-                        adapter->rx_csum = rx_csum;
-                } else {
-                        adapter->rx_csum = opt.def;
-                }
+                int rx_csum = XsumRX[bd];
+                e1000_validate_option(&rx_csum, &opt, adapter);
+                adapter->rx_csum = rx_csum;
         }
         { /* Flow Control */
 
@@ -384,13 +399,9 @@ e1000_check_options(struct e1000_adapter *adapter)
                                          .p = fc_list }}
                 };
 
-                if (num_FlowControl > bd) {
-                        int fc = FlowControl[bd];
-                        e1000_validate_option(&fc, &opt, adapter);
-                        adapter->hw.fc = adapter->hw.original_fc = fc;
-                } else {
-                        adapter->hw.fc = adapter->hw.original_fc = opt.def;
-                }
+                int fc = FlowControl[bd];
+                e1000_validate_option(&fc, &opt, adapter);
+                adapter->hw.fc = adapter->hw.original_fc = fc;
         }
         { /* Transmit Interrupt Delay */
                 struct e1000_option opt = {
@@ -402,13 +413,8 @@ e1000_check_options(struct e1000_adapter *adapter)
                                          .max = MAX_TXDELAY }}
                 };
 
-                if (num_TxIntDelay > bd) {
-                        adapter->tx_int_delay = TxIntDelay[bd];
-                        e1000_validate_option(&adapter->tx_int_delay, &opt,
-                                                                adapter);
-                } else {
-                        adapter->tx_int_delay = opt.def;
-                }
+                adapter->tx_int_delay = TxIntDelay[bd];
+                e1000_validate_option(&adapter->tx_int_delay, &opt, adapter);
         }
         { /* Transmit Absolute Interrupt Delay */
                 struct e1000_option opt = {
@@ -420,13 +426,9 @@ e1000_check_options(struct e1000_adapter *adapter)
                                          .max = MAX_TXABSDELAY }}
                 };
 
-                if (num_TxAbsIntDelay > bd) {
-                        adapter->tx_abs_int_delay = TxAbsIntDelay[bd];
-                        e1000_validate_option(&adapter->tx_abs_int_delay, &opt,
-                                                                adapter);
-                } else {
-                        adapter->tx_abs_int_delay = opt.def;
-                }
+                adapter->tx_abs_int_delay = TxAbsIntDelay[bd];
+                e1000_validate_option(&adapter->tx_abs_int_delay, &opt,
+                                      adapter);
         }
         { /* Receive Interrupt Delay */
                 struct e1000_option opt = {
@@ -438,13 +440,8 @@ e1000_check_options(struct e1000_adapter *adapter)
                                          .max = MAX_RXDELAY }}
                 };
 
-                if (num_RxIntDelay > bd) {
-                        adapter->rx_int_delay = RxIntDelay[bd];
-                        e1000_validate_option(&adapter->rx_int_delay, &opt,
-                                                                adapter);
-                } else {
-                        adapter->rx_int_delay = opt.def;
-                }
+                adapter->rx_int_delay = RxIntDelay[bd];
+                e1000_validate_option(&adapter->rx_int_delay, &opt, adapter);
         }
         { /* Receive Absolute Interrupt Delay */
                 struct e1000_option opt = {
@@ -456,13 +453,9 @@ e1000_check_options(struct e1000_adapter *adapter)
                                          .max = MAX_RXABSDELAY }}
                 };
 
-                if (num_RxAbsIntDelay > bd) {
-                        adapter->rx_abs_int_delay = RxAbsIntDelay[bd];
-                        e1000_validate_option(&adapter->rx_abs_int_delay, &opt,
-                                                                adapter);
-                } else {
-                        adapter->rx_abs_int_delay = opt.def;
-                }
+                adapter->rx_abs_int_delay = RxAbsIntDelay[bd];
+                e1000_validate_option(&adapter->rx_abs_int_delay, &opt,
+                                      adapter);
         }
         { /* Interrupt Throttling Rate */
                 struct e1000_option opt = {
@@ -474,26 +467,44 @@ e1000_check_options(struct e1000_adapter *adapter)
                                          .max = MAX_ITR }}
                 };
 
-                if (num_InterruptThrottleRate > bd) {
-                        adapter->itr = InterruptThrottleRate[bd];
-                        switch (adapter->itr) {
-                        case 0:
-                                DPRINTK(PROBE, INFO, "%s turned off\n",
-                                        opt.name);
-                                break;
-                        case 1:
-                                DPRINTK(PROBE, INFO, "%s set to dynamic mode\n",
-                                        opt.name);
-                                break;
-                        default:
-                                e1000_validate_option(&adapter->itr, &opt,
-                                        adapter);
-                                break;
-                        }
-                } else {
-                        adapter->itr = opt.def;
+                adapter->itr = InterruptThrottleRate[bd];
+                switch (adapter->itr) {
+                case 0:
+                        DPRINTK(PROBE, INFO, "%s turned off\n", opt.name);
+                        break;
+                case 1:
+                        DPRINTK(PROBE, INFO, "%s set to dynamic mode\n",
+                                opt.name);
+                        break;
+                default:
+                        e1000_validate_option(&adapter->itr, &opt, adapter);
+                        break;
                 }
         }
+        { /* Smart Power Down */
+                struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "PHY Smart Power Down",
+                        .err  = "defaulting to Disabled",
+                        .def  = OPTION_DISABLED
+                };
+
+                int spd = SmartPowerDownEnable[bd];
+                e1000_validate_option(&spd, &opt, adapter);
+                adapter->smart_power_down = spd;
+        }
+        { /* Kumeran Lock Loss Workaround */
+                struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "Kumeran Lock Loss Workaround",
+                        .err  = "defaulting to Enabled",
+                        .def  = OPTION_ENABLED
+                };
+
+                        int kmrn_lock_loss = KumeranLockLoss[bd];
+                        e1000_validate_option(&kmrn_lock_loss, &opt, adapter);
+                        adapter->hw.kmrn_lock_loss_workaround_disabled = !kmrn_lock_loss;
+        }
 
         switch (adapter->hw.media_type) {
         case e1000_media_type_fiber:
@@ -519,17 +530,18 @@ static void __devinit
 e1000_check_fiber_options(struct e1000_adapter *adapter)
 {
         int bd = adapter->bd_number;
-        if (num_Speed > bd) {
+        bd = bd > E1000_MAX_NIC ? E1000_MAX_NIC : bd;
+        if ((Speed[bd] != OPTION_UNSET)) {
                 DPRINTK(PROBE, INFO, "Speed not valid for fiber adapters, "
                        "parameter ignored\n");
         }
 
-        if (num_Duplex > bd) {
+        if ((Duplex[bd] != OPTION_UNSET)) {
                 DPRINTK(PROBE, INFO, "Duplex not valid for fiber adapters, "
                        "parameter ignored\n");
         }
 
-        if ((num_AutoNeg > bd) && (AutoNeg[bd] != 0x20)) {
+        if ((AutoNeg[bd] != OPTION_UNSET) && (AutoNeg[bd] != 0x20)) {
                 DPRINTK(PROBE, INFO, "AutoNeg other than 1000/Full is "
                                  "not valid for fiber adapters, "
                                  "parameter ignored\n");
@@ -548,6 +560,7 @@ e1000_check_copper_options(struct e1000_adapter *adapter)
 {
         int speed, dplx, an;
         int bd = adapter->bd_number;
+        bd = bd > E1000_MAX_NIC ? E1000_MAX_NIC : bd;
 
         { /* Speed */
                 struct e1000_opt_list speed_list[] = {{          0, "" },
@@ -564,12 +577,8 @@ e1000_check_copper_options(struct e1000_adapter *adapter)
                                          .p = speed_list }}
                 };
 
-                if (num_Speed > bd) {
-                        speed = Speed[bd];
-                        e1000_validate_option(&speed, &opt, adapter);
-                } else {
-                        speed = opt.def;
-                }
+                speed = Speed[bd];
+                e1000_validate_option(&speed, &opt, adapter);
         }
         { /* Duplex */
                 struct e1000_opt_list dplx_list[] = {{           0, "" },
@@ -591,15 +600,11 @@ e1000_check_copper_options(struct e1000_adapter *adapter)
                                 "Speed/Duplex/AutoNeg parameter ignored.\n");
                         return;
                 }
-                if (num_Duplex > bd) {
-                        dplx = Duplex[bd];
-                        e1000_validate_option(&dplx, &opt, adapter);
-                } else {
-                        dplx = opt.def;
-                }
+                dplx = Duplex[bd];
+                e1000_validate_option(&dplx, &opt, adapter);
         }
 
-        if ((num_AutoNeg > bd) && (speed != 0 || dplx != 0)) {
+        if (AutoNeg[bd] != OPTION_UNSET && (speed != 0 || dplx != 0)) {
                 DPRINTK(PROBE, INFO,
                        "AutoNeg specified along with Speed or Duplex, "
                        "parameter ignored\n");
@@ -648,19 +653,15 @@ e1000_check_copper_options(struct e1000_adapter *adapter)
                                          .p = an_list }}
                 };
 
-                if (num_AutoNeg > bd) {
-                        an = AutoNeg[bd];
-                        e1000_validate_option(&an, &opt, adapter);
-                } else {
-                        an = opt.def;
-                }
+                an = AutoNeg[bd];
+                e1000_validate_option(&an, &opt, adapter);
                 adapter->hw.autoneg_advertised = an;
         }
 
         switch (speed + dplx) {
         case 0:
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
-                if ((num_Speed > bd) && (speed != 0 || dplx != 0))
+                if (Speed[bd] != OPTION_UNSET || Duplex[bd] != OPTION_UNSET)
                         DPRINTK(PROBE, INFO,
                                "Speed and duplex autonegotiation enabled\n");
                 break;
diff --git a/drivers/net/e2100.c b/drivers/net/e2100.c
index e5c5cd2a2712..e4e733a380e3 100644
--- a/drivers/net/e2100.c
+++ b/drivers/net/e2100.c
@@ -425,8 +425,8 @@ MODULE_LICENSE("GPL");
 
 /* This is set up so that only a single autoprobe takes place per call.
 ISA device autoprobes on a running machine are not recommended. */
-int
-init_module(void)
+
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index 20d31430c74f..8dc61d65dd23 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1807,8 +1807,7 @@ MODULE_PARM_DESC(irq, "EtherExpress Pro/10 IRQ number(s)");
 MODULE_PARM_DESC(mem, "EtherExpress Pro/10 Rx buffer size(es) in kB (3-29)");
 MODULE_PARM_DESC(autodetect, "EtherExpress Pro/10 force board(s) detection (0-1)");
 
-int
-init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev;
         int i;
diff --git a/drivers/net/eepro100.c b/drivers/net/eepro100.c
index 2ad327542927..e445988c92ee 100644
--- a/drivers/net/eepro100.c
+++ b/drivers/net/eepro100.c
@@ -555,12 +555,12 @@ static int __devinit eepro100_init_one (struct pci_dev *pdev,
 
         if (!request_region(pci_resource_start(pdev, 1),
                         pci_resource_len(pdev, 1), "eepro100")) {
-                printk (KERN_ERR "eepro100: cannot reserve I/O ports\n");
+                dev_err(&pdev->dev, "eepro100: cannot reserve I/O ports\n");
                 goto err_out_none;
         }
         if (!request_mem_region(pci_resource_start(pdev, 0),
                         pci_resource_len(pdev, 0), "eepro100")) {
-                printk (KERN_ERR "eepro100: cannot reserve MMIO region\n");
+                dev_err(&pdev->dev, "eepro100: cannot reserve MMIO region\n");
                 goto err_out_free_pio_region;
         }
 
@@ -573,7 +573,7 @@ static int __devinit eepro100_init_one (struct pci_dev *pdev,
 
         ioaddr = pci_iomap(pdev, pci_bar, 0);
         if (!ioaddr) {
-                printk (KERN_ERR "eepro100: cannot remap IO\n");
+                dev_err(&pdev->dev, "eepro100: cannot remap IO\n");
                 goto err_out_free_mmio_region;
         }
 
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 33291bcf6d4c..0701c1d810ca 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1698,7 +1698,7 @@ MODULE_LICENSE("GPL");
  * are specified, we verify and then use them.  If no parameters are given, we
  * autoprobe for one card only.
  */
-int init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index 9f3e09a3d88c..a67650ccf084 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -19,62 +19,15 @@
 
         Information and updates available at
         http://www.scyld.com/network/epic100.html
+        [this link no longer provides anything useful -jgarzik]
 
         ---------------------------------------------------------------------
 
-        Linux kernel-specific changes:
-
-        LK1.1.2 (jgarzik):
-        * Merge becker version 1.09 (4/08/2000)
-
-        LK1.1.3:
-        * Major bugfix to 1.09 driver (Francis Romieu)
-
-        LK1.1.4 (jgarzik):
-        * Merge becker test version 1.09 (5/29/2000)
-
-        LK1.1.5:
-        * Fix locking (jgarzik)
-        * Limit 83c175 probe to ethernet-class PCI devices (rgooch)
-
-        LK1.1.6:
-        * Merge becker version 1.11
-        * Move pci_enable_device before any PCI BAR len checks
-
-        LK1.1.7:
-        * { fill me in }
-
-        LK1.1.8:
-        * ethtool driver info support (jgarzik)
-
-        LK1.1.9:
-        * ethtool media get/set support (jgarzik)
-
-        LK1.1.10:
-        * revert MII transceiver init change (jgarzik)
-
-        LK1.1.11:
-        * implement ETHTOOL_[GS]SET, _NWAY_RST, _[GS]MSGLVL, _GLINK (jgarzik)
-        * replace some MII-related magic numbers with constants
-
-        LK1.1.12:
-        * fix power-up sequence
-
-        LK1.1.13:
-        * revert version 1.1.12, power-up sequence "fix"
-
-        LK1.1.14 (Kryzsztof Halasa):
-        * fix spurious bad initializations
-        * pound phy a la SMSC's app note on the subject
-
-        AC1.1.14ac
-        * fix power up/down for ethtool that broke in 1.11
-
 */
 
 #define DRV_NAME        "epic100"
-#define DRV_VERSION     "1.11+LK1.1.14+AC1.1.14"
-#define DRV_RELDATE     "June 2, 2004"
+#define DRV_VERSION     "2.0"
+#define DRV_RELDATE     "June 27, 2006"
 
 /* The user-configurable values.
    These may be modified when a driver module is loaded.*/
@@ -204,19 +157,15 @@ typedef enum {
 
 struct epic_chip_info {
         const char *name;
-        int io_size;                            /* Needed for I/O region check or ioremap(). */
         int drv_flags;                          /* Driver use, intended as capability flags. */
 };
 
 
 /* indexed by chip_t */
 static const struct epic_chip_info pci_id_tbl[] = {
-        { "SMSC EPIC/100 83c170",
-          EPIC_TOTAL_SIZE, TYPE2_INTR | NO_MII | MII_PWRDWN },
-        { "SMSC EPIC/100 83c170",
-          EPIC_TOTAL_SIZE, TYPE2_INTR },
-        { "SMSC EPIC/C 83c175",
-          EPIC_TOTAL_SIZE, TYPE2_INTR | MII_PWRDWN },
+        { "SMSC EPIC/100 83c170",       TYPE2_INTR | NO_MII | MII_PWRDWN },
+        { "SMSC EPIC/100 83c170",       TYPE2_INTR },
+        { "SMSC EPIC/C 83c175",         TYPE2_INTR | MII_PWRDWN },
 };
 
 
@@ -385,8 +334,8 @@ static int __devinit epic_init_one (struct pci_dev *pdev,
                 goto out;
         irq = pdev->irq;
 
-        if (pci_resource_len(pdev, 0) < pci_id_tbl[chip_idx].io_size) {
-                printk (KERN_ERR "card %d: no PCI region space\n", card_idx);
+        if (pci_resource_len(pdev, 0) < EPIC_TOTAL_SIZE) {
+                dev_err(&pdev->dev, "no PCI region space\n");
                 ret = -ENODEV;
                 goto err_out_disable;
         }
@@ -401,7 +350,7 @@ static int __devinit epic_init_one (struct pci_dev *pdev,
 
         dev = alloc_etherdev(sizeof (*ep));
         if (!dev) {
-                printk (KERN_ERR "card %d: no memory for eth device\n", card_idx);
+                dev_err(&pdev->dev, "no memory for eth device\n");
                 goto err_out_free_res;
         }
         SET_MODULE_OWNER(dev);
@@ -413,7 +362,7 @@ static int __devinit epic_init_one (struct pci_dev *pdev,
         ioaddr = pci_resource_start (pdev, 1);
         ioaddr = (long) ioremap (ioaddr, pci_resource_len (pdev, 1));
         if (!ioaddr) {
-                printk (KERN_ERR DRV_NAME " %d: ioremap failed\n", card_idx);
+                dev_err(&pdev->dev, "ioremap failed\n");
                 goto err_out_free_netdev;
         }
 #endif
@@ -473,8 +422,7 @@ static int __devinit epic_init_one (struct pci_dev *pdev,
                 ((u16 *)dev->dev_addr)[i] = le16_to_cpu(inw(ioaddr + LAN0 + i*4));
 
         if (debug > 2) {
-                printk(KERN_DEBUG DRV_NAME "(%s): EEPROM contents\n",
-                       pci_name(pdev));
+                dev_printk(KERN_DEBUG, &pdev->dev, "EEPROM contents:\n");
                 for (i = 0; i < 64; i++)
                         printk(" %4.4x%s", read_eeprom(ioaddr, i),
                                    i % 16 == 15 ? "\n" : "");
@@ -496,21 +444,23 @@ static int __devinit epic_init_one (struct pci_dev *pdev,
                         int mii_status = mdio_read(dev, phy, MII_BMSR);
                         if (mii_status != 0xffff  &&  mii_status != 0x0000) {
                                 ep->phys[phy_idx++] = phy;
-                                printk(KERN_INFO DRV_NAME "(%s): MII transceiver #%d control "
-                                           "%4.4x status %4.4x.\n",
-                                           pci_name(pdev), phy, mdio_read(dev, phy, 0), mii_status);
+                                dev_info(&pdev->dev,
+                                        "MII transceiver #%d control "
+                                        "%4.4x status %4.4x.\n",
+                                        phy, mdio_read(dev, phy, 0), mii_status);
                         }
                 }
                 ep->mii_phy_cnt = phy_idx;
                 if (phy_idx != 0) {
                         phy = ep->phys[0];
                         ep->mii.advertising = mdio_read(dev, phy, MII_ADVERTISE);
-                        printk(KERN_INFO DRV_NAME "(%s): Autonegotiation advertising %4.4x link "
+                        dev_info(&pdev->dev,
+                                "Autonegotiation advertising %4.4x link "
                                    "partner %4.4x.\n",
-                                   pci_name(pdev), ep->mii.advertising, mdio_read(dev, phy, 5));
+                                   ep->mii.advertising, mdio_read(dev, phy, 5));
                 } else if ( ! (ep->chip_flags & NO_MII)) {
-                        printk(KERN_WARNING DRV_NAME "(%s): ***WARNING***: No MII transceiver found!\n",
-                               pci_name(pdev));
+                        dev_warn(&pdev->dev,
+                                "***WARNING***: No MII transceiver found!\n");
                         /* Use the known PHY address of the EPII. */
                         ep->phys[0] = 3;
                 }
@@ -525,8 +475,7 @@ static int __devinit epic_init_one (struct pci_dev *pdev,
         /* The lower four bits are the media type. */
         if (duplex) {
                 ep->mii.force_media = ep->mii.full_duplex = 1;
-                printk(KERN_INFO DRV_NAME "(%s):  Forced full duplex operation requested.\n",
-                       pci_name(pdev));
+                dev_info(&pdev->dev, "Forced full duplex requested.\n");
         }
         dev->if_port = ep->default_port = option;
 
diff --git a/drivers/net/es3210.c b/drivers/net/es3210.c
index 6b0ab1eac3fb..fd7b32a24ea4 100644
--- a/drivers/net/es3210.c
+++ b/drivers/net/es3210.c
@@ -421,8 +421,7 @@ MODULE_PARM_DESC(mem, "memory base address(es)");
 MODULE_DESCRIPTION("Racal-Interlan ES3210 EISA ethernet driver");
 MODULE_LICENSE("GPL");
 
-int
-init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 4bf76f86d8e9..ca42efa9143c 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -1434,7 +1434,7 @@ MODULE_PARM_DESC(mediatype, "eth16i media type of interface(s) (bnc,tp,dix,auto,
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "eth16i debug level (0-6)");
 
-int init_module(void)
+int __init init_module(void)
 {
         int this_dev, found = 0;
         struct net_device *dev;
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index c701951dcd6f..567e27413cfd 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -92,7 +92,7 @@ static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 #include <asm/uaccess.h>
 
 /* These identify the driver base version and may not be removed. */
-static char version[] __devinitdata =
+static char version[] =
 KERN_INFO DRV_NAME ".c:v" DRV_VERSION " " DRV_RELDATE "\n";
 
 
@@ -124,7 +124,9 @@ MODULE_PARM_DESC(multicast_filter_limit, "fealnx maximum number of filtered mult
 MODULE_PARM_DESC(options, "fealnx: Bits 0-3: media type, bit 17: full duplex");
 MODULE_PARM_DESC(full_duplex, "fealnx full duplex setting(s) (1)");
 
-#define MIN_REGION_SIZE 136
+enum {
+        MIN_REGION_SIZE         = 136,
+};
 
 /* A chip capabilities table, matching the entries in pci_tbl[] above. */
 enum chip_capability_flags {
@@ -146,14 +148,13 @@ enum phy_type_flags {
 
 struct chip_info {
         char *chip_name;
-        int io_size;
         int flags;
 };
 
-static const struct chip_info skel_netdrv_tbl[] = {
-        {"100/10M Ethernet PCI Adapter", 136, HAS_MII_XCVR},
-        {"100/10M Ethernet PCI Adapter", 136, HAS_CHIP_XCVR},
-        {"1000/100/10M Ethernet PCI Adapter", 136, HAS_MII_XCVR},
+static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
+        { "100/10M Ethernet PCI Adapter",       HAS_MII_XCVR },
+        { "100/10M Ethernet PCI Adapter",       HAS_CHIP_XCVR },
+        { "1000/100/10M Ethernet PCI Adapter",  HAS_MII_XCVR },
 };
 
 /* Offsets to the Command and Status Registers. */
@@ -504,13 +505,14 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
         
         len = pci_resource_len(pdev, bar);
         if (len < MIN_REGION_SIZE) {
-                printk(KERN_ERR "%s: region size %ld too small, aborting\n",
-                       boardname, len);
+                dev_err(&pdev->dev,
+                           "region size %ld too small, aborting\n", len);
                 return -ENODEV;
         }
 
         i = pci_request_regions(pdev, boardname);
-        if (i) return i;
+        if (i)
+                return i;
         
         irq = pdev->irq;
 
@@ -576,9 +578,9 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
 
                         if (mii_status != 0xffff && mii_status != 0x0000) {
                                 np->phys[phy_idx++] = phy;
-                                printk(KERN_INFO
-                                       "%s: MII PHY found at address %d, status "
-                                       "0x%4.4x.\n", dev->name, phy, mii_status);
+                                dev_info(&pdev->dev,
+                                       "MII PHY found at address %d, status "
+                                       "0x%4.4x.\n", phy, mii_status);
                                 /* get phy type */
                                 {
                                         unsigned int data;
@@ -601,10 +603,10 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
                 }
 
                 np->mii_cnt = phy_idx;
-                if (phy_idx == 0) {
-                        printk(KERN_WARNING "%s: MII PHY not found -- this device may "
-                               "not operate correctly.\n", dev->name);
-                }
+                if (phy_idx == 0)
+                        dev_warn(&pdev->dev,
+                                "MII PHY not found -- this device may "
+                               "not operate correctly.\n");
         } else {
                 np->phys[0] = 32;
 /* 89/6/23 add, (begin) */
@@ -630,7 +632,7 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
                 np->mii.full_duplex = full_duplex[card_idx];
 
         if (np->mii.full_duplex) {
-                printk(KERN_INFO "%s: Media type forced to Full Duplex.\n", dev->name);
+                dev_info(&pdev->dev, "Media type forced to Full Duplex.\n");
 /* 89/6/13 add, (begin) */
 //      if (np->PHYType==MarvellPHY)
                 if ((np->PHYType == MarvellPHY) || (np->PHYType == LevelOnePHY)) {
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 3c90003f4230..11b8f1b43dd5 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -240,10 +240,12 @@ enum {
 #define NVREG_RNDSEED_FORCE2    0x2d00
 #define NVREG_RNDSEED_FORCE3    0x7400
 
-        NvRegUnknownSetupReg1 = 0xA0,
-#define NVREG_UNKSETUP1_VAL     0x16070f
-        NvRegUnknownSetupReg2 = 0xA4,
-#define NVREG_UNKSETUP2_VAL     0x16
+        NvRegTxDeferral = 0xA0,
+#define NVREG_TX_DEFERRAL_DEFAULT       0x15050f
+#define NVREG_TX_DEFERRAL_RGMII_10_100  0x16070f
+#define NVREG_TX_DEFERRAL_RGMII_1000    0x14050f
+        NvRegRxDeferral = 0xA4,
+#define NVREG_RX_DEFERRAL_DEFAULT       0x16
         NvRegMacAddrA = 0xA8,
         NvRegMacAddrB = 0xAC,
         NvRegMulticastAddrA = 0xB0,
@@ -269,8 +271,10 @@ enum {
 #define NVREG_LINKSPEED_MASK    (0xFFF)
         NvRegUnknownSetupReg5 = 0x130,
 #define NVREG_UNKSETUP5_BIT31   (1<<31)
-        NvRegUnknownSetupReg3 = 0x13c,
-#define NVREG_UNKSETUP3_VAL1    0x200010
+        NvRegTxWatermark = 0x13c,
+#define NVREG_TX_WM_DESC1_DEFAULT       0x0200010
+#define NVREG_TX_WM_DESC2_3_DEFAULT     0x1e08000
+#define NVREG_TX_WM_DESC2_3_1000        0xfe08000
         NvRegTxRxControl = 0x144,
 #define NVREG_TXRXCTL_KICK      0x0001
 #define NVREG_TXRXCTL_BIT1      0x0002
@@ -658,7 +662,7 @@ static const struct register_test nv_registers_test[] = {
         { NvRegMisc1, 0x03c },
         { NvRegOffloadConfig, 0x03ff },
         { NvRegMulticastAddrA, 0xffffffff },
-        { NvRegUnknownSetupReg3, 0x0ff },
+        { NvRegTxWatermark, 0x0ff },
         { NvRegWakeUpFlags, 0x07777 },
         { 0,0 }
 };
@@ -1495,7 +1499,7 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
         np->tx_skbuff[nr] = skb;
 
 #ifdef NETIF_F_TSO
-        if (skb_shinfo(skb)->gso_size)
+        if (skb_is_gso(skb))
                 tx_flags_extra = NV_TX2_TSO | (skb_shinfo(skb)->gso_size << NV_TX2_TSO_SHIFT);
         else
 #endif
@@ -2127,7 +2131,7 @@ static int nv_update_linkspeed(struct net_device *dev)
         int newdup = np->duplex;
         int mii_status;
         int retval = 0;
-        u32 control_1000, status_1000, phyreg, pause_flags;
+        u32 control_1000, status_1000, phyreg, pause_flags, txreg;
 
         /* BMSR_LSTATUS is latched, read it twice:
          * we want the current value.
@@ -2245,6 +2249,26 @@ set_speed:
                 phyreg |= PHY_1000;
         writel(phyreg, base + NvRegPhyInterface);
 
+        if (phyreg & PHY_RGMII) {
+                if ((np->linkspeed & NVREG_LINKSPEED_MASK) == NVREG_LINKSPEED_1000)
+                        txreg = NVREG_TX_DEFERRAL_RGMII_1000;
+                else
+                        txreg = NVREG_TX_DEFERRAL_RGMII_10_100;
+        } else {
+                txreg = NVREG_TX_DEFERRAL_DEFAULT;
+        }
+        writel(txreg, base + NvRegTxDeferral);
+
+        if (np->desc_ver == DESC_VER_1) {
+                txreg = NVREG_TX_WM_DESC1_DEFAULT;
+        } else {
+                if ((np->linkspeed & NVREG_LINKSPEED_MASK) == NVREG_LINKSPEED_1000)
+                        txreg = NVREG_TX_WM_DESC2_3_1000;
+                else
+                        txreg = NVREG_TX_WM_DESC2_3_DEFAULT;
+        }
+        writel(txreg, base + NvRegTxWatermark);
+
         writel(NVREG_MISC1_FORCE | ( np->duplex ? 0 : NVREG_MISC1_HD),
                 base + NvRegMisc1);
         pci_push(base);
@@ -2735,21 +2759,21 @@ static void nv_do_nic_poll(unsigned long data)
 
         if (!using_multi_irqs(dev)) {
                 if (np->msi_flags & NV_MSI_X_ENABLED)
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                        disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
                 else
-                        disable_irq(dev->irq);
+                        disable_irq_lockdep(dev->irq);
                 mask = np->irqmask;
         } else {
                 if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                        disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
                         mask |= NVREG_IRQ_RX_ALL;
                 }
                 if (np->nic_poll_irq & NVREG_IRQ_TX_ALL) {
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                        disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
                         mask |= NVREG_IRQ_TX_ALL;
                 }
                 if (np->nic_poll_irq & NVREG_IRQ_OTHER) {
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+                        disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
                         mask |= NVREG_IRQ_OTHER;
                 }
         }
@@ -2761,23 +2785,23 @@ static void nv_do_nic_poll(unsigned long data)
         pci_push(base);
 
         if (!using_multi_irqs(dev)) {
-                nv_nic_irq((int) 0, (void *) data, (struct pt_regs *) NULL);
+                nv_nic_irq(0, dev, NULL);
                 if (np->msi_flags & NV_MSI_X_ENABLED)
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                        enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
                 else
-                        enable_irq(dev->irq);
+                        enable_irq_lockdep(dev->irq);
         } else {
                 if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
-                        nv_nic_irq_rx((int) 0, (void *) data, (struct pt_regs *) NULL);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                        nv_nic_irq_rx(0, dev, NULL);
+                        enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
                 }
                 if (np->nic_poll_irq & NVREG_IRQ_TX_ALL) {
-                        nv_nic_irq_tx((int) 0, (void *) data, (struct pt_regs *) NULL);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                        nv_nic_irq_tx(0, dev, NULL);
+                        enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
                 }
                 if (np->nic_poll_irq & NVREG_IRQ_OTHER) {
-                        nv_nic_irq_other((int) 0, (void *) data, (struct pt_regs *) NULL);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+                        nv_nic_irq_other(0, dev, NULL);
+                        enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
                 }
         }
 }
@@ -3910,7 +3934,10 @@ static int nv_open(struct net_device *dev)
 
         /* 5) continue setup */
         writel(np->linkspeed, base + NvRegLinkSpeed);
-        writel(NVREG_UNKSETUP3_VAL1, base + NvRegUnknownSetupReg3);
+        if (np->desc_ver == DESC_VER_1)
+                writel(NVREG_TX_WM_DESC1_DEFAULT, base + NvRegTxWatermark);
+        else
+                writel(NVREG_TX_WM_DESC2_3_DEFAULT, base + NvRegTxWatermark);
         writel(np->txrxctl_bits, base + NvRegTxRxControl);
         writel(np->vlanctl_bits, base + NvRegVlanControl);
         pci_push(base);
@@ -3932,8 +3959,8 @@ static int nv_open(struct net_device *dev)
         writel(readl(base + NvRegReceiverStatus), base + NvRegReceiverStatus);
         get_random_bytes(&i, sizeof(i));
         writel(NVREG_RNDSEED_FORCE | (i&NVREG_RNDSEED_MASK), base + NvRegRandomSeed);
-        writel(NVREG_UNKSETUP1_VAL, base + NvRegUnknownSetupReg1);
-        writel(NVREG_UNKSETUP2_VAL, base + NvRegUnknownSetupReg2);
+        writel(NVREG_TX_DEFERRAL_DEFAULT, base + NvRegTxDeferral);
+        writel(NVREG_RX_DEFERRAL_DEFAULT, base + NvRegRxDeferral);
         if (poll_interval == -1) {
                 if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT)
                         writel(NVREG_POLL_DEFAULT_THROUGHPUT, base + NvRegPollingInterval);
diff --git a/drivers/net/fs_enet/Makefile b/drivers/net/fs_enet/Makefile
index d6dd3f2fb43e..02d4dc18ba69 100644
--- a/drivers/net/fs_enet/Makefile
+++ b/drivers/net/fs_enet/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_FS_ENET) += fs_enet.o
 
-obj-$(CONFIG_8xx) += mac-fec.o mac-scc.o
-obj-$(CONFIG_8260) += mac-fcc.o
+obj-$(CONFIG_8xx) += mac-fec.o mac-scc.o mii-fec.o
+obj-$(CONFIG_CPM2) += mac-fcc.o mii-bitbang.o
 
-fs_enet-objs := fs_enet-main.o fs_enet-mii.o mii-bitbang.o mii-fixed.o
+fs_enet-objs := fs_enet-main.o
diff --git a/drivers/net/fs_enet/fec.h b/drivers/net/fs_enet/fec.h
new file mode 100644
index 000000000000..e980527e2b99
--- /dev/null
+++ b/drivers/net/fs_enet/fec.h
@@ -0,0 +1,42 @@
+#ifndef FS_ENET_FEC_H
+#define FS_ENET_FEC_H
+
+/* CRC polynomium used by the FEC for the multicast group filtering */
+#define FEC_CRC_POLY   0x04C11DB7
+
+#define FEC_MAX_MULTICAST_ADDRS 64
+
+/* Interrupt events/masks.
+*/
+#define FEC_ENET_HBERR  0x80000000U     /* Heartbeat error          */
+#define FEC_ENET_BABR   0x40000000U     /* Babbling receiver        */
+#define FEC_ENET_BABT   0x20000000U     /* Babbling transmitter     */
+#define FEC_ENET_GRA    0x10000000U     /* Graceful stop complete   */
+#define FEC_ENET_TXF    0x08000000U     /* Full frame transmitted   */
+#define FEC_ENET_TXB    0x04000000U     /* A buffer was transmitted */
+#define FEC_ENET_RXF    0x02000000U     /* Full frame received      */
+#define FEC_ENET_RXB    0x01000000U     /* A buffer was received    */
+#define FEC_ENET_MII    0x00800000U     /* MII interrupt            */
+#define FEC_ENET_EBERR  0x00400000U     /* SDMA bus error           */
+
+#define FEC_ECNTRL_PINMUX       0x00000004
+#define FEC_ECNTRL_ETHER_EN     0x00000002
+#define FEC_ECNTRL_RESET        0x00000001
+
+#define FEC_RCNTRL_BC_REJ       0x00000010
+#define FEC_RCNTRL_PROM         0x00000008
+#define FEC_RCNTRL_MII_MODE     0x00000004
+#define FEC_RCNTRL_DRT          0x00000002
+#define FEC_RCNTRL_LOOP         0x00000001
+
+#define FEC_TCNTRL_FDEN         0x00000004
+#define FEC_TCNTRL_HBC          0x00000002
+#define FEC_TCNTRL_GTS          0x00000001
+
+
+
+/*
+ * Delay to wait for FEC reset command to complete (in us)
+ */
+#define FEC_RESET_DELAY         50
+#endif
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index f6abff5846b3..df62506a1787 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -37,6 +37,7 @@
 #include <linux/bitops.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
+#include <linux/phy.h>
 
 #include <linux/vmalloc.h>
 #include <asm/pgtable.h>
@@ -682,35 +683,6 @@ static void fs_free_irq(struct net_device *dev, int irq)
         (*fep->ops->post_free_irq)(dev, irq);
 }
 
-/**********************************************************************************/
-
-/* This interrupt occurs when the PHY detects a link change. */
-static irqreturn_t
-fs_mii_link_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-        struct net_device *dev = dev_id;
-        struct fs_enet_private *fep;
-        const struct fs_platform_info *fpi;
-
-        fep = netdev_priv(dev);
-        fpi = fep->fpi;
-
-        /*
-         * Acknowledge the interrupt if possible. If we have not
-         * found the PHY yet we can't process or acknowledge the
-         * interrupt now. Instead we ignore this interrupt for now,
-         * which we can do since it is edge triggered. It will be
-         * acknowledged later by fs_enet_open().
-         */
-        if (!fep->phy)
-                return IRQ_NONE;
-
-        fs_mii_ack_int(dev);
-        fs_mii_link_status_change_check(dev, 0);
-
-        return IRQ_HANDLED;
-}
-
 static void fs_timeout(struct net_device *dev)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
@@ -722,10 +694,13 @@ static void fs_timeout(struct net_device *dev)
         spin_lock_irqsave(&fep->lock, flags);
 
         if (dev->flags & IFF_UP) {
+                phy_stop(fep->phydev);
                 (*fep->ops->stop)(dev);
                 (*fep->ops->restart)(dev);
+                phy_start(fep->phydev);
         }
 
+        phy_start(fep->phydev);
         wake = fep->tx_free && !(CBDR_SC(fep->cur_tx) & BD_ENET_TX_READY);
         spin_unlock_irqrestore(&fep->lock, flags);
 
@@ -733,35 +708,112 @@ static void fs_timeout(struct net_device *dev)
                 netif_wake_queue(dev);
 }
 
+/*-----------------------------------------------------------------------------
+ *  generic link-change handler - should be sufficient for most cases
+ *-----------------------------------------------------------------------------*/
+static void generic_adjust_link(struct  net_device *dev)
+{
+       struct fs_enet_private *fep = netdev_priv(dev);
+       struct phy_device *phydev = fep->phydev;
+       int new_state = 0;
+
+       if (phydev->link) {
+
+               /* adjust to duplex mode */
+               if (phydev->duplex != fep->oldduplex){
+                       new_state = 1;
+                       fep->oldduplex = phydev->duplex;
+               }
+
+               if (phydev->speed != fep->oldspeed) {
+                       new_state = 1;
+                       fep->oldspeed = phydev->speed;
+               }
+
+               if (!fep->oldlink) {
+                       new_state = 1;
+                       fep->oldlink = 1;
+                       netif_schedule(dev);
+                       netif_carrier_on(dev);
+                       netif_start_queue(dev);
+               }
+
+               if (new_state)
+                       fep->ops->restart(dev);
+
+       } else if (fep->oldlink) {
+               new_state = 1;
+               fep->oldlink = 0;
+               fep->oldspeed = 0;
+               fep->oldduplex = -1;
+               netif_carrier_off(dev);
+               netif_stop_queue(dev);
+       }
+
+       if (new_state && netif_msg_link(fep))
+               phy_print_status(phydev);
+}
+
+
+static void fs_adjust_link(struct net_device *dev)
+{
+        struct fs_enet_private *fep = netdev_priv(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&fep->lock, flags);
+
+        if(fep->ops->adjust_link)
+                fep->ops->adjust_link(dev);
+        else
+                generic_adjust_link(dev);
+
+        spin_unlock_irqrestore(&fep->lock, flags);
+}
+
+static int fs_init_phy(struct net_device *dev)
+{
+        struct fs_enet_private *fep = netdev_priv(dev);
+        struct phy_device *phydev;
+
+        fep->oldlink = 0;
+        fep->oldspeed = 0;
+        fep->oldduplex = -1;
+        if(fep->fpi->bus_id)
+                phydev = phy_connect(dev, fep->fpi->bus_id, &fs_adjust_link, 0);
+        else {
+                printk("No phy bus ID specified in BSP code\n");
+                return -EINVAL;
+        }
+        if (IS_ERR(phydev)) {
+                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
+                return PTR_ERR(phydev);
+        }
+
+        fep->phydev = phydev;
+
+        return 0;
+}
+
+
 static int fs_enet_open(struct net_device *dev)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
-        const struct fs_platform_info *fpi = fep->fpi;
         int r;
+        int err;
 
         /* Install our interrupt handler. */
         r = fs_request_irq(dev, fep->interrupt, "fs_enet-mac", fs_enet_interrupt);
         if (r != 0) {
                 printk(KERN_ERR DRV_MODULE_NAME
-                       ": %s Could not allocate FEC IRQ!", dev->name);
+                       ": %s Could not allocate FS_ENET IRQ!", dev->name);
                 return -EINVAL;
         }
 
-        /* Install our phy interrupt handler */
-        if (fpi->phy_irq != -1) {
-
-                r = fs_request_irq(dev, fpi->phy_irq, "fs_enet-phy", fs_mii_link_interrupt);
-                if (r != 0) {
-                        printk(KERN_ERR DRV_MODULE_NAME
-                               ": %s Could not allocate PHY IRQ!", dev->name);
-                        fs_free_irq(dev, fep->interrupt);
-                        return -EINVAL;
-                }
-        }
+        err = fs_init_phy(dev);
+        if(err)
+                return err;
 
-        fs_mii_startup(dev);
-        netif_carrier_off(dev);
-        fs_mii_link_status_change_check(dev, 1);
+        phy_start(fep->phydev);
 
         return 0;
 }
@@ -769,20 +821,19 @@ static int fs_enet_open(struct net_device *dev)
 static int fs_enet_close(struct net_device *dev)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
-        const struct fs_platform_info *fpi = fep->fpi;
         unsigned long flags;
 
         netif_stop_queue(dev);
         netif_carrier_off(dev);
-        fs_mii_shutdown(dev);
+        phy_stop(fep->phydev);
 
         spin_lock_irqsave(&fep->lock, flags);
         (*fep->ops->stop)(dev);
         spin_unlock_irqrestore(&fep->lock, flags);
 
         /* release any irqs */
-        if (fpi->phy_irq != -1)
-                fs_free_irq(dev, fpi->phy_irq);
+        phy_disconnect(fep->phydev);
+        fep->phydev = NULL;
         fs_free_irq(dev, fep->interrupt);
 
         return 0;
@@ -830,33 +881,19 @@ static void fs_get_regs(struct net_device *dev, struct ethtool_regs *regs,
 static int fs_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
-        unsigned long flags;
-        int rc;
-
-        spin_lock_irqsave(&fep->lock, flags);
-        rc = mii_ethtool_gset(&fep->mii_if, cmd);
-        spin_unlock_irqrestore(&fep->lock, flags);
-
-        return rc;
+        return phy_ethtool_gset(fep->phydev, cmd);
 }
 
 static int fs_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
-        unsigned long flags;
-        int rc;
-
-        spin_lock_irqsave(&fep->lock, flags);
-        rc = mii_ethtool_sset(&fep->mii_if, cmd);
-        spin_unlock_irqrestore(&fep->lock, flags);
-
-        return rc;
+        phy_ethtool_sset(fep->phydev, cmd);
+        return 0;
 }
 
 static int fs_nway_reset(struct net_device *dev)
 {
-        struct fs_enet_private *fep = netdev_priv(dev);
-        return mii_nway_restart(&fep->mii_if);
+        return 0;
 }
 
 static u32 fs_get_msglevel(struct net_device *dev)
@@ -898,7 +935,7 @@ static int fs_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 return -EINVAL;
 
         spin_lock_irqsave(&fep->lock, flags);
-        rc = generic_mii_ioctl(&fep->mii_if, mii, cmd, NULL);
+        rc = phy_mii_ioctl(fep->phydev, mii, cmd);
         spin_unlock_irqrestore(&fep->lock, flags);
         return rc;
 }
@@ -1030,12 +1067,6 @@ static struct net_device *fs_init_instance(struct device *dev,
         }
         registered = 1;
 
-        err = fs_mii_connect(ndev);
-        if (err != 0) {
-                printk(KERN_ERR DRV_MODULE_NAME
-                       ": %s fs_mii_connect failed.\n", ndev->name);
-                goto err;
-        }
 
         return ndev;
 
@@ -1073,8 +1104,6 @@ static int fs_cleanup_instance(struct net_device *ndev)
 
         fpi = fep->fpi;
 
-        fs_mii_disconnect(ndev);
-
         unregister_netdev(ndev);
 
         dma_free_coherent(fep->dev, (fpi->tx_ring + fpi->rx_ring) * sizeof(cbd_t),
@@ -1196,17 +1225,39 @@ static int __init fs_init(void)
         r = setup_immap();
         if (r != 0)
                 return r;
-        r = driver_register(&fs_enet_fec_driver);
+
+#ifdef CONFIG_FS_ENET_HAS_FCC
+        /* let's insert mii stuff */
+        r = fs_enet_mdio_bb_init();
+
+        if (r != 0) {
+                printk(KERN_ERR DRV_MODULE_NAME
+                        "BB PHY init failed.\n");
+                return r;
+        }
+        r = driver_register(&fs_enet_fcc_driver);
         if (r != 0)
                 goto err;
+#endif
 
-        r = driver_register(&fs_enet_fcc_driver);
+#ifdef CONFIG_FS_ENET_HAS_FEC
+        r =  fs_enet_mdio_fec_init();
+        if (r != 0) {
+                printk(KERN_ERR DRV_MODULE_NAME
+                        "FEC PHY init failed.\n");
+                return r;
+        }
+
+        r = driver_register(&fs_enet_fec_driver);
         if (r != 0)
                 goto err;
+#endif
 
+#ifdef CONFIG_FS_ENET_HAS_SCC
         r = driver_register(&fs_enet_scc_driver);
         if (r != 0)
                 goto err;
+#endif
 
         return 0;
 err:
diff --git a/drivers/net/fs_enet/fs_enet-mii.c b/drivers/net/fs_enet/fs_enet-mii.c
deleted file mode 100644
index b7e6e21725cb..000000000000
--- a/drivers/net/fs_enet/fs_enet-mii.c
+++ /dev/null
@@ -1,505 +0,0 @@
-/*
- * Combined Ethernet driver for Motorola MPC8xx and MPC82xx.
- *
- * Copyright (c) 2003 Intracom S.A. 
- *  by Pantelis Antoniou <panto@intracom.gr>
- * 
- * 2005 (c) MontaVista Software, Inc. 
- * Vitaly Bordug <vbordug@ru.mvista.com>
- *
- * Heavily based on original FEC driver by Dan Malek <dan@embeddededge.com>
- * and modifications by Joakim Tjernlund <joakim.tjernlund@lumentis.se>
- *
- * This file is licensed under the terms of the GNU General Public License 
- * version 2. This program is licensed "as is" without any warranty of any 
- * kind, whether express or implied.
- */
-
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/string.h>
-#include <linux/ptrace.h>
-#include <linux/errno.h>
-#include <linux/ioport.h>
-#include <linux/slab.h>
-#include <linux/interrupt.h>
-#include <linux/pci.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/spinlock.h>
-#include <linux/mii.h>
-#include <linux/ethtool.h>
-#include <linux/bitops.h>
-
-#include <asm/pgtable.h>
-#include <asm/irq.h>
-#include <asm/uaccess.h>
-
-#include "fs_enet.h"
-
-/*************************************************/
-
-/*
- * Generic PHY support.
- * Should work for all PHYs, but link change is detected by polling
- */
-
-static void generic_timer_callback(unsigned long data)
-{
-        struct net_device *dev = (struct net_device *)data;
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        fep->phy_timer_list.expires = jiffies + HZ / 2;
-
-        add_timer(&fep->phy_timer_list);
-
-        fs_mii_link_status_change_check(dev, 0);
-}
-
-static void generic_startup(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        fep->phy_timer_list.expires = jiffies + HZ / 2; /* every 500ms */
-        fep->phy_timer_list.data = (unsigned long)dev;
-        fep->phy_timer_list.function = generic_timer_callback;
-        add_timer(&fep->phy_timer_list);
-}
-
-static void generic_shutdown(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        del_timer_sync(&fep->phy_timer_list);
-}
-
-/* ------------------------------------------------------------------------- */
-/* The Davicom DM9161 is used on the NETTA board                             */
-
-/* register definitions */
-
-#define MII_DM9161_ANAR         4       /* Aux. Config Register         */
-#define MII_DM9161_ACR          16      /* Aux. Config Register         */
-#define MII_DM9161_ACSR         17      /* Aux. Config/Status Register  */
-#define MII_DM9161_10TCSR       18      /* 10BaseT Config/Status Reg.   */
-#define MII_DM9161_INTR         21      /* Interrupt Register           */
-#define MII_DM9161_RECR         22      /* Receive Error Counter Reg.   */
-#define MII_DM9161_DISCR        23      /* Disconnect Counter Register  */
-
-static void dm9161_startup(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        fs_mii_write(dev, fep->mii_if.phy_id, MII_DM9161_INTR, 0x0000);
-        /* Start autonegotiation */
-        fs_mii_write(dev, fep->mii_if.phy_id, MII_BMCR, 0x1200);
-
-        set_current_state(TASK_UNINTERRUPTIBLE);
-        schedule_timeout(HZ*8);
-}
-
-static void dm9161_ack_int(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        fs_mii_read(dev, fep->mii_if.phy_id, MII_DM9161_INTR);
-}
-
-static void dm9161_shutdown(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        fs_mii_write(dev, fep->mii_if.phy_id, MII_DM9161_INTR, 0x0f00);
-}
-
-/**********************************************************************************/
-
-static const struct phy_info phy_info[] = {
-        {
-                .id = 0x00181b88,
-                .name = "DM9161",
-                .startup = dm9161_startup,
-                .ack_int = dm9161_ack_int,
-                .shutdown = dm9161_shutdown,
-        }, {
-                .id = 0,
-                .name = "GENERIC",
-                .startup = generic_startup,
-                .shutdown = generic_shutdown,
-        },
-};
-
-/**********************************************************************************/
-
-static int phy_id_detect(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-        const struct fs_platform_info *fpi = fep->fpi;
-        struct fs_enet_mii_bus *bus = fep->mii_bus;
-        int i, r, start, end, phytype, physubtype;
-        const struct phy_info *phy;
-        int phy_hwid, phy_id;
-
-        phy_hwid = -1;
-        fep->phy = NULL;
-
-        /* auto-detect? */
-        if (fpi->phy_addr == -1) {
-                start = 1;
-                end = 32;
-        } else {                /* direct */
-                start = fpi->phy_addr;
-                end = start + 1;
-        }
-
-        for (phy_id = start; phy_id < end; phy_id++) {
-                /* skip already used phy addresses on this bus */ 
-                if (bus->usage_map & (1 << phy_id))
-                        continue;
-                r = fs_mii_read(dev, phy_id, MII_PHYSID1);
-                if (r == -1 || (phytype = (r & 0xffff)) == 0xffff)
-                        continue;
-                r = fs_mii_read(dev, phy_id, MII_PHYSID2);
-                if (r == -1 || (physubtype = (r & 0xffff)) == 0xffff)
-                        continue;
-                phy_hwid = (phytype << 16) | physubtype;
-                if (phy_hwid != -1)
-                        break;
-        }
-
-        if (phy_hwid == -1) {
-                printk(KERN_ERR DRV_MODULE_NAME
-                       ": %s No PHY detected! range=0x%02x-0x%02x\n",
-                        dev->name, start, end);
-                return -1;
-        }
-
-        for (i = 0, phy = phy_info; i < ARRAY_SIZE(phy_info); i++, phy++)
-                if (phy->id == (phy_hwid >> 4) || phy->id == 0)
-                        break;
-
-        if (i >= ARRAY_SIZE(phy_info)) {
-                printk(KERN_ERR DRV_MODULE_NAME
-                       ": %s PHY id 0x%08x is not supported!\n",
-                       dev->name, phy_hwid);
-                return -1;
-        }
-
-        fep->phy = phy;
-
-        /* mark this address as used */
-        bus->usage_map |= (1 << phy_id);
-
-        printk(KERN_INFO DRV_MODULE_NAME
-               ": %s Phy @ 0x%x, type %s (0x%08x)%s\n",
-               dev->name, phy_id, fep->phy->name, phy_hwid,
-               fpi->phy_addr == -1 ? " (auto-detected)" : "");
-
-        return phy_id;
-}
-
-void fs_mii_startup(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        if (fep->phy->startup)
-                (*fep->phy->startup) (dev);
-}
-
-void fs_mii_shutdown(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        if (fep->phy->shutdown)
-                (*fep->phy->shutdown) (dev);
-}
-
-void fs_mii_ack_int(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-
-        if (fep->phy->ack_int)
-                (*fep->phy->ack_int) (dev);
-}
-
-#define MII_LINK        0x0001
-#define MII_HALF        0x0002
-#define MII_FULL        0x0004
-#define MII_BASE4       0x0008
-#define MII_10M         0x0010
-#define MII_100M        0x0020
-#define MII_1G          0x0040
-#define MII_10G         0x0080
-
-/* return full mii info at one gulp, with a usable form */
-static unsigned int mii_full_status(struct mii_if_info *mii)
-{
-        unsigned int status;
-        int bmsr, adv, lpa, neg;
-        struct fs_enet_private* fep = netdev_priv(mii->dev);
-        
-        /* first, a dummy read, needed to latch some MII phys */
-        (void)mii->mdio_read(mii->dev, mii->phy_id, MII_BMSR);
-        bmsr = mii->mdio_read(mii->dev, mii->phy_id, MII_BMSR);
-
-        /* no link */
-        if ((bmsr & BMSR_LSTATUS) == 0)
-                return 0;
-
-        status = MII_LINK;
-        
-        /* Lets look what ANEG says if it's supported - otherwize we shall
-           take the right values from the platform info*/
-        if(!mii->force_media) {
-                /* autoneg not completed; don't bother */
-                if ((bmsr & BMSR_ANEGCOMPLETE) == 0)
-                        return 0;
-
-                adv = (*mii->mdio_read)(mii->dev, mii->phy_id, MII_ADVERTISE);
-                lpa = (*mii->mdio_read)(mii->dev, mii->phy_id, MII_LPA);
-
-                neg = lpa & adv;
-        } else {
-                neg = fep->fpi->bus_info->lpa;
-        }
-
-        if (neg & LPA_100FULL)
-                status |= MII_FULL | MII_100M;
-        else if (neg & LPA_100BASE4)
-                status |= MII_FULL | MII_BASE4 | MII_100M;
-        else if (neg & LPA_100HALF)
-                status |= MII_HALF | MII_100M;
-        else if (neg & LPA_10FULL)
-                status |= MII_FULL | MII_10M;
-        else
-                status |= MII_HALF | MII_10M;
-        
-        return status;
-}
-
-void fs_mii_link_status_change_check(struct net_device *dev, int init_media)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-        struct mii_if_info *mii = &fep->mii_if;
-        unsigned int mii_status;
-        int ok_to_print, link, duplex, speed;
-        unsigned long flags;
-
-        ok_to_print = netif_msg_link(fep);
-
-        mii_status = mii_full_status(mii);
-
-        if (!init_media && mii_status == fep->last_mii_status)
-                return;
-
-        fep->last_mii_status = mii_status;
-
-        link = !!(mii_status & MII_LINK);
-        duplex = !!(mii_status & MII_FULL);
-        speed = (mii_status & MII_100M) ? 100 : 10;
-
-        if (link == 0) {
-                netif_carrier_off(mii->dev);
-                netif_stop_queue(dev);
-                if (!init_media) {
-                        spin_lock_irqsave(&fep->lock, flags);
-                        (*fep->ops->stop)(dev);
-                        spin_unlock_irqrestore(&fep->lock, flags);
-                }
-
-                if (ok_to_print)
-                        printk(KERN_INFO "%s: link down\n", mii->dev->name);
-
-        } else {
-
-                mii->full_duplex = duplex;
-
-                netif_carrier_on(mii->dev);
-
-                spin_lock_irqsave(&fep->lock, flags);
-                fep->duplex = duplex;
-                fep->speed = speed;
-                (*fep->ops->restart)(dev);
-                spin_unlock_irqrestore(&fep->lock, flags);
-
-                netif_start_queue(dev);
-
-                if (ok_to_print)
-                        printk(KERN_INFO "%s: link up, %dMbps, %s-duplex\n",
-                               dev->name, speed, duplex ? "full" : "half");
-        }
-}
-
-/**********************************************************************************/
-
-int fs_mii_read(struct net_device *dev, int phy_id, int location)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-        struct fs_enet_mii_bus *bus = fep->mii_bus;
-
-        unsigned long flags;
-        int ret;
-
-        spin_lock_irqsave(&bus->mii_lock, flags);
-        ret = (*bus->mii_read)(bus, phy_id, location);
-        spin_unlock_irqrestore(&bus->mii_lock, flags);
-
-        return ret;
-}
-
-void fs_mii_write(struct net_device *dev, int phy_id, int location, int value)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-        struct fs_enet_mii_bus *bus = fep->mii_bus;
-        unsigned long flags;
-
-        spin_lock_irqsave(&bus->mii_lock, flags);
-        (*bus->mii_write)(bus, phy_id, location, value);
-        spin_unlock_irqrestore(&bus->mii_lock, flags);
-}
-
-/*****************************************************************************/
-
-/* list of all registered mii buses */
-static LIST_HEAD(fs_mii_bus_list);
-
-static struct fs_enet_mii_bus *lookup_bus(int method, int id)
-{
-        struct list_head *ptr;
-        struct fs_enet_mii_bus *bus;
-
-        list_for_each(ptr, &fs_mii_bus_list) {
-                bus = list_entry(ptr, struct fs_enet_mii_bus, list);
-                if (bus->bus_info->method == method &&
-                        bus->bus_info->id == id)
-                        return bus;
-        }
-        return NULL;
-}
-
-static struct fs_enet_mii_bus *create_bus(const struct fs_mii_bus_info *bi)
-{
-        struct fs_enet_mii_bus *bus;
-        int ret = 0;
-
-        bus = kmalloc(sizeof(*bus), GFP_KERNEL);
-        if (bus == NULL) {
-                ret = -ENOMEM;
-                goto err;
-        }
-        memset(bus, 0, sizeof(*bus));
-        spin_lock_init(&bus->mii_lock);
-        bus->bus_info = bi;
-        bus->refs = 0;
-        bus->usage_map = 0;
-
-        /* perform initialization */
-        switch (bi->method) {
-
-                case fsmii_fixed:
-                        ret = fs_mii_fixed_init(bus);
-                        if (ret != 0)
-                                goto err;
-                        break;
-
-                case fsmii_bitbang:
-                        ret = fs_mii_bitbang_init(bus);
-                        if (ret != 0)
-                                goto err;
-                        break;
-#ifdef CONFIG_FS_ENET_HAS_FEC
-                case fsmii_fec:
-                        ret = fs_mii_fec_init(bus);
-                        if (ret != 0)
-                                goto err;
-                        break;
-#endif
-                default:
-                        ret = -EINVAL;
-                        goto err;
-        }
-
-        list_add(&bus->list, &fs_mii_bus_list);
-
-        return bus;
-
-err:
-        kfree(bus);
-        return ERR_PTR(ret);
-}
-
-static void destroy_bus(struct fs_enet_mii_bus *bus)
-{
-        /* remove from bus list */
-        list_del(&bus->list);
-
-        /* nothing more needed */
-        kfree(bus);
-}
-
-int fs_mii_connect(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-        const struct fs_platform_info *fpi = fep->fpi;
-        struct fs_enet_mii_bus *bus = NULL;
-
-        /* check method validity */
-        switch (fpi->bus_info->method) {
-                case fsmii_fixed:
-                case fsmii_bitbang:
-                        break;
-#ifdef CONFIG_FS_ENET_HAS_FEC
-                case fsmii_fec:
-                        break;
-#endif
-                default:
-                        printk(KERN_ERR DRV_MODULE_NAME
-                               ": %s Unknown MII bus method (%d)!\n",
-                               dev->name, fpi->bus_info->method);
-                        return -EINVAL; 
-        }
-
-        bus = lookup_bus(fpi->bus_info->method, fpi->bus_info->id);
-
-        /* if not found create new bus */
-        if (bus == NULL) {
-                bus = create_bus(fpi->bus_info);
-                if (IS_ERR(bus)) {
-                        printk(KERN_ERR DRV_MODULE_NAME
-                               ": %s MII bus creation failure!\n", dev->name);
-                        return PTR_ERR(bus);
-                }
-        }
-
-        bus->refs++;
-
-        fep->mii_bus = bus;
-
-        fep->mii_if.dev = dev;
-        fep->mii_if.phy_id_mask = 0x1f;
-        fep->mii_if.reg_num_mask = 0x1f;
-        fep->mii_if.mdio_read = fs_mii_read;
-        fep->mii_if.mdio_write = fs_mii_write;
-        fep->mii_if.force_media = fpi->bus_info->disable_aneg;
-        fep->mii_if.phy_id = phy_id_detect(dev);
-
-        return 0;
-}
-
-void fs_mii_disconnect(struct net_device *dev)
-{
-        struct fs_enet_private *fep = netdev_priv(dev);
-        struct fs_enet_mii_bus *bus = NULL;
-
-        bus = fep->mii_bus;
-        fep->mii_bus = NULL;
-
-        if (--bus->refs <= 0)
-                destroy_bus(bus);
-}
diff --git a/drivers/net/fs_enet/fs_enet.h b/drivers/net/fs_enet/fs_enet.h
index e7ec96c964a9..95022c005f75 100644
--- a/drivers/net/fs_enet/fs_enet.h
+++ b/drivers/net/fs_enet/fs_enet.h
@@ -5,6 +5,7 @@
 #include <linux/netdevice.h>
 #include <linux/types.h>
 #include <linux/list.h>
+#include <linux/phy.h>
 
 #include <linux/fs_enet_pd.h>
 
@@ -12,12 +13,30 @@
 
 #ifdef CONFIG_CPM1
 #include <asm/commproc.h>
+
+struct fec_info {
+        fec_t*  fecp;
+        u32     mii_speed;
+};
 #endif
 
 #ifdef CONFIG_CPM2
 #include <asm/cpm2.h>
 #endif
 
+/* This is used to operate with pins.
+  Note that the actual port size may
+    be different; cpm(s) handle it OK  */
+struct bb_info {
+        u8 mdio_dat_msk;
+        u8 mdio_dir_msk;
+        u8 *mdio_dir;
+        u8 *mdio_dat;
+        u8 mdc_msk;
+        u8 *mdc_dat;
+        int delay;
+};
+
 /* hw driver ops */
 struct fs_ops {
         int (*setup_data)(struct net_device *dev);
@@ -25,6 +44,7 @@ struct fs_ops {
         void (*free_bd)(struct net_device *dev);
         void (*cleanup_data)(struct net_device *dev);
         void (*set_multicast_list)(struct net_device *dev);
+        void (*adjust_link)(struct net_device *dev);
         void (*restart)(struct net_device *dev);
         void (*stop)(struct net_device *dev);
         void (*pre_request_irq)(struct net_device *dev, int irq);
@@ -100,10 +120,6 @@ struct fs_enet_mii_bus {
         };
 };
 
-int fs_mii_bitbang_init(struct fs_enet_mii_bus *bus);
-int fs_mii_fixed_init(struct fs_enet_mii_bus *bus);
-int fs_mii_fec_init(struct fs_enet_mii_bus *bus);
-
 struct fs_enet_private {
         struct device *dev;     /* pointer back to the device (must be initialized first) */
         spinlock_t lock;        /* during all ops except TX pckt processing */
@@ -130,7 +146,8 @@ struct fs_enet_private {
         struct fs_enet_mii_bus *mii_bus;
         int interrupt;
 
-        int duplex, speed;      /* current settings */
+        struct phy_device *phydev;
+        int oldduplex, oldspeed, oldlink;       /* current settings */
 
         /* event masks */
         u32 ev_napi_rx;         /* mask of NAPI rx events */
@@ -168,15 +185,9 @@ struct fs_enet_private {
 };
 
 /***************************************************************************/
-
-int fs_mii_read(struct net_device *dev, int phy_id, int location);
-void fs_mii_write(struct net_device *dev, int phy_id, int location, int value);
-
-void fs_mii_startup(struct net_device *dev);
-void fs_mii_shutdown(struct net_device *dev);
-void fs_mii_ack_int(struct net_device *dev);
-
-void fs_mii_link_status_change_check(struct net_device *dev, int init_media);
+int fs_enet_mdio_bb_init(void);
+int fs_mii_fixed_init(struct fs_enet_mii_bus *bus);
+int fs_enet_mdio_fec_init(void);
 
 void fs_init_bds(struct net_device *dev);
 void fs_cleanup_bds(struct net_device *dev);
@@ -194,7 +205,6 @@ int fs_enet_platform_init(void);
 void fs_enet_platform_cleanup(void);
 
 /***************************************************************************/
-
 /* buffer descriptor access macros */
 
 /* access macros */
diff --git a/drivers/net/fs_enet/mac-fcc.c b/drivers/net/fs_enet/mac-fcc.c
index 64e20982c1fe..1ff2597b8495 100644
--- a/drivers/net/fs_enet/mac-fcc.c
+++ b/drivers/net/fs_enet/mac-fcc.c
@@ -34,6 +34,7 @@
 #include <linux/bitops.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
+#include <linux/phy.h>
 
 #include <asm/immap_cpm2.h>
 #include <asm/mpc8260.h>
@@ -122,22 +123,32 @@ static int do_pd_setup(struct fs_enet_private *fep)
 
         /* Attach the memory for the FCC Parameter RAM */
         r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fcc_pram");
-        fep->fcc.ep = (void *)r->start;
-
+        fep->fcc.ep = (void *)ioremap(r->start, r->end - r->start + 1);
         if (fep->fcc.ep == NULL)
                 return -EINVAL;
 
         r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fcc_regs");
-        fep->fcc.fccp = (void *)r->start;
-
+        fep->fcc.fccp = (void *)ioremap(r->start, r->end - r->start + 1);
         if (fep->fcc.fccp == NULL)
                 return -EINVAL;
 
-        fep->fcc.fcccp = (void *)fep->fpi->fcc_regs_c;
+        if (fep->fpi->fcc_regs_c) {
+
+                fep->fcc.fcccp = (void *)fep->fpi->fcc_regs_c;
+        } else {
+                r = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+                                "fcc_regs_c");
+                fep->fcc.fcccp = (void *)ioremap(r->start,
+                                r->end - r->start + 1);
+        }
 
         if (fep->fcc.fcccp == NULL)
                 return -EINVAL;
 
+        fep->fcc.mem = (void *)fep->fpi->mem_offset;
+        if (fep->fcc.mem == NULL)
+                return -EINVAL;
+
         return 0;
 }
 
@@ -155,8 +166,6 @@ static int setup_data(struct net_device *dev)
         if ((unsigned int)fep->fcc.idx >= 3)    /* max 3 FCCs */
                 return -EINVAL;
 
-        fep->fcc.mem = (void *)fpi->mem_offset;
-
         if (do_pd_setup(fep) != 0)
                 return -EINVAL;
 
@@ -394,7 +403,7 @@ static void restart(struct net_device *dev)
 
         /* adjust to speed (for RMII mode) */
         if (fpi->use_rmii) {
-                if (fep->speed == 100)
+                if (fep->phydev->speed == 100)
                         C8(fcccp, fcc_gfemr, 0x20);
                 else
                         S8(fcccp, fcc_gfemr, 0x20);
@@ -420,7 +429,7 @@ static void restart(struct net_device *dev)
                 S32(fccp, fcc_fpsmr, FCC_PSMR_RMII);
 
         /* adjust to duplex mode */
-        if (fep->duplex)
+        if (fep->phydev->duplex)
                 S32(fccp, fcc_fpsmr, FCC_PSMR_FDE | FCC_PSMR_LPB);
         else
                 C32(fccp, fcc_fpsmr, FCC_PSMR_FDE | FCC_PSMR_LPB);
@@ -486,7 +495,10 @@ static void rx_bd_done(struct net_device *dev)
 
 static void tx_kickstart(struct net_device *dev)
 {
-        /* nothing */
+        struct fs_enet_private *fep = netdev_priv(dev);
+        fcc_t *fccp = fep->fcc.fccp;
+
+        S32(fccp, fcc_ftodr, 0x80);
 }
 
 static u32 get_int_events(struct net_device *dev)
diff --git a/drivers/net/fs_enet/mac-fec.c b/drivers/net/fs_enet/mac-fec.c
index e09547077529..c2c5fd419bd0 100644
--- a/drivers/net/fs_enet/mac-fec.c
+++ b/drivers/net/fs_enet/mac-fec.c
@@ -46,6 +46,7 @@
 #endif
 
 #include "fs_enet.h"
+#include "fec.h"
 
 /*************************************************/
 
@@ -75,50 +76,8 @@
 /* clear bits */
 #define FC(_fecp, _reg, _v) FW(_fecp, _reg, FR(_fecp, _reg) & ~(_v))
 
-
-/* CRC polynomium used by the FEC for the multicast group filtering */
-#define FEC_CRC_POLY   0x04C11DB7
-
-#define FEC_MAX_MULTICAST_ADDRS 64
-
-/* Interrupt events/masks.
-*/
-#define FEC_ENET_HBERR  0x80000000U     /* Heartbeat error          */
-#define FEC_ENET_BABR   0x40000000U     /* Babbling receiver        */
-#define FEC_ENET_BABT   0x20000000U     /* Babbling transmitter     */
-#define FEC_ENET_GRA    0x10000000U     /* Graceful stop complete   */
-#define FEC_ENET_TXF    0x08000000U     /* Full frame transmitted   */
-#define FEC_ENET_TXB    0x04000000U     /* A buffer was transmitted */
-#define FEC_ENET_RXF    0x02000000U     /* Full frame received      */
-#define FEC_ENET_RXB    0x01000000U     /* A buffer was received    */
-#define FEC_ENET_MII    0x00800000U     /* MII interrupt            */
-#define FEC_ENET_EBERR  0x00400000U     /* SDMA bus error           */
-
-#define FEC_ECNTRL_PINMUX       0x00000004
-#define FEC_ECNTRL_ETHER_EN     0x00000002
-#define FEC_ECNTRL_RESET        0x00000001
-
-#define FEC_RCNTRL_BC_REJ       0x00000010
-#define FEC_RCNTRL_PROM         0x00000008
-#define FEC_RCNTRL_MII_MODE     0x00000004
-#define FEC_RCNTRL_DRT          0x00000002
-#define FEC_RCNTRL_LOOP         0x00000001
-
-#define FEC_TCNTRL_FDEN         0x00000004
-#define FEC_TCNTRL_HBC          0x00000002
-#define FEC_TCNTRL_GTS          0x00000001
-
-
-/* Make MII read/write commands for the FEC.
-*/
-#define mk_mii_read(REG)        (0x60020000 | ((REG & 0x1f) << 18))
-#define mk_mii_write(REG, VAL)  (0x50020000 | ((REG & 0x1f) << 18) | (VAL & 0xffff))
-#define mk_mii_end              0
-
-#define FEC_MII_LOOPS   10000
-
 /*
- * Delay to wait for FEC reset command to complete (in us) 
+ * Delay to wait for FEC reset command to complete (in us)
  */
 #define FEC_RESET_DELAY         50
 
@@ -303,13 +262,15 @@ static void restart(struct net_device *dev)
         int r;
         u32 addrhi, addrlo;
 
+        struct mii_bus* mii = fep->phydev->bus;
+        struct fec_info* fec_inf = mii->priv;
+
         r = whack_reset(fep->fec.fecp);
         if (r != 0)
                 printk(KERN_ERR DRV_MODULE_NAME
                                 ": %s FEC Reset FAILED!\n", dev->name);
-
         /*
-         * Set station address. 
+         * Set station address.
          */
         addrhi = ((u32) dev->dev_addr[0] << 24) |
                  ((u32) dev->dev_addr[1] << 16) |
@@ -350,12 +311,12 @@ static void restart(struct net_device *dev)
         FW(fecp, fun_code, 0x78000000);
 
         /*
-         * Set MII speed. 
+         * Set MII speed.
          */
-        FW(fecp, mii_speed, fep->mii_bus->fec.mii_speed);
+        FW(fecp, mii_speed, fec_inf->mii_speed);
 
         /*
-         * Clear any outstanding interrupt. 
+         * Clear any outstanding interrupt.
          */
         FW(fecp, ievent, 0xffc0);
         FW(fecp, ivec, (fep->interrupt / 2) << 29);
@@ -390,11 +351,12 @@ static void restart(struct net_device *dev)
         }
 #endif
 
+
         FW(fecp, r_cntrl, FEC_RCNTRL_MII_MODE); /* MII enable */
         /*
-         * adjust to duplex mode 
+         * adjust to duplex mode
          */
-        if (fep->duplex) {
+        if (fep->phydev->duplex) {
                 FC(fecp, r_cntrl, FEC_RCNTRL_DRT);
                 FS(fecp, x_cntrl, FEC_TCNTRL_FDEN);     /* FD enable */
         } else {
@@ -418,9 +380,11 @@ static void restart(struct net_device *dev)
 static void stop(struct net_device *dev)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
+        const struct fs_platform_info *fpi = fep->fpi;
         fec_t *fecp = fep->fec.fecp;
-        struct fs_enet_mii_bus *bus = fep->mii_bus;
-        const struct fs_mii_bus_info *bi = bus->bus_info;
+
+        struct fec_info* feci= fep->phydev->bus->priv;
+
         int i;
 
         if ((FR(fecp, ecntrl) & FEC_ECNTRL_ETHER_EN) == 0)
@@ -444,11 +408,11 @@ static void stop(struct net_device *dev)
         fs_cleanup_bds(dev);
 
         /* shut down FEC1? that's where the mii bus is */
-        if (fep->fec.idx == 0 && bus->refs > 1 && bi->method == fsmii_fec) {
+        if (fpi->has_phy) {
                 FS(fecp, r_cntrl, FEC_RCNTRL_MII_MODE); /* MII enable */
                 FS(fecp, ecntrl, FEC_ECNTRL_PINMUX | FEC_ECNTRL_ETHER_EN);
                 FW(fecp, ievent, FEC_ENET_MII);
-                FW(fecp, mii_speed, bus->fec.mii_speed);
+                FW(fecp, mii_speed, feci->mii_speed);
         }
 }
 
@@ -583,73 +547,3 @@ const struct fs_ops fs_fec_ops = {
         .free_bd                = free_bd,
 };
 
-/***********************************************************************/
-
-static int mii_read(struct fs_enet_mii_bus *bus, int phy_id, int location)
-{
-        fec_t *fecp = bus->fec.fecp;
-        int i, ret = -1;
-
-        if ((FR(fecp, r_cntrl) & FEC_RCNTRL_MII_MODE) == 0)
-                BUG();
-
-        /* Add PHY address to register command.  */
-        FW(fecp, mii_data, (phy_id << 23) | mk_mii_read(location));
-
-        for (i = 0; i < FEC_MII_LOOPS; i++)
-                if ((FR(fecp, ievent) & FEC_ENET_MII) != 0)
-                        break;
-
-        if (i < FEC_MII_LOOPS) {
-                FW(fecp, ievent, FEC_ENET_MII);
-                ret = FR(fecp, mii_data) & 0xffff;
-        }
-
-        return ret;
-}
-
-static void mii_write(struct fs_enet_mii_bus *bus, int phy_id, int location, int value)
-{
-        fec_t *fecp = bus->fec.fecp;
-        int i;
-
-        /* this must never happen */
-        if ((FR(fecp, r_cntrl) & FEC_RCNTRL_MII_MODE) == 0)
-                BUG();
-
-        /* Add PHY address to register command.  */
-        FW(fecp, mii_data, (phy_id << 23) | mk_mii_write(location, value));
-
-        for (i = 0; i < FEC_MII_LOOPS; i++)
-                if ((FR(fecp, ievent) & FEC_ENET_MII) != 0)
-                        break;
-
-        if (i < FEC_MII_LOOPS)
-                FW(fecp, ievent, FEC_ENET_MII);
-}
-
-int fs_mii_fec_init(struct fs_enet_mii_bus *bus)
-{
-        bd_t *bd = (bd_t *)__res;
-        const struct fs_mii_bus_info *bi = bus->bus_info;
-        fec_t *fecp;
-
-        if (bi->id != 0)
-                return -1;
-
-        bus->fec.fecp = &((immap_t *)fs_enet_immap)->im_cpm.cp_fec;
-        bus->fec.mii_speed = ((((bd->bi_intfreq + 4999999) / 2500000) / 2)
-                                & 0x3F) << 1;
-
-        fecp = bus->fec.fecp;
-
-        FS(fecp, r_cntrl, FEC_RCNTRL_MII_MODE); /* MII enable */
-        FS(fecp, ecntrl, FEC_ECNTRL_PINMUX | FEC_ECNTRL_ETHER_EN);
-        FW(fecp, ievent, FEC_ENET_MII);
-        FW(fecp, mii_speed, bus->fec.mii_speed);
-
-        bus->mii_read = mii_read;
-        bus->mii_write = mii_write;
-
-        return 0;
-}
diff --git a/drivers/net/fs_enet/mac-scc.c b/drivers/net/fs_enet/mac-scc.c
index eaa24fab645f..95ec5872c507 100644
--- a/drivers/net/fs_enet/mac-scc.c
+++ b/drivers/net/fs_enet/mac-scc.c
@@ -369,7 +369,7 @@ static void restart(struct net_device *dev)
         W16(sccp, scc_psmr, SCC_PSMR_ENCRC | SCC_PSMR_NIB22);
 
         /* Set full duplex mode if needed */
-        if (fep->duplex)
+        if (fep->phydev->duplex)
                 S16(sccp, scc_psmr, SCC_PSMR_LPB | SCC_PSMR_FDE);
 
         S32(sccp, scc_gsmrl, SCC_GSMRL_ENR | SCC_GSMRL_ENT);
@@ -500,6 +500,8 @@ static void tx_restart(struct net_device *dev)
         scc_cr_cmd(fep, CPM_CR_RESTART_TX);
 }
 
+
+
 /*************************************************************************/
 
 const struct fs_ops fs_scc_ops = {
diff --git a/drivers/net/fs_enet/mii-bitbang.c b/drivers/net/fs_enet/mii-bitbang.c
index 48f9cf83ab6f..0b9b8b5c847c 100644
--- a/drivers/net/fs_enet/mii-bitbang.c
+++ b/drivers/net/fs_enet/mii-bitbang.c
@@ -33,6 +33,7 @@
 #include <linux/mii.h>
 #include <linux/ethtool.h>
 #include <linux/bitops.h>
+#include <linux/platform_device.h>
 
 #include <asm/pgtable.h>
 #include <asm/irq.h>
@@ -40,129 +41,25 @@
 
 #include "fs_enet.h"
 
-#ifdef CONFIG_8xx
-static int bitbang_prep_bit(u8 **dirp, u8 **datp, u8 *mskp, int port, int bit)
+static int bitbang_prep_bit(u8 **datp, u8 *mskp,
+                struct fs_mii_bit *mii_bit)
 {
-        immap_t *im = (immap_t *)fs_enet_immap;
-        void *dir, *dat, *ppar;
+        void *dat;
         int adv;
         u8 msk;
 
-        switch (port) {
-                case fsiop_porta:
-                        dir = &im->im_ioport.iop_padir;
-                        dat = &im->im_ioport.iop_padat;
-                        ppar = &im->im_ioport.iop_papar;
-                        break;
-
-                case fsiop_portb:
-                        dir = &im->im_cpm.cp_pbdir;
-                        dat = &im->im_cpm.cp_pbdat;
-                        ppar = &im->im_cpm.cp_pbpar;
-                        break;
-
-                case fsiop_portc:
-                        dir = &im->im_ioport.iop_pcdir;
-                        dat = &im->im_ioport.iop_pcdat;
-                        ppar = &im->im_ioport.iop_pcpar;
-                        break;
-
-                case fsiop_portd:
-                        dir = &im->im_ioport.iop_pddir;
-                        dat = &im->im_ioport.iop_pddat;
-                        ppar = &im->im_ioport.iop_pdpar;
-                        break;
-
-                case fsiop_porte:
-                        dir = &im->im_cpm.cp_pedir;
-                        dat = &im->im_cpm.cp_pedat;
-                        ppar = &im->im_cpm.cp_pepar;
-                        break;
-
-                default:
-                        printk(KERN_ERR DRV_MODULE_NAME
-                               "Illegal port value %d!\n", port);
-                        return -EINVAL;
-        }
-
-        adv = bit >> 3;
-        dir = (char *)dir + adv;
-        dat = (char *)dat + adv;
-        ppar = (char *)ppar + adv;
-
-        msk = 1 << (7 - (bit & 7));
-        if ((in_8(ppar) & msk) != 0) {
-                printk(KERN_ERR DRV_MODULE_NAME
-                       "pin %d on port %d is not general purpose!\n", bit, port);
-                return -EINVAL;
-        }
-
-        *dirp = dir;
-        *datp = dat;
-        *mskp = msk;
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_8260
-static int bitbang_prep_bit(u8 **dirp, u8 **datp, u8 *mskp, int port, int bit)
-{
-        iop_cpm2_t *io = &((cpm2_map_t *)fs_enet_immap)->im_ioport;
-        void *dir, *dat, *ppar;
-        int adv;
-        u8 msk;
-
-        switch (port) {
-                case fsiop_porta:
-                        dir = &io->iop_pdira;
-                        dat = &io->iop_pdata;
-                        ppar = &io->iop_ppara;
-                        break;
-
-                case fsiop_portb:
-                        dir = &io->iop_pdirb;
-                        dat = &io->iop_pdatb;
-                        ppar = &io->iop_pparb;
-                        break;
-
-                case fsiop_portc:
-                        dir = &io->iop_pdirc;
-                        dat = &io->iop_pdatc;
-                        ppar = &io->iop_pparc;
-                        break;
-
-                case fsiop_portd:
-                        dir = &io->iop_pdird;
-                        dat = &io->iop_pdatd;
-                        ppar = &io->iop_ppard;
-                        break;
-
-                default:
-                        printk(KERN_ERR DRV_MODULE_NAME
-                               "Illegal port value %d!\n", port);
-                        return -EINVAL;
-        }
+        dat = (void*) mii_bit->offset;
 
-        adv = bit >> 3;
-        dir = (char *)dir + adv;
+        adv = mii_bit->bit >> 3;
         dat = (char *)dat + adv;
-        ppar = (char *)ppar + adv;
 
-        msk = 1 << (7 - (bit & 7));
-        if ((in_8(ppar) & msk) != 0) {
-                printk(KERN_ERR DRV_MODULE_NAME
-                       "pin %d on port %d is not general purpose!\n", bit, port);
-                return -EINVAL;
-        }
+        msk = 1 << (7 - (mii_bit->bit & 7));
 
-        *dirp = dir;
         *datp = dat;
         *mskp = msk;
 
         return 0;
 }
-#endif
 
 static inline void bb_set(u8 *p, u8 m)
 {
@@ -179,44 +76,44 @@ static inline int bb_read(u8 *p, u8 m)
         return (in_8(p) & m) != 0;
 }
 
-static inline void mdio_active(struct fs_enet_mii_bus *bus)
+static inline void mdio_active(struct bb_info *bitbang)
 {
-        bb_set(bus->bitbang.mdio_dir, bus->bitbang.mdio_msk);
+        bb_set(bitbang->mdio_dir, bitbang->mdio_dir_msk);
 }
 
-static inline void mdio_tristate(struct fs_enet_mii_bus *bus)
+static inline void mdio_tristate(struct bb_info *bitbang )
 {
-        bb_clr(bus->bitbang.mdio_dir, bus->bitbang.mdio_msk);
+        bb_clr(bitbang->mdio_dir, bitbang->mdio_dir_msk);
 }
 
-static inline int mdio_read(struct fs_enet_mii_bus *bus)
+static inline int mdio_read(struct bb_info *bitbang )
 {
-        return bb_read(bus->bitbang.mdio_dat, bus->bitbang.mdio_msk);
+        return bb_read(bitbang->mdio_dat, bitbang->mdio_dat_msk);
 }
 
-static inline void mdio(struct fs_enet_mii_bus *bus, int what)
+static inline void mdio(struct bb_info *bitbang , int what)
 {
         if (what)
-                bb_set(bus->bitbang.mdio_dat, bus->bitbang.mdio_msk);
+                bb_set(bitbang->mdio_dat, bitbang->mdio_dat_msk);
         else
-                bb_clr(bus->bitbang.mdio_dat, bus->bitbang.mdio_msk);
+                bb_clr(bitbang->mdio_dat, bitbang->mdio_dat_msk);
 }
 
-static inline void mdc(struct fs_enet_mii_bus *bus, int what)
+static inline void mdc(struct bb_info *bitbang , int what)
 {
         if (what)
-                bb_set(bus->bitbang.mdc_dat, bus->bitbang.mdc_msk);
+                bb_set(bitbang->mdc_dat, bitbang->mdc_msk);
         else
-                bb_clr(bus->bitbang.mdc_dat, bus->bitbang.mdc_msk);
+                bb_clr(bitbang->mdc_dat, bitbang->mdc_msk);
 }
 
-static inline void mii_delay(struct fs_enet_mii_bus *bus)
+static inline void mii_delay(struct bb_info *bitbang )
 {
-        udelay(bus->bus_info->i.bitbang.delay);
+        udelay(bitbang->delay);
 }
 
 /* Utility to send the preamble, address, and register (common to read and write). */
-static void bitbang_pre(struct fs_enet_mii_bus *bus, int read, u8 addr, u8 reg)
+static void bitbang_pre(struct bb_info *bitbang , int read, u8 addr, u8 reg)
 {
         int j;
 
@@ -228,177 +125,284 @@ static void bitbang_pre(struct fs_enet_mii_bus *bus, int read, u8 addr, u8 reg)
          * but it is safer and will be much more robust.
          */
 
-        mdio_active(bus);
-        mdio(bus, 1);
+        mdio_active(bitbang);
+        mdio(bitbang, 1);
         for (j = 0; j < 32; j++) {
-                mdc(bus, 0);
-                mii_delay(bus);
-                mdc(bus, 1);
-                mii_delay(bus);
+                mdc(bitbang, 0);
+                mii_delay(bitbang);
+                mdc(bitbang, 1);
+                mii_delay(bitbang);
         }
 
         /* send the start bit (01) and the read opcode (10) or write (10) */
-        mdc(bus, 0);
-        mdio(bus, 0);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 0);
-        mdio(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 0);
-        mdio(bus, read);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 0);
-        mdio(bus, !read);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
+        mdc(bitbang, 0);
+        mdio(bitbang, 0);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 0);
+        mdio(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 0);
+        mdio(bitbang, read);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 0);
+        mdio(bitbang, !read);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
 
         /* send the PHY address */
         for (j = 0; j < 5; j++) {
-                mdc(bus, 0);
-                mdio(bus, (addr & 0x10) != 0);
-                mii_delay(bus);
-                mdc(bus, 1);
-                mii_delay(bus);
+                mdc(bitbang, 0);
+                mdio(bitbang, (addr & 0x10) != 0);
+                mii_delay(bitbang);
+                mdc(bitbang, 1);
+                mii_delay(bitbang);
                 addr <<= 1;
         }
 
         /* send the register address */
         for (j = 0; j < 5; j++) {
-                mdc(bus, 0);
-                mdio(bus, (reg & 0x10) != 0);
-                mii_delay(bus);
-                mdc(bus, 1);
-                mii_delay(bus);
+                mdc(bitbang, 0);
+                mdio(bitbang, (reg & 0x10) != 0);
+                mii_delay(bitbang);
+                mdc(bitbang, 1);
+                mii_delay(bitbang);
                 reg <<= 1;
         }
 }
 
-static int mii_read(struct fs_enet_mii_bus *bus, int phy_id, int location)
+static int fs_enet_mii_bb_read(struct mii_bus *bus , int phy_id, int location)
 {
         u16 rdreg;
         int ret, j;
         u8 addr = phy_id & 0xff;
         u8 reg = location & 0xff;
+        struct bb_info* bitbang = bus->priv;
 
-        bitbang_pre(bus, 1, addr, reg);
+        bitbang_pre(bitbang, 1, addr, reg);
 
         /* tri-state our MDIO I/O pin so we can read */
-        mdc(bus, 0);
-        mdio_tristate(bus);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
+        mdc(bitbang, 0);
+        mdio_tristate(bitbang);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
 
         /* check the turnaround bit: the PHY should be driving it to zero */
-        if (mdio_read(bus) != 0) {
+        if (mdio_read(bitbang) != 0) {
                 /* PHY didn't drive TA low */
                 for (j = 0; j < 32; j++) {
-                        mdc(bus, 0);
-                        mii_delay(bus);
-                        mdc(bus, 1);
-                        mii_delay(bus);
+                        mdc(bitbang, 0);
+                        mii_delay(bitbang);
+                        mdc(bitbang, 1);
+                        mii_delay(bitbang);
                 }
                 ret = -1;
                 goto out;
         }
 
-        mdc(bus, 0);
-        mii_delay(bus);
+        mdc(bitbang, 0);
+        mii_delay(bitbang);
 
         /* read 16 bits of register data, MSB first */
         rdreg = 0;
         for (j = 0; j < 16; j++) {
-                mdc(bus, 1);
-                mii_delay(bus);
+                mdc(bitbang, 1);
+                mii_delay(bitbang);
                 rdreg <<= 1;
-                rdreg |= mdio_read(bus);
-                mdc(bus, 0);
-                mii_delay(bus);
+                rdreg |= mdio_read(bitbang);
+                mdc(bitbang, 0);
+                mii_delay(bitbang);
         }
 
-        mdc(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 0);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 0);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
 
         ret = rdreg;
 out:
         return ret;
 }
 
-static void mii_write(struct fs_enet_mii_bus *bus, int phy_id, int location, int val)
+static int fs_enet_mii_bb_write(struct mii_bus *bus, int phy_id, int location, u16 val)
 {
         int j;
+        struct bb_info* bitbang = bus->priv;
+
         u8 addr = phy_id & 0xff;
         u8 reg = location & 0xff;
         u16 value = val & 0xffff;
 
-        bitbang_pre(bus, 0, addr, reg);
+        bitbang_pre(bitbang, 0, addr, reg);
 
         /* send the turnaround (10) */
-        mdc(bus, 0);
-        mdio(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
-        mdc(bus, 0);
-        mdio(bus, 0);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
+        mdc(bitbang, 0);
+        mdio(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
+        mdc(bitbang, 0);
+        mdio(bitbang, 0);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
 
         /* write 16 bits of register data, MSB first */
         for (j = 0; j < 16; j++) {
-                mdc(bus, 0);
-                mdio(bus, (value & 0x8000) != 0);
-                mii_delay(bus);
-                mdc(bus, 1);
-                mii_delay(bus);
+                mdc(bitbang, 0);
+                mdio(bitbang, (value & 0x8000) != 0);
+                mii_delay(bitbang);
+                mdc(bitbang, 1);
+                mii_delay(bitbang);
                 value <<= 1;
         }
 
         /*
          * Tri-state the MDIO line.
          */
-        mdio_tristate(bus);
-        mdc(bus, 0);
-        mii_delay(bus);
-        mdc(bus, 1);
-        mii_delay(bus);
+        mdio_tristate(bitbang);
+        mdc(bitbang, 0);
+        mii_delay(bitbang);
+        mdc(bitbang, 1);
+        mii_delay(bitbang);
+        return 0;
 }
 
-int fs_mii_bitbang_init(struct fs_enet_mii_bus *bus)
+static int fs_enet_mii_bb_reset(struct mii_bus *bus)
+{
+        /*nothing here - dunno how to reset it*/
+        return 0;
+}
+
+static int fs_mii_bitbang_init(struct bb_info *bitbang, struct fs_mii_bb_platform_info* fmpi)
 {
-        const struct fs_mii_bus_info *bi = bus->bus_info;
         int r;
 
-        r = bitbang_prep_bit(&bus->bitbang.mdio_dir,
-                         &bus->bitbang.mdio_dat,
-                         &bus->bitbang.mdio_msk,
-                         bi->i.bitbang.mdio_port,
-                         bi->i.bitbang.mdio_bit);
+        bitbang->delay = fmpi->delay;
+
+        r = bitbang_prep_bit(&bitbang->mdio_dir,
+                         &bitbang->mdio_dir_msk,
+                         &fmpi->mdio_dir);
         if (r != 0)
                 return r;
 
-        r = bitbang_prep_bit(&bus->bitbang.mdc_dir,
-                         &bus->bitbang.mdc_dat,
-                         &bus->bitbang.mdc_msk,
-                         bi->i.bitbang.mdc_port,
-                         bi->i.bitbang.mdc_bit);
+        r = bitbang_prep_bit(&bitbang->mdio_dat,
+                         &bitbang->mdio_dat_msk,
+                         &fmpi->mdio_dat);
         if (r != 0)
                 return r;
 
-        bus->mii_read = mii_read;
-        bus->mii_write = mii_write;
+        r = bitbang_prep_bit(&bitbang->mdc_dat,
+                         &bitbang->mdc_msk,
+                         &fmpi->mdc_dat);
+        if (r != 0)
+                return r;
 
         return 0;
 }
+
+
+static int __devinit fs_enet_mdio_probe(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct fs_mii_bb_platform_info *pdata;
+        struct mii_bus *new_bus;
+        struct bb_info *bitbang;
+        int err = 0;
+
+        if (NULL == dev)
+                return -EINVAL;
+
+        new_bus = kzalloc(sizeof(struct mii_bus), GFP_KERNEL);
+
+        if (NULL == new_bus)
+                return -ENOMEM;
+
+        bitbang = kzalloc(sizeof(struct bb_info), GFP_KERNEL);
+
+        if (NULL == bitbang)
+                return -ENOMEM;
+
+        new_bus->name = "BB MII Bus",
+        new_bus->read = &fs_enet_mii_bb_read,
+        new_bus->write = &fs_enet_mii_bb_write,
+        new_bus->reset = &fs_enet_mii_bb_reset,
+        new_bus->id = pdev->id;
+
+        new_bus->phy_mask = ~0x9;
+        pdata = (struct fs_mii_bb_platform_info *)pdev->dev.platform_data;
+
+        if (NULL == pdata) {
+                printk(KERN_ERR "gfar mdio %d: Missing platform data!\n", pdev->id);
+                return -ENODEV;
+        }
+
+        /*set up workspace*/
+        fs_mii_bitbang_init(bitbang, pdata);
+
+        new_bus->priv = bitbang;
+
+        new_bus->irq = pdata->irq;
+
+        new_bus->dev = dev;
+        dev_set_drvdata(dev, new_bus);
+
+        err = mdiobus_register(new_bus);
+
+        if (0 != err) {
+                printk (KERN_ERR "%s: Cannot register as MDIO bus\n",
+                                new_bus->name);
+                goto bus_register_fail;
+        }
+
+        return 0;
+
+bus_register_fail:
+        kfree(bitbang);
+        kfree(new_bus);
+
+        return err;
+}
+
+
+static int fs_enet_mdio_remove(struct device *dev)
+{
+        struct mii_bus *bus = dev_get_drvdata(dev);
+
+        mdiobus_unregister(bus);
+
+        dev_set_drvdata(dev, NULL);
+
+        iounmap((void *) (&bus->priv));
+        bus->priv = NULL;
+        kfree(bus);
+
+        return 0;
+}
+
+static struct device_driver fs_enet_bb_mdio_driver = {
+        .name = "fsl-bb-mdio",
+        .bus = &platform_bus_type,
+        .probe = fs_enet_mdio_probe,
+        .remove = fs_enet_mdio_remove,
+};
+
+int fs_enet_mdio_bb_init(void)
+{
+        return driver_register(&fs_enet_bb_mdio_driver);
+}
+
+void fs_enet_mdio_bb_exit(void)
+{
+        driver_unregister(&fs_enet_bb_mdio_driver);
+}
+
diff --git a/drivers/net/fs_enet/mii-fec.c b/drivers/net/fs_enet/mii-fec.c
new file mode 100644
index 000000000000..1328e10caa35
--- /dev/null
+++ b/drivers/net/fs_enet/mii-fec.c
@@ -0,0 +1,243 @@
+/*
+ * Combined Ethernet driver for Motorola MPC8xx and MPC82xx.
+ *
+ * Copyright (c) 2003 Intracom S.A.
+ *  by Pantelis Antoniou <panto@intracom.gr>
+ *
+ * 2005 (c) MontaVista Software, Inc.
+ * Vitaly Bordug <vbordug@ru.mvista.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/ptrace.h>
+#include <linux/errno.h>
+#include <linux/ioport.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/bitops.h>
+#include <linux/platform_device.h>
+
+#include <asm/pgtable.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+#include "fs_enet.h"
+#include "fec.h"
+
+/* Make MII read/write commands for the FEC.
+*/
+#define mk_mii_read(REG)        (0x60020000 | ((REG & 0x1f) << 18))
+#define mk_mii_write(REG, VAL)  (0x50020000 | ((REG & 0x1f) << 18) | (VAL & 0xffff))
+#define mk_mii_end              0
+
+#define FEC_MII_LOOPS   10000
+
+static int match_has_phy (struct device *dev, void* data)
+{
+        struct platform_device* pdev = container_of(dev, struct platform_device, dev);
+        struct fs_platform_info* fpi;
+        if(strcmp(pdev->name, (char*)data))
+        {
+            return 0;
+        }
+
+        fpi = pdev->dev.platform_data;
+        if((fpi)&&(fpi->has_phy))
+                return 1;
+        return 0;
+}
+
+static int fs_mii_fec_init(struct fec_info* fec, struct fs_mii_fec_platform_info *fmpi)
+{
+        struct resource *r;
+        fec_t *fecp;
+        char* name = "fsl-cpm-fec";
+
+        /* we need fec in order to be useful */
+        struct platform_device *fec_pdev =
+                container_of(bus_find_device(&platform_bus_type, NULL, name, match_has_phy),
+                                struct platform_device, dev);
+
+        if(fec_pdev == NULL) {
+                printk(KERN_ERR"Unable to find PHY for %s", name);
+                return -ENODEV;
+        }
+
+        r = platform_get_resource_byname(fec_pdev, IORESOURCE_MEM, "regs");
+
+        fec->fecp = fecp = (fec_t*)ioremap(r->start,sizeof(fec_t));
+        fec->mii_speed = fmpi->mii_speed;
+
+        setbits32(&fecp->fec_r_cntrl, FEC_RCNTRL_MII_MODE);     /* MII enable */
+        setbits32(&fecp->fec_ecntrl, FEC_ECNTRL_PINMUX | FEC_ECNTRL_ETHER_EN);
+        out_be32(&fecp->fec_ievent, FEC_ENET_MII);
+        out_be32(&fecp->fec_mii_speed, fec->mii_speed);
+
+        return 0;
+}
+
+static int fs_enet_fec_mii_read(struct mii_bus *bus , int phy_id, int location)
+{
+        struct fec_info* fec = bus->priv;
+        fec_t *fecp = fec->fecp;
+        int i, ret = -1;
+
+        if ((in_be32(&fecp->fec_r_cntrl) & FEC_RCNTRL_MII_MODE) == 0)
+                BUG();
+
+        /* Add PHY address to register command.  */
+        out_be32(&fecp->fec_mii_data, (phy_id << 23) | mk_mii_read(location));
+
+        for (i = 0; i < FEC_MII_LOOPS; i++)
+                if ((in_be32(&fecp->fec_ievent) & FEC_ENET_MII) != 0)
+                        break;
+
+        if (i < FEC_MII_LOOPS) {
+                out_be32(&fecp->fec_ievent, FEC_ENET_MII);
+                ret = in_be32(&fecp->fec_mii_data) & 0xffff;
+        }
+
+        return ret;
+
+}
+
+static int fs_enet_fec_mii_write(struct mii_bus *bus, int phy_id, int location, u16 val)
+{
+        struct fec_info* fec = bus->priv;
+        fec_t *fecp = fec->fecp;
+        int i;
+
+        /* this must never happen */
+        if ((in_be32(&fecp->fec_r_cntrl) & FEC_RCNTRL_MII_MODE) == 0)
+                BUG();
+
+        /* Add PHY address to register command.  */
+        out_be32(&fecp->fec_mii_data, (phy_id << 23) | mk_mii_write(location, val));
+
+        for (i = 0; i < FEC_MII_LOOPS; i++)
+                if ((in_be32(&fecp->fec_ievent) & FEC_ENET_MII) != 0)
+                        break;
+
+        if (i < FEC_MII_LOOPS)
+                out_be32(&fecp->fec_ievent, FEC_ENET_MII);
+
+        return 0;
+
+}
+
+static int fs_enet_fec_mii_reset(struct mii_bus *bus)
+{
+        /* nothing here - for now */
+        return 0;
+}
+
+static int __devinit fs_enet_fec_mdio_probe(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct fs_mii_fec_platform_info *pdata;
+        struct mii_bus *new_bus;
+        struct fec_info *fec;
+        int err = 0;
+        if (NULL == dev)
+                return -EINVAL;
+        new_bus = kzalloc(sizeof(struct mii_bus), GFP_KERNEL);
+
+        if (NULL == new_bus)
+                return -ENOMEM;
+
+        fec = kzalloc(sizeof(struct fec_info), GFP_KERNEL);
+
+        if (NULL == fec)
+                return -ENOMEM;
+
+        new_bus->name = "FEC MII Bus",
+        new_bus->read = &fs_enet_fec_mii_read,
+        new_bus->write = &fs_enet_fec_mii_write,
+        new_bus->reset = &fs_enet_fec_mii_reset,
+        new_bus->id = pdev->id;
+
+        pdata = (struct fs_mii_fec_platform_info *)pdev->dev.platform_data;
+
+        if (NULL == pdata) {
+                printk(KERN_ERR "fs_enet FEC mdio %d: Missing platform data!\n", pdev->id);
+                return -ENODEV;
+        }
+
+        /*set up workspace*/
+
+        fs_mii_fec_init(fec, pdata);
+        new_bus->priv = fec;
+
+        new_bus->irq = pdata->irq;
+
+        new_bus->dev = dev;
+        dev_set_drvdata(dev, new_bus);
+
+        err = mdiobus_register(new_bus);
+
+        if (0 != err) {
+                printk (KERN_ERR "%s: Cannot register as MDIO bus\n",
+                                new_bus->name);
+                goto bus_register_fail;
+        }
+
+        return 0;
+
+bus_register_fail:
+        kfree(new_bus);
+
+        return err;
+}
+
+
+static int fs_enet_fec_mdio_remove(struct device *dev)
+{
+        struct mii_bus *bus = dev_get_drvdata(dev);
+
+        mdiobus_unregister(bus);
+
+        dev_set_drvdata(dev, NULL);
+        kfree(bus->priv);
+
+        bus->priv = NULL;
+        kfree(bus);
+
+        return 0;
+}
+
+static struct device_driver fs_enet_fec_mdio_driver = {
+        .name = "fsl-cpm-fec-mdio",
+        .bus = &platform_bus_type,
+        .probe = fs_enet_fec_mdio_probe,
+        .remove = fs_enet_fec_mdio_remove,
+};
+
+int fs_enet_mdio_fec_init(void)
+{
+        return driver_register(&fs_enet_fec_mdio_driver);
+}
+
+void fs_enet_mdio_fec_exit(void)
+{
+        driver_unregister(&fs_enet_fec_mdio_driver);
+}
+
diff --git a/drivers/net/fs_enet/mii-fixed.c b/drivers/net/fs_enet/mii-fixed.c
deleted file mode 100644
index ae4a9c3bb393..000000000000
--- a/drivers/net/fs_enet/mii-fixed.c
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Combined Ethernet driver for Motorola MPC8xx and MPC82xx.
- *
- * Copyright (c) 2003 Intracom S.A. 
- *  by Pantelis Antoniou <panto@intracom.gr>
- * 
- * 2005 (c) MontaVista Software, Inc. 
- * Vitaly Bordug <vbordug@ru.mvista.com>
- *
- * This file is licensed under the terms of the GNU General Public License 
- * version 2. This program is licensed "as is" without any warranty of any 
- * kind, whether express or implied.
- */
-
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/string.h>
-#include <linux/ptrace.h>
-#include <linux/errno.h>
-#include <linux/ioport.h>
-#include <linux/slab.h>
-#include <linux/interrupt.h>
-#include <linux/pci.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/spinlock.h>
-#include <linux/mii.h>
-#include <linux/ethtool.h>
-#include <linux/bitops.h>
-
-#include <asm/pgtable.h>
-#include <asm/irq.h>
-#include <asm/uaccess.h>
-
-#include "fs_enet.h"
-
-static const u16 mii_regs[7] = {
-        0x3100,
-        0x786d,
-        0x0fff,
-        0x0fff,
-        0x01e1,
-        0x45e1,
-        0x0003,
-};
-
-static int mii_read(struct fs_enet_mii_bus *bus, int phy_id, int location)
-{
-        int ret = 0;
-
-        if ((unsigned int)location >= ARRAY_SIZE(mii_regs))
-                return -1;
-
-        if (location != 5)
-                ret = mii_regs[location];
-        else
-                ret = bus->fixed.lpa;
-
-        return ret;
-}
-
-static void mii_write(struct fs_enet_mii_bus *bus, int phy_id, int location, int val)
-{
-        /* do nothing */
-}
-
-int fs_mii_fixed_init(struct fs_enet_mii_bus *bus)
-{
-        const struct fs_mii_bus_info *bi = bus->bus_info;
-
-        bus->fixed.lpa = 0x45e1;        /* default 100Mb, full duplex */
-
-        /* if speed is fixed at 10Mb, remove 100Mb modes */
-        if (bi->i.fixed.speed == 10)
-                bus->fixed.lpa &= ~LPA_100;
-
-        /* if duplex is half, remove full duplex modes */
-        if (bi->i.fixed.duplex == 0)
-                bus->fixed.lpa &= ~LPA_DUPLEX;
-
-        bus->mii_read = mii_read;
-        bus->mii_write = mii_write;
-
-        return 0;
-}
diff --git a/drivers/net/gt96100eth.c b/drivers/net/gt96100eth.c
index 49dacc6e35aa..2b4db7414475 100644
--- a/drivers/net/gt96100eth.c
+++ b/drivers/net/gt96100eth.c
@@ -699,7 +699,6 @@ static int __init gt96100_probe1(struct pci_dev *pci, int port_num)
         memset(gp, 0, sizeof(*gp)); // clear it
 
         gp->port_num = port_num;
-        gp->io_size = GT96100_ETH_IO_SIZE;
         gp->port_offset = port_num * GT96100_ETH_IO_SIZE;
         gp->phy_addr = phy_addr;
         gp->chip_rev = chip_rev;
@@ -1531,7 +1530,7 @@ static void gt96100_cleanup_module(void)
                                 + sizeof(gt96100_td_t) * TX_RING_SIZE,
                                 gp->rx_ring);
                         free_netdev(gtif->dev);
-                        release_region(gtif->iobase, gp->io_size);
+                        release_region(gtif->iobase, GT96100_ETH_IO_SIZE);
                 }
         }
 }
diff --git a/drivers/net/gt96100eth.h b/drivers/net/gt96100eth.h
index 2a8331938b84..3b62a87c7d7f 100644
--- a/drivers/net/gt96100eth.h
+++ b/drivers/net/gt96100eth.h
@@ -331,7 +331,6 @@ struct gt96100_private {
         mib_counters_t mib;
         struct net_device_stats stats;
 
-        int io_size;
         int port_num;  // 0 or 1
         int chip_rev;
         u32 port_offset;
@@ -340,7 +339,6 @@ struct gt96100_private {
         u32 last_psr; // last value of the port status register
 
         int options;     /* User-settable misc. driver options. */
-        int drv_flags;
         struct timer_list timer;
         spinlock_t lock; /* Serialise access to device */
 };
diff --git a/drivers/net/hamachi.c b/drivers/net/hamachi.c
index 7bcd939c6edd..409c6aab0411 100644
--- a/drivers/net/hamachi.c
+++ b/drivers/net/hamachi.c
@@ -20,22 +20,15 @@
 
         Support and updates available at
         http://www.scyld.com/network/hamachi.html
+        [link no longer provides useful info -jgarzik]
         or
         http://www.parl.clemson.edu/~keithu/hamachi.html
 
-
-
-        Linux kernel changelog:
-
-        LK1.0.1:
-        - fix lack of pci_dev<->dev association
-        - ethtool support (jgarzik)
-
 */
 
 #define DRV_NAME        "hamachi"
-#define DRV_VERSION     "1.01+LK1.0.1"
-#define DRV_RELDATE     "5/18/2001"
+#define DRV_VERSION     "2.0"
+#define DRV_RELDATE     "June 27, 2006"
 
 
 /* A few user-configurable values. */
@@ -608,7 +601,8 @@ static int __devinit hamachi_init_one (struct pci_dev *pdev,
         pci_set_master(pdev);
 
         i = pci_request_regions(pdev, DRV_NAME);
-        if (i) return i;
+        if (i)
+                return i;
 
         irq = pdev->irq;
         ioaddr = ioremap(base, 0x400);
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 0641f54fc638..889f338132fa 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -122,6 +122,12 @@ struct bpqdev {
 
 static LIST_HEAD(bpq_devices);
 
+/*
+ * bpqether network devices are paired with ethernet devices below them, so
+ * form a special "super class" of normal ethernet devices; split their locks
+ * off into a separate class since they always nest.
+ */
+static struct lock_class_key bpq_netdev_xmit_lock_key;
 
 /* ------------------------------------------------------------------------ */
 
@@ -528,6 +534,7 @@ static int bpq_new_device(struct net_device *edev)
         err = register_netdevice(ndev);
         if (err)
                 goto error;
+        lockdep_set_class(&ndev->_xmit_lock, &bpq_netdev_xmit_lock_key);
 
         /* List protected by RTNL */
         list_add_rcu(&bpq->bpq_list, &bpq_devices);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 3a42afab5036..43e3f33ed5e2 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -271,6 +271,7 @@ static int __init ifb_init_module(void)
         for (i = 0; i < numifbs && !err; i++)
                 err = ifb_init_one(i); 
         if (err) { 
+                i--;
                 while (--i >= 0)
                         ifb_free_one(i);
         }
diff --git a/drivers/net/irda/ali-ircc.c b/drivers/net/irda/ali-ircc.c
index bf1fca5a3fa0..e3c8cd5eca67 100644
--- a/drivers/net/irda/ali-ircc.c
+++ b/drivers/net/irda/ali-ircc.c
@@ -146,7 +146,7 @@ static int __init ali_ircc_init(void)
 {
         ali_chip_t *chip;
         chipio_t info;
-        int ret = -ENODEV;
+        int ret;
         int cfg, cfg_base;
         int reg, revision;
         int i = 0;
@@ -160,6 +160,7 @@ static int __init ali_ircc_init(void)
                 return ret;
         }
 
+        ret = -ENODEV;
         
         /* Probe for all the ALi chipsets we know about */
         for (chip= chips; chip->name; chip++, i++) 
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index a4674044bd6f..2eff45bedc7c 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -2353,7 +2353,7 @@ static int __init smsc_superio_lpc(unsigned short cfg_base)
 #ifdef CONFIG_PCI
 #define PCIID_VENDOR_INTEL 0x8086
 #define PCIID_VENDOR_ALI 0x10b9
-static struct smsc_ircc_subsystem_configuration subsystem_configurations[] __devinitdata = {
+static struct smsc_ircc_subsystem_configuration subsystem_configurations[] __initdata = {
         {
                 .vendor = PCIID_VENDOR_INTEL, /* Intel 82801DBM LPC bridge */
                 .device = 0x24cc,
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index b91e082483f6..7bbd447289b5 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1173,7 +1173,7 @@ ixgb_tso(struct ixgb_adapter *adapter, struct sk_buff *skb)
         uint16_t ipcse, tucse, mss;
         int err;
 
-        if(likely(skb_shinfo(skb)->gso_size)) {
+        if (likely(skb_is_gso(skb))) {
                 if (skb_header_cloned(skb)) {
                         err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
                         if (err)
@@ -1281,7 +1281,7 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
 
         while(len) {
                 buffer_info = &tx_ring->buffer_info[i];
-                size = min(len, IXGB_MAX_JUMBO_FRAME_SIZE);
+                size = min(len, IXGB_MAX_DATA_PER_TXD);
                 buffer_info->length = size;
                 buffer_info->dma =
                         pci_map_single(adapter->pdev,
@@ -1306,7 +1306,7 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
 
                 while(len) {
                         buffer_info = &tx_ring->buffer_info[i];
-                        size = min(len, IXGB_MAX_JUMBO_FRAME_SIZE);
+                        size = min(len, IXGB_MAX_DATA_PER_TXD);
                         buffer_info->length = size;
                         buffer_info->dma =
                                 pci_map_page(adapter->pdev,
diff --git a/drivers/net/lance.c b/drivers/net/lance.c
index c1c3452c90ca..5b4dbfe5fb77 100644
--- a/drivers/net/lance.c
+++ b/drivers/net/lance.c
@@ -326,7 +326,7 @@ MODULE_PARM_DESC(dma, "LANCE/PCnet ISA DMA channel (ignored for some devices)");
 MODULE_PARM_DESC(irq, "LANCE/PCnet IRQ number (ignored for some devices)");
 MODULE_PARM_DESC(lance_debug, "LANCE/PCnet debug level (0-7)");
 
-int init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/lne390.c b/drivers/net/lne390.c
index 646e89fc3562..c0ec7f6abcb2 100644
--- a/drivers/net/lne390.c
+++ b/drivers/net/lne390.c
@@ -406,7 +406,7 @@ MODULE_PARM_DESC(mem, "memory base address(es)");
 MODULE_DESCRIPTION("Mylex LNE390A/B EISA Ethernet driver");
 MODULE_LICENSE("GPL");
 
-int init_module(void)
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 43fef7de8cb9..997cbce9af6e 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -139,7 +139,7 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
 
 #ifdef LOOPBACK_TSO
-        if (skb_shinfo(skb)->gso_size) {
+        if (skb_is_gso(skb)) {
                 BUG_ON(skb->protocol != htons(ETH_P_IP));
                 BUG_ON(skb->nh.iph->protocol != IPPROTO_TCP);
 
diff --git a/drivers/net/mace.c b/drivers/net/mace.c
index f2c0bf89f0c7..29e4b5aa6ead 100644
--- a/drivers/net/mace.c
+++ b/drivers/net/mace.c
@@ -242,12 +242,12 @@ static int __devinit mace_probe(struct macio_dev *mdev, const struct of_device_i
         }
         rc = request_irq(mp->tx_dma_intr, mace_txdma_intr, 0, "MACE-txdma", dev);
         if (rc) {
-                printk(KERN_ERR "MACE: can't get irq %d\n", mace->intrs[1].line);
+                printk(KERN_ERR "MACE: can't get irq %d\n", mp->tx_dma_intr);
                 goto err_free_irq;
         }
         rc = request_irq(mp->rx_dma_intr, mace_rxdma_intr, 0, "MACE-rxdma", dev);
         if (rc) {
-                printk(KERN_ERR "MACE: can't get irq %d\n", mace->intrs[2].line);
+                printk(KERN_ERR "MACE: can't get irq %d\n", mp->rx_dma_intr);
                 goto err_free_tx_irq;
         }
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 760c61b98867..eeab1df5bef3 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -385,6 +385,8 @@ static int mv643xx_eth_receive_queue(struct net_device *dev, int budget)
         struct pkt_info pkt_info;
 
         while (budget-- > 0 && eth_port_receive(mp, &pkt_info) == ETH_OK) {
+                dma_unmap_single(NULL, pkt_info.buf_ptr, RX_SKB_SIZE,
+                                                        DMA_FROM_DEVICE);
                 mp->rx_desc_count--;
                 received_packets++;
 
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 72aad42db7b4..9bdd43ab3573 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -177,6 +177,7 @@ struct myri10ge_priv {
         struct work_struct watchdog_work;
         struct timer_list watchdog_timer;
         int watchdog_tx_done;
+        int watchdog_tx_req;
         int watchdog_resets;
         int tx_linearized;
         int pause;
@@ -188,7 +189,6 @@ struct myri10ge_priv {
         int vendor_specific_offset;
         u32 devctl;
         u16 msi_flags;
-        u32 pm_state[16];
         u32 read_dma;
         u32 write_dma;
         u32 read_write_dma;
@@ -449,6 +449,7 @@ static int myri10ge_load_hotplug_firmware(struct myri10ge_priv *mgp, u32 * size)
         struct mcp_gen_header *hdr;
         size_t hdr_offset;
         int status;
+        unsigned i;
 
         if ((status = request_firmware(&fw, mgp->fw_name, dev)) < 0) {
                 dev_err(dev, "Unable to load %s firmware image via hotplug\n",
@@ -480,18 +481,12 @@ static int myri10ge_load_hotplug_firmware(struct myri10ge_priv *mgp, u32 * size)
                 goto abort_with_fw;
 
         crc = crc32(~0, fw->data, fw->size);
-        if (mgp->tx.boundary == 2048) {
-                /* Avoid PCI burst on chipset with unaligned completions. */
-                int i;
-                __iomem u32 *ptr = (__iomem u32 *) (mgp->sram +
-                                                    MYRI10GE_FW_OFFSET);
-                for (i = 0; i < fw->size / 4; i++) {
-                        __raw_writel(((u32 *) fw->data)[i], ptr + i);
-                        wmb();
-                }
-        } else {
-                myri10ge_pio_copy(mgp->sram + MYRI10GE_FW_OFFSET, fw->data,
-                                  fw->size);
+        for (i = 0; i < fw->size; i += 256) {
+                myri10ge_pio_copy(mgp->sram + MYRI10GE_FW_OFFSET + i,
+                                  fw->data + i,
+                                  min(256U, (unsigned)(fw->size - i)));
+                mb();
+                readb(mgp->sram);
         }
         /* corruption checking is good for parity recovery and buggy chipset */
         memcpy_fromio(fw->data, mgp->sram + MYRI10GE_FW_OFFSET, fw->size);
@@ -621,7 +616,7 @@ static int myri10ge_load_firmware(struct myri10ge_priv *mgp)
                 return -ENXIO;
         }
         dev_info(&mgp->pdev->dev, "handoff confirmed\n");
-        myri10ge_dummy_rdma(mgp, mgp->tx.boundary != 4096);
+        myri10ge_dummy_rdma(mgp, 1);
 
         return 0;
 }
@@ -1289,6 +1284,7 @@ static const char myri10ge_gstrings_stats[][ETH_GSTRING_LEN] = {
         "tx_aborted_errors", "tx_carrier_errors", "tx_fifo_errors",
         "tx_heartbeat_errors", "tx_window_errors",
         /* device-specific stats */
+        "tx_boundary", "WC", "irq", "MSI",
         "read_dma_bw_MBs", "write_dma_bw_MBs", "read_write_dma_bw_MBs",
         "serial_number", "tx_pkt_start", "tx_pkt_done",
         "tx_req", "tx_done", "rx_small_cnt", "rx_big_cnt",
@@ -1327,6 +1323,10 @@ myri10ge_get_ethtool_stats(struct net_device *netdev,
         for (i = 0; i < MYRI10GE_NET_STATS_LEN; i++)
                 data[i] = ((unsigned long *)&mgp->stats)[i];
 
+        data[i++] = (unsigned int)mgp->tx.boundary;
+        data[i++] = (unsigned int)(mgp->mtrr >= 0);
+        data[i++] = (unsigned int)mgp->pdev->irq;
+        data[i++] = (unsigned int)mgp->msi_enabled;
         data[i++] = (unsigned int)mgp->read_dma;
         data[i++] = (unsigned int)mgp->write_dma;
         data[i++] = (unsigned int)mgp->read_write_dma;
@@ -2112,7 +2112,7 @@ abort_linearize:
                 }
                 idx = (idx + 1) & tx->mask;
         } while (idx != last_idx);
-        if (skb_shinfo(skb)->gso_size) {
+        if (skb_is_gso(skb)) {
                 printk(KERN_ERR
                        "myri10ge: %s: TSO but wanted to linearize?!?!?\n",
                        mgp->dev->name);
@@ -2197,8 +2197,6 @@ static int myri10ge_change_mtu(struct net_device *dev, int new_mtu)
  * any other device, except if forced with myri10ge_ecrc_enable > 1.
  */
 
-#define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_PCIE  0x005d
-
 static void myri10ge_enable_ecrc(struct myri10ge_priv *mgp)
 {
         struct pci_dev *bridge = mgp->pdev->bus->self;
@@ -2410,18 +2408,24 @@ static int myri10ge_resume(struct pci_dev *pdev)
                 return -EIO;
         }
         myri10ge_restore_state(mgp);
-        pci_enable_device(pdev);
+
+        status = pci_enable_device(pdev);
+        if (status < 0) {
+                dev_err(&pdev->dev, "failed to enable device\n");
+                return -EIO;
+        }
+
         pci_set_master(pdev);
 
         status = request_irq(pdev->irq, myri10ge_intr, IRQF_SHARED,
                              netdev->name, mgp);
         if (status != 0) {
                 dev_err(&pdev->dev, "failed to allocate IRQ\n");
-                goto abort_with_msi;
+                goto abort_with_enabled;
         }
 
         myri10ge_reset(mgp);
-        myri10ge_dummy_rdma(mgp, mgp->tx.boundary != 4096);
+        myri10ge_dummy_rdma(mgp, 1);
 
         /* Save configuration space to be restored if the
          * nic resets due to a parity error */
@@ -2436,7 +2440,8 @@ static int myri10ge_resume(struct pci_dev *pdev)
 
         return 0;
 
-abort_with_msi:
+abort_with_enabled:
+        pci_disable_device(pdev);
         return -EIO;
 
 }
@@ -2538,7 +2543,8 @@ static void myri10ge_watchdog_timer(unsigned long arg)
 
         mgp = (struct myri10ge_priv *)arg;
         if (mgp->tx.req != mgp->tx.done &&
-            mgp->tx.done == mgp->watchdog_tx_done)
+            mgp->tx.done == mgp->watchdog_tx_done &&
+            mgp->watchdog_tx_req != mgp->watchdog_tx_done)
                 /* nic seems like it might be stuck.. */
                 schedule_work(&mgp->watchdog_work);
         else
@@ -2547,6 +2553,7 @@ static void myri10ge_watchdog_timer(unsigned long arg)
                           jiffies + myri10ge_watchdog_timeout * HZ);
 
         mgp->watchdog_tx_done = mgp->tx.done;
+        mgp->watchdog_tx_req = mgp->tx.req;
 }
 
 static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -2737,11 +2744,10 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dev_err(&pdev->dev, "register_netdev failed: %d\n", status);
                 goto abort_with_irq;
         }
-
-        printk(KERN_INFO "myri10ge: %s: %s IRQ %d, tx bndry %d, fw %s, WC %s\n",
-               netdev->name, (mgp->msi_enabled ? "MSI" : "xPIC"),
-               pdev->irq, mgp->tx.boundary, mgp->fw_name,
-               (mgp->mtrr >= 0 ? "Enabled" : "Disabled"));
+        dev_info(dev, "%s IRQ %d, tx bndry %d, fw %s, WC %s\n",
+                 (mgp->msi_enabled ? "MSI" : "xPIC"),
+                 pdev->irq, mgp->tx.boundary, mgp->fw_name,
+                 (mgp->mtrr >= 0 ? "Enabled" : "Disabled"));
 
         return 0;
 
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 9df2628be1e7..db0475a1102f 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -20,120 +20,9 @@
 
         Support information and updates available at
         http://www.scyld.com/network/netsemi.html
+        [link no longer provides useful info -jgarzik]
 
 
-        Linux kernel modifications:
-
-        Version 1.0.1:
-                - Spinlock fixes
-                - Bug fixes and better intr performance (Tjeerd)
-        Version 1.0.2:
-                - Now reads correct MAC address from eeprom
-        Version 1.0.3:
-                - Eliminate redundant priv->tx_full flag
-                - Call netif_start_queue from dev->tx_timeout
-                - wmb() in start_tx() to flush data
-                - Update Tx locking
-                - Clean up PCI enable (davej)
-        Version 1.0.4:
-                - Merge Donald Becker's natsemi.c version 1.07
-        Version 1.0.5:
-                - { fill me in }
-        Version 1.0.6:
-                * ethtool support (jgarzik)
-                * Proper initialization of the card (which sometimes
-                fails to occur and leaves the card in a non-functional
-                state). (uzi)
-
-                * Some documented register settings to optimize some
-                of the 100Mbit autodetection circuitry in rev C cards. (uzi)
-
-                * Polling of the PHY intr for stuff like link state
-                change and auto- negotiation to finally work properly. (uzi)
-
-                * One-liner removal of a duplicate declaration of
-                netdev_error(). (uzi)
-
-        Version 1.0.7: (Manfred Spraul)
-                * pci dma
-                * SMP locking update
-                * full reset added into tx_timeout
-                * correct multicast hash generation (both big and little endian)
-                        [copied from a natsemi driver version
-                         from Myrio Corporation, Greg Smith]
-                * suspend/resume
-
-        version 1.0.8 (Tim Hockin <thockin@sun.com>)
-                * ETHTOOL_* support
-                * Wake on lan support (Erik Gilling)
-                * MXDMA fixes for serverworks
-                * EEPROM reload
-
-        version 1.0.9 (Manfred Spraul)
-                * Main change: fix lack of synchronize
-                netif_close/netif_suspend against a last interrupt
-                or packet.
-                * do not enable superflous interrupts (e.g. the
-                drivers relies on TxDone - TxIntr not needed)
-                * wait that the hardware has really stopped in close
-                and suspend.
-                * workaround for the (at least) gcc-2.95.1 compiler
-                problem. Also simplifies the code a bit.
-                * disable_irq() in tx_timeout - needed to protect
-                against rx interrupts.
-                * stop the nic before switching into silent rx mode
-                for wol (required according to docu).
-
-        version 1.0.10:
-                * use long for ee_addr (various)
-                * print pointers properly (DaveM)
-                * include asm/irq.h (?)
-
-        version 1.0.11:
-                * check and reset if PHY errors appear (Adrian Sun)
-                * WoL cleanup (Tim Hockin)
-                * Magic number cleanup (Tim Hockin)
-                * Don't reload EEPROM on every reset (Tim Hockin)
-                * Save and restore EEPROM state across reset (Tim Hockin)
-                * MDIO Cleanup (Tim Hockin)
-                * Reformat register offsets/bits (jgarzik)
-
-        version 1.0.12:
-                * ETHTOOL_* further support (Tim Hockin)
-
-        version 1.0.13:
-                * ETHTOOL_[G]EEPROM support (Tim Hockin)
-
-        version 1.0.13:
-                * crc cleanup (Matt Domsch <Matt_Domsch@dell.com>)
-
-        version 1.0.14:
-                * Cleanup some messages and autoneg in ethtool (Tim Hockin)
-
-        version 1.0.15:
-                * Get rid of cable_magic flag
-                * use new (National provided) solution for cable magic issue
-
-        version 1.0.16:
-                * call netdev_rx() for RxErrors (Manfred Spraul)
-                * formatting and cleanups
-                * change options and full_duplex arrays to be zero
-                  initialized
-                * enable only the WoL and PHY interrupts in wol mode
-
-        version 1.0.17:
-                * only do cable_magic on 83815 and early 83816 (Tim Hockin)
-                * create a function for rx refill (Manfred Spraul)
-                * combine drain_ring and init_ring (Manfred Spraul)
-                * oom handling (Manfred Spraul)
-                * hands_off instead of playing with netif_device_{de,a}ttach
-                  (Manfred Spraul)
-                * be sure to write the MAC back to the chip (Manfred Spraul)
-                * lengthen EEPROM timeout, and always warn about timeouts
-                  (Manfred Spraul)
-                * comments update (Manfred)
-                * do the right thing on a phy-reset (Manfred and Tim)
-
         TODO:
         * big endian support with CFG:BEM instead of cpu_to_le32
 */
@@ -165,8 +54,8 @@
 #include <asm/uaccess.h>
 
 #define DRV_NAME        "natsemi"
-#define DRV_VERSION     "1.07+LK1.0.17"
-#define DRV_RELDATE     "Sep 27, 2002"
+#define DRV_VERSION     "2.0"
+#define DRV_RELDATE     "June 27, 2006"
 
 #define RX_OFFSET       2
 
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index fa50eb889408..34bdba9eec79 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -231,12 +231,12 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
         irq = pdev->irq;
 
         if (!ioaddr || ((pci_resource_flags (pdev, 0) & IORESOURCE_IO) == 0)) {
-                printk (KERN_ERR PFX "no I/O resource at PCI BAR #0\n");
+                dev_err(&pdev->dev, "no I/O resource at PCI BAR #0\n");
                 return -ENODEV;
         }
 
         if (request_region (ioaddr, NE_IO_EXTENT, DRV_NAME) == NULL) {
-                printk (KERN_ERR PFX "I/O resource 0x%x @ 0x%lx busy\n",
+                dev_err(&pdev->dev, "I/O resource 0x%x @ 0x%lx busy\n",
                         NE_IO_EXTENT, ioaddr);
                 return -EBUSY;
         }
@@ -263,7 +263,7 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
         /* Allocate net_device, dev->priv; fill in 8390 specific dev fields. */
         dev = alloc_ei_netdev();
         if (!dev) {
-                printk (KERN_ERR PFX "cannot allocate ethernet device\n");
+                dev_err(&pdev->dev, "cannot allocate ethernet device\n");
                 goto err_out_free_res;
         }
         SET_MODULE_OWNER(dev);
@@ -281,7 +281,8 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
                 while ((inb(ioaddr + EN0_ISR) & ENISR_RESET) == 0)
                         /* Limit wait: '2' avoids jiffy roll-over. */
                         if (jiffies - reset_start_time > 2) {
-                                printk(KERN_ERR PFX "Card failure (no reset ack).\n");
+                                dev_err(&pdev->dev,
+                                        "Card failure (no reset ack).\n");
                                 goto err_out_free_netdev;
                         }
 
diff --git a/drivers/net/ni5010.c b/drivers/net/ni5010.c
index a68bf474f6ed..d4be207d321a 100644
--- a/drivers/net/ni5010.c
+++ b/drivers/net/ni5010.c
@@ -1,17 +1,12 @@
 /*      ni5010.c: A network driver for the MiCom-Interlan NI5010 ethercard.
  *
- *      Copyright 1996,1997 Jan-Pascal van Best and Andreas Mohr.
+ *      Copyright 1996,1997,2006 Jan-Pascal van Best and Andreas Mohr.
  *
  *      This software may be used and distributed according to the terms
  *      of the GNU General Public License, incorporated herein by reference.
  *
  *      The authors may be reached as:
- *              jvbest@wi.leidenuniv.nl         a.mohr@mailto.de
- *      or by snail mail as
- *              Jan-Pascal van Best             Andreas Mohr
- *              Klikspaanweg 58-4               Stauferstr. 6
- *              2324 LZ  Leiden                 D-71272 Renningen
- *              The Netherlands                 Germany
+ *              janpascal@vanbest.org           andi@lisas.de
  *
  *      Sources:
  *              Donald Becker's "skeleton.c"
@@ -27,8 +22,9 @@
  *      970503  v0.93: Fixed auto-irq failure on warm reboot (JB)
  *      970623  v1.00: First kernel version (AM)
  *      970814  v1.01: Added detection of onboard receive buffer size (AM)
+ *      060611  v1.02: slight cleanup: email addresses, driver modernization.
  *      Bugs:
- *              - None known...
+ *              - not SMP-safe (no locking of I/O accesses)
  *              - Note that you have to patch ifconfig for the new /proc/net/dev
  *              format. It gives incorrect stats otherwise.
  *
@@ -39,7 +35,7 @@
  *              Complete merge with Andreas' driver
  *              Implement ring buffers (Is this useful? You can't squeeze
  *                      too many packet in a 2k buffer!)
- *              Implement DMA (Again, is this useful? Some docs says DMA is
+ *              Implement DMA (Again, is this useful? Some docs say DMA is
  *                      slower than programmed I/O)
  *
  *      Compile with:
@@ -47,7 +43,7 @@
  *                      -DMODULE -c ni5010.c 
  *
  *      Insert with e.g.:
- *              insmod ni5010.o io=0x300 irq=5  
+ *              insmod ni5010.ko io=0x300 irq=5
  */
 
 #include <linux/module.h>
@@ -69,15 +65,15 @@
 
 #include "ni5010.h"
 
-static const char *boardname = "NI5010";
-static char *version =
-        "ni5010.c: v1.00 06/23/97 Jan-Pascal van Best and Andreas Mohr\n";
+static const char boardname[] = "NI5010";
+static char version[] __initdata =
+        "ni5010.c: v1.02 20060611 Jan-Pascal van Best and Andreas Mohr\n";
         
 /* bufsize_rcv == 0 means autoprobing */
 static unsigned int bufsize_rcv;
 
-#define jumpered_interrupts     /* IRQ line jumpered on board */
-#undef jumpered_dma             /* No DMA used */
+#define JUMPERED_INTERRUPTS     /* IRQ line jumpered on board */
+#undef JUMPERED_DMA             /* No DMA used */
 #undef FULL_IODETECT            /* Only detect in portlist */
 
 #ifndef FULL_IODETECT
@@ -281,7 +277,7 @@ static int __init ni5010_probe1(struct net_device *dev, int ioaddr)
 
         PRINTK2((KERN_DEBUG "%s: I/O #4 passed!\n", dev->name));
 
-#ifdef jumpered_interrupts
+#ifdef JUMPERED_INTERRUPTS
         if (dev->irq == 0xff)
                 ;
         else if (dev->irq < 2) {
@@ -305,7 +301,7 @@ static int __init ni5010_probe1(struct net_device *dev, int ioaddr)
         } else if (dev->irq == 2) {
                 dev->irq = 9;
         }
-#endif  /* jumpered_irq */
+#endif  /* JUMPERED_INTERRUPTS */
         PRINTK2((KERN_DEBUG "%s: I/O #9 passed!\n", dev->name));
 
         /* DMA is not supported (yet?), so no use detecting it */
@@ -334,7 +330,7 @@ static int __init ni5010_probe1(struct net_device *dev, int ioaddr)
                 outw(0, IE_GP);         /* Point GP at start of packet */
                 outb(0, IE_RBUF);       /* set buffer byte 0 to 0 again */
         }
-        printk("// bufsize rcv/xmt=%d/%d\n", bufsize_rcv, NI5010_BUFSIZE);
+        printk("-> bufsize rcv/xmt=%d/%d\n", bufsize_rcv, NI5010_BUFSIZE);
         memset(dev->priv, 0, sizeof(struct ni5010_local));
         
         dev->open               = ni5010_open;
@@ -354,11 +350,9 @@ static int __init ni5010_probe1(struct net_device *dev, int ioaddr)
         outb(0xff, EDLC_XCLR);  /* Kill all pending xmt interrupts */
 
         printk(KERN_INFO "%s: NI5010 found at 0x%x, using IRQ %d", dev->name, ioaddr, dev->irq);
-        if (dev->dma) printk(" & DMA %d", dev->dma);
+        if (dev->dma)
+                printk(" & DMA %d", dev->dma);
         printk(".\n");
-
-        printk(KERN_INFO "Join the NI5010 driver development team!\n");
-        printk(KERN_INFO "Mail to a.mohr@mailto.de or jvbest@wi.leidenuniv.nl\n");
         return 0;
 out:
         release_region(dev->base_addr, NI5010_IO_EXTENT);
@@ -371,7 +365,7 @@ out:
  *
  * This routine should set everything up anew at each open, even
  * registers that "should" only need to be set once at boot, so that
- * there is non-reboot way to recover if something goes wrong.
+ * there is a non-reboot way to recover if something goes wrong.
  */
    
 static int ni5010_open(struct net_device *dev)
@@ -390,13 +384,13 @@ static int ni5010_open(struct net_device *dev)
          * Always allocate the DMA channel after the IRQ,
          * and clean up on failure.
          */
-#ifdef jumpered_dma
+#ifdef JUMPERED_DMA
         if (request_dma(dev->dma, cardname)) {
                 printk(KERN_WARNING "%s: Cannot get dma %#2x\n", dev->name, dev->dma);
                 free_irq(dev->irq, NULL);
                 return -EAGAIN;
         }
-#endif  /* jumpered_dma */
+#endif  /* JUMPERED_DMA */
 
         PRINTK3((KERN_DEBUG "%s: passed open() #2\n", dev->name));
         /* Reset the hardware here.  Don't forget to set the station address. */
@@ -633,7 +627,7 @@ static int ni5010_close(struct net_device *dev)
         int ioaddr = dev->base_addr;
 
         PRINTK2((KERN_DEBUG "%s: entering ni5010_close\n", dev->name));
-#ifdef jumpered_interrupts      
+#ifdef JUMPERED_INTERRUPTS
         free_irq(dev->irq, NULL);
 #endif
         /* Put card in held-RESET state */
@@ -771,7 +765,7 @@ module_param(irq, int, 0);
 MODULE_PARM_DESC(io, "ni5010 I/O base address");
 MODULE_PARM_DESC(irq, "ni5010 IRQ number");
 
-int init_module(void)
+static int __init ni5010_init_module(void)
 {
         PRINTK2((KERN_DEBUG "%s: entering init_module\n", boardname));
         /*
@@ -792,13 +786,15 @@ int init_module(void)
         return 0;
 }
 
-void cleanup_module(void)
+static void __exit ni5010_cleanup_module(void)
 {
         PRINTK2((KERN_DEBUG "%s: entering cleanup_module\n", boardname));
         unregister_netdev(dev_ni5010);
         release_region(dev_ni5010->base_addr, NI5010_IO_EXTENT);
         free_netdev(dev_ni5010);
 }
+module_init(ni5010_init_module);
+module_exit(ni5010_cleanup_module);
 #endif /* MODULE */
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/net/ni52.c b/drivers/net/ni52.c
index fa854c8fde75..4d52ecf8af56 100644
--- a/drivers/net/ni52.c
+++ b/drivers/net/ni52.c
@@ -1323,7 +1323,7 @@ MODULE_PARM_DESC(irq, "NI5210 IRQ number,required");
 MODULE_PARM_DESC(memstart, "NI5210 memory base address,required");
 MODULE_PARM_DESC(memend, "NI5210 memory end address,required");
 
-int init_module(void)
+int __init init_module(void)
 {
         if(io <= 0x0 || !memend || !memstart || irq < 2) {
                 printk("ni52: Autoprobing not allowed for modules.\nni52: Set symbols 'io' 'irq' 'memstart' and 'memend'\n");
diff --git a/drivers/net/ni65.c b/drivers/net/ni65.c
index bb42ff218484..810cc572f5f7 100644
--- a/drivers/net/ni65.c
+++ b/drivers/net/ni65.c
@@ -1253,7 +1253,7 @@ MODULE_PARM_DESC(irq, "ni6510 IRQ number (ignored for some cards)");
 MODULE_PARM_DESC(io, "ni6510 I/O base address");
 MODULE_PARM_DESC(dma, "ni6510 ISA DMA channel (ignored for some cards)");
 
-int init_module(void)
+int __init init_module(void)
 {
         dev_ni65 = ni65_probe(-1);
         return IS_ERR(dev_ni65) ? PTR_ERR(dev_ni65) : 0;
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 70429108c40d..0e76859c90a2 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -803,7 +803,7 @@ static int ns83820_setup_rx(struct net_device *ndev)
 
                 writel(dev->IMR_cache, dev->base + IMR);
                 writel(1, dev->base + IER);
-                spin_unlock_irq(&dev->misc_lock);
+                spin_unlock(&dev->misc_lock);
 
                 kick_rx(ndev);
 
@@ -1012,8 +1012,6 @@ static void do_tx_done(struct net_device *ndev)
         struct ns83820 *dev = PRIV(ndev);
         u32 cmdsts, tx_done_idx, *desc;
 
-        spin_lock_irq(&dev->tx_lock);
-
         dprintk("do_tx_done(%p)\n", ndev);
         tx_done_idx = dev->tx_done_idx;
         desc = dev->tx_descs + (tx_done_idx * DESC_SIZE);
@@ -1069,7 +1067,6 @@ static void do_tx_done(struct net_device *ndev)
                 netif_start_queue(ndev);
                 netif_wake_queue(ndev);
         }
-        spin_unlock_irq(&dev->tx_lock);
 }
 
 static void ns83820_cleanup_tx(struct ns83820 *dev)
@@ -1281,11 +1278,13 @@ static struct ethtool_ops ops = {
         .get_link = ns83820_get_link
 };
 
+/* this function is called in irq context from the ISR */
 static void ns83820_mib_isr(struct ns83820 *dev)
 {
-        spin_lock(&dev->misc_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&dev->misc_lock, flags);
         ns83820_update_stats(dev);
-        spin_unlock(&dev->misc_lock);
+        spin_unlock_irqrestore(&dev->misc_lock, flags);
 }
 
 static void ns83820_do_isr(struct net_device *ndev, u32 isr);
@@ -1307,6 +1306,8 @@ static irqreturn_t ns83820_irq(int foo, void *data, struct pt_regs *regs)
 static void ns83820_do_isr(struct net_device *ndev, u32 isr)
 {
         struct ns83820 *dev = PRIV(ndev);
+        unsigned long flags;
+
 #ifdef DEBUG
         if (isr & ~(ISR_PHY | ISR_RXDESC | ISR_RXEARLY | ISR_RXOK | ISR_RXERR | ISR_TXIDLE | ISR_TXOK | ISR_TXDESC))
                 Dprintk("odd isr? 0x%08x\n", isr);
@@ -1321,10 +1322,10 @@ static void ns83820_do_isr(struct net_device *ndev, u32 isr)
         if ((ISR_RXDESC | ISR_RXOK) & isr) {
                 prefetch(dev->rx_info.next_rx_desc);
 
-                spin_lock_irq(&dev->misc_lock);
+                spin_lock_irqsave(&dev->misc_lock, flags);
                 dev->IMR_cache &= ~(ISR_RXDESC | ISR_RXOK);
                 writel(dev->IMR_cache, dev->base + IMR);
-                spin_unlock_irq(&dev->misc_lock);
+                spin_unlock_irqrestore(&dev->misc_lock, flags);
 
                 tasklet_schedule(&dev->rx_tasklet);
                 //rx_irq(ndev);
@@ -1370,16 +1371,18 @@ static void ns83820_do_isr(struct net_device *ndev, u32 isr)
          * work has accumulated
          */
         if ((ISR_TXDESC | ISR_TXIDLE | ISR_TXOK | ISR_TXERR) & isr) {
+                spin_lock_irqsave(&dev->tx_lock, flags);
                 do_tx_done(ndev);
+                spin_unlock_irqrestore(&dev->tx_lock, flags);
 
                 /* Disable TxOk if there are no outstanding tx packets.
                  */
                 if ((dev->tx_done_idx == dev->tx_free_idx) &&
                     (dev->IMR_cache & ISR_TXOK)) {
-                        spin_lock_irq(&dev->misc_lock);
+                        spin_lock_irqsave(&dev->misc_lock, flags);
                         dev->IMR_cache &= ~ISR_TXOK;
                         writel(dev->IMR_cache, dev->base + IMR);
-                        spin_unlock_irq(&dev->misc_lock);
+                        spin_unlock_irqrestore(&dev->misc_lock, flags);
                 }
         }
 
@@ -1390,10 +1393,10 @@ static void ns83820_do_isr(struct net_device *ndev, u32 isr)
          * nature are expected, we must enable TxOk.
          */
         if ((ISR_TXIDLE & isr) && (dev->tx_done_idx != dev->tx_free_idx)) {
-                spin_lock_irq(&dev->misc_lock);
+                spin_lock_irqsave(&dev->misc_lock, flags);
                 dev->IMR_cache |= ISR_TXOK;
                 writel(dev->IMR_cache, dev->base + IMR);
-                spin_unlock_irq(&dev->misc_lock);
+                spin_unlock_irqrestore(&dev->misc_lock, flags);
         }
 
         /* MIB interrupt: one of the statistics counters is about to overflow */
@@ -1455,7 +1458,7 @@ static void ns83820_tx_timeout(struct net_device *ndev)
         u32 tx_done_idx, *desc;
         unsigned long flags;
 
-        local_irq_save(flags);
+        spin_lock_irqsave(&dev->tx_lock, flags);
 
         tx_done_idx = dev->tx_done_idx;
         desc = dev->tx_descs + (tx_done_idx * DESC_SIZE);
@@ -1482,7 +1485,7 @@ static void ns83820_tx_timeout(struct net_device *ndev)
                 ndev->name,
                 tx_done_idx, dev->tx_free_idx, le32_to_cpu(desc[DESC_CMDSTS]));
 
-        local_irq_restore(flags);
+        spin_unlock_irqrestore(&dev->tx_lock, flags);
 }
 
 static void ns83820_tx_watch(unsigned long data)
@@ -1832,7 +1835,7 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev, const struct pci_
         } else if (!pci_set_dma_mask(pci_dev, DMA_32BIT_MASK)) {
                 using_dac = 0;
         } else {
-                printk(KERN_WARNING "ns83820.c: pci_set_dma_mask failed!\n");
+                dev_warn(&pci_dev->dev, "pci_set_dma_mask failed!\n");
                 return -ENODEV;
         }
 
@@ -1855,7 +1858,7 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev, const struct pci_
 
         err = pci_enable_device(pci_dev);
         if (err) {
-                printk(KERN_INFO "ns83820: pci_enable_dev failed: %d\n", err);
+                dev_info(&pci_dev->dev, "pci_enable_dev failed: %d\n", err);
                 goto out_free;
         }
 
@@ -1884,8 +1887,8 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev, const struct pci_
         err = request_irq(pci_dev->irq, ns83820_irq, IRQF_SHARED,
                           DRV_NAME, ndev);
         if (err) {
-                printk(KERN_INFO "ns83820: unable to register irq %d\n",
-                        pci_dev->irq);
+                dev_info(&pci_dev->dev, "unable to register irq %d, err %d\n",
+                        pci_dev->irq, err);
                 goto out_disable;
         }
 
@@ -1899,7 +1902,7 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev, const struct pci_
         rtnl_lock();
         err = dev_alloc_name(ndev, ndev->name);
         if (err < 0) {
-                printk(KERN_INFO "ns83820: unable to get netdev name: %d\n", err);
+                dev_info(&pci_dev->dev, "unable to get netdev name: %d\n", err);
                 goto out_free_irq;
         }
 
diff --git a/drivers/net/pci-skeleton.c b/drivers/net/pci-skeleton.c
index 3388ee1313ea..e0e293964042 100644
--- a/drivers/net/pci-skeleton.c
+++ b/drivers/net/pci-skeleton.c
@@ -601,7 +601,7 @@ static int __devinit netdrv_init_board (struct pci_dev *pdev,
         /* dev zeroed in alloc_etherdev */
         dev = alloc_etherdev (sizeof (*tp));
         if (dev == NULL) {
-                printk (KERN_ERR PFX "unable to alloc new ethernet\n");
+                dev_err(&pdev->dev, "unable to alloc new ethernet\n");
                 DPRINTK ("EXIT, returning -ENOMEM\n");
                 return -ENOMEM;
         }
@@ -631,14 +631,14 @@ static int __devinit netdrv_init_board (struct pci_dev *pdev,
 
         /* make sure PCI base addr 0 is PIO */
         if (!(pio_flags & IORESOURCE_IO)) {
-                printk (KERN_ERR PFX "region #0 not a PIO resource, aborting\n");
+                dev_err(&pdev->dev, "region #0 not a PIO resource, aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
 
         /* make sure PCI base addr 1 is MMIO */
         if (!(mmio_flags & IORESOURCE_MEM)) {
-                printk (KERN_ERR PFX "region #1 not an MMIO resource, aborting\n");
+                dev_err(&pdev->dev, "region #1 not an MMIO resource, aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
@@ -646,12 +646,12 @@ static int __devinit netdrv_init_board (struct pci_dev *pdev,
         /* check for weird/broken PCI region reporting */
         if ((pio_len < NETDRV_MIN_IO_SIZE) ||
             (mmio_len < NETDRV_MIN_IO_SIZE)) {
-                printk (KERN_ERR PFX "Invalid PCI region size(s), aborting\n");
+                dev_err(&pdev->dev, "Invalid PCI region size(s), aborting\n");
                 rc = -ENODEV;
                 goto err_out;
         }
 
-        rc = pci_request_regions (pdev, "pci-skeleton");
+        rc = pci_request_regions (pdev, MODNAME);
         if (rc)
                 goto err_out;
 
@@ -663,7 +663,7 @@ static int __devinit netdrv_init_board (struct pci_dev *pdev,
         /* ioremap MMIO region */
         ioaddr = ioremap (mmio_start, mmio_len);
         if (ioaddr == NULL) {
-                printk (KERN_ERR PFX "cannot remap MMIO, aborting\n");
+                dev_err(&pdev->dev, "cannot remap MMIO, aborting\n");
                 rc = -EIO;
                 goto err_out_free_res;
         }
@@ -699,9 +699,10 @@ static int __devinit netdrv_init_board (struct pci_dev *pdev,
                 }
 
         /* if unknown chip, assume array element #0, original RTL-8139 in this case */
-        printk (KERN_DEBUG PFX "PCI device %s: unknown chip version, assuming RTL-8139\n",
-                pci_name(pdev));
-        printk (KERN_DEBUG PFX "PCI device %s: TxConfig = 0x%lx\n", pci_name(pdev), NETDRV_R32 (TxConfig));
+        dev_printk (KERN_DEBUG, &pdev->dev,
+                "unknown chip version, assuming RTL-8139\n");
+        dev_printk (KERN_DEBUG, &pdev->dev, "TxConfig = 0x%lx\n",
+                NETDRV_R32 (TxConfig));
         tp->chipset = 0;
 
 match:
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index 9bae77ce1314..4122bb46f5ff 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -345,6 +345,7 @@ typedef struct local_info_t {
     void __iomem *dingo_ccr; /* only used for CEM56 cards */
     unsigned last_ptr_value; /* last packets transmitted value */
     const char *manf_str;
+    struct work_struct tx_timeout_task;
 } local_info_t;
 
 /****************
@@ -352,6 +353,7 @@ typedef struct local_info_t {
  */
 static int do_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static void do_tx_timeout(struct net_device *dev);
+static void xirc2ps_tx_timeout_task(void *data);
 static struct net_device_stats *do_get_stats(struct net_device *dev);
 static void set_addresses(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
@@ -589,6 +591,7 @@ xirc2ps_probe(struct pcmcia_device *link)
 #ifdef HAVE_TX_TIMEOUT
     dev->tx_timeout = do_tx_timeout;
     dev->watchdog_timeo = TX_TIMEOUT;
+    INIT_WORK(&local->tx_timeout_task, xirc2ps_tx_timeout_task, dev);
 #endif
 
     return xirc2ps_config(link);
@@ -1341,17 +1344,24 @@ xirc2ps_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 /*====================================================================*/
 
 static void
-do_tx_timeout(struct net_device *dev)
+xirc2ps_tx_timeout_task(void *data)
 {
-    local_info_t *lp = netdev_priv(dev);
-    printk(KERN_NOTICE "%s: transmit timed out\n", dev->name);
-    lp->stats.tx_errors++;
+    struct net_device *dev = data;
     /* reset the card */
     do_reset(dev,1);
     dev->trans_start = jiffies;
     netif_wake_queue(dev);
 }
 
+static void
+do_tx_timeout(struct net_device *dev)
+{
+    local_info_t *lp = netdev_priv(dev);
+    lp->stats.tx_errors++;
+    printk(KERN_NOTICE "%s: transmit timed out\n", dev->name);
+    schedule_work(&lp->tx_timeout_task);
+}
+
 static int
 do_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index d768f3d1ac28..d50bcb89dd28 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -58,18 +58,15 @@ static const char *const version =
  * PCI device identifiers for "new style" Linux PCI Device Drivers
  */
 static struct pci_device_id pcnet32_pci_tbl[] = {
-        { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_LANCE_HOME,
-          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-        { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_LANCE,
-          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_LANCE_HOME), },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_LANCE), },
 
         /*
          * Adapters that were sold with IBM's RS/6000 or pSeries hardware have
          * the incorrect vendor id.
          */
-        { PCI_VENDOR_ID_TRIDENT, PCI_DEVICE_ID_AMD_LANCE,
-          PCI_ANY_ID, PCI_ANY_ID,
-          PCI_CLASS_NETWORK_ETHERNET << 8, 0xffff00, 0},
+        { PCI_DEVICE(PCI_VENDOR_ID_TRIDENT, PCI_DEVICE_ID_AMD_LANCE),
+          .class = (PCI_CLASS_NETWORK_ETHERNET << 8), .class_mask = 0xffff00, },
 
         { }     /* terminate list */
 };
@@ -188,6 +185,25 @@ static int homepna[MAX_UNITS];
 
 #define PCNET32_TOTAL_SIZE      0x20
 
+#define CSR0            0
+#define CSR0_INIT       0x1
+#define CSR0_START      0x2
+#define CSR0_STOP       0x4
+#define CSR0_TXPOLL     0x8
+#define CSR0_INTEN      0x40
+#define CSR0_IDON       0x0100
+#define CSR0_NORMAL     (CSR0_START | CSR0_INTEN)
+#define PCNET32_INIT_LOW        1
+#define PCNET32_INIT_HIGH       2
+#define CSR3            3
+#define CSR4            4
+#define CSR5            5
+#define CSR5_SUSPEND    0x0001
+#define CSR15           15
+#define PCNET32_MC_FILTER       8
+
+#define PCNET32_79C970A 0x2621
+
 /* The PCNET32 Rx and Tx ring descriptors. */
 struct pcnet32_rx_head {
         u32     base;
@@ -275,9 +291,9 @@ struct pcnet32_private {
 
         /* each bit indicates an available PHY */
         u32                     phymask;
+        unsigned short          chip_version;   /* which variant this is */
 };
 
-static void pcnet32_probe_vlbus(void);
 static int pcnet32_probe_pci(struct pci_dev *, const struct pci_device_id *);
 static int pcnet32_probe1(unsigned long, int, struct pci_dev *);
 static int pcnet32_open(struct net_device *);
@@ -419,6 +435,238 @@ static struct pcnet32_access pcnet32_dwio = {
         .reset = pcnet32_dwio_reset
 };
 
+static void pcnet32_netif_stop(struct net_device *dev)
+{
+        dev->trans_start = jiffies;
+        netif_poll_disable(dev);
+        netif_tx_disable(dev);
+}
+
+static void pcnet32_netif_start(struct net_device *dev)
+{
+        netif_wake_queue(dev);
+        netif_poll_enable(dev);
+}
+
+/*
+ * Allocate space for the new sized tx ring.
+ * Free old resources
+ * Save new resources.
+ * Any failure keeps old resources.
+ * Must be called with lp->lock held.
+ */
+static void pcnet32_realloc_tx_ring(struct net_device *dev,
+                                    struct pcnet32_private *lp,
+                                    unsigned int size)
+{
+        dma_addr_t new_ring_dma_addr;
+        dma_addr_t *new_dma_addr_list;
+        struct pcnet32_tx_head *new_tx_ring;
+        struct sk_buff **new_skb_list;
+
+        pcnet32_purge_tx_ring(dev);
+
+        new_tx_ring = pci_alloc_consistent(lp->pci_dev,
+                                           sizeof(struct pcnet32_tx_head) *
+                                           (1 << size),
+                                           &new_ring_dma_addr);
+        if (new_tx_ring == NULL) {
+                if (netif_msg_drv(lp))
+                        printk("\n" KERN_ERR
+                               "%s: Consistent memory allocation failed.\n",
+                               dev->name);
+                return;
+        }
+        memset(new_tx_ring, 0, sizeof(struct pcnet32_tx_head) * (1 << size));
+
+        new_dma_addr_list = kcalloc((1 << size), sizeof(dma_addr_t),
+                                GFP_ATOMIC);
+        if (!new_dma_addr_list) {
+                if (netif_msg_drv(lp))
+                        printk("\n" KERN_ERR
+                               "%s: Memory allocation failed.\n", dev->name);
+                goto free_new_tx_ring;
+        }
+
+        new_skb_list = kcalloc((1 << size), sizeof(struct sk_buff *),
+                                GFP_ATOMIC);
+        if (!new_skb_list) {
+                if (netif_msg_drv(lp))
+                        printk("\n" KERN_ERR
+                               "%s: Memory allocation failed.\n", dev->name);
+                goto free_new_lists;
+        }
+
+        kfree(lp->tx_skbuff);
+        kfree(lp->tx_dma_addr);
+        pci_free_consistent(lp->pci_dev,
+                            sizeof(struct pcnet32_tx_head) *
+                            lp->tx_ring_size, lp->tx_ring,
+                            lp->tx_ring_dma_addr);
+
+        lp->tx_ring_size = (1 << size);
+        lp->tx_mod_mask = lp->tx_ring_size - 1;
+        lp->tx_len_bits = (size << 12);
+        lp->tx_ring = new_tx_ring;
+        lp->tx_ring_dma_addr = new_ring_dma_addr;
+        lp->tx_dma_addr = new_dma_addr_list;
+        lp->tx_skbuff = new_skb_list;
+        return;
+
+    free_new_lists:
+        kfree(new_dma_addr_list);
+    free_new_tx_ring:
+        pci_free_consistent(lp->pci_dev,
+                            sizeof(struct pcnet32_tx_head) *
+                            (1 << size),
+                            new_tx_ring,
+                            new_ring_dma_addr);
+        return;
+}
+
+/*
+ * Allocate space for the new sized rx ring.
+ * Re-use old receive buffers.
+ *   alloc extra buffers
+ *   free unneeded buffers
+ *   free unneeded buffers
+ * Save new resources.
+ * Any failure keeps old resources.
+ * Must be called with lp->lock held.
+ */
+static void pcnet32_realloc_rx_ring(struct net_device *dev,
+                                    struct pcnet32_private *lp,
+                                    unsigned int size)
+{
+        dma_addr_t new_ring_dma_addr;
+        dma_addr_t *new_dma_addr_list;
+        struct pcnet32_rx_head *new_rx_ring;
+        struct sk_buff **new_skb_list;
+        int new, overlap;
+
+        new_rx_ring = pci_alloc_consistent(lp->pci_dev,
+                                           sizeof(struct pcnet32_rx_head) *
+                                           (1 << size),
+                                           &new_ring_dma_addr);
+        if (new_rx_ring == NULL) {
+                if (netif_msg_drv(lp))
+                        printk("\n" KERN_ERR
+                               "%s: Consistent memory allocation failed.\n",
+                               dev->name);
+                return;
+        }
+        memset(new_rx_ring, 0, sizeof(struct pcnet32_rx_head) * (1 << size));
+
+        new_dma_addr_list = kcalloc((1 << size), sizeof(dma_addr_t),
+                                GFP_ATOMIC);
+        if (!new_dma_addr_list) {
+                if (netif_msg_drv(lp))
+                        printk("\n" KERN_ERR
+                               "%s: Memory allocation failed.\n", dev->name);
+                goto free_new_rx_ring;
+        }
+
+        new_skb_list = kcalloc((1 << size), sizeof(struct sk_buff *),
+                                GFP_ATOMIC);
+        if (!new_skb_list) {
+                if (netif_msg_drv(lp))
+                        printk("\n" KERN_ERR
+                               "%s: Memory allocation failed.\n", dev->name);
+                goto free_new_lists;
+        }
+
+        /* first copy the current receive buffers */
+        overlap = min(size, lp->rx_ring_size);
+        for (new = 0; new < overlap; new++) {
+                new_rx_ring[new] = lp->rx_ring[new];
+                new_dma_addr_list[new] = lp->rx_dma_addr[new];
+                new_skb_list[new] = lp->rx_skbuff[new];
+        }
+        /* now allocate any new buffers needed */
+        for (; new < size; new++ ) {
+                struct sk_buff *rx_skbuff;
+                new_skb_list[new] = dev_alloc_skb(PKT_BUF_SZ);
+                if (!(rx_skbuff = new_skb_list[new])) {
+                        /* keep the original lists and buffers */
+                        if (netif_msg_drv(lp))
+                                printk(KERN_ERR
+                                       "%s: pcnet32_realloc_rx_ring dev_alloc_skb failed.\n",
+                                       dev->name);
+                        goto free_all_new;
+                }
+                skb_reserve(rx_skbuff, 2);
+
+                new_dma_addr_list[new] =
+                            pci_map_single(lp->pci_dev, rx_skbuff->data,
+                                           PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
+                new_rx_ring[new].base = (u32) le32_to_cpu(new_dma_addr_list[new]);
+                new_rx_ring[new].buf_length = le16_to_cpu(2 - PKT_BUF_SZ);
+                new_rx_ring[new].status = le16_to_cpu(0x8000);
+        }
+        /* and free any unneeded buffers */
+        for (; new < lp->rx_ring_size; new++) {
+                if (lp->rx_skbuff[new]) {
+                        pci_unmap_single(lp->pci_dev, lp->rx_dma_addr[new],
+                                         PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb(lp->rx_skbuff[new]);
+                }
+        }
+
+        kfree(lp->rx_skbuff);
+        kfree(lp->rx_dma_addr);
+        pci_free_consistent(lp->pci_dev,
+                            sizeof(struct pcnet32_rx_head) *
+                            lp->rx_ring_size, lp->rx_ring,
+                            lp->rx_ring_dma_addr);
+
+        lp->rx_ring_size = (1 << size);
+        lp->rx_mod_mask = lp->rx_ring_size - 1;
+        lp->rx_len_bits = (size << 4);
+        lp->rx_ring = new_rx_ring;
+        lp->rx_ring_dma_addr = new_ring_dma_addr;
+        lp->rx_dma_addr = new_dma_addr_list;
+        lp->rx_skbuff = new_skb_list;
+        return;
+
+    free_all_new:
+        for (; --new >= lp->rx_ring_size; ) {
+                if (new_skb_list[new]) {
+                        pci_unmap_single(lp->pci_dev, new_dma_addr_list[new],
+                                         PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb(new_skb_list[new]);
+                }
+        }
+        kfree(new_skb_list);
+    free_new_lists:
+        kfree(new_dma_addr_list);
+    free_new_rx_ring:
+        pci_free_consistent(lp->pci_dev,
+                            sizeof(struct pcnet32_rx_head) *
+                            (1 << size),
+                            new_rx_ring,
+                            new_ring_dma_addr);
+        return;
+}
+
+static void pcnet32_purge_rx_ring(struct net_device *dev)
+{
+        struct pcnet32_private *lp = dev->priv;
+        int i;
+
+        /* free all allocated skbuffs */
+        for (i = 0; i < lp->rx_ring_size; i++) {
+                lp->rx_ring[i].status = 0;      /* CPU owns buffer */
+                wmb();          /* Make sure adapter sees owner change */
+                if (lp->rx_skbuff[i]) {
+                        pci_unmap_single(lp->pci_dev, lp->rx_dma_addr[i],
+                                         PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb_any(lp->rx_skbuff[i]);
+                }
+                lp->rx_skbuff[i] = NULL;
+                lp->rx_dma_addr[i] = 0;
+        }
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void pcnet32_poll_controller(struct net_device *dev)
 {
@@ -479,9 +727,11 @@ static u32 pcnet32_get_link(struct net_device *dev)
         spin_lock_irqsave(&lp->lock, flags);
         if (lp->mii) {
                 r = mii_link_ok(&lp->mii_if);
-        } else {
+        } else if (lp->chip_version >= PCNET32_79C970A) {
                 ulong ioaddr = dev->base_addr;  /* card base I/O address */
                 r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
+        } else {        /* can not detect link on really old chips */
+                r = 1;
         }
         spin_unlock_irqrestore(&lp->lock, flags);
 
@@ -519,10 +769,10 @@ static void pcnet32_get_ringparam(struct net_device *dev,
 {
         struct pcnet32_private *lp = dev->priv;
 
-        ering->tx_max_pending = TX_MAX_RING_SIZE - 1;
-        ering->tx_pending = lp->tx_ring_size - 1;
-        ering->rx_max_pending = RX_MAX_RING_SIZE - 1;
-        ering->rx_pending = lp->rx_ring_size - 1;
+        ering->tx_max_pending = TX_MAX_RING_SIZE;
+        ering->tx_pending = lp->tx_ring_size;
+        ering->rx_max_pending = RX_MAX_RING_SIZE;
+        ering->rx_pending = lp->rx_ring_size;
 }
 
 static int pcnet32_set_ringparam(struct net_device *dev,
@@ -530,56 +780,53 @@ static int pcnet32_set_ringparam(struct net_device *dev,
 {
         struct pcnet32_private *lp = dev->priv;
         unsigned long flags;
+        unsigned int size;
+        ulong ioaddr = dev->base_addr;
         int i;
 
         if (ering->rx_mini_pending || ering->rx_jumbo_pending)
                 return -EINVAL;
 
         if (netif_running(dev))
-                pcnet32_close(dev);
+                pcnet32_netif_stop(dev);
 
         spin_lock_irqsave(&lp->lock, flags);
-        pcnet32_free_ring(dev);
-        lp->tx_ring_size =
-            min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
-        lp->rx_ring_size =
-            min(ering->rx_pending, (unsigned int)RX_MAX_RING_SIZE);
+        lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);       /* stop the chip */
+
+        size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
 
         /* set the minimum ring size to 4, to allow the loopback test to work
          * unchanged.
          */
         for (i = 2; i <= PCNET32_LOG_MAX_TX_BUFFERS; i++) {
-                if (lp->tx_ring_size <= (1 << i))
+                if (size <= (1 << i))
                         break;
         }
-        lp->tx_ring_size = (1 << i);
-        lp->tx_mod_mask = lp->tx_ring_size - 1;
-        lp->tx_len_bits = (i << 12);
-
+        if ((1 << i) != lp->tx_ring_size)
+                pcnet32_realloc_tx_ring(dev, lp, i);
+        
+        size = min(ering->rx_pending, (unsigned int)RX_MAX_RING_SIZE);
         for (i = 2; i <= PCNET32_LOG_MAX_RX_BUFFERS; i++) {
-                if (lp->rx_ring_size <= (1 << i))
+                if (size <= (1 << i))
                         break;
         }
-        lp->rx_ring_size = (1 << i);
-        lp->rx_mod_mask = lp->rx_ring_size - 1;
-        lp->rx_len_bits = (i << 4);
+        if ((1 << i) != lp->rx_ring_size)
+                pcnet32_realloc_rx_ring(dev, lp, i);
+        
+        dev->weight = lp->rx_ring_size / 2;
 
-        if (pcnet32_alloc_ring(dev, dev->name)) {
-                pcnet32_free_ring(dev);
-                spin_unlock_irqrestore(&lp->lock, flags);
-                return -ENOMEM;
+        if (netif_running(dev)) {
+                pcnet32_netif_start(dev);
+                pcnet32_restart(dev, CSR0_NORMAL);
         }
 
         spin_unlock_irqrestore(&lp->lock, flags);
 
-        if (pcnet32_debug & NETIF_MSG_DRV)
-                printk(KERN_INFO PFX
+        if (netif_msg_drv(lp))
+                printk(KERN_INFO
                        "%s: Ring Param Settings: RX: %d, TX: %d\n", dev->name,
                        lp->rx_ring_size, lp->tx_ring_size);
 
-        if (netif_running(dev))
-                pcnet32_open(dev);
-
         return 0;
 }
 
@@ -633,29 +880,27 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
         unsigned long flags;
         unsigned long ticks;
 
-        *data1 = 1;             /* status of test, default to fail */
         rc = 1;                 /* default to fail */
 
         if (netif_running(dev))
                 pcnet32_close(dev);
 
         spin_lock_irqsave(&lp->lock, flags);
+        lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);       /* stop the chip */
+
+        numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
 
         /* Reset the PCNET32 */
         lp->a.reset(ioaddr);
+        lp->a.write_csr(ioaddr, CSR4, 0x0915);
 
         /* switch pcnet32 to 32bit mode */
         lp->a.write_bcr(ioaddr, 20, 2);
 
-        lp->init_block.mode =
-            le16_to_cpu((lp->options & PCNET32_PORT_PORTSEL) << 7);
-        lp->init_block.filter[0] = 0;
-        lp->init_block.filter[1] = 0;
-
         /* purge & init rings but don't actually restart */
         pcnet32_restart(dev, 0x0000);
 
-        lp->a.write_csr(ioaddr, 0, 0x0004);     /* Set STOP bit */
+        lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);       /* Set STOP bit */
 
         /* Initialize Transmit buffers. */
         size = data_len + 15;
@@ -697,14 +942,15 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
                 }
         }
 
-        x = a->read_bcr(ioaddr, 32);    /* set internal loopback in BSR32 */
-        x = x | 0x0002;
-        a->write_bcr(ioaddr, 32, x);
+        x = a->read_bcr(ioaddr, 32);    /* set internal loopback in BCR32 */
+        a->write_bcr(ioaddr, 32, x | 0x0002);
 
-        lp->a.write_csr(ioaddr, 15, 0x0044);    /* set int loopback in CSR15 */
+        /* set int loopback in CSR15 */
+        x = a->read_csr(ioaddr, CSR15) & 0xfffc;
+        lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
 
         teststatus = le16_to_cpu(0x8000);
-        lp->a.write_csr(ioaddr, 0, 0x0002);     /* Set STRT bit */
+        lp->a.write_csr(ioaddr, CSR0, CSR0_START);      /* Set STRT bit */
 
         /* Check status of descriptors */
         for (x = 0; x < numbuffs; x++) {
@@ -712,7 +958,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
                 rmb();
                 while ((lp->rx_ring[x].status & teststatus) && (ticks < 200)) {
                         spin_unlock_irqrestore(&lp->lock, flags);
-                        mdelay(1);
+                        msleep(1);
                         spin_lock_irqsave(&lp->lock, flags);
                         rmb();
                         ticks++;
@@ -725,7 +971,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
                 }
         }
 
-        lp->a.write_csr(ioaddr, 0, 0x0004);     /* Set STOP bit */
+        lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);       /* Set STOP bit */
         wmb();
         if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
                 printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
@@ -758,25 +1004,24 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
                 }
                 x++;
         }
-        if (!rc) {
-                *data1 = 0;
-        }
 
       clean_up:
+        *data1 = rc;
         pcnet32_purge_tx_ring(dev);
-        x = a->read_csr(ioaddr, 15) & 0xFFFF;
-        a->write_csr(ioaddr, 15, (x & ~0x0044));        /* reset bits 6 and 2 */
 
-        x = a->read_bcr(ioaddr, 32);    /* reset internal loopback */
-        x = x & ~0x0002;
-        a->write_bcr(ioaddr, 32, x);
+        x = a->read_csr(ioaddr, CSR15);
+        a->write_csr(ioaddr, CSR15, (x & ~0x0044));     /* reset bits 6 and 2 */
 
-        spin_unlock_irqrestore(&lp->lock, flags);
+        x = a->read_bcr(ioaddr, 32);    /* reset internal loopback */
+        a->write_bcr(ioaddr, 32, (x & ~0x0002));
 
         if (netif_running(dev)) {
+                spin_unlock_irqrestore(&lp->lock, flags);
                 pcnet32_open(dev);
         } else {
+                pcnet32_purge_rx_ring(dev);
                 lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
+                spin_unlock_irqrestore(&lp->lock, flags);
         }
 
         return (rc);
@@ -839,6 +1084,47 @@ static int pcnet32_phys_id(struct net_device *dev, u32 data)
         return 0;
 }
 
+/*
+ * lp->lock must be held.
+ */
+static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
+                int can_sleep)
+{
+        int csr5;
+        struct pcnet32_private *lp = dev->priv;
+        struct pcnet32_access *a = &lp->a;
+        ulong ioaddr = dev->base_addr;
+        int ticks;
+
+        /* really old chips have to be stopped. */
+        if (lp->chip_version < PCNET32_79C970A)
+                return 0;
+
+        /* set SUSPEND (SPND) - CSR5 bit 0 */
+        csr5 = a->read_csr(ioaddr, CSR5);
+        a->write_csr(ioaddr, CSR5, csr5 | CSR5_SUSPEND);
+
+        /* poll waiting for bit to be set */
+        ticks = 0;
+        while (!(a->read_csr(ioaddr, CSR5) & CSR5_SUSPEND)) {
+                spin_unlock_irqrestore(&lp->lock, *flags);
+                if (can_sleep)
+                        msleep(1);
+                else
+                        mdelay(1);
+                spin_lock_irqsave(&lp->lock, *flags);
+                ticks++;
+                if (ticks > 200) {
+                        if (netif_msg_hw(lp))
+                                printk(KERN_DEBUG
+                                       "%s: Error getting into suspend!\n",
+                                       dev->name);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
 #define PCNET32_REGS_PER_PHY    32
 #define PCNET32_MAX_PHYS        32
 static int pcnet32_get_regs_len(struct net_device *dev)
@@ -857,32 +1143,13 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
         struct pcnet32_private *lp = dev->priv;
         struct pcnet32_access *a = &lp->a;
         ulong ioaddr = dev->base_addr;
-        int ticks;
         unsigned long flags;
 
         spin_lock_irqsave(&lp->lock, flags);
 
-        csr0 = a->read_csr(ioaddr, 0);
-        if (!(csr0 & 0x0004)) { /* If not stopped */
-                /* set SUSPEND (SPND) - CSR5 bit 0 */
-                a->write_csr(ioaddr, 5, 0x0001);
-
-                /* poll waiting for bit to be set */
-                ticks = 0;
-                while (!(a->read_csr(ioaddr, 5) & 0x0001)) {
-                        spin_unlock_irqrestore(&lp->lock, flags);
-                        mdelay(1);
-                        spin_lock_irqsave(&lp->lock, flags);
-                        ticks++;
-                        if (ticks > 200) {
-                                if (netif_msg_hw(lp))
-                                        printk(KERN_DEBUG
-                                               "%s: Error getting into suspend!\n",
-                                               dev->name);
-                                break;
-                        }
-                }
-        }
+        csr0 = a->read_csr(ioaddr, CSR0);
+        if (!(csr0 & CSR0_STOP))        /* If not stopped */
+                pcnet32_suspend(dev, &flags, 1);
 
         /* read address PROM */
         for (i = 0; i < 16; i += 2)
@@ -919,9 +1186,12 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
                 }
         }
 
-        if (!(csr0 & 0x0004)) { /* If not stopped */
+        if (!(csr0 & CSR0_STOP)) {      /* If not stopped */
+                int csr5;
+
                 /* clear SUSPEND (SPND) - CSR5 bit 0 */
-                a->write_csr(ioaddr, 5, 0x0000);
+                csr5 = a->read_csr(ioaddr, CSR5);
+                a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
         }
 
         spin_unlock_irqrestore(&lp->lock, flags);
@@ -952,7 +1222,7 @@ static struct ethtool_ops pcnet32_ethtool_ops = {
 /* only probes for non-PCI devices, the rest are handled by
  * pci_register_driver via pcnet32_probe_pci */
 
-static void __devinit pcnet32_probe_vlbus(void)
+static void __devinit pcnet32_probe_vlbus(unsigned int *pcnet32_portlist)
 {
         unsigned int *port, ioaddr;
 
@@ -1268,6 +1538,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
         lp->mii_if.reg_num_mask = 0x1f;
         lp->dxsuflo = dxsuflo;
         lp->mii = mii;
+        lp->chip_version = chip_version;
         lp->msg_enable = pcnet32_debug;
         if ((cards_found >= MAX_UNITS)
             || (options[cards_found] > sizeof(options_mapping)))
@@ -1436,7 +1707,7 @@ static int pcnet32_alloc_ring(struct net_device *dev, char *name)
                                            lp->tx_ring_size,
                                            &lp->tx_ring_dma_addr);
         if (lp->tx_ring == NULL) {
-                if (pcnet32_debug & NETIF_MSG_DRV)
+                if (netif_msg_drv(lp))
                         printk("\n" KERN_ERR PFX
                                "%s: Consistent memory allocation failed.\n",
                                name);
@@ -1448,52 +1719,48 @@ static int pcnet32_alloc_ring(struct net_device *dev, char *name)
                                            lp->rx_ring_size,
                                            &lp->rx_ring_dma_addr);
         if (lp->rx_ring == NULL) {
-                if (pcnet32_debug & NETIF_MSG_DRV)
+                if (netif_msg_drv(lp))
                         printk("\n" KERN_ERR PFX
                                "%s: Consistent memory allocation failed.\n",
                                name);
                 return -ENOMEM;
         }
 
-        lp->tx_dma_addr = kmalloc(sizeof(dma_addr_t) * lp->tx_ring_size,
+        lp->tx_dma_addr = kcalloc(lp->tx_ring_size, sizeof(dma_addr_t),
                                   GFP_ATOMIC);
         if (!lp->tx_dma_addr) {
-                if (pcnet32_debug & NETIF_MSG_DRV)
+                if (netif_msg_drv(lp))
                         printk("\n" KERN_ERR PFX
                                "%s: Memory allocation failed.\n", name);
                 return -ENOMEM;
         }
-        memset(lp->tx_dma_addr, 0, sizeof(dma_addr_t) * lp->tx_ring_size);
 
-        lp->rx_dma_addr = kmalloc(sizeof(dma_addr_t) * lp->rx_ring_size,
+        lp->rx_dma_addr = kcalloc(lp->rx_ring_size, sizeof(dma_addr_t),
                                   GFP_ATOMIC);
         if (!lp->rx_dma_addr) {
-                if (pcnet32_debug & NETIF_MSG_DRV)
+                if (netif_msg_drv(lp))
                         printk("\n" KERN_ERR PFX
                                "%s: Memory allocation failed.\n", name);
                 return -ENOMEM;
         }
-        memset(lp->rx_dma_addr, 0, sizeof(dma_addr_t) * lp->rx_ring_size);
 
-        lp->tx_skbuff = kmalloc(sizeof(struct sk_buff *) * lp->tx_ring_size,
+        lp->tx_skbuff = kcalloc(lp->tx_ring_size, sizeof(struct sk_buff *),
                                 GFP_ATOMIC);
         if (!lp->tx_skbuff) {
-                if (pcnet32_debug & NETIF_MSG_DRV)
+                if (netif_msg_drv(lp))
                         printk("\n" KERN_ERR PFX
                                "%s: Memory allocation failed.\n", name);
                 return -ENOMEM;
         }
-        memset(lp->tx_skbuff, 0, sizeof(struct sk_buff *) * lp->tx_ring_size);
 
-        lp->rx_skbuff = kmalloc(sizeof(struct sk_buff *) * lp->rx_ring_size,
+        lp->rx_skbuff = kcalloc(lp->rx_ring_size, sizeof(struct sk_buff *),
                                 GFP_ATOMIC);
         if (!lp->rx_skbuff) {
-                if (pcnet32_debug & NETIF_MSG_DRV)
+                if (netif_msg_drv(lp))
                         printk("\n" KERN_ERR PFX
                                "%s: Memory allocation failed.\n", name);
                 return -ENOMEM;
         }
-        memset(lp->rx_skbuff, 0, sizeof(struct sk_buff *) * lp->rx_ring_size);
 
         return 0;
 }
@@ -1582,10 +1849,7 @@ static int pcnet32_open(struct net_device *dev)
                                 val |= 2;
                 } else if (lp->options & PCNET32_PORT_ASEL) {
                         /* workaround of xSeries250, turn on for 79C975 only */
-                        i = ((lp->a.read_csr(ioaddr, 88) |
-                              (lp->a.
-                               read_csr(ioaddr, 89) << 16)) >> 12) & 0xffff;
-                        if (i == 0x2627)
+                        if (lp->chip_version == 0x2627)
                                 val |= 3;
                 }
                 lp->a.write_bcr(ioaddr, 9, val);
@@ -1729,9 +1993,11 @@ static int pcnet32_open(struct net_device *dev)
 
         netif_start_queue(dev);
 
-        /* Print the link status and start the watchdog */
-        pcnet32_check_media(dev, 1);
-        mod_timer(&(lp->watchdog_timer), PCNET32_WATCHDOG_TIMEOUT);
+        if (lp->chip_version >= PCNET32_79C970A) {
+                /* Print the link status and start the watchdog */
+                pcnet32_check_media(dev, 1);
+                mod_timer(&(lp->watchdog_timer), PCNET32_WATCHDOG_TIMEOUT);
+        }
 
         i = 0;
         while (i++ < 100)
@@ -1757,16 +2023,7 @@ static int pcnet32_open(struct net_device *dev)
 
       err_free_ring:
         /* free any allocated skbuffs */
-        for (i = 0; i < lp->rx_ring_size; i++) {
-                lp->rx_ring[i].status = 0;
-                if (lp->rx_skbuff[i]) {
-                        pci_unmap_single(lp->pci_dev, lp->rx_dma_addr[i],
-                                         PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(lp->rx_skbuff[i]);
-                }
-                lp->rx_skbuff[i] = NULL;
-                lp->rx_dma_addr[i] = 0;
-        }
+        pcnet32_purge_rx_ring(dev);
 
         /*
          * Switch back to 16bit mode to avoid problems with dumb
@@ -2348,7 +2605,6 @@ static int pcnet32_close(struct net_device *dev)
 {
         unsigned long ioaddr = dev->base_addr;
         struct pcnet32_private *lp = dev->priv;
-        int i;
         unsigned long flags;
 
         del_timer_sync(&lp->watchdog_timer);
@@ -2379,31 +2635,8 @@ static int pcnet32_close(struct net_device *dev)
 
         spin_lock_irqsave(&lp->lock, flags);
 
-        /* free all allocated skbuffs */
-        for (i = 0; i < lp->rx_ring_size; i++) {
-                lp->rx_ring[i].status = 0;
-                wmb();          /* Make sure adapter sees owner change */
-                if (lp->rx_skbuff[i]) {
-                        pci_unmap_single(lp->pci_dev, lp->rx_dma_addr[i],
-                                         PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(lp->rx_skbuff[i]);
-                }
-                lp->rx_skbuff[i] = NULL;
-                lp->rx_dma_addr[i] = 0;
-        }
-
-        for (i = 0; i < lp->tx_ring_size; i++) {
-                lp->tx_ring[i].status = 0;      /* CPU owns buffer */
-                wmb();          /* Make sure adapter sees owner change */
-                if (lp->tx_skbuff[i]) {
-                        pci_unmap_single(lp->pci_dev, lp->tx_dma_addr[i],
-                                         lp->tx_skbuff[i]->len,
-                                         PCI_DMA_TODEVICE);
-                        dev_kfree_skb(lp->tx_skbuff[i]);
-                }
-                lp->tx_skbuff[i] = NULL;
-                lp->tx_dma_addr[i] = 0;
-        }
+        pcnet32_purge_rx_ring(dev);
+        pcnet32_purge_tx_ring(dev);
 
         spin_unlock_irqrestore(&lp->lock, flags);
 
@@ -2433,6 +2666,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
         volatile struct pcnet32_init_block *ib = &lp->init_block;
         volatile u16 *mcast_table = (u16 *) & ib->filter;
         struct dev_mc_list *dmi = dev->mc_list;
+        unsigned long ioaddr = dev->base_addr;
         char *addrs;
         int i;
         u32 crc;
@@ -2441,6 +2675,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
         if (dev->flags & IFF_ALLMULTI) {
                 ib->filter[0] = 0xffffffff;
                 ib->filter[1] = 0xffffffff;
+                lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
+                lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
+                lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
+                lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
                 return;
         }
         /* clear the multicast filter */
@@ -2462,6 +2700,9 @@ static void pcnet32_load_multicast(struct net_device *dev)
                     le16_to_cpu(le16_to_cpu(mcast_table[crc >> 4]) |
                                 (1 << (crc & 0xf)));
         }
+        for (i = 0; i < 4; i++)
+                lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
+                                le16_to_cpu(mcast_table[i]));
         return;
 }
 
@@ -2472,8 +2713,11 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
 {
         unsigned long ioaddr = dev->base_addr, flags;
         struct pcnet32_private *lp = dev->priv;
+        int csr15, suspended;
 
         spin_lock_irqsave(&lp->lock, flags);
+        suspended = pcnet32_suspend(dev, &flags, 0);
+        csr15 = lp->a.read_csr(ioaddr, CSR15);
         if (dev->flags & IFF_PROMISC) {
                 /* Log any net taps. */
                 if (netif_msg_hw(lp))
@@ -2482,15 +2726,24 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
                 lp->init_block.mode =
                     le16_to_cpu(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
                                 7);
+                lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
         } else {
                 lp->init_block.mode =
                     le16_to_cpu((lp->options & PCNET32_PORT_PORTSEL) << 7);
+                lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
                 pcnet32_load_multicast(dev);
         }
 
-        lp->a.write_csr(ioaddr, 0, 0x0004);     /* Temporarily stop the lance. */
-        pcnet32_restart(dev, 0x0042);   /*  Resume normal operation */
-        netif_wake_queue(dev);
+        if (suspended) {
+                int csr5;
+                /* clear SUSPEND (SPND) - CSR5 bit 0 */
+                csr5 = lp->a.read_csr(ioaddr, CSR5);
+                lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
+        } else { 
+                lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
+                pcnet32_restart(dev, CSR0_NORMAL);
+                netif_wake_queue(dev);
+        }
 
         spin_unlock_irqrestore(&lp->lock, flags);
 }
@@ -2730,7 +2983,7 @@ static int __init pcnet32_init_module(void)
 
         /* should we find any remaining VLbus devices ? */
         if (pcnet32vlb)
-                pcnet32_probe_vlbus();
+                pcnet32_probe_vlbus(pcnet32_portlist);
 
         if (cards_found && (pcnet32_debug & NETIF_MSG_PROBE))
                 printk(KERN_INFO PFX "%d cards_found.\n", cards_found);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 2ba6d3a40e2e..b79ec0d7480f 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -56,5 +56,22 @@ config SMSC_PHY
         ---help---
           Currently supports the LAN83C185 PHY
 
+config FIXED_PHY
+        tristate "Drivers for PHY emulation on fixed speed/link"
+        depends on PHYLIB
+        ---help---
+          Adds the driver to PHY layer to cover the boards that do not have any PHY bound,
+          but with the ability to manipulate with speed/link in software. The relavant MII
+          speed/duplex parameters could be effectively handled in user-specified  fuction.
+          Currently tested with mpc866ads.
+
+config FIXED_MII_10_FDX
+        bool "Emulation for 10M Fdx fixed PHY behavior"
+        depends on FIXED_PHY
+
+config FIXED_MII_100_FDX
+        bool "Emulation for 100M Fdx fixed PHY behavior"
+        depends on FIXED_PHY
+
 endmenu
 
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index a00e61942525..320f8323123f 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -10,3 +10,4 @@ obj-$(CONFIG_LXT_PHY)		+= lxt.o
 obj-$(CONFIG_QSEMI_PHY)         += qsemi.o
 obj-$(CONFIG_SMSC_PHY)          += smsc.o
 obj-$(CONFIG_VITESSE_PHY)       += vitesse.o
+obj-$(CONFIG_FIXED_PHY)         += fixed.o
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
index 3efb715c28dc..ae60e6e4107c 100644
--- a/drivers/net/phy/cicada.c
+++ b/drivers/net/phy/cicada.c
@@ -103,7 +103,22 @@ static int cis820x_config_intr(struct phy_device *phydev)
         return err;
 }
 
-/* Cicada 820x */
+/* Cicada 8201, a.k.a Vitesse VSC8201 */
+static struct phy_driver cis8201_driver = {
+        .phy_id         = 0x000fc410,
+        .name           = "Cicada Cis8201",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &cis820x_config_init,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &cis820x_ack_interrupt,
+        .config_intr    = &cis820x_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+/* Cicada 8204 */
 static struct phy_driver cis8204_driver = {
         .phy_id         = 0x000fc440,
         .name           = "Cicada Cis8204",
@@ -118,15 +133,30 @@ static struct phy_driver cis8204_driver = {
         .driver         = { .owner = THIS_MODULE,},
 };
 
-static int __init cis8204_init(void)
+static int __init cicada_init(void)
 {
-        return phy_driver_register(&cis8204_driver);
+        int ret;
+
+        ret = phy_driver_register(&cis8204_driver);
+        if (ret)
+                goto err1;
+
+        ret = phy_driver_register(&cis8201_driver);
+        if (ret)
+                goto err2;
+        return 0;
+
+err2:
+        phy_driver_unregister(&cis8204_driver);
+err1:
+        return ret;
 }
 
-static void __exit cis8204_exit(void)
+static void __exit cicada_exit(void)
 {
         phy_driver_unregister(&cis8204_driver);
+        phy_driver_unregister(&cis8201_driver);
 }
 
-module_init(cis8204_init);
-module_exit(cis8204_exit);
+module_init(cicada_init);
+module_exit(cicada_exit);
diff --git a/drivers/net/phy/fixed.c b/drivers/net/phy/fixed.c
new file mode 100644
index 000000000000..341036df4710
--- /dev/null
+++ b/drivers/net/phy/fixed.c
@@ -0,0 +1,358 @@
+/*
+ * drivers/net/phy/fixed.c
+ *
+ * Driver for fixed PHYs, when transceiver is able to operate in one fixed mode.
+ *
+ * Author: Vitaly Bordug
+ *
+ * Copyright (c) 2006 MontaVista Software, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/unistd.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+#include <linux/phy.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+#define MII_REGS_NUM    7
+
+/*
+    The idea is to emulate normal phy behavior by responding with
+    pre-defined values to mii BMCR read, so that read_status hook could
+    take all the needed info.
+*/
+
+struct fixed_phy_status {
+        u8      link;
+        u16     speed;
+        u8      duplex;
+};
+
+/*-----------------------------------------------------------------------------
+ *  Private information hoder for mii_bus
+ *-----------------------------------------------------------------------------*/
+struct fixed_info {
+        u16 *regs;
+        u8 regs_num;
+        struct fixed_phy_status phy_status;
+        struct phy_device *phydev; /* pointer to the container */
+        /* link & speed cb */
+        int(*link_update)(struct net_device*, struct fixed_phy_status*);
+
+};
+
+/*-----------------------------------------------------------------------------
+ *  If something weird is required to be done with link/speed,
+ * network driver is able to assign a function to implement this.
+ * May be useful for PHY's that need to be software-driven.
+ *-----------------------------------------------------------------------------*/
+int fixed_mdio_set_link_update(struct phy_device* phydev,
+                int(*link_update)(struct net_device*, struct fixed_phy_status*))
+{
+        struct fixed_info *fixed;
+
+        if(link_update == NULL)
+                return -EINVAL;
+
+        if(phydev) {
+                if(phydev->bus) {
+                        fixed = phydev->bus->priv;
+                        fixed->link_update = link_update;
+                        return 0;
+                }
+        }
+        return -EINVAL;
+}
+EXPORT_SYMBOL(fixed_mdio_set_link_update);
+
+/*-----------------------------------------------------------------------------
+ *  This is used for updating internal mii regs from the status
+ *-----------------------------------------------------------------------------*/
+static int fixed_mdio_update_regs(struct fixed_info *fixed)
+{
+        u16 *regs = fixed->regs;
+        u16 bmsr = 0;
+        u16 bmcr = 0;
+
+        if(!regs) {
+                printk(KERN_ERR "%s: regs not set up", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        if(fixed->phy_status.link)
+                bmsr |= BMSR_LSTATUS;
+
+        if(fixed->phy_status.duplex) {
+                bmcr |= BMCR_FULLDPLX;
+
+                switch ( fixed->phy_status.speed ) {
+                case 100:
+                        bmsr |= BMSR_100FULL;
+                        bmcr |= BMCR_SPEED100;
+                break;
+
+                case 10:
+                        bmsr |= BMSR_10FULL;
+                break;
+                }
+        } else {
+                switch ( fixed->phy_status.speed ) {
+                case 100:
+                        bmsr |= BMSR_100HALF;
+                        bmcr |= BMCR_SPEED100;
+                break;
+
+                case 10:
+                        bmsr |= BMSR_100HALF;
+                break;
+                }
+        }
+
+        regs[MII_BMCR] =  bmcr;
+        regs[MII_BMSR] =  bmsr | 0x800; /*we are always capable of 10 hdx*/
+
+        return 0;
+}
+
+static int fixed_mii_read(struct mii_bus *bus, int phy_id, int location)
+{
+        struct fixed_info *fixed = bus->priv;
+
+        /* if user has registered link update callback, use it */
+        if(fixed->phydev)
+                if(fixed->phydev->attached_dev) {
+                        if(fixed->link_update) {
+                                fixed->link_update(fixed->phydev->attached_dev,
+                                                &fixed->phy_status);
+                                fixed_mdio_update_regs(fixed);
+                        }
+        }
+
+        if ((unsigned int)location >= fixed->regs_num)
+                return -1;
+        return fixed->regs[location];
+}
+
+static int fixed_mii_write(struct mii_bus *bus, int phy_id, int location, u16 val)
+{
+        /* do nothing for now*/
+        return 0;
+}
+
+static int fixed_mii_reset(struct mii_bus *bus)
+{
+        /*nothing here - no way/need to reset it*/
+        return 0;
+}
+
+static int fixed_config_aneg(struct phy_device *phydev)
+{
+        /* :TODO:03/13/2006 09:45:37 PM::
+         The full autoneg funcionality can be emulated,
+         but no need to have anything here for now
+         */
+        return 0;
+}
+
+/*-----------------------------------------------------------------------------
+ * the manual bind will do the magic - with phy_id_mask == 0
+ * match will never return true...
+ *-----------------------------------------------------------------------------*/
+static struct phy_driver fixed_mdio_driver = {
+        .name           = "Fixed PHY",
+        .features       = PHY_BASIC_FEATURES,
+        .config_aneg    = fixed_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+/*-----------------------------------------------------------------------------
+ *  This func is used to create all the necessary stuff, bind
+ * the fixed phy driver and register all it on the mdio_bus_type.
+ * speed is either 10 or 100, duplex is boolean.
+ * number is used to create multiple fixed PHYs, so that several devices can
+ * utilize them simultaneously.
+ *-----------------------------------------------------------------------------*/
+static int fixed_mdio_register_device(int number, int speed, int duplex)
+{
+        struct mii_bus *new_bus;
+        struct fixed_info *fixed;
+        struct phy_device *phydev;
+        int err = 0;
+
+        struct device* dev = kzalloc(sizeof(struct device), GFP_KERNEL);
+
+        if (NULL == dev)
+                return -ENOMEM;
+
+        new_bus = kzalloc(sizeof(struct mii_bus), GFP_KERNEL);
+
+        if (NULL == new_bus) {
+                kfree(dev);
+                return -ENOMEM;
+        }
+        fixed = kzalloc(sizeof(struct fixed_info), GFP_KERNEL);
+
+        if (NULL == fixed) {
+                kfree(dev);
+                kfree(new_bus);
+                return -ENOMEM;
+        }
+
+        fixed->regs = kzalloc(MII_REGS_NUM*sizeof(int), GFP_KERNEL);
+        fixed->regs_num = MII_REGS_NUM;
+        fixed->phy_status.speed = speed;
+        fixed->phy_status.duplex = duplex;
+        fixed->phy_status.link = 1;
+
+        new_bus->name = "Fixed MII Bus",
+        new_bus->read = &fixed_mii_read,
+        new_bus->write = &fixed_mii_write,
+        new_bus->reset = &fixed_mii_reset,
+
+        /*set up workspace*/
+        fixed_mdio_update_regs(fixed);
+        new_bus->priv = fixed;
+
+        new_bus->dev = dev;
+        dev_set_drvdata(dev, new_bus);
+
+        /* create phy_device and register it on the mdio bus */
+        phydev = phy_device_create(new_bus, 0, 0);
+
+        /*
+         Put the phydev pointer into the fixed pack so that bus read/write code could
+         be able to access for instance attached netdev. Well it doesn't have to do
+         so, only in case of utilizing user-specified link-update...
+         */
+        fixed->phydev = phydev;
+
+        if(NULL == phydev) {
+                err = -ENOMEM;
+                goto device_create_fail;
+        }
+
+        phydev->irq = -1;
+        phydev->dev.bus = &mdio_bus_type;
+
+        if(number)
+                snprintf(phydev->dev.bus_id, BUS_ID_SIZE,
+                                "fixed_%d@%d:%d", number, speed, duplex);
+        else
+                snprintf(phydev->dev.bus_id, BUS_ID_SIZE,
+                                "fixed@%d:%d", speed, duplex);
+        phydev->bus = new_bus;
+
+        err = device_register(&phydev->dev);
+        if(err) {
+                printk(KERN_ERR "Phy %s failed to register\n",
+                                phydev->dev.bus_id);
+                goto bus_register_fail;
+        }
+
+        /*
+           the mdio bus has phy_id match... In order not to do it
+           artificially, we are binding the driver here by hand;
+           it will be the same for all the fixed phys anyway.
+         */
+        down_write(&phydev->dev.bus->subsys.rwsem);
+
+        phydev->dev.driver = &fixed_mdio_driver.driver;
+
+        err = phydev->dev.driver->probe(&phydev->dev);
+        if(err < 0) {
+                printk(KERN_ERR "Phy %s: problems with fixed driver\n",phydev->dev.bus_id);
+                up_write(&phydev->dev.bus->subsys.rwsem);
+                goto probe_fail;
+        }
+
+        device_bind_driver(&phydev->dev);
+        up_write(&phydev->dev.bus->subsys.rwsem);
+
+        return 0;
+
+probe_fail:
+        device_unregister(&phydev->dev);
+bus_register_fail:
+        kfree(phydev);
+device_create_fail:
+        kfree(dev);
+        kfree(new_bus);
+        kfree(fixed);
+
+        return err;
+}
+
+
+MODULE_DESCRIPTION("Fixed PHY device & driver for PAL");
+MODULE_AUTHOR("Vitaly Bordug");
+MODULE_LICENSE("GPL");
+
+static int __init fixed_init(void)
+{
+        int ret;
+        int duplex = 0;
+
+        /* register on the bus... Not expected to be matched with anything there... */
+        phy_driver_register(&fixed_mdio_driver);
+
+        /* So let the fun begin...
+           We will create several mdio devices here, and will bound the upper
+           driver to them.
+
+           Then the external software can lookup the phy bus by searching
+           fixed@speed:duplex, e.g. fixed@100:1, to be connected to the
+           virtual 100M Fdx phy.
+
+           In case several virtual PHYs required, the bus_id will be in form
+           fixed_<num>@<speed>:<duplex>, which make it able even to define
+           driver-specific link control callback, if for instance PHY is completely
+           SW-driven.
+
+        */
+
+#ifdef CONFIG_FIXED_MII_DUPLEX
+        duplex = 1;
+#endif
+
+#ifdef CONFIG_FIXED_MII_100_FDX
+        fixed_mdio_register_device(0, 100, 1);
+#endif
+
+#ifdef CONFIX_FIXED_MII_10_FDX
+        fixed_mdio_register_device(0, 10, 1);
+#endif
+        return 0;
+}
+
+static void __exit fixed_exit(void)
+{
+        phy_driver_unregister(&fixed_mdio_driver);
+        /* :WARNING:02/18/2006 04:32:40 AM:: Cleanup all the created stuff */
+}
+
+module_init(fixed_init);
+module_exit(fixed_exit);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 1dde390c164d..cf6660c93ffa 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -159,6 +159,7 @@ struct bus_type mdio_bus_type = {
         .suspend        = mdio_bus_suspend,
         .resume         = mdio_bus_resume,
 };
+EXPORT_SYMBOL(mdio_bus_type);
 
 int __init mdio_bus_init(void)
 {
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 7d5c2233c252..f5aad77288f9 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -419,9 +419,8 @@ void phy_start_machine(struct phy_device *phydev,
 
 /* phy_stop_machine
  *
- * description: Stops the state machine timer, sets the state to
- *   UP (unless it wasn't up yet), and then frees the interrupt,
- *   if it is in use. This function must be called BEFORE
+ * description: Stops the state machine timer, sets the state to UP
+ *   (unless it wasn't up yet). This function must be called BEFORE
  *   phy_detach.
  */
 void phy_stop_machine(struct phy_device *phydev)
@@ -433,9 +432,6 @@ void phy_stop_machine(struct phy_device *phydev)
                 phydev->state = PHY_UP;
         spin_unlock(&phydev->lock);
 
-        if (phydev->irq != PHY_POLL)
-                phy_stop_interrupts(phydev);
-
         phydev->adjust_state = NULL;
 }
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 1bc1e032c5d6..2d1ecfdc80db 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -45,6 +45,35 @@ static struct phy_driver genphy_driver;
 extern int mdio_bus_init(void);
 extern void mdio_bus_exit(void);
 
+struct phy_device* phy_device_create(struct mii_bus *bus, int addr, int phy_id)
+{
+        struct phy_device *dev;
+        /* We allocate the device, and initialize the
+         * default values */
+        dev = kcalloc(1, sizeof(*dev), GFP_KERNEL);
+
+        if (NULL == dev)
+                return (struct phy_device*) PTR_ERR((void*)-ENOMEM);
+
+        dev->speed = 0;
+        dev->duplex = -1;
+        dev->pause = dev->asym_pause = 0;
+        dev->link = 1;
+
+        dev->autoneg = AUTONEG_ENABLE;
+
+        dev->addr = addr;
+        dev->phy_id = phy_id;
+        dev->bus = bus;
+
+        dev->state = PHY_DOWN;
+
+        spin_lock_init(&dev->lock);
+
+        return dev;
+}
+EXPORT_SYMBOL(phy_device_create);
+
 /* get_phy_device
  *
  * description: Reads the ID registers of the PHY at addr on the
@@ -78,27 +107,7 @@ struct phy_device * get_phy_device(struct mii_bus *bus, int addr)
         if (0xffffffff == phy_id)
                 return NULL;
 
-        /* Otherwise, we allocate the device, and initialize the
-         * default values */
-        dev = kcalloc(1, sizeof(*dev), GFP_KERNEL);
-
-        if (NULL == dev)
-                return ERR_PTR(-ENOMEM);
-
-        dev->speed = 0;
-        dev->duplex = -1;
-        dev->pause = dev->asym_pause = 0;
-        dev->link = 1;
-
-        dev->autoneg = AUTONEG_ENABLE;
-
-        dev->addr = addr;
-        dev->phy_id = phy_id;
-        dev->bus = bus;
-
-        dev->state = PHY_DOWN;
-
-        spin_lock_init(&dev->lock);
+        dev = phy_device_create(bus, addr, phy_id);
 
         return dev;
 }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 0ec6e9d57b94..c872f7c6cce3 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -192,7 +192,7 @@ struct cardmap {
         void *ptr[CARDMAP_WIDTH];
 };
 static void *cardmap_get(struct cardmap *map, unsigned int nr);
-static void cardmap_set(struct cardmap **map, unsigned int nr, void *ptr);
+static int cardmap_set(struct cardmap **map, unsigned int nr, void *ptr);
 static unsigned int cardmap_find_first_free(struct cardmap *map);
 static void cardmap_destroy(struct cardmap **map);
 
@@ -1995,10 +1995,9 @@ ppp_register_channel(struct ppp_channel *chan)
 {
         struct channel *pch;
 
-        pch = kmalloc(sizeof(struct channel), GFP_KERNEL);
+        pch = kzalloc(sizeof(struct channel), GFP_KERNEL);
         if (pch == 0)
                 return -ENOMEM;
-        memset(pch, 0, sizeof(struct channel));
         pch->ppp = NULL;
         pch->chan = chan;
         chan->ppp = pch;
@@ -2408,13 +2407,12 @@ ppp_create_interface(int unit, int *retp)
         int ret = -ENOMEM;
         int i;
 
-        ppp = kmalloc(sizeof(struct ppp), GFP_KERNEL);
+        ppp = kzalloc(sizeof(struct ppp), GFP_KERNEL);
         if (!ppp)
                 goto out;
         dev = alloc_netdev(0, "", ppp_setup);
         if (!dev)
                 goto out1;
-        memset(ppp, 0, sizeof(struct ppp));
 
         ppp->mru = PPP_MRU;
         init_ppp_file(&ppp->file, INTERFACE);
@@ -2454,11 +2452,16 @@ ppp_create_interface(int unit, int *retp)
         }
 
         atomic_inc(&ppp_unit_count);
-        cardmap_set(&all_ppp_units, unit, ppp);
+        ret = cardmap_set(&all_ppp_units, unit, ppp);
+        if (ret != 0)
+                goto out3;
+
         mutex_unlock(&all_ppp_mutex);
         *retp = 0;
         return ppp;
 
+out3:
+        atomic_dec(&ppp_unit_count);
 out2:
         mutex_unlock(&all_ppp_mutex);
         free_netdev(dev);
@@ -2695,7 +2698,7 @@ static void *cardmap_get(struct cardmap *map, unsigned int nr)
         return NULL;
 }
 
-static void cardmap_set(struct cardmap **pmap, unsigned int nr, void *ptr)
+static int cardmap_set(struct cardmap **pmap, unsigned int nr, void *ptr)
 {
         struct cardmap *p;
         int i;
@@ -2704,8 +2707,9 @@ static void cardmap_set(struct cardmap **pmap, unsigned int nr, void *ptr)
         if (p == NULL || (nr >> p->shift) >= CARDMAP_WIDTH) {
                 do {
                         /* need a new top level */
-                        struct cardmap *np = kmalloc(sizeof(*np), GFP_KERNEL);
-                        memset(np, 0, sizeof(*np));
+                        struct cardmap *np = kzalloc(sizeof(*np), GFP_KERNEL);
+                        if (!np)
+                                goto enomem;
                         np->ptr[0] = p;
                         if (p != NULL) {
                                 np->shift = p->shift + CARDMAP_ORDER;
@@ -2719,8 +2723,9 @@ static void cardmap_set(struct cardmap **pmap, unsigned int nr, void *ptr)
         while (p->shift > 0) {
                 i = (nr >> p->shift) & CARDMAP_MASK;
                 if (p->ptr[i] == NULL) {
-                        struct cardmap *np = kmalloc(sizeof(*np), GFP_KERNEL);
-                        memset(np, 0, sizeof(*np));
+                        struct cardmap *np = kzalloc(sizeof(*np), GFP_KERNEL);
+                        if (!np)
+                                goto enomem;
                         np->shift = p->shift - CARDMAP_ORDER;
                         np->parent = p;
                         p->ptr[i] = np;
@@ -2735,6 +2740,9 @@ static void cardmap_set(struct cardmap **pmap, unsigned int nr, void *ptr)
                 set_bit(i, &p->inuse);
         else
                 clear_bit(i, &p->inuse);
+        return 0;
+ enomem:
+        return -ENOMEM;
 }
 
 static unsigned int cardmap_find_first_free(struct cardmap *map)
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 16a0ef1b1369..4c2f575faad7 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1406,7 +1406,7 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         dev = alloc_etherdev(sizeof (*tp));
         if (dev == NULL) {
                 if (netif_msg_drv(&debug))
-                        printk(KERN_ERR PFX "unable to alloc new ethernet\n");
+                        dev_err(&pdev->dev, "unable to alloc new ethernet\n");
                 goto err_out;
         }
 
@@ -1418,10 +1418,8 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         /* enable device (incl. PCI PM wakeup and hotplug setup) */
         rc = pci_enable_device(pdev);
         if (rc < 0) {
-                if (netif_msg_probe(tp)) {
-                        printk(KERN_ERR PFX "%s: enable failure\n",
-                               pci_name(pdev));
-                }
+                if (netif_msg_probe(tp))
+                        dev_err(&pdev->dev, "enable failure\n");
                 goto err_out_free_dev;
         }
 
@@ -1437,37 +1435,32 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
                 pci_read_config_word(pdev, pm_cap + PCI_PM_CTRL, &pwr_command);
                 acpi_idle_state = pwr_command & PCI_PM_CTRL_STATE_MASK;
         } else {
-                if (netif_msg_probe(tp)) {
-                        printk(KERN_ERR PFX
+                if (netif_msg_probe(tp))
+                        dev_err(&pdev->dev,
                                "PowerManagement capability not found.\n");
-                }
         }
 
         /* make sure PCI base addr 1 is MMIO */
         if (!(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
-                if (netif_msg_probe(tp)) {
-                        printk(KERN_ERR PFX
+                if (netif_msg_probe(tp))
+                        dev_err(&pdev->dev,
                                "region #1 not an MMIO resource, aborting\n");
-                }
                 rc = -ENODEV;
                 goto err_out_mwi;
         }
         /* check for weird/broken PCI region reporting */
         if (pci_resource_len(pdev, 1) < R8169_REGS_SIZE) {
-                if (netif_msg_probe(tp)) {
-                        printk(KERN_ERR PFX
+                if (netif_msg_probe(tp))
+                        dev_err(&pdev->dev,
                                "Invalid PCI region size(s), aborting\n");
-                }
                 rc = -ENODEV;
                 goto err_out_mwi;
         }
 
         rc = pci_request_regions(pdev, MODULENAME);
         if (rc < 0) {
-                if (netif_msg_probe(tp)) {
-                        printk(KERN_ERR PFX "%s: could not request regions.\n",
-                               pci_name(pdev));
-                }
+                if (netif_msg_probe(tp))
+                        dev_err(&pdev->dev, "could not request regions.\n");
                 goto err_out_mwi;
         }
 
@@ -1480,10 +1473,9 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         } else {
                 rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
                 if (rc < 0) {
-                        if (netif_msg_probe(tp)) {
-                                printk(KERN_ERR PFX
+                        if (netif_msg_probe(tp))
+                                dev_err(&pdev->dev,
                                        "DMA configuration failed.\n");
-                        }
                         goto err_out_free_res;
                 }
         }
@@ -1494,7 +1486,7 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         ioaddr = ioremap(pci_resource_start(pdev, 1), R8169_REGS_SIZE);
         if (ioaddr == NULL) {
                 if (netif_msg_probe(tp))
-                        printk(KERN_ERR PFX "cannot remap MMIO, aborting\n");
+                        dev_err(&pdev->dev, "cannot remap MMIO, aborting\n");
                 rc = -EIO;
                 goto err_out_free_res;
         }
@@ -1526,9 +1518,9 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         if (i < 0) {
                 /* Unknown chip: assume array element #0, original RTL-8169 */
                 if (netif_msg_probe(tp)) {
-                        printk(KERN_DEBUG PFX "PCI device %s: "
+                        dev_printk(KERN_DEBUG, &pdev->dev,
                                "unknown chip version, assuming %s\n",
-                               pci_name(pdev), rtl_chip_info[0].name);
+                               rtl_chip_info[0].name);
                 }
                 i++;
         }
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index c6b77acb35ef..e72e0e099060 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -71,12 +71,13 @@
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/div64.h>
+#include <asm/irq.h>
 
 /* local include */
 #include "s2io.h"
 #include "s2io-regs.h"
 
-#define DRV_VERSION "2.0.14.2"
+#define DRV_VERSION "2.0.15.2"
 
 /* S2io Driver name & version. */
 static char s2io_driver_name[] = "Neterion";
@@ -370,38 +371,50 @@ static const u64 fix_mac[] = {
         END_SIGN
 };
 
+MODULE_AUTHOR("Raghavendra Koushik <raghavendra.koushik@neterion.com>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+
+
 /* Module Loadable parameters. */
-static unsigned int tx_fifo_num = 1;
-static unsigned int tx_fifo_len[MAX_TX_FIFOS] =
-    {DEFAULT_FIFO_0_LEN, [1 ...(MAX_TX_FIFOS - 1)] = DEFAULT_FIFO_1_7_LEN};
-static unsigned int rx_ring_num = 1;
-static unsigned int rx_ring_sz[MAX_RX_RINGS] =
-    {[0 ...(MAX_RX_RINGS - 1)] = SMALL_BLK_CNT};
-static unsigned int rts_frm_len[MAX_RX_RINGS] =
-    {[0 ...(MAX_RX_RINGS - 1)] = 0 };
-static unsigned int rx_ring_mode = 1;
-static unsigned int use_continuous_tx_intrs = 1;
-static unsigned int rmac_pause_time = 0x100;
-static unsigned int mc_pause_threshold_q0q3 = 187;
-static unsigned int mc_pause_threshold_q4q7 = 187;
-static unsigned int shared_splits;
-static unsigned int tmac_util_period = 5;
-static unsigned int rmac_util_period = 5;
-static unsigned int bimodal = 0;
-static unsigned int l3l4hdr_size = 128;
-#ifndef CONFIG_S2IO_NAPI
-static unsigned int indicate_max_pkts;
-#endif
+S2IO_PARM_INT(tx_fifo_num, 1);
+S2IO_PARM_INT(rx_ring_num, 1);
+
+
+S2IO_PARM_INT(rx_ring_mode, 1);
+S2IO_PARM_INT(use_continuous_tx_intrs, 1);
+S2IO_PARM_INT(rmac_pause_time, 0x100);
+S2IO_PARM_INT(mc_pause_threshold_q0q3, 187);
+S2IO_PARM_INT(mc_pause_threshold_q4q7, 187);
+S2IO_PARM_INT(shared_splits, 0);
+S2IO_PARM_INT(tmac_util_period, 5);
+S2IO_PARM_INT(rmac_util_period, 5);
+S2IO_PARM_INT(bimodal, 0);
+S2IO_PARM_INT(l3l4hdr_size, 128);
 /* Frequency of Rx desc syncs expressed as power of 2 */
-static unsigned int rxsync_frequency = 3;
+S2IO_PARM_INT(rxsync_frequency, 3);
 /* Interrupt type. Values can be 0(INTA), 1(MSI), 2(MSI_X) */
-static unsigned int intr_type = 0;
+S2IO_PARM_INT(intr_type, 0);
 /* Large receive offload feature */
-static unsigned int lro = 0;
+S2IO_PARM_INT(lro, 0);
 /* Max pkts to be aggregated by LRO at one time. If not specified,
  * aggregation happens until we hit max IP pkt size(64K)
  */
-static unsigned int lro_max_pkts = 0xFFFF;
+S2IO_PARM_INT(lro_max_pkts, 0xFFFF);
+#ifndef CONFIG_S2IO_NAPI
+S2IO_PARM_INT(indicate_max_pkts, 0);
+#endif
+
+static unsigned int tx_fifo_len[MAX_TX_FIFOS] =
+    {DEFAULT_FIFO_0_LEN, [1 ...(MAX_TX_FIFOS - 1)] = DEFAULT_FIFO_1_7_LEN};
+static unsigned int rx_ring_sz[MAX_RX_RINGS] =
+    {[0 ...(MAX_RX_RINGS - 1)] = SMALL_BLK_CNT};
+static unsigned int rts_frm_len[MAX_RX_RINGS] =
+    {[0 ...(MAX_RX_RINGS - 1)] = 0 };
+
+module_param_array(tx_fifo_len, uint, NULL, 0);
+module_param_array(rx_ring_sz, uint, NULL, 0);
+module_param_array(rts_frm_len, uint, NULL, 0);
 
 /*
  * S2IO device table.
@@ -464,10 +477,9 @@ static int init_shared_mem(struct s2io_nic *nic)
                 size += config->tx_cfg[i].fifo_len;
         }
         if (size > MAX_AVAILABLE_TXDS) {
-                DBG_PRINT(ERR_DBG, "%s: Requested TxDs too high, ",
-                          __FUNCTION__);
+                DBG_PRINT(ERR_DBG, "s2io: Requested TxDs too high, ");
                 DBG_PRINT(ERR_DBG, "Requested: %d, max supported: 8192\n", size);
-                return FAILURE;
+                return -EINVAL;
         }
 
         lst_size = (sizeof(TxD_t) * config->max_txds);
@@ -547,6 +559,7 @@ static int init_shared_mem(struct s2io_nic *nic)
         nic->ufo_in_band_v = kmalloc((sizeof(u64) * size), GFP_KERNEL);
         if (!nic->ufo_in_band_v)
                 return -ENOMEM;
+        memset(nic->ufo_in_band_v, 0, size);
 
         /* Allocation and initialization of RXDs in Rings */
         size = 0;
@@ -1213,7 +1226,7 @@ static int init_nic(struct s2io_nic *nic)
                 break;
         }
 
-        /* Enable Tx FIFO partition 0. */
+        /* Enable all configured Tx FIFO partitions */
         val64 = readq(&bar0->tx_fifo_partition_0);
         val64 |= (TX_FIFO_PARTITION_EN);
         writeq(val64, &bar0->tx_fifo_partition_0);
@@ -1650,7 +1663,7 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         writeq(temp64, &bar0->general_int_mask);
                         /*
                          * If Hercules adapter enable GPIO otherwise
-                         * disabled all PCIX, Flash, MDIO, IIC and GPIO
+                         * disable all PCIX, Flash, MDIO, IIC and GPIO
                          * interrupts for now.
                          * TODO
                          */
@@ -1976,7 +1989,6 @@ static int start_nic(struct s2io_nic *nic)
         XENA_dev_config_t __iomem *bar0 = nic->bar0;
         struct net_device *dev = nic->dev;
         register u64 val64 = 0;
-        u16 interruptible;
         u16 subid, i;
         mac_info_t *mac_control;
         struct config_param *config;
@@ -2047,16 +2059,6 @@ static int start_nic(struct s2io_nic *nic)
                 return FAILURE;
         }
 
-        /*  Enable select interrupts */
-        if (nic->intr_type != INTA)
-                en_dis_able_nic_intrs(nic, ENA_ALL_INTRS, DISABLE_INTRS);
-        else {
-                interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR;
-                interruptible |= TX_PIC_INTR | RX_PIC_INTR;
-                interruptible |= TX_MAC_INTR | RX_MAC_INTR;
-                en_dis_able_nic_intrs(nic, interruptible, ENABLE_INTRS);
-        }
-
         /*
          * With some switches, link might be already up at this point.
          * Because of this weird behavior, when we enable laser,
@@ -2130,7 +2132,7 @@ static struct sk_buff *s2io_txdl_getskb(fifo_info_t *fifo_data, TxD_t *txdlp, in
                                        frag->size, PCI_DMA_TODEVICE);
                 }
         }
-        txdlp->Host_Control = 0;
+        memset(txdlp,0, (sizeof(TxD_t) * fifo_data->max_txds));
         return(skb);
 }
 
@@ -2382,9 +2384,14 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                         skb->data = (void *) (unsigned long)tmp;
                         skb->tail = (void *) (unsigned long)tmp;
 
-                        ((RxD3_t*)rxdp)->Buffer0_ptr =
-                            pci_map_single(nic->pdev, ba->ba_0, BUF0_LEN,
+                        if (!(((RxD3_t*)rxdp)->Buffer0_ptr))
+                                ((RxD3_t*)rxdp)->Buffer0_ptr =
+                                   pci_map_single(nic->pdev, ba->ba_0, BUF0_LEN,
                                            PCI_DMA_FROMDEVICE);
+                        else
+                                pci_dma_sync_single_for_device(nic->pdev,
+                                    (dma_addr_t) ((RxD3_t*)rxdp)->Buffer0_ptr,
+                                    BUF0_LEN, PCI_DMA_FROMDEVICE);
                         rxdp->Control_2 = SET_BUFFER0_SIZE_3(BUF0_LEN);
                         if (nic->rxd_mode == RXD_MODE_3B) {
                                 /* Two buffer mode */
@@ -2397,10 +2404,13 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                                 (nic->pdev, skb->data, dev->mtu + 4,
                                                 PCI_DMA_FROMDEVICE);
 
-                                /* Buffer-1 will be dummy buffer not used */
-                                ((RxD3_t*)rxdp)->Buffer1_ptr =
-                                pci_map_single(nic->pdev, ba->ba_1, BUF1_LEN,
-                                        PCI_DMA_FROMDEVICE);
+                                /* Buffer-1 will be dummy buffer. Not used */
+                                if (!(((RxD3_t*)rxdp)->Buffer1_ptr)) {
+                                        ((RxD3_t*)rxdp)->Buffer1_ptr =
+                                                pci_map_single(nic->pdev, 
+                                                ba->ba_1, BUF1_LEN,
+                                                PCI_DMA_FROMDEVICE);
+                                }
                                 rxdp->Control_2 |= SET_BUFFER1_SIZE_3(1);
                                 rxdp->Control_2 |= SET_BUFFER2_SIZE_3
                                                                 (dev->mtu + 4);
@@ -2625,23 +2635,23 @@ no_rx:
 }
 #endif
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
 /**
- * s2io_netpoll - Rx interrupt service handler for netpoll support
+ * s2io_netpoll - netpoll event handler entry point
  * @dev : pointer to the device structure.
  * Description:
- * Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
+ *      This function will be called by upper layer to check for events on the
+ * interface in situations where interrupts are disabled. It is used for
+ * specific in-kernel networking tasks, such as remote consoles and kernel
+ * debugging over the network (example netdump in RedHat).
  */
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
 static void s2io_netpoll(struct net_device *dev)
 {
         nic_t *nic = dev->priv;
         mac_info_t *mac_control;
         struct config_param *config;
         XENA_dev_config_t __iomem *bar0 = nic->bar0;
-        u64 val64;
+        u64 val64 = 0xFFFFFFFFFFFFFFFFULL;
         int i;
 
         disable_irq(dev->irq);
@@ -2650,9 +2660,17 @@ static void s2io_netpoll(struct net_device *dev)
         mac_control = &nic->mac_control;
         config = &nic->config;
 
-        val64 = readq(&bar0->rx_traffic_int);
         writeq(val64, &bar0->rx_traffic_int);
+        writeq(val64, &bar0->tx_traffic_int);
 
+        /* we need to free up the transmitted skbufs or else netpoll will 
+         * run out of skbs and will fail and eventually netpoll application such
+         * as netdump will fail.
+         */
+        for (i = 0; i < config->tx_fifo_num; i++)
+                tx_intr_handler(&mac_control->fifos[i]);
+
+        /* check for received packet and indicate up to network */
         for (i = 0; i < config->rx_ring_num; i++)
                 rx_intr_handler(&mac_control->rings[i]);
 
@@ -2719,7 +2737,7 @@ static void rx_intr_handler(ring_info_t *ring_data)
                 /* If your are next to put index then it's FIFO full condition */
                 if ((get_block == put_block) &&
                     (get_info.offset + 1) == put_info.offset) {
-                        DBG_PRINT(ERR_DBG, "%s: Ring Full\n",dev->name);
+                        DBG_PRINT(INTR_DBG, "%s: Ring Full\n",dev->name);
                         break;
                 }
                 skb = (struct sk_buff *) ((unsigned long)rxdp->Host_Control);
@@ -2739,18 +2757,15 @@ static void rx_intr_handler(ring_info_t *ring_data)
                                  HEADER_SNAP_SIZE,
                                  PCI_DMA_FROMDEVICE);
                 } else if (nic->rxd_mode == RXD_MODE_3B) {
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
+                        pci_dma_sync_single_for_cpu(nic->pdev, (dma_addr_t)
                                  ((RxD3_t*)rxdp)->Buffer0_ptr,
                                  BUF0_LEN, PCI_DMA_FROMDEVICE);
                         pci_unmap_single(nic->pdev, (dma_addr_t)
-                                 ((RxD3_t*)rxdp)->Buffer1_ptr,
-                                 BUF1_LEN, PCI_DMA_FROMDEVICE);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
                                  ((RxD3_t*)rxdp)->Buffer2_ptr,
                                  dev->mtu + 4,
                                  PCI_DMA_FROMDEVICE);
                 } else {
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
+                        pci_dma_sync_single_for_cpu(nic->pdev, (dma_addr_t)
                                          ((RxD3_t*)rxdp)->Buffer0_ptr, BUF0_LEN,
                                          PCI_DMA_FROMDEVICE);
                         pci_unmap_single(nic->pdev, (dma_addr_t)
@@ -3338,7 +3353,7 @@ static void s2io_reset(nic_t * sp)
 
         /* Clear certain PCI/PCI-X fields after reset */
         if (sp->device_type == XFRAME_II_DEVICE) {
-                /* Clear parity err detect bit */
+                /* Clear "detected parity error" bit */
                 pci_write_config_word(sp->pdev, PCI_STATUS, 0x8000);
 
                 /* Clearing PCIX Ecc status register */
@@ -3539,7 +3554,7 @@ static void restore_xmsi_data(nic_t *nic)
         u64 val64;
         int i;
 
-        for (i=0; i< nic->avail_msix_vectors; i++) {
+        for (i=0; i < MAX_REQUESTED_MSI_X; i++) {
                 writeq(nic->msix_info[i].addr, &bar0->xmsi_address);
                 writeq(nic->msix_info[i].data, &bar0->xmsi_data);
                 val64 = (BIT(7) | BIT(15) | vBIT(i, 26, 6));
@@ -3558,7 +3573,7 @@ static void store_xmsi_data(nic_t *nic)
         int i;
 
         /* Store and display */
-        for (i=0; i< nic->avail_msix_vectors; i++) {
+        for (i=0; i < MAX_REQUESTED_MSI_X; i++) {
                 val64 = (BIT(15) | vBIT(i, 26, 6));
                 writeq(val64, &bar0->xmsi_access);
                 if (wait_for_msix_trans(nic, i)) {
@@ -3749,101 +3764,19 @@ static int s2io_open(struct net_device *dev)
         if (err) {
                 DBG_PRINT(ERR_DBG, "%s: H/W initialization failed\n",
                           dev->name);
-                if (err == -ENODEV)
-                        goto hw_init_failed;
-                else
-                        goto hw_enable_failed;
-        }
-
-        /* Store the values of the MSIX table in the nic_t structure */
-        store_xmsi_data(sp);
-
-        /* After proper initialization of H/W, register ISR */
-        if (sp->intr_type == MSI) {
-                err = request_irq((int) sp->pdev->irq, s2io_msi_handle, 
-                        IRQF_SHARED, sp->name, dev);
-                if (err) {
-                        DBG_PRINT(ERR_DBG, "%s: MSI registration \
-failed\n", dev->name);
-                        goto isr_registration_failed;
-                }
-        }
-        if (sp->intr_type == MSI_X) {
-                int i;
-
-                for (i=1; (sp->s2io_entries[i].in_use == MSIX_FLG); i++) {
-                        if (sp->s2io_entries[i].type == MSIX_FIFO_TYPE) {
-                                sprintf(sp->desc1, "%s:MSI-X-%d-TX",
-                                        dev->name, i);
-                                err = request_irq(sp->entries[i].vector,
-                                          s2io_msix_fifo_handle, 0, sp->desc1,
-                                          sp->s2io_entries[i].arg);
-                                DBG_PRINT(ERR_DBG, "%s @ 0x%llx\n", sp->desc1, 
-                                    (unsigned long long)sp->msix_info[i].addr);
-                        } else {
-                                sprintf(sp->desc2, "%s:MSI-X-%d-RX",
-                                        dev->name, i);
-                                err = request_irq(sp->entries[i].vector,
-                                          s2io_msix_ring_handle, 0, sp->desc2,
-                                          sp->s2io_entries[i].arg);
-                                DBG_PRINT(ERR_DBG, "%s @ 0x%llx\n", sp->desc2, 
-                                     (unsigned long long)sp->msix_info[i].addr);
-                        }
-                        if (err) {
-                                DBG_PRINT(ERR_DBG, "%s: MSI-X-%d registration \
-failed\n", dev->name, i);
-                                DBG_PRINT(ERR_DBG, "Returned: %d\n", err);
-                                goto isr_registration_failed;
-                        }
-                        sp->s2io_entries[i].in_use = MSIX_REGISTERED_SUCCESS;
-                }
-        }
-        if (sp->intr_type == INTA) {
-                err = request_irq((int) sp->pdev->irq, s2io_isr, IRQF_SHARED,
-                                sp->name, dev);
-                if (err) {
-                        DBG_PRINT(ERR_DBG, "%s: ISR registration failed\n",
-                                  dev->name);
-                        goto isr_registration_failed;
-                }
+                goto hw_init_failed;
         }
 
         if (s2io_set_mac_addr(dev, dev->dev_addr) == FAILURE) {
                 DBG_PRINT(ERR_DBG, "Set Mac Address Failed\n");
+                s2io_card_down(sp);
                 err = -ENODEV;
-                goto setting_mac_address_failed;
+                goto hw_init_failed;
         }
 
         netif_start_queue(dev);
         return 0;
 
-setting_mac_address_failed:
-        if (sp->intr_type != MSI_X)
-                free_irq(sp->pdev->irq, dev);
-isr_registration_failed:
-        del_timer_sync(&sp->alarm_timer);
-        if (sp->intr_type == MSI_X) {
-                int i;
-                u16 msi_control; /* Temp variable */
-
-                for (i=1; (sp->s2io_entries[i].in_use == 
-                                MSIX_REGISTERED_SUCCESS); i++) {
-                        int vector = sp->entries[i].vector;
-                        void *arg = sp->s2io_entries[i].arg;
-
-                        free_irq(vector, arg);
-                }
-                pci_disable_msix(sp->pdev);
-
-                /* Temp */
-                pci_read_config_word(sp->pdev, 0x42, &msi_control);
-                msi_control &= 0xFFFE; /* Disable MSI */
-                pci_write_config_word(sp->pdev, 0x42, msi_control);
-        }
-        else if (sp->intr_type == MSI)
-                pci_disable_msi(sp->pdev);
-hw_enable_failed:
-        s2io_reset(sp);
 hw_init_failed:
         if (sp->intr_type == MSI_X) {
                 if (sp->entries)
@@ -3874,7 +3807,7 @@ static int s2io_close(struct net_device *dev)
         flush_scheduled_work();
         netif_stop_queue(dev);
         /* Reset card, kill tasklet and free Tx and Rx buffers. */
-        s2io_card_down(sp, 1);
+        s2io_card_down(sp);
 
         sp->device_close_flag = TRUE;   /* Device is shut down. */
         return 0;
@@ -3901,13 +3834,11 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         TxD_t *txdp;
         TxFIFO_element_t __iomem *tx_fifo;
         unsigned long flags;
-#ifdef NETIF_F_TSO
-        int mss;
-#endif
         u16 vlan_tag = 0;
         int vlan_priority = 0;
         mac_info_t *mac_control;
         struct config_param *config;
+        int offload_type;
 
         mac_control = &sp->mac_control;
         config = &sp->config;
@@ -3955,13 +3886,11 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                 return 0;
         }
 
-        txdp->Control_1 = 0;
-        txdp->Control_2 = 0;
+        offload_type = s2io_offload_type(skb);
 #ifdef NETIF_F_TSO
-        mss = skb_shinfo(skb)->gso_size;
-        if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+        if (offload_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
                 txdp->Control_1 |= TXD_TCP_LSO_EN;
-                txdp->Control_1 |= TXD_TCP_LSO_MSS(mss);
+                txdp->Control_1 |= TXD_TCP_LSO_MSS(s2io_tcp_mss(skb));
         }
 #endif
         if (skb->ip_summed == CHECKSUM_HW) {
@@ -3979,10 +3908,10 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         frg_len = skb->len - skb->data_len;
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP) {
+        if (offload_type == SKB_GSO_UDP) {
                 int ufo_size;
 
-                ufo_size = skb_shinfo(skb)->gso_size;
+                ufo_size = s2io_udp_mss(skb);
                 ufo_size &= ~7;
                 txdp->Control_1 |= TXD_UFO_EN;
                 txdp->Control_1 |= TXD_UFO_MSS(ufo_size);
@@ -3999,16 +3928,13 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                                         sp->ufo_in_band_v,
                                         sizeof(u64), PCI_DMA_TODEVICE);
                 txdp++;
-                txdp->Control_1 = 0;
-                txdp->Control_2 = 0;
         }
 
         txdp->Buffer_Pointer = pci_map_single
             (sp->pdev, skb->data, frg_len, PCI_DMA_TODEVICE);
         txdp->Host_Control = (unsigned long) skb;
         txdp->Control_1 |= TXD_BUFFER0_SIZE(frg_len);
-
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+        if (offload_type == SKB_GSO_UDP)
                 txdp->Control_1 |= TXD_UFO_EN;
 
         frg_cnt = skb_shinfo(skb)->nr_frags;
@@ -4023,12 +3949,12 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                     (sp->pdev, frag->page, frag->page_offset,
                      frag->size, PCI_DMA_TODEVICE);
                 txdp->Control_1 = TXD_BUFFER0_SIZE(frag->size);
-                if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+                if (offload_type == SKB_GSO_UDP)
                         txdp->Control_1 |= TXD_UFO_EN;
         }
         txdp->Control_1 |= TXD_GATHER_CODE_LAST;
 
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+        if (offload_type == SKB_GSO_UDP)
                 frg_cnt++; /* as Txd0 was used for inband header */
 
         tx_fifo = mac_control->tx_FIFO_start[queue];
@@ -4037,13 +3963,9 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
 
         val64 = (TX_FIFO_LAST_TXD_NUM(frg_cnt) | TX_FIFO_FIRST_LIST |
                  TX_FIFO_LAST_LIST);
-
-#ifdef NETIF_F_TSO
-        if (mss)
-                val64 |= TX_FIFO_SPECIAL_FUNC;
-#endif
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+        if (offload_type)
                 val64 |= TX_FIFO_SPECIAL_FUNC;
+
         writeq(val64, &tx_fifo->List_Control);
 
         mmiowb();
@@ -4077,13 +3999,41 @@ s2io_alarm_handle(unsigned long data)
         mod_timer(&sp->alarm_timer, jiffies + HZ / 2);
 }
 
+static int s2io_chk_rx_buffers(nic_t *sp, int rng_n)
+{
+        int rxb_size, level;
+
+        if (!sp->lro) {
+                rxb_size = atomic_read(&sp->rx_bufs_left[rng_n]);
+                level = rx_buffer_level(sp, rxb_size, rng_n);
+
+                if ((level == PANIC) && (!TASKLET_IN_USE)) {
+                        int ret;
+                        DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", __FUNCTION__);
+                        DBG_PRINT(INTR_DBG, "PANIC levels\n");
+                        if ((ret = fill_rx_buffers(sp, rng_n)) == -ENOMEM) {
+                                DBG_PRINT(ERR_DBG, "Out of memory in %s",
+                                          __FUNCTION__);
+                                clear_bit(0, (&sp->tasklet_status));
+                                return -1;
+                        }
+                        clear_bit(0, (&sp->tasklet_status));
+                } else if (level == LOW)
+                        tasklet_schedule(&sp->task);
+
+        } else if (fill_rx_buffers(sp, rng_n) == -ENOMEM) {
+                        DBG_PRINT(ERR_DBG, "%s:Out of memory", sp->dev->name);
+                        DBG_PRINT(ERR_DBG, " in Rx Intr!!\n");
+        }
+        return 0;
+}
+
 static irqreturn_t
 s2io_msi_handle(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
         nic_t *sp = dev->priv;
         int i;
-        int ret;
         mac_info_t *mac_control;
         struct config_param *config;
 
@@ -4105,35 +4055,8 @@ s2io_msi_handle(int irq, void *dev_id, struct pt_regs *regs)
          * reallocate the buffers from the interrupt handler itself,
          * else schedule a tasklet to reallocate the buffers.
          */
-        for (i = 0; i < config->rx_ring_num; i++) {
-                if (!sp->lro) {
-                        int rxb_size = atomic_read(&sp->rx_bufs_left[i]);
-                        int level = rx_buffer_level(sp, rxb_size, i);
-
-                        if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                                DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", 
-                                                        dev->name);
-                                DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                                if ((ret = fill_rx_buffers(sp, i)) == -ENOMEM) {
-                                        DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                  dev->name);
-                                        DBG_PRINT(ERR_DBG, " in ISR!!\n");
-                                        clear_bit(0, (&sp->tasklet_status));
-                                        atomic_dec(&sp->isr_cnt);
-                                        return IRQ_HANDLED;
-                                }
-                                clear_bit(0, (&sp->tasklet_status));
-                        } else if (level == LOW) {
-                                tasklet_schedule(&sp->task);
-                        }
-                }
-                else if (fill_rx_buffers(sp, i) == -ENOMEM) {
-                                DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                        dev->name);
-                                DBG_PRINT(ERR_DBG, " in Rx Intr!!\n");
-                                break;
-                }
-        }
+        for (i = 0; i < config->rx_ring_num; i++)
+                s2io_chk_rx_buffers(sp, i);
 
         atomic_dec(&sp->isr_cnt);
         return IRQ_HANDLED;
@@ -4144,39 +4067,13 @@ s2io_msix_ring_handle(int irq, void *dev_id, struct pt_regs *regs)
 {
         ring_info_t *ring = (ring_info_t *)dev_id;
         nic_t *sp = ring->nic;
-        struct net_device *dev = (struct net_device *) dev_id;
-        int rxb_size, level, rng_n;
 
         atomic_inc(&sp->isr_cnt);
-        rx_intr_handler(ring);
 
-        rng_n = ring->ring_no;
-        if (!sp->lro) {
-                rxb_size = atomic_read(&sp->rx_bufs_left[rng_n]);
-                level = rx_buffer_level(sp, rxb_size, rng_n);
-
-                if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                        int ret;
-                        DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", __FUNCTION__);
-                        DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                        if ((ret = fill_rx_buffers(sp, rng_n)) == -ENOMEM) {
-                                DBG_PRINT(ERR_DBG, "Out of memory in %s",
-                                          __FUNCTION__);
-                                clear_bit(0, (&sp->tasklet_status));
-                                return IRQ_HANDLED;
-                        }
-                        clear_bit(0, (&sp->tasklet_status));
-                } else if (level == LOW) {
-                        tasklet_schedule(&sp->task);
-                }
-        }
-        else if (fill_rx_buffers(sp, rng_n) == -ENOMEM) {
-                        DBG_PRINT(ERR_DBG, "%s:Out of memory", dev->name);
-                        DBG_PRINT(ERR_DBG, " in Rx Intr!!\n");
-        }
+        rx_intr_handler(ring);
+        s2io_chk_rx_buffers(sp, ring->ring_no);
 
         atomic_dec(&sp->isr_cnt);
-
         return IRQ_HANDLED;
 }
 
@@ -4341,37 +4238,8 @@ static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
          * else schedule a tasklet to reallocate the buffers.
          */
 #ifndef CONFIG_S2IO_NAPI
-        for (i = 0; i < config->rx_ring_num; i++) {
-                if (!sp->lro) {
-                        int ret;
-                        int rxb_size = atomic_read(&sp->rx_bufs_left[i]);
-                        int level = rx_buffer_level(sp, rxb_size, i);
-
-                        if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                                DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", 
-                                                        dev->name);
-                                DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                                if ((ret = fill_rx_buffers(sp, i)) == -ENOMEM) {
-                                        DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                  dev->name);
-                                        DBG_PRINT(ERR_DBG, " in ISR!!\n");
-                                        clear_bit(0, (&sp->tasklet_status));
-                                        atomic_dec(&sp->isr_cnt);
-                                        writeq(org_mask, &bar0->general_int_mask);
-                                        return IRQ_HANDLED;
-                                }
-                                clear_bit(0, (&sp->tasklet_status));
-                        } else if (level == LOW) {
-                                tasklet_schedule(&sp->task);
-                        }
-                }
-                else if (fill_rx_buffers(sp, i) == -ENOMEM) {
-                                DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                        dev->name);
-                                DBG_PRINT(ERR_DBG, " in Rx intr!!\n");
-                                break;
-                }
-        }
+        for (i = 0; i < config->rx_ring_num; i++)
+                s2io_chk_rx_buffers(sp, i);
 #endif
         writeq(org_mask, &bar0->general_int_mask);
         atomic_dec(&sp->isr_cnt);
@@ -4401,6 +4269,8 @@ static void s2io_updt_stats(nic_t *sp)
                         if (cnt == 5)
                                 break; /* Updt failed */
                 } while(1);
+        } else {
+                memset(sp->mac_control.stats_info, 0, sizeof(StatInfo_t));
         }
 }
 
@@ -5035,7 +4905,8 @@ static int write_eeprom(nic_t * sp, int off, u64 data, int cnt)
 }
 static void s2io_vpd_read(nic_t *nic)
 {
-        u8 vpd_data[256],data;
+        u8 *vpd_data;
+        u8 data;
         int i=0, cnt, fail = 0;
         int vpd_addr = 0x80;
 
@@ -5048,6 +4919,10 @@ static void s2io_vpd_read(nic_t *nic)
                 vpd_addr = 0x50;
         }
 
+        vpd_data = kmalloc(256, GFP_KERNEL);
+        if (!vpd_data)
+                return;
+
         for (i = 0; i < 256; i +=4 ) {
                 pci_write_config_byte(nic->pdev, (vpd_addr + 2), i);
                 pci_read_config_byte(nic->pdev,  (vpd_addr + 2), &data);
@@ -5070,6 +4945,7 @@ static void s2io_vpd_read(nic_t *nic)
                 memset(nic->product_name, 0, vpd_data[1]);
                 memcpy(nic->product_name, &vpd_data[3], vpd_data[1]);
         }
+        kfree(vpd_data);
 }
 
 /**
@@ -5388,7 +5264,7 @@ static int s2io_link_test(nic_t * sp, uint64_t * data)
         else
                 *data = 0;
 
-        return 0;
+        return *data;
 }
 
 /**
@@ -5846,6 +5722,19 @@ static int s2io_ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
         return 0;
 }
 
+static u32 s2io_ethtool_op_get_tso(struct net_device *dev)
+{
+        return (dev->features & NETIF_F_TSO) != 0;
+}
+static int s2io_ethtool_op_set_tso(struct net_device *dev, u32 data)
+{
+        if (data)
+                dev->features |= (NETIF_F_TSO | NETIF_F_TSO6);
+        else
+                dev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
+
+        return 0;
+}
 
 static struct ethtool_ops netdev_ethtool_ops = {
         .get_settings = s2io_ethtool_gset,
@@ -5866,8 +5755,8 @@ static struct ethtool_ops netdev_ethtool_ops = {
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
 #ifdef NETIF_F_TSO
-        .get_tso = ethtool_op_get_tso,
-        .set_tso = ethtool_op_set_tso,
+        .get_tso = s2io_ethtool_op_get_tso,
+        .set_tso = s2io_ethtool_op_set_tso,
 #endif
         .get_ufo = ethtool_op_get_ufo,
         .set_ufo = ethtool_op_set_ufo,
@@ -5919,7 +5808,7 @@ static int s2io_change_mtu(struct net_device *dev, int new_mtu)
 
         dev->mtu = new_mtu;
         if (netif_running(dev)) {
-                s2io_card_down(sp, 0);
+                s2io_card_down(sp);
                 netif_stop_queue(dev);
                 if (s2io_card_up(sp)) {
                         DBG_PRINT(ERR_DBG, "%s: Device bring up failed\n",
@@ -6216,43 +6105,106 @@ static  int rxd_owner_bit_reset(nic_t *sp)
 
 }
 
-static void s2io_card_down(nic_t * sp, int flag)
+static int s2io_add_isr(nic_t * sp)
 {
-        int cnt = 0;
-        XENA_dev_config_t __iomem *bar0 = sp->bar0;
-        unsigned long flags;
-        register u64 val64 = 0;
+        int ret = 0;
         struct net_device *dev = sp->dev;
+        int err = 0;
 
-        del_timer_sync(&sp->alarm_timer);
-        /* If s2io_set_link task is executing, wait till it completes. */
-        while (test_and_set_bit(0, &(sp->link_state))) {
-                msleep(50);
+        if (sp->intr_type == MSI)
+                ret = s2io_enable_msi(sp);
+        else if (sp->intr_type == MSI_X)
+                ret = s2io_enable_msi_x(sp);
+        if (ret) {
+                DBG_PRINT(ERR_DBG, "%s: Defaulting to INTA\n", dev->name);
+                sp->intr_type = INTA;
         }
-        atomic_set(&sp->card_state, CARD_DOWN);
 
-        /* disable Tx and Rx traffic on the NIC */
-        stop_nic(sp);
-        if (flag) {
-                if (sp->intr_type == MSI_X) {
-                        int i;
-                        u16 msi_control;
+        /* Store the values of the MSIX table in the nic_t structure */
+        store_xmsi_data(sp);
 
-                        for (i=1; (sp->s2io_entries[i].in_use ==
-                                MSIX_REGISTERED_SUCCESS); i++) {
-                                int vector = sp->entries[i].vector;
-                                void *arg = sp->s2io_entries[i].arg;
+        /* After proper initialization of H/W, register ISR */
+        if (sp->intr_type == MSI) {
+                err = request_irq((int) sp->pdev->irq, s2io_msi_handle,
+                        IRQF_SHARED, sp->name, dev);
+                if (err) {
+                        pci_disable_msi(sp->pdev);
+                        DBG_PRINT(ERR_DBG, "%s: MSI registration failed\n",
+                                  dev->name);
+                        return -1;
+                }
+        }
+        if (sp->intr_type == MSI_X) {
+                int i;
 
-                                free_irq(vector, arg);
+                for (i=1; (sp->s2io_entries[i].in_use == MSIX_FLG); i++) {
+                        if (sp->s2io_entries[i].type == MSIX_FIFO_TYPE) {
+                                sprintf(sp->desc[i], "%s:MSI-X-%d-TX",
+                                        dev->name, i);
+                                err = request_irq(sp->entries[i].vector,
+                                          s2io_msix_fifo_handle, 0, sp->desc[i],
+                                                  sp->s2io_entries[i].arg);
+                                DBG_PRINT(ERR_DBG, "%s @ 0x%llx\n", sp->desc[i],
+                                (unsigned long long)sp->msix_info[i].addr);
+                        } else {
+                                sprintf(sp->desc[i], "%s:MSI-X-%d-RX",
+                                        dev->name, i);
+                                err = request_irq(sp->entries[i].vector,
+                                          s2io_msix_ring_handle, 0, sp->desc[i],
+                                                  sp->s2io_entries[i].arg);
+                                DBG_PRINT(ERR_DBG, "%s @ 0x%llx\n", sp->desc[i],
+                                (unsigned long long)sp->msix_info[i].addr);
                         }
-                        pci_read_config_word(sp->pdev, 0x42, &msi_control);
-                        msi_control &= 0xFFFE; /* Disable MSI */
-                        pci_write_config_word(sp->pdev, 0x42, msi_control);
-                        pci_disable_msix(sp->pdev);
-                } else {
-                        free_irq(sp->pdev->irq, dev);
-                        if (sp->intr_type == MSI)
-                                pci_disable_msi(sp->pdev);
+                        if (err) {
+                                DBG_PRINT(ERR_DBG,"%s:MSI-X-%d registration "
+                                          "failed\n", dev->name, i);
+                                DBG_PRINT(ERR_DBG, "Returned: %d\n", err);
+                                return -1;
+                        }
+                        sp->s2io_entries[i].in_use = MSIX_REGISTERED_SUCCESS;
+                }
+        }
+        if (sp->intr_type == INTA) {
+                err = request_irq((int) sp->pdev->irq, s2io_isr, IRQF_SHARED,
+                                sp->name, dev);
+                if (err) {
+                        DBG_PRINT(ERR_DBG, "%s: ISR registration failed\n",
+                                  dev->name);
+                        return -1;
+                }
+        }
+        return 0;
+}
+static void s2io_rem_isr(nic_t * sp)
+{
+        int cnt = 0;
+        struct net_device *dev = sp->dev;
+
+        if (sp->intr_type == MSI_X) {
+                int i;
+                u16 msi_control;
+
+                for (i=1; (sp->s2io_entries[i].in_use ==
+                        MSIX_REGISTERED_SUCCESS); i++) {
+                        int vector = sp->entries[i].vector;
+                        void *arg = sp->s2io_entries[i].arg;
+
+                        free_irq(vector, arg);
+                }
+                pci_read_config_word(sp->pdev, 0x42, &msi_control);
+                msi_control &= 0xFFFE; /* Disable MSI */
+                pci_write_config_word(sp->pdev, 0x42, msi_control);
+
+                pci_disable_msix(sp->pdev);
+        } else {
+                free_irq(sp->pdev->irq, dev);
+                if (sp->intr_type == MSI) {
+                        u16 val;
+
+                        pci_disable_msi(sp->pdev);
+                        pci_read_config_word(sp->pdev, 0x4c, &val);
+                        val ^= 0x1;
+                        pci_write_config_word(sp->pdev, 0x4c, val);
                 }
         }
         /* Waiting till all Interrupt handlers are complete */
@@ -6263,6 +6215,26 @@ static void s2io_card_down(nic_t * sp, int flag)
                         break;
                 cnt++;
         } while(cnt < 5);
+}
+
+static void s2io_card_down(nic_t * sp)
+{
+        int cnt = 0;
+        XENA_dev_config_t __iomem *bar0 = sp->bar0;
+        unsigned long flags;
+        register u64 val64 = 0;
+
+        del_timer_sync(&sp->alarm_timer);
+        /* If s2io_set_link task is executing, wait till it completes. */
+        while (test_and_set_bit(0, &(sp->link_state))) {
+                msleep(50);
+        }
+        atomic_set(&sp->card_state, CARD_DOWN);
+
+        /* disable Tx and Rx traffic on the NIC */
+        stop_nic(sp);
+
+        s2io_rem_isr(sp);
 
         /* Kill tasklet. */
         tasklet_kill(&sp->task);
@@ -6314,23 +6286,16 @@ static int s2io_card_up(nic_t * sp)
         mac_info_t *mac_control;
         struct config_param *config;
         struct net_device *dev = (struct net_device *) sp->dev;
+        u16 interruptible;
 
         /* Initialize the H/W I/O registers */
         if (init_nic(sp) != 0) {
                 DBG_PRINT(ERR_DBG, "%s: H/W initialization failed\n",
                           dev->name);
+                s2io_reset(sp);
                 return -ENODEV;
         }
 
-        if (sp->intr_type == MSI)
-                ret = s2io_enable_msi(sp);
-        else if (sp->intr_type == MSI_X)
-                ret = s2io_enable_msi_x(sp);
-        if (ret) {
-                DBG_PRINT(ERR_DBG, "%s: Defaulting to INTA\n", dev->name);
-                sp->intr_type = INTA;
-        }
-
         /*
          * Initializing the Rx buffers. For now we are considering only 1
          * Rx ring and initializing buffers into 30 Rx blocks
@@ -6354,28 +6319,46 @@ static int s2io_card_up(nic_t * sp)
         s2io_set_multicast(dev);
 
         if (sp->lro) {
-                /* Initialize max aggregatable pkts based on MTU */
+                /* Initialize max aggregatable pkts per session based on MTU */
                 sp->lro_max_aggr_per_sess = ((1<<16) - 1) / dev->mtu;
                 /* Check if we can use(if specified) user provided value */
                 if (lro_max_pkts < sp->lro_max_aggr_per_sess)
                         sp->lro_max_aggr_per_sess = lro_max_pkts;
         }
 
-        /* Enable tasklet for the device */
-        tasklet_init(&sp->task, s2io_tasklet, (unsigned long) dev);
-
         /* Enable Rx Traffic and interrupts on the NIC */
         if (start_nic(sp)) {
                 DBG_PRINT(ERR_DBG, "%s: Starting NIC failed\n", dev->name);
-                tasklet_kill(&sp->task);
                 s2io_reset(sp);
-                free_irq(dev->irq, dev);
+                free_rx_buffers(sp);
+                return -ENODEV;
+        }
+
+        /* Add interrupt service routine */
+        if (s2io_add_isr(sp) != 0) {
+                if (sp->intr_type == MSI_X)
+                        s2io_rem_isr(sp);
+                s2io_reset(sp);
                 free_rx_buffers(sp);
                 return -ENODEV;
         }
 
         S2IO_TIMER_CONF(sp->alarm_timer, s2io_alarm_handle, sp, (HZ/2));
 
+        /* Enable tasklet for the device */
+        tasklet_init(&sp->task, s2io_tasklet, (unsigned long) dev);
+
+        /*  Enable select interrupts */
+        if (sp->intr_type != INTA)
+                en_dis_able_nic_intrs(sp, ENA_ALL_INTRS, DISABLE_INTRS);
+        else {
+                interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR;
+                interruptible |= TX_PIC_INTR | RX_PIC_INTR;
+                interruptible |= TX_MAC_INTR | RX_MAC_INTR;
+                en_dis_able_nic_intrs(sp, interruptible, ENABLE_INTRS);
+        }
+
+
         atomic_set(&sp->card_state, CARD_UP);
         return 0;
 }
@@ -6395,7 +6378,7 @@ static void s2io_restart_nic(unsigned long data)
         struct net_device *dev = (struct net_device *) data;
         nic_t *sp = dev->priv;
 
-        s2io_card_down(sp, 0);
+        s2io_card_down(sp);
         if (s2io_card_up(sp)) {
                 DBG_PRINT(ERR_DBG, "%s: Device bring up failed\n",
                           dev->name);
@@ -6437,7 +6420,7 @@ static void s2io_tx_watchdog(struct net_device *dev)
  *   @cksum : FCS checksum of the frame.
  *   @ring_no : the ring from which this RxD was extracted.
  *   Description:
- *   This function is called by the Tx interrupt serivce routine to perform
+ *   This function is called by the Rx interrupt serivce routine to perform
  *   some OS related operations on the SKB before passing it to the upper
  *   layers. It mainly checks if the checksum is OK, if so adds it to the
  *   SKBs cksum variable, increments the Rx packet count and passes the SKB
@@ -6697,33 +6680,6 @@ static void s2io_init_pci(nic_t * sp)
         pci_read_config_word(sp->pdev, PCI_COMMAND, &pci_cmd);
 }
 
-MODULE_AUTHOR("Raghavendra Koushik <raghavendra.koushik@neterion.com>");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(DRV_VERSION);
-
-module_param(tx_fifo_num, int, 0);
-module_param(rx_ring_num, int, 0);
-module_param(rx_ring_mode, int, 0);
-module_param_array(tx_fifo_len, uint, NULL, 0);
-module_param_array(rx_ring_sz, uint, NULL, 0);
-module_param_array(rts_frm_len, uint, NULL, 0);
-module_param(use_continuous_tx_intrs, int, 1);
-module_param(rmac_pause_time, int, 0);
-module_param(mc_pause_threshold_q0q3, int, 0);
-module_param(mc_pause_threshold_q4q7, int, 0);
-module_param(shared_splits, int, 0);
-module_param(tmac_util_period, int, 0);
-module_param(rmac_util_period, int, 0);
-module_param(bimodal, bool, 0);
-module_param(l3l4hdr_size, int , 0);
-#ifndef CONFIG_S2IO_NAPI
-module_param(indicate_max_pkts, int, 0);
-#endif
-module_param(rxsync_frequency, int, 0);
-module_param(intr_type, int, 0);
-module_param(lro, int, 0);
-module_param(lro_max_pkts, int, 0);
-
 static int s2io_verify_parm(struct pci_dev *pdev, u8 *dev_intr_type)
 {
         if ( tx_fifo_num > 8) {
@@ -6831,8 +6787,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         }
         if (dev_intr_type != MSI_X) {
                 if (pci_request_regions(pdev, s2io_driver_name)) {
-                        DBG_PRINT(ERR_DBG, "Request Regions failed\n"),
-                            pci_disable_device(pdev);
+                        DBG_PRINT(ERR_DBG, "Request Regions failed\n");
+                        pci_disable_device(pdev);
                         return -ENODEV;
                 }
         }
@@ -6956,7 +6912,7 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         /*  initialize the shared memory used by the NIC and the host */
         if (init_shared_mem(sp)) {
                 DBG_PRINT(ERR_DBG, "%s: Memory allocation failed\n",
-                          __FUNCTION__);
+                          dev->name);
                 ret = -ENOMEM;
                 goto mem_alloc_failed;
         }
@@ -7093,6 +7049,9 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         dev->addr_len = ETH_ALEN;
         memcpy(dev->dev_addr, sp->def_mac_addr, ETH_ALEN);
 
+        /* reset Nic and bring it to known state */
+        s2io_reset(sp);
+
         /*
          * Initialize the tasklet status and link state flags
          * and the card state parameter
@@ -7130,11 +7089,11 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                 goto register_failed;
         }
         s2io_vpd_read(sp);
-        DBG_PRINT(ERR_DBG, "%s: Neterion %s",dev->name, sp->product_name);
-        DBG_PRINT(ERR_DBG, "(rev %d), Driver version %s\n",
-                                get_xena_rev_id(sp->pdev),
-                                s2io_driver_version);
         DBG_PRINT(ERR_DBG, "Copyright(c) 2002-2005 Neterion Inc.\n");
+        DBG_PRINT(ERR_DBG, "%s: Neterion %s (rev %d)\n",dev->name,
+                  sp->product_name, get_xena_rev_id(sp->pdev));
+        DBG_PRINT(ERR_DBG, "%s: Driver version %s\n", dev->name,
+                  s2io_driver_version);
         DBG_PRINT(ERR_DBG, "%s: MAC ADDR: "
                           "%02x:%02x:%02x:%02x:%02x:%02x\n", dev->name,
                           sp->def_mac_addr[0].mac_addr[0],
@@ -7435,8 +7394,13 @@ static int verify_l3_l4_lro_capable(lro_t *l_lro, struct iphdr *ip,
         if (ip->ihl != 5) /* IP has options */
                 return -1;
 
+        /* If we see CE codepoint in IP header, packet is not mergeable */
+        if (INET_ECN_is_ce(ipv4_get_dsfield(ip)))
+                return -1;
+
+        /* If we see ECE or CWR flags in TCP header, packet is not mergeable */
         if (tcp->urg || tcp->psh || tcp->rst || tcp->syn || tcp->fin ||
-                                                                !tcp->ack) {
+                                    tcp->ece || tcp->cwr || !tcp->ack) {
                 /*
                  * Currently recognize only the ack control word and
                  * any other control field being set would result in
@@ -7590,18 +7554,16 @@ static void queue_rx_frame(struct sk_buff *skb)
 static void lro_append_pkt(nic_t *sp, lro_t *lro, struct sk_buff *skb,
                            u32 tcp_len)
 {
-        struct sk_buff *tmp, *first = lro->parent;
+        struct sk_buff *first = lro->parent;
 
         first->len += tcp_len;
         first->data_len = lro->frags_len;
         skb_pull(skb, (skb->len - tcp_len));
-        if ((tmp = skb_shinfo(first)->frag_list)) {
-                while (tmp->next)
-                        tmp = tmp->next;
-                tmp->next = skb;
-        }
+        if (skb_shinfo(first)->frag_list)
+                lro->last_frag->next = skb;
         else
                 skb_shinfo(first)->frag_list = skb;
+        lro->last_frag = skb;
         sp->mac_control.stats_info->sw_stat.clubbed_frms_cnt++;
         return;
 }
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index c43f52179708..5ed49c3be1e9 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -719,6 +719,7 @@ struct msix_info_st {
 /* Data structure to represent a LRO session */
 typedef struct lro {
         struct sk_buff  *parent;
+        struct sk_buff  *last_frag;
         u8              *l2h;
         struct iphdr    *iph;
         struct tcphdr   *tcph;
@@ -829,8 +830,7 @@ struct s2io_nic {
 #define MSIX_FLG                0xA5
         struct msix_entry *entries;
         struct s2io_msix_entry *s2io_entries;
-        char desc1[35];
-        char desc2[35];
+        char desc[MAX_REQUESTED_MSI_X][25];
 
         int avail_msix_vectors; /* No. of MSI-X vectors granted by system */
 
@@ -1002,7 +1002,7 @@ static int verify_xena_quiescence(nic_t *sp, u64 val64, int flag);
 static struct ethtool_ops netdev_ethtool_ops;
 static void s2io_set_link(unsigned long data);
 static int s2io_set_swapper(nic_t * sp);
-static void s2io_card_down(nic_t *nic, int flag);
+static void s2io_card_down(nic_t *nic);
 static int s2io_card_up(nic_t *nic);
 static int get_xena_rev_id(struct pci_dev *pdev);
 static void restore_xmsi_data(nic_t *nic);
@@ -1012,4 +1012,13 @@ static void clear_lro_session(lro_t *lro);
 static void queue_rx_frame(struct sk_buff *skb);
 static void update_L3L4_header(nic_t *sp, lro_t *lro);
 static void lro_append_pkt(nic_t *sp, lro_t *lro, struct sk_buff *skb, u32 tcp_len);
+
+#define s2io_tcp_mss(skb) skb_shinfo(skb)->gso_size
+#define s2io_udp_mss(skb) skb_shinfo(skb)->gso_size
+#define s2io_offload_type(skb) skb_shinfo(skb)->gso_type
+
+#define S2IO_PARM_INT(X, def_val) \
+        static unsigned int X = def_val;\
+                module_param(X , uint, 0);
+
 #endif                          /* _S2IO_H */
diff --git a/drivers/net/seeq8005.c b/drivers/net/seeq8005.c
index efd0f235020f..01392bca0223 100644
--- a/drivers/net/seeq8005.c
+++ b/drivers/net/seeq8005.c
@@ -742,7 +742,7 @@ module_param(irq, int, 0);
 MODULE_PARM_DESC(io, "SEEQ 8005 I/O base address");
 MODULE_PARM_DESC(irq, "SEEQ 8005 IRQ number");
 
-int init_module(void)
+int __init init_module(void)
 {
         dev_seeq = seeq8005_probe(-1);
         if (IS_ERR(dev_seeq))
diff --git a/drivers/net/sk98lin/h/xmac_ii.h b/drivers/net/sk98lin/h/xmac_ii.h
index 2b19f8ad0318..7f8e6d0084c7 100644
--- a/drivers/net/sk98lin/h/xmac_ii.h
+++ b/drivers/net/sk98lin/h/xmac_ii.h
@@ -1473,7 +1473,7 @@ extern "C" {
 #define GM_TXCR_FORCE_JAM       (1<<15) /* Bit 15:      Force Jam / Flow-Control */
 #define GM_TXCR_CRC_DIS         (1<<14) /* Bit 14:      Disable insertion of CRC */
 #define GM_TXCR_PAD_DIS         (1<<13) /* Bit 13:      Disable padding of packets */
-#define GM_TXCR_COL_THR_MSK     (1<<10) /* Bit 12..10:  Collision Threshold */
+#define GM_TXCR_COL_THR_MSK     (7<<10) /* Bit 12..10:  Collision Threshold */
 
 #define TX_COL_THR(x)           (SHIFT10(x) & GM_TXCR_COL_THR_MSK)
 
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 82200bfaa8ed..ad878dfddef4 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -516,10 +516,7 @@ static int skge_set_pauseparam(struct net_device *dev,
 /* Chip internal frequency for clock calculations */
 static inline u32 hwkhz(const struct skge_hw *hw)
 {
-        if (hw->chip_id == CHIP_ID_GENESIS)
-                return 53215; /* or:  53.125 MHz */
-        else
-                return 78215; /* or:  78.125 MHz */
+        return (hw->chip_id == CHIP_ID_GENESIS) ? 53125 : 78125;
 }
 
 /* Chip HZ to microseconds */
@@ -2214,6 +2211,7 @@ static int skge_up(struct net_device *dev)
         skge_write8(hw, Q_ADDR(rxqaddr[port], Q_CSR), CSR_START | CSR_IRQ_CL_F);
         skge_led(skge, LED_MODE_ON);
 
+        netif_poll_enable(dev);
         return 0;
 
  free_rx_ring:
@@ -2282,6 +2280,7 @@ static int skge_down(struct net_device *dev)
 
         skge_led(skge, LED_MODE_OFF);
 
+        netif_poll_disable(dev);
         skge_tx_clean(skge);
         skge_rx_clean(skge);
 
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index ed19ff47ce11..593387b3c0dd 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -1734,11 +1734,11 @@ enum {
         GM_TXCR_FORCE_JAM       = 1<<15, /* Bit 15:     Force Jam / Flow-Control */
         GM_TXCR_CRC_DIS         = 1<<14, /* Bit 14:     Disable insertion of CRC */
         GM_TXCR_PAD_DIS         = 1<<13, /* Bit 13:     Disable padding of packets */
-        GM_TXCR_COL_THR_MSK     = 1<<10, /* Bit 12..10: Collision Threshold */
+        GM_TXCR_COL_THR_MSK     = 7<<10, /* Bit 12..10: Collision Threshold */
 };
 
 #define TX_COL_THR(x)           (((x)<<10) & GM_TXCR_COL_THR_MSK)
-#define TX_COL_DEF              0x04
+#define TX_COL_DEF              0x04    /* late collision after 64 byte */
 
 /*      GM_RX_CTRL                      16 bit r/w      Receive Control Register */
 enum {
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 418f169a6a31..933e87f1cc68 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -50,7 +50,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.4"
+#define DRV_VERSION             "1.5"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -65,6 +65,7 @@
 #define RX_MAX_PENDING          (RX_LE_SIZE/2 - 2)
 #define RX_DEF_PENDING          RX_MAX_PENDING
 #define RX_SKB_ALIGN            8
+#define RX_BUF_WRITE            16
 
 #define TX_RING_SIZE            512
 #define TX_DEF_PENDING          (TX_RING_SIZE - 1)
@@ -232,9 +233,10 @@ static void sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                         if (hw->ports > 1)
                                 reg1 |= PCI_Y2_PHY2_COMA;
                 }
+                sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+                udelay(100);
 
                 if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
-                        sky2_write16(hw, B0_CTST, Y2_HW_WOL_ON);
                         sky2_pci_write32(hw, PCI_DEV_REG3, 0);
                         reg1 = sky2_pci_read32(hw, PCI_DEV_REG4);
                         reg1 &= P_ASPM_CONTROL_MSK;
@@ -242,8 +244,6 @@ static void sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                         sky2_pci_write32(hw, PCI_DEV_REG5, 0);
                 }
 
-                sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
-
                 break;
 
         case PCI_D3hot:
@@ -255,6 +255,7 @@ static void sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                 else
                         reg1 |= (PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
                 sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+                udelay(100);
 
                 if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
                         sky2_write8(hw, B2_Y2_CLK_GATE, 0);
@@ -1159,7 +1160,7 @@ static unsigned tx_le_req(const struct sk_buff *skb)
         count = sizeof(dma_addr_t) / sizeof(u32);
         count += skb_shinfo(skb)->nr_frags * count;
 
-        if (skb_shinfo(skb)->gso_size)
+        if (skb_is_gso(skb))
                 ++count;
 
         if (skb->ip_summed == CHECKSUM_HW)
@@ -1389,7 +1390,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
         }
 
         sky2->tx_cons = put;
-        if (tx_avail(sky2) > MAX_SKB_TX_LE)
+        if (tx_avail(sky2) > MAX_SKB_TX_LE + 4)
                 netif_wake_queue(dev);
 }
 
@@ -1888,9 +1889,6 @@ resubmit:
         re->skb->ip_summed = CHECKSUM_NONE;
         sky2_rx_add(sky2, re->mapaddr);
 
-        /* Tell receiver about new buffers. */
-        sky2_put_idx(sky2->hw, rxqaddr[sky2->port], sky2->rx_put);
-
         return skb;
 
 oversize:
@@ -1937,7 +1935,9 @@ static inline int sky2_more_work(const struct sky2_hw *hw)
 /* Process status response ring */
 static int sky2_status_intr(struct sky2_hw *hw, int to_do)
 {
+        struct sky2_port *sky2;
         int work_done = 0;
+        unsigned buf_write[2] = { 0, 0 };
         u16 hwidx = sky2_read16(hw, STAT_PUT_IDX);
 
         rmb();
@@ -1945,7 +1945,6 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
         while (hw->st_idx != hwidx) {
                 struct sky2_status_le *le  = hw->st_le + hw->st_idx;
                 struct net_device *dev;
-                struct sky2_port *sky2;
                 struct sk_buff *skb;
                 u32 status;
                 u16 length;
@@ -1978,6 +1977,14 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
 #endif
                                 netif_receive_skb(skb);
 
+                        /* Update receiver after 16 frames */
+                        if (++buf_write[le->link] == RX_BUF_WRITE) {
+                                sky2_put_idx(hw, rxqaddr[le->link],
+                                             sky2->rx_put);
+                                buf_write[le->link] = 0;
+                        }
+
+                        /* Stop after net poll weight */
                         if (++work_done >= to_do)
                                 goto exit_loop;
                         break;
@@ -2016,6 +2023,16 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
         }
 
 exit_loop:
+        if (buf_write[0]) {
+                sky2 = netdev_priv(hw->dev[0]);
+                sky2_put_idx(hw, Q_R1, sky2->rx_put);
+        }
+
+        if (buf_write[1]) {
+                sky2 = netdev_priv(hw->dev[1]);
+                sky2_put_idx(hw, Q_R2, sky2->rx_put);
+        }
+
         return work_done;
 }
 
@@ -2186,9 +2203,6 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         int work_done = 0;
         u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
 
-        if (!~status)
-                goto out;
-
         if (status & Y2_IS_HW_ERR)
                 sky2_hw_intr(hw);
 
@@ -2225,7 +2239,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
 
         if (sky2_more_work(hw))
                 return 1;
-out:
+
         netif_rx_complete(dev0);
 
         sky2_read32(hw, B0_Y2_SP_LISR);
@@ -2286,7 +2300,7 @@ static inline u32 sky2_clk2us(const struct sky2_hw *hw, u32 clk)
 }
 
 
-static int __devinit sky2_reset(struct sky2_hw *hw)
+static int sky2_reset(struct sky2_hw *hw)
 {
         u16 status;
         u8 t8, pmd_type;
@@ -3437,17 +3451,14 @@ static int sky2_suspend(struct pci_dev *pdev, pm_message_t state)
                 return -EINVAL;
 
         del_timer_sync(&hw->idle_timer);
+        netif_poll_disable(hw->dev[0]);
 
         for (i = 0; i < hw->ports; i++) {
                 struct net_device *dev = hw->dev[i];
 
-                if (dev) {
-                        if (!netif_running(dev))
-                                continue;
-
+                if (netif_running(dev)) {
                         sky2_down(dev);
                         netif_device_detach(dev);
-                        netif_poll_disable(dev);
                 }
         }
 
@@ -3474,9 +3485,8 @@ static int sky2_resume(struct pci_dev *pdev)
 
         for (i = 0; i < hw->ports; i++) {
                 struct net_device *dev = hw->dev[i];
-                if (dev && netif_running(dev)) {
+                if (netif_running(dev)) {
                         netif_device_attach(dev);
-                        netif_poll_enable(dev);
 
                         err = sky2_up(dev);
                         if (err) {
@@ -3488,6 +3498,7 @@ static int sky2_resume(struct pci_dev *pdev)
                 }
         }
 
+        netif_poll_enable(hw->dev[0]);
         sky2_idle_start(hw);
 out:
         return err;
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 8a0bc5525f0a..2db8d19b22d1 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -1480,7 +1480,7 @@ enum {
         GM_TXCR_FORCE_JAM       = 1<<15, /* Bit 15:     Force Jam / Flow-Control */
         GM_TXCR_CRC_DIS         = 1<<14, /* Bit 14:     Disable insertion of CRC */
         GM_TXCR_PAD_DIS         = 1<<13, /* Bit 13:     Disable padding of packets */
-        GM_TXCR_COL_THR_MSK     = 1<<10, /* Bit 12..10: Collision Threshold */
+        GM_TXCR_COL_THR_MSK     = 7<<10, /* Bit 12..10: Collision Threshold */
 };
 
 #define TX_COL_THR(x)           (((x)<<10) & GM_TXCR_COL_THR_MSK)
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index d37bd860b336..0b15290df278 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -1092,6 +1092,7 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
         /* Spurious interrupt check */
         if ((SMC_GET_IRQ_CFG() & (INT_CFG_IRQ_INT_ | INT_CFG_IRQ_EN_)) !=
                 (INT_CFG_IRQ_INT_ | INT_CFG_IRQ_EN_)) {
+                spin_unlock_irqrestore(&lp->lock, flags);
                 return IRQ_NONE;
         }
 
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 3d8dcb6c8758..cf62373b808b 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -321,12 +321,12 @@ static void smc_reset(struct net_device *dev)
         DBG(2, "%s: %s\n", dev->name, __FUNCTION__);
 
         /* Disable all interrupts, block TX tasklet */
-        spin_lock(&lp->lock);
+        spin_lock_irq(&lp->lock);
         SMC_SELECT_BANK(2);
         SMC_SET_INT_MASK(0);
         pending_skb = lp->pending_tx_skb;
         lp->pending_tx_skb = NULL;
-        spin_unlock(&lp->lock);
+        spin_unlock_irq(&lp->lock);
 
         /* free any pending tx skb */
         if (pending_skb) {
@@ -448,12 +448,12 @@ static void smc_shutdown(struct net_device *dev)
         DBG(2, "%s: %s\n", CARDNAME, __FUNCTION__);
 
         /* no more interrupts for me */
-        spin_lock(&lp->lock);
+        spin_lock_irq(&lp->lock);
         SMC_SELECT_BANK(2);
         SMC_SET_INT_MASK(0);
         pending_skb = lp->pending_tx_skb;
         lp->pending_tx_skb = NULL;
-        spin_unlock(&lp->lock);
+        spin_unlock_irq(&lp->lock);
         if (pending_skb)
                 dev_kfree_skb(pending_skb);
 
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index b4028049ed76..7aa7fbac8224 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -136,14 +136,9 @@
 #define SMC_CAN_USE_32BIT       0
 #define SMC_IO_SHIFT            0
 #define SMC_NOWAIT              1
-#define SMC_USE_PXA_DMA         1
 
-#define SMC_inb(a, r)           readb((a) + (r))
 #define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
 #define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
 #define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 
@@ -189,16 +184,10 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_IO_SHIFT            0
 #define SMC_NOWAIT              1
 
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
 #define SMC_inw(a, r)           readw((a) + (r))
 #define SMC_outw(v, a, r)       writew(v, (a) + (r))
 #define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
 
 #include <asm/mach-types.h>
 #include <asm/arch/cpu.h>
@@ -354,6 +343,42 @@ static inline void LPD7_SMC_outsw (unsigned char* a, int r,
 
 #define SMC_IRQ_FLAGS           (0)
 
+#elif   defined(CONFIG_ARCH_VERSATILE)
+
+#define SMC_CAN_USE_8BIT        1
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       1
+#define SMC_NOWAIT              1
+
+#define SMC_inb(a, r)           readb((a) + (r))
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inl(a, r)           readl((a) + (r))
+#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+#define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
+#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+
+#define SMC_IRQ_FLAGS           (0)
+
+#elif   defined(CONFIG_ARCH_VERSATILE)
+
+#define SMC_CAN_USE_8BIT        1
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       1
+#define SMC_NOWAIT              1
+
+#define SMC_inb(a, r)           readb((a) + (r))
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inl(a, r)           readl((a) + (r))
+#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+#define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
+#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+
+#define SMC_IRQ_FLAGS           (0)
+
 #else
 
 #define SMC_CAN_USE_8BIT        1
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index fb1d5a8a45cf..88907218457a 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -84,7 +84,7 @@ MODULE_DEVICE_TABLE(pci, spider_net_pci_tbl);
  *
  * returns the content of the specified SMMIO register.
  */
-static u32
+static inline u32
 spider_net_read_reg(struct spider_net_card *card, u32 reg)
 {
         u32 value;
@@ -101,7 +101,7 @@ spider_net_read_reg(struct spider_net_card *card, u32 reg)
  * @reg: register to write to
  * @value: value to write into the specified SMMIO register
  */
-static void
+static inline void
 spider_net_write_reg(struct spider_net_card *card, u32 reg, u32 value)
 {
         value = cpu_to_le32(value);
@@ -259,39 +259,10 @@ spider_net_get_mac_address(struct net_device *netdev)
  *
  * returns the status as in the dmac_cmd_status field of the descriptor
  */
-static enum spider_net_descr_status
+static inline int
 spider_net_get_descr_status(struct spider_net_descr *descr)
 {
-        u32 cmd_status;
-
-        cmd_status = descr->dmac_cmd_status;
-        cmd_status >>= SPIDER_NET_DESCR_IND_PROC_SHIFT;
-        /* no need to mask out any bits, as cmd_status is 32 bits wide only
-         * (and unsigned) */
-        return cmd_status;
-}
-
-/**
- * spider_net_set_descr_status -- sets the status of a descriptor
- * @descr: descriptor to change
- * @status: status to set in the descriptor
- *
- * changes the status to the specified value. Doesn't change other bits
- * in the status
- */
-static void
-spider_net_set_descr_status(struct spider_net_descr *descr,
-                            enum spider_net_descr_status status)
-{
-        u32 cmd_status;
-        /* read the status */
-        cmd_status = descr->dmac_cmd_status;
-        /* clean the upper 4 bits */
-        cmd_status &= SPIDER_NET_DESCR_IND_PROC_MASKO;
-        /* add the status to it */
-        cmd_status |= ((u32)status)<<SPIDER_NET_DESCR_IND_PROC_SHIFT;
-        /* and write it back */
-        descr->dmac_cmd_status = cmd_status;
+        return descr->dmac_cmd_status & SPIDER_NET_DESCR_IND_PROC_MASK;
 }
 
 /**
@@ -328,24 +299,23 @@ spider_net_free_chain(struct spider_net_card *card,
 static int
 spider_net_init_chain(struct spider_net_card *card,
                        struct spider_net_descr_chain *chain,
-                       struct spider_net_descr *start_descr, int no)
+                       struct spider_net_descr *start_descr,
+                       int direction, int no)
 {
         int i;
         struct spider_net_descr *descr;
         dma_addr_t buf;
 
-        atomic_set(&card->rx_chain_refill,0);
-
         descr = start_descr;
         memset(descr, 0, sizeof(*descr) * no);
 
         /* set up the hardware pointers in each descriptor */
         for (i=0; i<no; i++, descr++) {
-                spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
 
                 buf = pci_map_single(card->pdev, descr,
                                      SPIDER_NET_DESCR_SIZE,
-                                     PCI_DMA_BIDIRECTIONAL);
+                                     direction);
 
                 if (buf == DMA_ERROR_CODE)
                         goto iommu_error;
@@ -360,10 +330,11 @@ spider_net_init_chain(struct spider_net_card *card,
         start_descr->prev = descr-1;
 
         descr = start_descr;
-        for (i=0; i < no; i++, descr++) {
-                descr->next_descr_addr = descr->next->bus_addr;
-        }
+        if (direction == PCI_DMA_FROMDEVICE)
+                for (i=0; i < no; i++, descr++)
+                        descr->next_descr_addr = descr->next->bus_addr;
 
+        spin_lock_init(&chain->lock);
         chain->head = start_descr;
         chain->tail = start_descr;
 
@@ -375,7 +346,7 @@ iommu_error:
                 if (descr->bus_addr)
                         pci_unmap_single(card->pdev, descr->bus_addr,
                                          SPIDER_NET_DESCR_SIZE,
-                                         PCI_DMA_BIDIRECTIONAL);
+                                         direction);
         return -ENOMEM;
 }
 
@@ -396,7 +367,7 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card)
                         dev_kfree_skb(descr->skb);
                         pci_unmap_single(card->pdev, descr->buf_addr,
                                          SPIDER_NET_MAX_FRAME,
-                                         PCI_DMA_BIDIRECTIONAL);
+                                         PCI_DMA_FROMDEVICE);
                 }
                 descr = descr->next;
         }
@@ -446,15 +417,16 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
                 skb_reserve(descr->skb, SPIDER_NET_RXBUF_ALIGN - offset);
         /* io-mmu-map the skb */
         buf = pci_map_single(card->pdev, descr->skb->data,
-                             SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL);
+                        SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE);
         descr->buf_addr = buf;
         if (buf == DMA_ERROR_CODE) {
                 dev_kfree_skb_any(descr->skb);
                 if (netif_msg_rx_err(card) && net_ratelimit())
                         pr_err("Could not iommu-map rx buffer\n");
-                spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
         } else {
-                descr->dmac_cmd_status = SPIDER_NET_DMAC_RX_CARDOWNED;
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_CARDOWNED |
+                                         SPIDER_NET_DMAC_NOINTR_COMPLETE;
         }
 
         return error;
@@ -468,7 +440,7 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
  * chip by writing to the appropriate register. DMA is enabled in
  * spider_net_enable_rxdmac.
  */
-static void
+static inline void
 spider_net_enable_rxchtails(struct spider_net_card *card)
 {
         /* assume chain is aligned correctly */
@@ -483,7 +455,7 @@ spider_net_enable_rxchtails(struct spider_net_card *card)
  * spider_net_enable_rxdmac enables the DMA controller by setting RX_DMA_EN
  * in the GDADMACCNTR register
  */
-static void
+static inline void
 spider_net_enable_rxdmac(struct spider_net_card *card)
 {
         wmb();
@@ -500,23 +472,24 @@ spider_net_enable_rxdmac(struct spider_net_card *card)
 static void
 spider_net_refill_rx_chain(struct spider_net_card *card)
 {
-        struct spider_net_descr_chain *chain;
-
-        chain = &card->rx_chain;
+        struct spider_net_descr_chain *chain = &card->rx_chain;
+        unsigned long flags;
 
         /* one context doing the refill (and a second context seeing that
          * and omitting it) is ok. If called by NAPI, we'll be called again
          * as spider_net_decode_one_descr is called several times. If some
          * interrupt calls us, the NAPI is about to clean up anyway. */
-        if (atomic_inc_return(&card->rx_chain_refill) == 1)
-                while (spider_net_get_descr_status(chain->head) ==
-                       SPIDER_NET_DESCR_NOT_IN_USE) {
-                        if (spider_net_prepare_rx_descr(card, chain->head))
-                                break;
-                        chain->head = chain->head->next;
-                }
+        if (!spin_trylock_irqsave(&chain->lock, flags))
+                return;
+
+        while (spider_net_get_descr_status(chain->head) ==
+                        SPIDER_NET_DESCR_NOT_IN_USE) {
+                if (spider_net_prepare_rx_descr(card, chain->head))
+                        break;
+                chain->head = chain->head->next;
+        }
 
-        atomic_dec(&card->rx_chain_refill);
+        spin_unlock_irqrestore(&chain->lock, flags);
 }
 
 /**
@@ -554,111 +527,6 @@ error:
 }
 
 /**
- * spider_net_release_tx_descr - processes a used tx descriptor
- * @card: card structure
- * @descr: descriptor to release
- *
- * releases a used tx descriptor (unmapping, freeing of skb)
- */
-static void
-spider_net_release_tx_descr(struct spider_net_card *card,
-                            struct spider_net_descr *descr)
-{
-        struct sk_buff *skb;
-
-        /* unmap the skb */
-        skb = descr->skb;
-        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
-                         PCI_DMA_BIDIRECTIONAL);
-
-        dev_kfree_skb_any(skb);
-
-        /* set status to not used */
-        spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
-}
-
-/**
- * spider_net_release_tx_chain - processes sent tx descriptors
- * @card: adapter structure
- * @brutal: if set, don't care about whether descriptor seems to be in use
- *
- * returns 0 if the tx ring is empty, otherwise 1.
- *
- * spider_net_release_tx_chain releases the tx descriptors that spider has
- * finished with (if non-brutal) or simply release tx descriptors (if brutal).
- * If some other context is calling this function, we return 1 so that we're
- * scheduled again (if we were scheduled) and will not loose initiative.
- */
-static int
-spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
-{
-        struct spider_net_descr_chain *tx_chain = &card->tx_chain;
-        enum spider_net_descr_status status;
-
-        if (atomic_inc_return(&card->tx_chain_release) != 1) {
-                atomic_dec(&card->tx_chain_release);
-                return 1;
-        }
-
-        for (;;) {
-                status = spider_net_get_descr_status(tx_chain->tail);
-                switch (status) {
-                case SPIDER_NET_DESCR_CARDOWNED:
-                        if (!brutal)
-                                goto out;
-                        /* fallthrough, if we release the descriptors
-                         * brutally (then we don't care about
-                         * SPIDER_NET_DESCR_CARDOWNED) */
-                case SPIDER_NET_DESCR_RESPONSE_ERROR:
-                case SPIDER_NET_DESCR_PROTECTION_ERROR:
-                case SPIDER_NET_DESCR_FORCE_END:
-                        if (netif_msg_tx_err(card))
-                                pr_err("%s: forcing end of tx descriptor "
-                                       "with status x%02x\n",
-                                       card->netdev->name, status);
-                        card->netdev_stats.tx_dropped++;
-                        break;
-
-                case SPIDER_NET_DESCR_COMPLETE:
-                        card->netdev_stats.tx_packets++;
-                        card->netdev_stats.tx_bytes +=
-                                tx_chain->tail->skb->len;
-                        break;
-
-                default: /* any other value (== SPIDER_NET_DESCR_NOT_IN_USE) */
-                        goto out;
-                }
-                spider_net_release_tx_descr(card, tx_chain->tail);
-                tx_chain->tail = tx_chain->tail->next;
-        }
-out:
-        atomic_dec(&card->tx_chain_release);
-
-        netif_wake_queue(card->netdev);
-
-        if (status == SPIDER_NET_DESCR_CARDOWNED)
-                return 1;
-        return 0;
-}
-
-/**
- * spider_net_cleanup_tx_ring - cleans up the TX ring
- * @card: card structure
- *
- * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
- * interrupts to cleanup our TX ring) and returns sent packets to the stack
- * by freeing them
- */
-static void
-spider_net_cleanup_tx_ring(struct spider_net_card *card)
-{
-        if ( (spider_net_release_tx_chain(card, 0)) &&
-              (card->netdev->flags & IFF_UP) ) {
-                mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
-        }
-}
-
-/**
  * spider_net_get_multicast_hash - generates hash for multicast filter table
  * @addr: multicast address
  *
@@ -761,97 +629,6 @@ spider_net_disable_rxdmac(struct spider_net_card *card)
 }
 
 /**
- * spider_net_stop - called upon ifconfig down
- * @netdev: interface device structure
- *
- * always returns 0
- */
-int
-spider_net_stop(struct net_device *netdev)
-{
-        struct spider_net_card *card = netdev_priv(netdev);
-
-        tasklet_kill(&card->rxram_full_tl);
-        netif_poll_disable(netdev);
-        netif_carrier_off(netdev);
-        netif_stop_queue(netdev);
-        del_timer_sync(&card->tx_timer);
-
-        /* disable/mask all interrupts */
-        spider_net_write_reg(card, SPIDER_NET_GHIINT0MSK, 0);
-        spider_net_write_reg(card, SPIDER_NET_GHIINT1MSK, 0);
-        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK, 0);
-
-        /* free_irq(netdev->irq, netdev);*/
-        free_irq(to_pci_dev(netdev->class_dev.dev)->irq, netdev);
-
-        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
-                             SPIDER_NET_DMA_TX_FEND_VALUE);
-
-        /* turn off DMA, force end */
-        spider_net_disable_rxdmac(card);
-
-        /* release chains */
-        spider_net_release_tx_chain(card, 1);
-
-        spider_net_free_chain(card, &card->tx_chain);
-        spider_net_free_chain(card, &card->rx_chain);
-
-        return 0;
-}
-
-/**
- * spider_net_get_next_tx_descr - returns the next available tx descriptor
- * @card: device structure to get descriptor from
- *
- * returns the address of the next descriptor, or NULL if not available.
- */
-static struct spider_net_descr *
-spider_net_get_next_tx_descr(struct spider_net_card *card)
-{
-        /* check, if head points to not-in-use descr */
-        if ( spider_net_get_descr_status(card->tx_chain.head) ==
-             SPIDER_NET_DESCR_NOT_IN_USE ) {
-                return card->tx_chain.head;
-        } else {
-                return NULL;
-        }
-}
-
-/**
- * spider_net_set_txdescr_cmdstat - sets the tx descriptor command field
- * @descr: descriptor structure to fill out
- * @skb: packet to consider
- *
- * fills out the command and status field of the descriptor structure,
- * depending on hardware checksum settings.
- */
-static void
-spider_net_set_txdescr_cmdstat(struct spider_net_descr *descr,
-                               struct sk_buff *skb)
-{
-        /* make sure the other fields in the descriptor are written */
-        wmb();
-
-        if (skb->ip_summed != CHECKSUM_HW) {
-                descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_NOCS;
-                return;
-        }
-
-        /* is packet ip?
-         * if yes: tcp? udp? */
-        if (skb->protocol == htons(ETH_P_IP)) {
-                if (skb->nh.iph->protocol == IPPROTO_TCP)
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_TCPCS;
-                else if (skb->nh.iph->protocol == IPPROTO_UDP)
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_UDPCS;
-                else /* the stack should checksum non-tcp and non-udp
-                        packets on his own: NETIF_F_IP_CSUM */
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_NOCS;
-        }
-}
-
-/**
  * spider_net_prepare_tx_descr - fill tx descriptor with skb data
  * @card: card structure
  * @descr: descriptor structure to fill out
@@ -864,13 +641,12 @@ spider_net_set_txdescr_cmdstat(struct spider_net_descr *descr,
  */
 static int
 spider_net_prepare_tx_descr(struct spider_net_card *card,
-                            struct spider_net_descr *descr,
                             struct sk_buff *skb)
 {
+        struct spider_net_descr *descr = card->tx_chain.head;
         dma_addr_t buf;
 
-        buf = pci_map_single(card->pdev, skb->data,
-                             skb->len, PCI_DMA_BIDIRECTIONAL);
+        buf = pci_map_single(card->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
         if (buf == DMA_ERROR_CODE) {
                 if (netif_msg_tx_err(card) && net_ratelimit())
                         pr_err("could not iommu-map packet (%p, %i). "
@@ -880,10 +656,101 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
 
         descr->buf_addr = buf;
         descr->buf_size = skb->len;
+        descr->next_descr_addr = 0;
         descr->skb = skb;
         descr->data_status = 0;
 
-        spider_net_set_txdescr_cmdstat(descr,skb);
+        descr->dmac_cmd_status =
+                        SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
+        if (skb->protocol == htons(ETH_P_IP))
+                switch (skb->nh.iph->protocol) {
+                case IPPROTO_TCP:
+                        descr->dmac_cmd_status |= SPIDER_NET_DMAC_TCP;
+                        break;
+                case IPPROTO_UDP:
+                        descr->dmac_cmd_status |= SPIDER_NET_DMAC_UDP;
+                        break;
+                }
+
+        descr->prev->next_descr_addr = descr->bus_addr;
+
+        return 0;
+}
+
+/**
+ * spider_net_release_tx_descr - processes a used tx descriptor
+ * @card: card structure
+ * @descr: descriptor to release
+ *
+ * releases a used tx descriptor (unmapping, freeing of skb)
+ */
+static inline void
+spider_net_release_tx_descr(struct spider_net_card *card)
+{
+        struct spider_net_descr *descr = card->tx_chain.tail;
+        struct sk_buff *skb;
+
+        card->tx_chain.tail = card->tx_chain.tail->next;
+        descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+
+        /* unmap the skb */
+        skb = descr->skb;
+        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
+                        PCI_DMA_TODEVICE);
+        dev_kfree_skb_any(skb);
+}
+
+/**
+ * spider_net_release_tx_chain - processes sent tx descriptors
+ * @card: adapter structure
+ * @brutal: if set, don't care about whether descriptor seems to be in use
+ *
+ * returns 0 if the tx ring is empty, otherwise 1.
+ *
+ * spider_net_release_tx_chain releases the tx descriptors that spider has
+ * finished with (if non-brutal) or simply release tx descriptors (if brutal).
+ * If some other context is calling this function, we return 1 so that we're
+ * scheduled again (if we were scheduled) and will not loose initiative.
+ */
+static int
+spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
+{
+        struct spider_net_descr_chain *chain = &card->tx_chain;
+        int status;
+
+        spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR);
+
+        while (chain->tail != chain->head) {
+                status = spider_net_get_descr_status(chain->tail);
+                switch (status) {
+                case SPIDER_NET_DESCR_COMPLETE:
+                        card->netdev_stats.tx_packets++;
+                        card->netdev_stats.tx_bytes += chain->tail->skb->len;
+                        break;
+
+                case SPIDER_NET_DESCR_CARDOWNED:
+                        if (!brutal)
+                                return 1;
+                        /* fallthrough, if we release the descriptors
+                         * brutally (then we don't care about
+                         * SPIDER_NET_DESCR_CARDOWNED) */
+
+                case SPIDER_NET_DESCR_RESPONSE_ERROR:
+                case SPIDER_NET_DESCR_PROTECTION_ERROR:
+                case SPIDER_NET_DESCR_FORCE_END:
+                        if (netif_msg_tx_err(card))
+                                pr_err("%s: forcing end of tx descriptor "
+                                       "with status x%02x\n",
+                                       card->netdev->name, status);
+                        card->netdev_stats.tx_errors++;
+                        break;
+
+                default:
+                        card->netdev_stats.tx_dropped++;
+                        return 1;
+                }
+                spider_net_release_tx_descr(card);
+        }
 
         return 0;
 }
@@ -896,18 +763,32 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
  * spider_net_kick_tx_dma writes the current tx chain head as start address
  * of the tx descriptor chain and enables the transmission DMA engine
  */
-static void
-spider_net_kick_tx_dma(struct spider_net_card *card,
-                       struct spider_net_descr *descr)
+static inline void
+spider_net_kick_tx_dma(struct spider_net_card *card)
 {
-        /* this is the only descriptor in the output chain.
-         * Enable TX DMA */
+        struct spider_net_descr *descr;
 
-        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
-                             descr->bus_addr);
+        if (spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR) &
+                        SPIDER_NET_TX_DMA_EN)
+                goto out;
 
-        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
-                             SPIDER_NET_DMA_TX_VALUE);
+        descr = card->tx_chain.tail;
+        for (;;) {
+                if (spider_net_get_descr_status(descr) ==
+                                SPIDER_NET_DESCR_CARDOWNED) {
+                        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
+                                        descr->bus_addr);
+                        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                                        SPIDER_NET_DMA_TX_VALUE);
+                        break;
+                }
+                if (descr == card->tx_chain.head)
+                        break;
+                descr = descr->next;
+        }
+
+out:
+        mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
 }
 
 /**
@@ -915,47 +796,69 @@ spider_net_kick_tx_dma(struct spider_net_card *card,
  * @skb: packet to send out
  * @netdev: interface device structure
  *
- * returns 0 on success, <0 on failure
+ * returns 0 on success, !0 on failure
  */
 static int
 spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
         struct spider_net_card *card = netdev_priv(netdev);
-        struct spider_net_descr *descr;
+        struct spider_net_descr_chain *chain = &card->tx_chain;
+        struct spider_net_descr *descr = chain->head;
+        unsigned long flags;
         int result;
 
+        spin_lock_irqsave(&chain->lock, flags);
+
         spider_net_release_tx_chain(card, 0);
 
-        descr = spider_net_get_next_tx_descr(card);
+        if (chain->head->next == chain->tail->prev) {
+                card->netdev_stats.tx_dropped++;
+                result = NETDEV_TX_LOCKED;
+                goto out;
+        }
 
-        if (!descr)
-                goto error;
+        if (spider_net_get_descr_status(descr) != SPIDER_NET_DESCR_NOT_IN_USE) {
+                result = NETDEV_TX_LOCKED;
+                goto out;
+        }
 
-        result = spider_net_prepare_tx_descr(card, descr, skb);
-        if (result)
-                goto error;
+        if (spider_net_prepare_tx_descr(card, skb) != 0) {
+                card->netdev_stats.tx_dropped++;
+                result = NETDEV_TX_BUSY;
+                goto out;
+        }
 
+        result = NETDEV_TX_OK;
+
+        spider_net_kick_tx_dma(card);
         card->tx_chain.head = card->tx_chain.head->next;
 
-        if (spider_net_get_descr_status(descr->prev) !=
-            SPIDER_NET_DESCR_CARDOWNED) {
-                /* make sure the current descriptor is in memory. Then
-                 * kicking it on again makes sense, if the previous is not
-                 * card-owned anymore. Check the previous descriptor twice
-                 * to omit an mb() in heavy traffic cases */
-                mb();
-                if (spider_net_get_descr_status(descr->prev) !=
-                    SPIDER_NET_DESCR_CARDOWNED)
-                        spider_net_kick_tx_dma(card, descr);
-        }
+out:
+        spin_unlock_irqrestore(&chain->lock, flags);
+        netif_wake_queue(netdev);
+        return result;
+}
 
-        mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
+/**
+ * spider_net_cleanup_tx_ring - cleans up the TX ring
+ * @card: card structure
+ *
+ * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
+ * interrupts to cleanup our TX ring) and returns sent packets to the stack
+ * by freeing them
+ */
+static void
+spider_net_cleanup_tx_ring(struct spider_net_card *card)
+{
+        unsigned long flags;
 
-        return NETDEV_TX_OK;
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
 
-error:
-        card->netdev_stats.tx_dropped++;
-        return NETDEV_TX_BUSY;
+        if ((spider_net_release_tx_chain(card, 0) != 0) &&
+            (card->netdev->flags & IFF_UP))
+                spider_net_kick_tx_dma(card);
+
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
 }
 
 /**
@@ -1002,7 +905,7 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
 
         /* unmap descriptor */
         pci_unmap_single(card->pdev, descr->buf_addr, SPIDER_NET_MAX_FRAME,
-                         PCI_DMA_BIDIRECTIONAL);
+                        PCI_DMA_FROMDEVICE);
 
         /* the cases we'll throw away the packet immediately */
         if (data_error & SPIDER_NET_DESTROY_RX_FLAGS) {
@@ -1067,14 +970,11 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
 static int
 spider_net_decode_one_descr(struct spider_net_card *card, int napi)
 {
-        enum spider_net_descr_status status;
-        struct spider_net_descr *descr;
-        struct spider_net_descr_chain *chain;
+        struct spider_net_descr_chain *chain = &card->rx_chain;
+        struct spider_net_descr *descr = chain->tail;
+        int status;
         int result;
 
-        chain = &card->rx_chain;
-        descr = chain->tail;
-
         status = spider_net_get_descr_status(descr);
 
         if (status == SPIDER_NET_DESCR_CARDOWNED) {
@@ -1103,7 +1003,7 @@ spider_net_decode_one_descr(struct spider_net_card *card, int napi)
                                card->netdev->name, status);
                 card->netdev_stats.rx_dropped++;
                 pci_unmap_single(card->pdev, descr->buf_addr,
-                                 SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL);
+                                SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_irq(descr->skb);
                 goto refill;
         }
@@ -1119,7 +1019,7 @@ spider_net_decode_one_descr(struct spider_net_card *card, int napi)
         /* ok, we've got a packet in descr */
         result = spider_net_pass_skb_up(descr, card, napi);
 refill:
-        spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+        descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
         /* change the descriptor state: */
         if (!napi)
                 spider_net_refill_rx_chain(card);
@@ -1291,21 +1191,6 @@ spider_net_set_mac(struct net_device *netdev, void *p)
 }
 
 /**
- * spider_net_enable_txdmac - enables a TX DMA controller
- * @card: card structure
- *
- * spider_net_enable_txdmac enables the TX DMA controller by setting the
- * descriptor chain tail address
- */
-static void
-spider_net_enable_txdmac(struct spider_net_card *card)
-{
-        /* assume chain is aligned correctly */
-        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
-                             card->tx_chain.tail->bus_addr);
-}
-
-/**
  * spider_net_handle_rxram_full - cleans up RX ring upon RX RAM full interrupt
  * @card: card structure
  *
@@ -1653,7 +1538,6 @@ spider_net_enable_card(struct spider_net_card *card)
                 { SPIDER_NET_GMRWOLCTRL, 0 },
                 { SPIDER_NET_GTESTMD, 0x10000000 },
                 { SPIDER_NET_GTTQMSK, 0x00400040 },
-                { SPIDER_NET_GTESTMD, 0 },
 
                 { SPIDER_NET_GMACINTEN, 0 },
 
@@ -1692,9 +1576,6 @@ spider_net_enable_card(struct spider_net_card *card)
 
         spider_net_write_reg(card, SPIDER_NET_GRXDMAEN, SPIDER_NET_WOL_VALUE);
 
-        /* set chain tail adress for TX chain */
-        spider_net_enable_txdmac(card);
-
         spider_net_write_reg(card, SPIDER_NET_GMACLENLMT,
                              SPIDER_NET_LENLMT_VALUE);
         spider_net_write_reg(card, SPIDER_NET_GMACMODE,
@@ -1709,6 +1590,9 @@ spider_net_enable_card(struct spider_net_card *card)
                              SPIDER_NET_INT1_MASK_VALUE);
         spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK,
                              SPIDER_NET_INT2_MASK_VALUE);
+
+        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                             SPIDER_NET_GDTDCEIDIS);
 }
 
 /**
@@ -1727,11 +1611,12 @@ spider_net_open(struct net_device *netdev)
         int result;
 
         result = -ENOMEM;
-        if (spider_net_init_chain(card, &card->tx_chain,
-                          card->descr, tx_descriptors))
+        if (spider_net_init_chain(card, &card->tx_chain, card->descr,
+                        PCI_DMA_TODEVICE, card->tx_desc))
                 goto alloc_tx_failed;
         if (spider_net_init_chain(card, &card->rx_chain,
-                          card->descr + tx_descriptors, rx_descriptors))
+                        card->descr + card->rx_desc,
+                        PCI_DMA_FROMDEVICE, card->rx_desc))
                 goto alloc_rx_failed;
 
         /* allocate rx skbs */
@@ -1938,7 +1823,7 @@ spider_net_workaround_rxramfull(struct spider_net_card *card)
         /* empty sequencer data */
         for (sequencer = 0; sequencer < SPIDER_NET_FIRMWARE_SEQS;
              sequencer++) {
-                spider_net_write_reg(card, SPIDER_NET_GSnPRGDAT +
+                spider_net_write_reg(card, SPIDER_NET_GSnPRGADR +
                                      sequencer * 8, 0x0);
                 for (i = 0; i < SPIDER_NET_FIRMWARE_SEQWORDS; i++) {
                         spider_net_write_reg(card, SPIDER_NET_GSnPRGDAT +
@@ -1955,6 +1840,49 @@ spider_net_workaround_rxramfull(struct spider_net_card *card)
 }
 
 /**
+ * spider_net_stop - called upon ifconfig down
+ * @netdev: interface device structure
+ *
+ * always returns 0
+ */
+int
+spider_net_stop(struct net_device *netdev)
+{
+        struct spider_net_card *card = netdev_priv(netdev);
+
+        tasklet_kill(&card->rxram_full_tl);
+        netif_poll_disable(netdev);
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+        del_timer_sync(&card->tx_timer);
+
+        /* disable/mask all interrupts */
+        spider_net_write_reg(card, SPIDER_NET_GHIINT0MSK, 0);
+        spider_net_write_reg(card, SPIDER_NET_GHIINT1MSK, 0);
+        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK, 0);
+
+        /* free_irq(netdev->irq, netdev);*/
+        free_irq(to_pci_dev(netdev->class_dev.dev)->irq, netdev);
+
+        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                             SPIDER_NET_DMA_TX_FEND_VALUE);
+
+        /* turn off DMA, force end */
+        spider_net_disable_rxdmac(card);
+
+        /* release chains */
+        if (spin_trylock(&card->tx_chain.lock)) {
+                spider_net_release_tx_chain(card, 1);
+                spin_unlock(&card->tx_chain.lock);
+        }
+
+        spider_net_free_chain(card, &card->tx_chain);
+        spider_net_free_chain(card, &card->rx_chain);
+
+        return 0;
+}
+
+/**
  * spider_net_tx_timeout_task - task scheduled by the watchdog timeout
  * function (to be called not under interrupt status)
  * @data: data, is interface device structure
@@ -1982,7 +1910,7 @@ spider_net_tx_timeout_task(void *data)
                 goto out;
 
         spider_net_open(netdev);
-        spider_net_kick_tx_dma(card, card->tx_chain.head);
+        spider_net_kick_tx_dma(card);
         netif_device_attach(netdev);
 
 out:
@@ -2065,7 +1993,6 @@ spider_net_setup_netdev(struct spider_net_card *card)
 
         pci_set_drvdata(card->pdev, netdev);
 
-        atomic_set(&card->tx_chain_release,0);
         card->rxram_full_tl.data = (unsigned long) card;
         card->rxram_full_tl.func =
                 (void (*)(unsigned long)) spider_net_handle_rxram_full;
@@ -2077,9 +2004,12 @@ spider_net_setup_netdev(struct spider_net_card *card)
 
         card->options.rx_csum = SPIDER_NET_RX_CSUM_DEFAULT;
 
+        card->tx_desc = tx_descriptors;
+        card->rx_desc = rx_descriptors;
+
         spider_net_setup_netdev_ops(netdev);
 
-        netdev->features = NETIF_F_HW_CSUM;
+        netdev->features = NETIF_F_HW_CSUM | NETIF_F_LLTX;
         /* some time: NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
          *              NETIF_F_HW_VLAN_FILTER */
 
diff --git a/drivers/net/spider_net.h b/drivers/net/spider_net.h
index 3b8d951cf73c..30407cdf0892 100644
--- a/drivers/net/spider_net.h
+++ b/drivers/net/spider_net.h
@@ -208,7 +208,10 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_DMA_RX_VALUE         0x80000000
 #define SPIDER_NET_DMA_RX_FEND_VALUE    0x00030003
 /* to set TX_DMA_EN */
-#define SPIDER_NET_DMA_TX_VALUE         0x80000000
+#define SPIDER_NET_TX_DMA_EN            0x80000000
+#define SPIDER_NET_GDTDCEIDIS           0x00000002
+#define SPIDER_NET_DMA_TX_VALUE         SPIDER_NET_TX_DMA_EN | \
+                                        SPIDER_NET_GDTDCEIDIS
 #define SPIDER_NET_DMA_TX_FEND_VALUE    0x00030003
 
 /* SPIDER_NET_UA_DESCR_VALUE is OR'ed with the unicast address */
@@ -329,55 +332,23 @@ enum spider_net_int2_status {
                                   (~SPIDER_NET_TXINT) & \
                                   (~SPIDER_NET_RXINT) )
 
-#define SPIDER_NET_GPREXEC              0x80000000
-#define SPIDER_NET_GPRDAT_MASK          0x0000ffff
+#define SPIDER_NET_GPREXEC                      0x80000000
+#define SPIDER_NET_GPRDAT_MASK                  0x0000ffff
 
-/* descriptor bits
- *
- * 1010                                 descriptor ready
- *     0                                descr in middle of chain
- *      000                             fixed to 0
- *
- *         0                            no interrupt on completion
- *          000                         fixed to 0
- *             1                        no ipsec processing
- *              1                       last descriptor for this frame
- *               00                     no checksum
- *               10                     tcp checksum
- *               11                     udp checksum
- *
- *                 00                   fixed to 0
- *                   0                  fixed to 0
- *                    0                 no interrupt on response errors
- *                     0                no interrupt on invalid descr
- *                      0               no interrupt on dma process termination
- *                       0              no interrupt on descr chain end
- *                        0             no interrupt on descr complete
- *
- *                         000          fixed to 0
- *                            0         response error interrupt status
- *                             0        invalid descr status
- *                              0       dma termination status
- *                               0      descr chain end status
- *                                0     descr complete status */
-#define SPIDER_NET_DMAC_CMDSTAT_NOCS    0xa00c0000
-#define SPIDER_NET_DMAC_CMDSTAT_TCPCS   0xa00e0000
-#define SPIDER_NET_DMAC_CMDSTAT_UDPCS   0xa00f0000
-#define SPIDER_NET_DESCR_IND_PROC_SHIFT 28
-#define SPIDER_NET_DESCR_IND_PROC_MASKO 0x0fffffff
-
-/* descr ready, descr is in middle of chain, get interrupt on completion */
-#define SPIDER_NET_DMAC_RX_CARDOWNED    0xa0800000
-
-enum spider_net_descr_status {
-        SPIDER_NET_DESCR_COMPLETE               = 0x00, /* used in rx and tx */
-        SPIDER_NET_DESCR_RESPONSE_ERROR         = 0x01, /* used in rx and tx */
-        SPIDER_NET_DESCR_PROTECTION_ERROR       = 0x02, /* used in rx and tx */
-        SPIDER_NET_DESCR_FRAME_END              = 0x04, /* used in rx */
-        SPIDER_NET_DESCR_FORCE_END              = 0x05, /* used in rx and tx */
-        SPIDER_NET_DESCR_CARDOWNED              = 0x0a, /* used in rx and tx */
-        SPIDER_NET_DESCR_NOT_IN_USE /* any other value */
-};
+#define SPIDER_NET_DMAC_NOINTR_COMPLETE         0x00800000
+#define SPIDER_NET_DMAC_NOCS                    0x00040000
+#define SPIDER_NET_DMAC_TCP                     0x00020000
+#define SPIDER_NET_DMAC_UDP                     0x00030000
+#define SPIDER_NET_TXDCEST                      0x08000000
+
+#define SPIDER_NET_DESCR_IND_PROC_MASK          0xF0000000
+#define SPIDER_NET_DESCR_COMPLETE               0x00000000 /* used in rx and tx */
+#define SPIDER_NET_DESCR_RESPONSE_ERROR         0x10000000 /* used in rx and tx */
+#define SPIDER_NET_DESCR_PROTECTION_ERROR       0x20000000 /* used in rx and tx */
+#define SPIDER_NET_DESCR_FRAME_END              0x40000000 /* used in rx */
+#define SPIDER_NET_DESCR_FORCE_END              0x50000000 /* used in rx and tx */
+#define SPIDER_NET_DESCR_CARDOWNED              0xA0000000 /* used in rx and tx */
+#define SPIDER_NET_DESCR_NOT_IN_USE             0xF0000000
 
 struct spider_net_descr {
         /* as defined by the hardware */
@@ -398,7 +369,7 @@ struct spider_net_descr {
 } __attribute__((aligned(32)));
 
 struct spider_net_descr_chain {
-        /* we walk from tail to head */
+        spinlock_t lock;
         struct spider_net_descr *head;
         struct spider_net_descr *tail;
 };
@@ -453,8 +424,6 @@ struct spider_net_card {
 
         struct spider_net_descr_chain tx_chain;
         struct spider_net_descr_chain rx_chain;
-        atomic_t rx_chain_refill;
-        atomic_t tx_chain_release;
 
         struct net_device_stats netdev_stats;
 
@@ -471,6 +440,9 @@ struct spider_net_card {
         /* for ethtool */
         int msg_enable;
 
+        int rx_desc;
+        int tx_desc;
+
         struct spider_net_descr descr[0];
 };
 
diff --git a/drivers/net/spider_net_ethtool.c b/drivers/net/spider_net_ethtool.c
index a5bb0b7633af..02209222b8c9 100644
--- a/drivers/net/spider_net_ethtool.c
+++ b/drivers/net/spider_net_ethtool.c
@@ -130,6 +130,18 @@ spider_net_ethtool_set_tx_csum(struct net_device *netdev, uint32_t data)
         return 0;
 }
 
+static void
+spider_net_ethtool_get_ringparam(struct net_device *netdev,
+                                 struct ethtool_ringparam *ering)
+{
+        struct spider_net_card *card = netdev->priv;
+
+        ering->tx_max_pending = SPIDER_NET_TX_DESCRIPTORS_MAX;
+        ering->tx_pending = card->tx_desc;
+        ering->rx_max_pending = SPIDER_NET_RX_DESCRIPTORS_MAX;
+        ering->rx_pending = card->rx_desc;
+}
+
 struct ethtool_ops spider_net_ethtool_ops = {
         .get_settings           = spider_net_ethtool_get_settings,
         .get_drvinfo            = spider_net_ethtool_get_drvinfo,
@@ -141,5 +153,6 @@ struct ethtool_ops spider_net_ethtool_ops = {
         .set_rx_csum            = spider_net_ethtool_set_rx_csum,
         .get_tx_csum            = spider_net_ethtool_get_tx_csum,
         .set_tx_csum            = spider_net_ethtool_set_tx_csum,
+        .get_ringparam          = spider_net_ethtool_get_ringparam,
 };
 
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index ed1f59901ff4..c0a62b00ffc8 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -22,129 +22,13 @@
 
         Support and updates available at
         http://www.scyld.com/network/starfire.html
+        [link no longer provides useful info -jgarzik]
 
-        -----------------------------------------------------------
-
-        Linux kernel-specific changes:
-
-        LK1.1.1 (jgarzik):
-        - Use PCI driver interface
-        - Fix MOD_xxx races
-        - softnet fixups
-
-        LK1.1.2 (jgarzik):
-        - Merge Becker version 0.15
-
-        LK1.1.3 (Andrew Morton)
-        - Timer cleanups
-
-        LK1.1.4 (jgarzik):
-        - Merge Becker version 1.03
-
-        LK1.2.1 (Ion Badulescu <ionut@cs.columbia.edu>)
-        - Support hardware Rx/Tx checksumming
-        - Use the GFP firmware taken from Adaptec's Netware driver
-
-        LK1.2.2 (Ion Badulescu)
-        - Backported to 2.2.x
-
-        LK1.2.3 (Ion Badulescu)
-        - Fix the flaky mdio interface
-        - More compat clean-ups
-
-        LK1.2.4 (Ion Badulescu)
-        - More 2.2.x initialization fixes
-
-        LK1.2.5 (Ion Badulescu)
-        - Several fixes from Manfred Spraul
-
-        LK1.2.6 (Ion Badulescu)
-        - Fixed ifup/ifdown/ifup problem in 2.4.x
-
-        LK1.2.7 (Ion Badulescu)
-        - Removed unused code
-        - Made more functions static and __init
-
-        LK1.2.8 (Ion Badulescu)
-        - Quell bogus error messages, inform about the Tx threshold
-        - Removed #ifdef CONFIG_PCI, this driver is PCI only
-
-        LK1.2.9 (Ion Badulescu)
-        - Merged Jeff Garzik's changes from 2.4.4-pre5
-        - Added 2.2.x compatibility stuff required by the above changes
-
-        LK1.2.9a (Ion Badulescu)
-        - More updates from Jeff Garzik
-
-        LK1.3.0 (Ion Badulescu)
-        - Merged zerocopy support
-
-        LK1.3.1 (Ion Badulescu)
-        - Added ethtool support
-        - Added GPIO (media change) interrupt support
-
-        LK1.3.2 (Ion Badulescu)
-        - Fixed 2.2.x compatibility issues introduced in 1.3.1
-        - Fixed ethtool ioctl returning uninitialized memory
-
-        LK1.3.3 (Ion Badulescu)
-        - Initialize the TxMode register properly
-        - Don't dereference dev->priv after freeing it
-
-        LK1.3.4 (Ion Badulescu)
-        - Fixed initialization timing problems
-        - Fixed interrupt mask definitions
-
-        LK1.3.5 (jgarzik)
-        - ethtool NWAY_RST, GLINK, [GS]MSGLVL support
-
-        LK1.3.6:
-        - Sparc64 support and fixes (Ion Badulescu)
-        - Better stats and error handling (Ion Badulescu)
-        - Use new pci_set_mwi() PCI API function (jgarzik)
-
-        LK1.3.7 (Ion Badulescu)
-        - minimal implementation of tx_timeout()
-        - correctly shutdown the Rx/Tx engines in netdev_close()
-        - added calls to netif_carrier_on/off
-        (patch from Stefan Rompf <srompf@isg.de>)
-        - VLAN support
-
-        LK1.3.8 (Ion Badulescu)
-        - adjust DMA burst size on sparc64
-        - 64-bit support
-        - reworked zerocopy support for 64-bit buffers
-        - working and usable interrupt mitigation/latency
-        - reduced Tx interrupt frequency for lower interrupt overhead
-
-        LK1.3.9 (Ion Badulescu)
-        - bugfix for mcast filter
-        - enable the right kind of Tx interrupts (TxDMADone, not TxDone)
-
-        LK1.4.0 (Ion Badulescu)
-        - NAPI support
-
-        LK1.4.1 (Ion Badulescu)
-        - flush PCI posting buffers after disabling Rx interrupts
-        - put the chip to a D3 slumber on driver unload
-        - added config option to enable/disable NAPI
-
-        LK1.4.2 (Ion Badulescu)
-        - finally added firmware (GPL'ed by Adaptec)
-        - removed compatibility code for 2.2.x
-
-        LK1.4.2.1 (Ion Badulescu)
-        - fixed 32/64 bit issues on i386 + CONFIG_HIGHMEM
-        - added 32-bit padding to outgoing skb's, removed previous workaround
-
-TODO:   - fix forced speed/duplexing code (broken a long time ago, when
-        somebody converted the driver to use the generic MII code)
-        - fix VLAN support
 */
 
 #define DRV_NAME        "starfire"
-#define DRV_VERSION     "1.03+LK1.4.2.1"
-#define DRV_RELDATE     "October 3, 2005"
+#define DRV_VERSION     "2.0"
+#define DRV_RELDATE     "June 27, 2006"
 
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -846,7 +730,6 @@ static int __devinit starfire_init_one(struct pci_dev *pdev,
                 goto err_out_free_netdev;
         }
 
-        /* ioremap is borken in Linux-2.2.x/sparc64 */
         base = ioremap(ioaddr, io_size);
         if (!base) {
                 printk(KERN_ERR DRV_NAME " %d: cannot remap %#x @ %#lx, aborting\n",
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
index 643fceae3db5..698568e751da 100644
--- a/drivers/net/sundance.c
+++ b/drivers/net/sundance.c
@@ -16,91 +16,13 @@
 
         Support and updates available at
         http://www.scyld.com/network/sundance.html
+        [link no longer provides useful info -jgarzik]
 
-
-        Version LK1.01a (jgarzik):
-        - Replace some MII-related magic numbers with constants
-
-        Version LK1.02 (D-Link):
-        - Add new board to PCI ID list
-        - Fix multicast bug
-
-        Version LK1.03 (D-Link):
-        - New Rx scheme, reduce Rx congestion
-        - Option to disable flow control
-
-        Version LK1.04 (D-Link):
-        - Tx timeout recovery
-        - More support for ethtool.
-
-        Version LK1.04a:
-        - Remove unused/constant members from struct pci_id_info
-        (which then allows removal of 'drv_flags' from private struct)
-        (jgarzik)
-        - If no phy is found, fail to load that board (jgarzik)
-        - Always start phy id scan at id 1 to avoid problems (Donald Becker)
-        - Autodetect where mii_preable_required is needed,
-        default to not needed.  (Donald Becker)
-
-        Version LK1.04b:
-        - Remove mii_preamble_required module parameter (Donald Becker)
-        - Add per-interface mii_preamble_required (setting is autodetected)
-          (Donald Becker)
-        - Remove unnecessary cast from void pointer (jgarzik)
-        - Re-align comments in private struct (jgarzik)
-
-        Version LK1.04c (jgarzik):
-        - Support bitmapped message levels (NETIF_MSG_xxx), and the
-          two ethtool ioctls that get/set them
-        - Don't hand-code MII ethtool support, use standard API/lib
-
-        Version LK1.04d:
-        - Merge from Donald Becker's sundance.c: (Jason Lunz)
-                * proper support for variably-sized MTUs
-                * default to PIO, to fix chip bugs
-        - Add missing unregister_netdev (Jason Lunz)
-        - Add CONFIG_SUNDANCE_MMIO config option (jgarzik)
-        - Better rx buf size calculation (Donald Becker)
-
-        Version LK1.05 (D-Link):
-        - Fix DFE-580TX packet drop issue (for DL10050C)
-        - Fix reset_tx logic
-
-        Version LK1.06 (D-Link):
-        - Fix crash while unloading driver
-
-        Versin LK1.06b (D-Link):
-        - New tx scheme, adaptive tx_coalesce
-        
-        Version LK1.07 (D-Link):
-        - Fix tx bugs in big-endian machines
-        - Remove unused max_interrupt_work module parameter, the new 
-          NAPI-like rx scheme doesn't need it.
-        - Remove redundancy get_stats() in intr_handler(), those 
-          I/O access could affect performance in ARM-based system
-        - Add Linux software VLAN support
-        
-        Version LK1.08 (Philippe De Muyter phdm@macqel.be):
-        - Fix bug of custom mac address 
-        (StationAddr register only accept word write) 
-
-        Version LK1.09 (D-Link):
-        - Fix the flowctrl bug. 
-        - Set Pause bit in MII ANAR if flow control enabled.    
-
-        Version LK1.09a (ICPlus):
-        - Add the delay time in reading the contents of EEPROM
-
-        Version LK1.10 (Philippe De Muyter phdm@macqel.be):
-        - Make 'unblock interface after Tx underrun' work
-
-        Version LK1.11 (Pedro Alejandro Lopez-Valencia palopezv at gmail.com):
-        - Add support for IC Plus Corporation IP100A chipset
 */
 
 #define DRV_NAME        "sundance"
-#define DRV_VERSION     "1.01+LK1.11"
-#define DRV_RELDATE     "14-Jun-2006"
+#define DRV_VERSION     "1.1"
+#define DRV_RELDATE     "27-Jun-2006"
 
 
 /* The user-configurable values.
@@ -185,7 +107,7 @@ static char *media[MAX_UNITS];
 #endif
 
 /* These identify the driver base version and may not be removed. */
-static char version[] __devinitdata =
+static char version[] =
 KERN_INFO DRV_NAME ".c:v" DRV_VERSION " " DRV_RELDATE "  Written by Donald Becker\n"
 KERN_INFO "  http://www.scyld.com/network/sundance.html\n";
 
@@ -282,15 +204,15 @@ IVc. Errata
 #define USE_IO_OPS 1
 #endif
 
-static struct pci_device_id sundance_pci_tbl[] = {
-        {0x1186, 0x1002, 0x1186, 0x1002, 0, 0, 0},
-        {0x1186, 0x1002, 0x1186, 0x1003, 0, 0, 1},
-        {0x1186, 0x1002, 0x1186, 0x1012, 0, 0, 2},
-        {0x1186, 0x1002, 0x1186, 0x1040, 0, 0, 3},
-        {0x1186, 0x1002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
-        {0x13F0, 0x0201, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5},
-        {0x13F0, 0x0200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 6},
-        {0,}
+static const struct pci_device_id sundance_pci_tbl[] = {
+        { 0x1186, 0x1002, 0x1186, 0x1002, 0, 0, 0 },
+        { 0x1186, 0x1002, 0x1186, 0x1003, 0, 0, 1 },
+        { 0x1186, 0x1002, 0x1186, 0x1012, 0, 0, 2 },
+        { 0x1186, 0x1002, 0x1186, 0x1040, 0, 0, 3 },
+        { 0x1186, 0x1002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
+        { 0x13F0, 0x0201, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
+        { 0x13F0, 0x0200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 6 },
+        { }
 };
 MODULE_DEVICE_TABLE(pci, sundance_pci_tbl);
 
@@ -301,7 +223,7 @@ enum {
 struct pci_id_info {
         const char *name;
 };
-static const struct pci_id_info pci_id_tbl[] = {
+static const struct pci_id_info pci_id_tbl[] __devinitdata = {
         {"D-Link DFE-550TX FAST Ethernet Adapter"},
         {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
         {"D-Link DFE-580TX 4 port Server Adapter"},
@@ -309,7 +231,7 @@ static const struct pci_id_info pci_id_tbl[] = {
         {"D-Link DL10050-based FAST Ethernet Adapter"},
         {"Sundance Technology Alta"},
         {"IC Plus Corporation IP100A FAST Ethernet Adapter"},
-        {NULL,},                        /* 0 terminated list. */
+        { }     /* terminate list. */
 };
 
 /* This driver was written to use PCI memory space, however x86-oriented
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 8673fd4c08c7..c6f5bc3c042f 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -3255,12 +3255,7 @@ static void __devexit happy_meal_pci_remove(struct pci_dev *pdev)
 }
 
 static struct pci_device_id happymeal_pci_ids[] = {
-        {
-          .vendor       = PCI_VENDOR_ID_SUN,
-          .device       = PCI_DEVICE_ID_SUN_HAPPYMEAL,
-          .subvendor    = PCI_ANY_ID,
-          .subdevice    = PCI_ANY_ID,
-        },
+        { PCI_DEVICE(PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_HAPPYMEAL) },
         { }                     /* Terminating entry */
 };
 
@@ -3275,7 +3270,7 @@ static struct pci_driver hme_pci_driver = {
 
 static int __init happy_meal_pci_init(void)
 {
-        return pci_module_init(&hme_pci_driver);
+        return pci_register_driver(&hme_pci_driver);
 }
 
 static void happy_meal_pci_exit(void)
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 1ef9fd39a79a..ec0413609f36 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -1537,7 +1537,7 @@ static int __init sparc_lance_init(void)
 {
         if ((idprom->id_machtype == (SM_SUN4|SM_4_330)) ||
             (idprom->id_machtype == (SM_SUN4|SM_4_470))) {
-                memset(&sun4_sdev, 0, sizeof(sdev));
+                memset(&sun4_sdev, 0, sizeof(struct sbus_dev));
                 sun4_sdev.reg_addrs[0].phys_addr = sun4_eth_physaddr;
                 sun4_sdev.irqs[0] = 6;
                 return sparc_lance_probe_one(&sun4_sdev, NULL, NULL);
@@ -1547,16 +1547,16 @@ static int __init sparc_lance_init(void)
 
 static int __exit sunlance_sun4_remove(void)
 {
-        struct lance_private *lp = dev_get_drvdata(&sun4_sdev->dev);
+        struct lance_private *lp = dev_get_drvdata(&sun4_sdev.ofdev.dev);
         struct net_device *net_dev = lp->dev;
 
         unregister_netdevice(net_dev);
 
-        lance_free_hwresources(root_lance_dev);
+        lance_free_hwresources(lp);
 
         free_netdev(net_dev);
 
-        dev_set_drvdata(&sun4_sdev->dev, NULL);
+        dev_set_drvdata(&sun4_sdev.ofdev.dev, NULL);
 
         return 0;
 }
@@ -1566,20 +1566,21 @@ static int __exit sunlance_sun4_remove(void)
 static int __devinit sunlance_sbus_probe(struct of_device *dev, const struct of_device_id *match)
 {
         struct sbus_dev *sdev = to_sbus_device(&dev->dev);
-        struct device_node *dp = dev->node;
         int err;
 
-        if (!strcmp(dp->name, "le")) {
-                err = sparc_lance_probe_one(sdev, NULL, NULL);
-        } else if (!strcmp(dp->name, "ledma")) {
-                struct sbus_dma *ledma = find_ledma(sdev);
+        if (sdev->parent) {
+                struct of_device *parent = &sdev->parent->ofdev;
 
-                err = sparc_lance_probe_one(sdev->child, ledma, NULL);
-        } else {
-                BUG_ON(strcmp(dp->name, "lebuffer"));
+                if (!strcmp(parent->node->name, "ledma")) {
+                        struct sbus_dma *ledma = find_ledma(to_sbus_device(&parent->dev));
 
-                err = sparc_lance_probe_one(sdev->child, NULL, sdev);
-        }
+                        err = sparc_lance_probe_one(sdev, ledma, NULL);
+                } else if (!strcmp(parent->node->name, "lebuffer")) {
+                        err = sparc_lance_probe_one(sdev, NULL, to_sbus_device(&parent->dev));
+                } else
+                        err = sparc_lance_probe_one(sdev, NULL, NULL);
+        } else
+                err = sparc_lance_probe_one(sdev, NULL, NULL);
 
         return err;
 }
@@ -1604,12 +1605,6 @@ static struct of_device_id sunlance_sbus_match[] = {
         {
                 .name = "le",
         },
-        {
-                .name = "ledma",
-        },
-        {
-                .name = "lebuffer",
-        },
         {},
 };
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index e5e1b2962936..eafabb253f08 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.61"
-#define DRV_MODULE_RELDATE      "June 29, 2006"
+#define DRV_MODULE_VERSION      "3.65"
+#define DRV_MODULE_RELDATE      "August 07, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -123,9 +123,6 @@
                                    TG3_RX_RCB_RING_SIZE(tp))
 #define TG3_TX_RING_BYTES       (sizeof(struct tg3_tx_buffer_desc) * \
                                  TG3_TX_RING_SIZE)
-#define TX_BUFFS_AVAIL(TP)                                              \
-        ((TP)->tx_pending -                                             \
-         (((TP)->tx_prod - (TP)->tx_cons) & (TG3_TX_RING_SIZE - 1)))
 #define NEXT_TX(N)              (((N) + 1) & (TG3_TX_RING_SIZE - 1))
 
 #define RX_PKT_BUF_SZ           (1536 + tp->rx_offset + 64)
@@ -2987,6 +2984,13 @@ static void tg3_tx_recover(struct tg3 *tp)
         spin_unlock(&tp->lock);
 }
 
+static inline u32 tg3_tx_avail(struct tg3 *tp)
+{
+        smp_mb();
+        return (tp->tx_pending -
+                ((tp->tx_prod - tp->tx_cons) & (TG3_TX_RING_SIZE - 1)));
+}
+
 /* Tigon3 never reports partial packet sends.  So we do not
  * need special logic to handle SKBs that have not had all
  * of their frags sent yet, like SunGEM does.
@@ -3038,12 +3042,20 @@ static void tg3_tx(struct tg3 *tp)
 
         tp->tx_cons = sw_idx;
 
-        if (unlikely(netif_queue_stopped(tp->dev))) {
-                spin_lock(&tp->tx_lock);
+        /* Need to make the tx_cons update visible to tg3_start_xmit()
+         * before checking for netif_queue_stopped().  Without the
+         * memory barrier, there is a small possibility that tg3_start_xmit()
+         * will miss it and cause the queue to be stopped forever.
+         */
+        smp_mb();
+
+        if (unlikely(netif_queue_stopped(tp->dev) &&
+                     (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH))) {
+                netif_tx_lock(tp->dev);
                 if (netif_queue_stopped(tp->dev) &&
-                    (TX_BUFFS_AVAIL(tp) > TG3_TX_WAKEUP_THRESH))
+                    (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH))
                         netif_wake_queue(tp->dev);
-                spin_unlock(&tp->tx_lock);
+                netif_tx_unlock(tp->dev);
         }
 }
 
@@ -3097,11 +3109,10 @@ static int tg3_alloc_rx_skb(struct tg3 *tp, u32 opaque_key,
          * Callers depend upon this behavior and assume that
          * we leave everything unchanged if we fail.
          */
-        skb = dev_alloc_skb(skb_size);
+        skb = netdev_alloc_skb(tp->dev, skb_size);
         if (skb == NULL)
                 return -ENOMEM;
 
-        skb->dev = tp->dev;
         skb_reserve(skb, tp->rx_offset);
 
         mapping = pci_map_single(tp->pdev, skb->data,
@@ -3270,11 +3281,10 @@ static int tg3_rx(struct tg3 *tp, int budget)
                         tg3_recycle_rx(tp, opaque_key,
                                        desc_idx, *post_ptr);
 
-                        copy_skb = dev_alloc_skb(len + 2);
+                        copy_skb = netdev_alloc_skb(tp->dev, len + 2);
                         if (copy_skb == NULL)
                                 goto drop_it_no_recycle;
 
-                        copy_skb->dev = tp->dev;
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
@@ -3590,6 +3600,28 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
 static int tg3_init_hw(struct tg3 *, int);
 static int tg3_halt(struct tg3 *, int, int);
 
+/* Restart hardware after configuration changes, self-test, etc.
+ * Invoked with tp->lock held.
+ */
+static int tg3_restart_hw(struct tg3 *tp, int reset_phy)
+{
+        int err;
+
+        err = tg3_init_hw(tp, reset_phy);
+        if (err) {
+                printk(KERN_ERR PFX "%s: Failed to re-initialize device, "
+                       "aborting.\n", tp->dev->name);
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+                tg3_full_unlock(tp);
+                del_timer_sync(&tp->timer);
+                tp->irq_sync = 0;
+                netif_poll_enable(tp->dev);
+                dev_close(tp->dev);
+                tg3_full_lock(tp, 0);
+        }
+        return err;
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void tg3_poll_controller(struct net_device *dev)
 {
@@ -3630,13 +3662,15 @@ static void tg3_reset_task(void *_data)
         }
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
-        tg3_init_hw(tp, 1);
+        if (tg3_init_hw(tp, 1))
+                goto out;
 
         tg3_netif_start(tp);
 
         if (restart_timer)
                 mod_timer(&tp->timer, jiffies + 1);
 
+out:
         tp->tg3_flags &= ~TG3_FLAG_IN_RESET_TASK;
 
         tg3_full_unlock(tp);
@@ -3773,7 +3807,7 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * interrupt.  Furthermore, IRQ processing runs lockless so we have
          * no IRQ context deadlocks to worry about either.  Rejoice!
          */
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
+        if (unlikely(tg3_tx_avail(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
 
@@ -3798,18 +3832,24 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         goto out_unlock;
                 }
 
-                tcp_opt_len = ((skb->h.th->doff - 5) * 4);
-                ip_tcp_len = (skb->nh.iph->ihl * 4) + sizeof(struct tcphdr);
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                        mss |= (skb_headlen(skb) - ETH_HLEN) << 9;
+                else {
+                        tcp_opt_len = ((skb->h.th->doff - 5) * 4);
+                        ip_tcp_len = (skb->nh.iph->ihl * 4) +
+                                     sizeof(struct tcphdr);
+
+                        skb->nh.iph->check = 0;
+                        skb->nh.iph->tot_len = htons(mss + ip_tcp_len +
+                                                     tcp_opt_len);
+                        mss |= (ip_tcp_len + tcp_opt_len) << 9;
+                }
 
                 base_flags |= (TXD_FLAG_CPU_PRE_DMA |
                                TXD_FLAG_CPU_POST_DMA);
 
-                skb->nh.iph->check = 0;
-                skb->nh.iph->tot_len = htons(mss + ip_tcp_len + tcp_opt_len);
-
                 skb->h.th->check = 0;
 
-                mss |= (ip_tcp_len + tcp_opt_len) << 9;
         }
         else if (skb->ip_summed == CHECKSUM_HW)
                 base_flags |= TXD_FLAG_TCPUDP_CSUM;
@@ -3863,12 +3903,10 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tw32_tx_mbox((MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW), entry);
 
         tp->tx_prod = entry;
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (MAX_SKB_FRAGS + 1))) {
-                spin_lock(&tp->tx_lock);
+        if (unlikely(tg3_tx_avail(tp) <= (MAX_SKB_FRAGS + 1))) {
                 netif_stop_queue(dev);
-                if (TX_BUFFS_AVAIL(tp) > TG3_TX_WAKEUP_THRESH)
+                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH)
                         netif_wake_queue(tp->dev);
-                spin_unlock(&tp->tx_lock);
         }
 
 out_unlock:
@@ -3890,7 +3928,7 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
         struct sk_buff *segs, *nskb;
 
         /* Estimate the number of fragments in the worst case */
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->gso_segs * 3))) {
+        if (unlikely(tg3_tx_avail(tp) <= (skb_shinfo(skb)->gso_segs * 3))) {
                 netif_stop_queue(tp->dev);
                 return NETDEV_TX_BUSY;
         }
@@ -3930,7 +3968,7 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
          * interrupt.  Furthermore, IRQ processing runs lockless so we have
          * no IRQ context deadlocks to worry about either.  Rejoice!
          */
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
+        if (unlikely(tg3_tx_avail(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
 
@@ -4080,12 +4118,10 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
         tw32_tx_mbox((MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW), entry);
 
         tp->tx_prod = entry;
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (MAX_SKB_FRAGS + 1))) {
-                spin_lock(&tp->tx_lock);
+        if (unlikely(tg3_tx_avail(tp) <= (MAX_SKB_FRAGS + 1))) {
                 netif_stop_queue(dev);
-                if (TX_BUFFS_AVAIL(tp) > TG3_TX_WAKEUP_THRESH)
+                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH)
                         netif_wake_queue(tp->dev);
-                spin_unlock(&tp->tx_lock);
         }
 
 out_unlock:
@@ -4118,6 +4154,7 @@ static inline void tg3_set_mtu(struct net_device *dev, struct tg3 *tp,
 static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct tg3 *tp = netdev_priv(dev);
+        int err;
 
         if (new_mtu < TG3_MIN_MTU || new_mtu > TG3_MAX_MTU(tp))
                 return -EINVAL;
@@ -4138,13 +4175,14 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 
         tg3_set_mtu(dev, tp, new_mtu);
 
-        tg3_init_hw(tp, 0);
+        err = tg3_restart_hw(tp, 0);
 
-        tg3_netif_start(tp);
+        if (!err)
+                tg3_netif_start(tp);
 
         tg3_full_unlock(tp);
 
-        return 0;
+        return err;
 }
 
 /* Free up pending packets in all rx/tx rings.
@@ -4226,7 +4264,7 @@ static void tg3_free_rings(struct tg3 *tp)
  * end up in the driver.  tp->{tx,}lock are held and thus
  * we may not sleep.
  */
-static void tg3_init_rings(struct tg3 *tp)
+static int tg3_init_rings(struct tg3 *tp)
 {
         u32 i;
 
@@ -4275,18 +4313,38 @@ static void tg3_init_rings(struct tg3 *tp)
 
         /* Now allocate fresh SKBs for each rx ring. */
         for (i = 0; i < tp->rx_pending; i++) {
-                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD,
-                                     -1, i) < 0)
+                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD, -1, i) < 0) {
+                        printk(KERN_WARNING PFX
+                               "%s: Using a smaller RX standard ring, "
+                               "only %d out of %d buffers were allocated "
+                               "successfully.\n",
+                               tp->dev->name, i, tp->rx_pending);
+                        if (i == 0)
+                                return -ENOMEM;
+                        tp->rx_pending = i;
                         break;
+                }
         }
 
         if (tp->tg3_flags & TG3_FLAG_JUMBO_RING_ENABLE) {
                 for (i = 0; i < tp->rx_jumbo_pending; i++) {
                         if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_JUMBO,
-                                             -1, i) < 0)
+                                             -1, i) < 0) {
+                                printk(KERN_WARNING PFX
+                                       "%s: Using a smaller RX jumbo ring, "
+                                       "only %d out of %d buffers were "
+                                       "allocated successfully.\n",
+                                       tp->dev->name, i, tp->rx_jumbo_pending);
+                                if (i == 0) {
+                                        tg3_free_rings(tp);
+                                        return -ENOMEM;
+                                }
+                                tp->rx_jumbo_pending = i;
                                 break;
+                        }
                 }
         }
+        return 0;
 }
 
 /*
@@ -5809,6 +5867,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
 {
         struct tg3 *tp = netdev_priv(dev);
         struct sockaddr *addr = p;
+        int err = 0;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EINVAL;
@@ -5826,9 +5885,9 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                 tg3_full_lock(tp, 1);
 
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 0);
-
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 0);
+                if (!err)
+                        tg3_netif_start(tp);
                 tg3_full_unlock(tp);
         } else {
                 spin_lock_bh(&tp->lock);
@@ -5836,7 +5895,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                 spin_unlock_bh(&tp->lock);
         }
 
-        return 0;
+        return err;
 }
 
 /* tp->lock is held. */
@@ -5936,7 +5995,9 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
          * can only do this after the hardware has been
          * successfully reset.
          */
-        tg3_init_rings(tp);
+        err = tg3_init_rings(tp);
+        if (err)
+                return err;
 
         /* This value is determined during the probe time DMA
          * engine test, tg3_test_dma.
@@ -7887,6 +7948,12 @@ static int tg3_set_tso(struct net_device *dev, u32 value)
                         return -EINVAL;
                 return 0;
         }
+        if (tp->tg3_flags2 & TG3_FLG2_HW_TSO_2) {
+                if (value)
+                        dev->features |= NETIF_F_TSO6;
+                else
+                        dev->features &= ~NETIF_F_TSO6;
+        }
         return ethtool_op_set_tso(dev, value);
 }
 #endif
@@ -7944,7 +8011,7 @@ static void tg3_get_ringparam(struct net_device *dev, struct ethtool_ringparam *
 static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ering)
 {
         struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
   
         if ((ering->rx_pending > TG3_RX_RING_SIZE - 1) ||
             (ering->rx_jumbo_pending > TG3_RX_JUMBO_RING_SIZE - 1) ||
@@ -7968,13 +8035,14 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 1);
+                if (!err)
+                        tg3_netif_start(tp);
         }
 
         tg3_full_unlock(tp);
   
-        return 0;
+        return err;
 }
   
 static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
@@ -7989,7 +8057,7 @@ static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
 {
         struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
   
         if (netif_running(dev)) {
                 tg3_netif_stop(tp);
@@ -8013,13 +8081,14 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 1);
+                if (!err)
+                        tg3_netif_start(tp);
         }
 
         tg3_full_unlock(tp);
   
-        return 0;
+        return err;
 }
   
 static u32 tg3_get_rx_csum(struct net_device *dev)
@@ -8555,7 +8624,7 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
         err = -EIO;
 
         tx_len = 1514;
-        skb = dev_alloc_skb(tx_len);
+        skb = netdev_alloc_skb(tp->dev, tx_len);
         if (!skb)
                 return -ENOMEM;
 
@@ -8654,7 +8723,9 @@ static int tg3_test_loopback(struct tg3 *tp)
         if (!netif_running(tp->dev))
                 return TG3_LOOPBACK_FAILED;
 
-        tg3_reset_hw(tp, 1);
+        err = tg3_reset_hw(tp, 1);
+        if (err)
+                return TG3_LOOPBACK_FAILED;
 
         if (tg3_run_loopback(tp, TG3_MAC_LOOPBACK))
                 err |= TG3_MAC_LOOPBACK_FAILED;
@@ -8728,8 +8799,8 @@ static void tg3_self_test(struct net_device *dev, struct ethtool_test *etest,
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 if (netif_running(dev)) {
                         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                        tg3_init_hw(tp, 1);
-                        tg3_netif_start(tp);
+                        if (!tg3_restart_hw(tp, 1))
+                                tg3_netif_start(tp);
                 }
 
                 tg3_full_unlock(tp);
@@ -10066,6 +10137,8 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         static struct pci_device_id write_reorder_chipsets[] = {
                 { PCI_DEVICE(PCI_VENDOR_ID_AMD,
                              PCI_DEVICE_ID_AMD_FE_GATE_700C) },
+                { PCI_DEVICE(PCI_VENDOR_ID_AMD,
+                             PCI_DEVICE_ID_AMD_8131_BRIDGE) },
                 { PCI_DEVICE(PCI_VENDOR_ID_VIA,
                              PCI_DEVICE_ID_VIA_8385_0) },
                 { },
@@ -11407,7 +11480,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         tp->grc_mode |= GRC_MODE_BSWAP_NONFRM_DATA;
 #endif
         spin_lock_init(&tp->lock);
-        spin_lock_init(&tp->tx_lock);
         spin_lock_init(&tp->indirect_lock);
         INIT_WORK(&tp->reset_task, tg3_reset_task, tp);
 
@@ -11507,8 +11579,11 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
          * Firmware TSO on older chips gives lower performance, so it
          * is off by default, but can be enabled using ethtool.
          */
-        if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
+        if (tp->tg3_flags2 & TG3_FLG2_HW_TSO) {
                 dev->features |= NETIF_F_TSO;
+                if (tp->tg3_flags2 & TG3_FLG2_HW_TSO_2)
+                        dev->features |= NETIF_F_TSO6;
+        }
 
 #endif
 
@@ -11682,7 +11757,8 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 tg3_full_lock(tp, 0);
 
                 tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                tg3_init_hw(tp, 1);
+                if (tg3_restart_hw(tp, 1))
+                        goto out;
 
                 tp->timer.expires = jiffies + tp->timer_offset;
                 add_timer(&tp->timer);
@@ -11690,6 +11766,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 netif_device_attach(dev);
                 tg3_netif_start(tp);
 
+out:
                 tg3_full_unlock(tp);
         }
 
@@ -11716,16 +11793,19 @@ static int tg3_resume(struct pci_dev *pdev)
         tg3_full_lock(tp, 0);
 
         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-        tg3_init_hw(tp, 1);
+        err = tg3_restart_hw(tp, 1);
+        if (err)
+                goto out;
 
         tp->timer.expires = jiffies + tp->timer_offset;
         add_timer(&tp->timer);
 
         tg3_netif_start(tp);
 
+out:
         tg3_full_unlock(tp);
 
-        return 0;
+        return err;
 }
 
 static struct pci_driver tg3_driver = {
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index ba2c98711c88..3ecf356cfb08 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2079,9 +2079,9 @@ struct tg3 {
          * lock: Held during reset, PHY access, timer, and when
          *       updating tg3_flags and tg3_flags2.
          *
-         * tx_lock: Held during tg3_start_xmit and tg3_tx only
-         *          when calling netif_[start|stop]_queue.
-         *          tg3_start_xmit is protected by netif_tx_lock.
+         * netif_tx_lock: Held during tg3_start_xmit. tg3_tx holds
+         *                netif_tx_lock when it needs to call
+         *                netif_wake_queue.
          *
          * Both of these locks are to be held with BH safety.
          *
@@ -2118,8 +2118,6 @@ struct tg3 {
         u32                             tx_cons;
         u32                             tx_pending;
 
-        spinlock_t                      tx_lock;
-
         struct tg3_tx_buffer_desc       *tx_ring;
         struct tx_ring_info             *tx_buffers;
         dma_addr_t                      tx_desc_mapping;
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9f491563944e..4470025ff7f8 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -140,7 +140,7 @@ in the event that chatty debug messages are desired - jjs 12/30/98 */
 
 /* version and credits */
 #ifndef PCMCIA
-static char version[] __initdata =
+static char version[] __devinitdata =
     "\nibmtr.c: v1.3.57   8/ 7/94 Peter De Schrijver and Mark Swanson\n"
     "         v2.1.125 10/20/98 Paul Norton    <pnorton@ieee.org>\n"
     "         v2.2.0   12/30/98 Joel Sloan     <jjs@c-me.com>\n"
@@ -216,7 +216,7 @@ static int __devinitdata turbo_irq[IBMTR_MAX_ADAPTERS] = {0};
 static int __devinitdata turbo_searched = 0;
 
 #ifndef PCMCIA
-static __u32 ibmtr_mem_base __initdata = 0xd0000;
+static __u32 ibmtr_mem_base __devinitdata = 0xd0000;
 #endif
 
 static void __devinit PrtChanID(char *pcid, short stride)
diff --git a/drivers/net/tokenring/smctr.c b/drivers/net/tokenring/smctr.c
index cd2e0251e2bc..85a7f797d343 100644
--- a/drivers/net/tokenring/smctr.c
+++ b/drivers/net/tokenring/smctr.c
@@ -5666,7 +5666,7 @@ module_param_array(io, int, NULL, 0);
 module_param_array(irq, int, NULL, 0);
 module_param(ringspeed, int, 0);
 
-static struct net_device *setup_card(int n)
+static struct net_device * __init setup_card(int n)
 {
         struct net_device *dev = alloc_trdev(sizeof(struct net_local));
         int err;
@@ -5696,9 +5696,8 @@ out:
         free_netdev(dev);
         return ERR_PTR(err);
 }
-                        
 
-int init_module(void)
+int __init init_module(void)
 {
         int i, found = 0;
         struct net_device *dev;
diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
index b4c0d101a7d7..eba9083da146 100644
--- a/drivers/net/tulip/winbond-840.c
+++ b/drivers/net/tulip/winbond-840.c
@@ -138,7 +138,7 @@ static int full_duplex[MAX_UNITS] = {-1, -1, -1, -1, -1, -1, -1, -1};
 #include <asm/irq.h>
 
 /* These identify the driver base version and may not be removed. */
-static char version[] __devinitdata =
+static char version[] =
 KERN_INFO DRV_NAME ".c:v" DRV_VERSION " (2.4 port) " DRV_RELDATE "  Donald Becker <becker@scyld.com>\n"
 KERN_INFO "  http://www.scyld.com/network/drivers.html\n";
 
@@ -224,24 +224,21 @@ static const struct pci_device_id w840_pci_tbl[] = {
 };
 MODULE_DEVICE_TABLE(pci, w840_pci_tbl);
 
+enum {
+        netdev_res_size         = 128,  /* size of PCI BAR resource */
+};
+
 struct pci_id_info {
         const char *name;
-        struct match_info {
-                int     pci, pci_mask, subsystem, subsystem_mask;
-                int revision, revision_mask;                            /* Only 8 bits. */
-        } id;
-        int io_size;                            /* Needed for I/O region check or ioremap(). */
-        int drv_flags;                          /* Driver use, intended as capability flags. */
+        int drv_flags;          /* Driver use, intended as capability flags. */
 };
-static struct pci_id_info pci_id_tbl[] = {
-        {"Winbond W89c840",                     /* Sometime a Level-One switch card. */
-         { 0x08401050, 0xffffffff, 0x81530000, 0xffff0000 },
-           128, CanHaveMII | HasBrokenTx | FDXOnNoMII},
-        {"Winbond W89c840", { 0x08401050, 0xffffffff, },
-           128, CanHaveMII | HasBrokenTx},
-        {"Compex RL100-ATX", { 0x201111F6, 0xffffffff,},
-           128, CanHaveMII | HasBrokenTx},
-        {NULL,},                                        /* 0 terminated list. */
+
+static const struct pci_id_info pci_id_tbl[] __devinitdata = {
+        {                               /* Sometime a Level-One switch card. */
+          "Winbond W89c840",    CanHaveMII | HasBrokenTx | FDXOnNoMII},
+        { "Winbond W89c840",    CanHaveMII | HasBrokenTx},
+        { "Compex RL100-ATX",   CanHaveMII | HasBrokenTx},
+        { }     /* terminate list. */
 };
 
 /* This driver was written to use PCI memory space, however some x86 systems
@@ -399,7 +396,7 @@ static int __devinit w840_probe1 (struct pci_dev *pdev,
 #ifdef USE_IO_OPS
         bar = 0;
 #endif
-        ioaddr = pci_iomap(pdev, bar, pci_id_tbl[chip_idx].io_size);
+        ioaddr = pci_iomap(pdev, bar, netdev_res_size);
         if (!ioaddr)
                 goto err_out_free_res;
 
diff --git a/drivers/net/tulip/xircom_cb.c b/drivers/net/tulip/xircom_cb.c
index f874e4f6ccf6..cf43390d2c80 100644
--- a/drivers/net/tulip/xircom_cb.c
+++ b/drivers/net/tulip/xircom_cb.c
@@ -1264,8 +1264,7 @@ static void investigate_write_descriptor(struct net_device *dev, struct xircom_p
 
 static int __init xircom_init(void)
 {
-        pci_register_driver(&xircom_ops);
-        return 0;
+        return pci_register_driver(&xircom_ops);
 }
 
 static void __exit xircom_exit(void)
diff --git a/drivers/net/tulip/xircom_tulip_cb.c b/drivers/net/tulip/xircom_tulip_cb.c
index 091ebb7a62f6..17ca7dc42e6f 100644
--- a/drivers/net/tulip/xircom_tulip_cb.c
+++ b/drivers/net/tulip/xircom_tulip_cb.c
@@ -10,26 +10,11 @@
         410 Severn Ave., Suite 210
         Annapolis MD 21403
 
-        -----------------------------------------------------------
-
-        Linux kernel-specific changes:
-
-        LK1.0 (Ion Badulescu)
-        - Major cleanup
-        - Use 2.4 PCI API
-        - Support ethtool
-        - Rewrite perfect filter/hash code
-        - Use interrupts for media changes
-
-        LK1.1 (Ion Badulescu)
-        - Disallow negotiation of unsupported full-duplex modes
 */
 
 #define DRV_NAME        "xircom_tulip_cb"
-#define DRV_VERSION     "0.91+LK1.1"
-#define DRV_RELDATE     "October 11, 2001"
-
-#define CARDBUS 1
+#define DRV_VERSION     "0.92"
+#define DRV_RELDATE     "June 27, 2006"
 
 /* A few user-configurable values. */
 
@@ -306,10 +291,10 @@ struct xircom_private {
         struct xircom_tx_desc tx_ring[TX_RING_SIZE];
         /* The saved address of a sent-in-place packet/buffer, for skfree(). */
         struct sk_buff* tx_skbuff[TX_RING_SIZE];
-#ifdef CARDBUS
+
         /* The X3201-3 requires 4-byte aligned tx bufs */
         struct sk_buff* tx_aligned_skbuff[TX_RING_SIZE];
-#endif
+
         /* The addresses of receive-in-place skbuffs. */
         struct sk_buff* rx_skbuff[RX_RING_SIZE];
         u16 setup_frame[PKT_SETUP_SZ / sizeof(u16)];    /* Pseudo-Tx frame to init address table. */
@@ -908,10 +893,8 @@ static void xircom_init_ring(struct net_device *dev)
                 tp->tx_skbuff[i] = NULL;
                 tp->tx_ring[i].status = 0;
                 tp->tx_ring[i].buffer2 = virt_to_bus(&tp->tx_ring[i+1]);
-#ifdef CARDBUS
                 if (tp->chip_id == X3201_3)
                         tp->tx_aligned_skbuff[i] = dev_alloc_skb(PKT_BUF_SZ);
-#endif /* CARDBUS */
         }
         tp->tx_ring[i-1].buffer2 = virt_to_bus(&tp->tx_ring[0]);
 }
@@ -931,12 +914,10 @@ xircom_start_xmit(struct sk_buff *skb, struct net_device *dev)
         entry = tp->cur_tx % TX_RING_SIZE;
 
         tp->tx_skbuff[entry] = skb;
-#ifdef CARDBUS
         if (tp->chip_id == X3201_3) {
                 memcpy(tp->tx_aligned_skbuff[entry]->data,skb->data,skb->len);
                 tp->tx_ring[entry].buffer1 = virt_to_bus(tp->tx_aligned_skbuff[entry]->data);
         } else
-#endif
                 tp->tx_ring[entry].buffer1 = virt_to_bus(skb->data);
 
         if (tp->cur_tx - tp->dirty_tx < TX_RING_SIZE/2) {/* Typical path */
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index 063816f2b11e..4103c37172f9 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -805,7 +805,7 @@ typhoon_start_tx(struct sk_buff *skb, struct net_device *dev)
          * If problems develop with TSO, check this first.
          */
         numDesc = skb_shinfo(skb)->nr_frags + 1;
-        if(skb_tso_size(skb))
+        if (skb_is_gso(skb))
                 numDesc++;
 
         /* When checking for free space in the ring, we need to also
@@ -845,7 +845,7 @@ typhoon_start_tx(struct sk_buff *skb, struct net_device *dev)
                                 TYPHOON_TX_PF_VLAN_TAG_SHIFT);
         }
 
-        if(skb_tso_size(skb)) {
+        if (skb_is_gso(skb)) {
                 first_txd->processFlags |= TYPHOON_TX_PF_TCP_SEGMENT;
                 first_txd->numDesc++;
 
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
new file mode 100644
index 000000000000..47f49ef72bdc
--- /dev/null
+++ b/drivers/net/ucc_geth.c
@@ -0,0 +1,4278 @@
+/*
+ * Copyright (C) Freescale Semicondutor, Inc. 2006. All rights reserved.
+ *
+ * Author: Shlomi Gridish <gridish@freescale.com>
+ *
+ * Description:
+ * QE UCC Gigabit Ethernet Driver
+ *
+ * Changelog:
+ * Jul 6, 2006 Li Yang <LeoLi@freescale.com>
+ * - Rearrange code and style fixes
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/stddef.h>
+#include <linux/interrupt.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/ethtool.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/fsl_devices.h>
+#include <linux/ethtool.h>
+#include <linux/platform_device.h>
+#include <linux/mii.h>
+
+#include <asm/uaccess.h>
+#include <asm/irq.h>
+#include <asm/io.h>
+#include <asm/immap_qe.h>
+#include <asm/qe.h>
+#include <asm/ucc.h>
+#include <asm/ucc_fast.h>
+
+#include "ucc_geth.h"
+#include "ucc_geth_phy.h"
+
+#undef DEBUG
+
+#define DRV_DESC "QE UCC Gigabit Ethernet Controller version:June 20, 2006"
+#define DRV_NAME "ucc_geth"
+
+#define ugeth_printk(level, format, arg...)  \
+        printk(level format "\n", ## arg)
+
+#define ugeth_dbg(format, arg...)            \
+        ugeth_printk(KERN_DEBUG , format , ## arg)
+#define ugeth_err(format, arg...)            \
+        ugeth_printk(KERN_ERR , format , ## arg)
+#define ugeth_info(format, arg...)           \
+        ugeth_printk(KERN_INFO , format , ## arg)
+#define ugeth_warn(format, arg...)           \
+        ugeth_printk(KERN_WARNING , format , ## arg)
+
+#ifdef UGETH_VERBOSE_DEBUG
+#define ugeth_vdbg ugeth_dbg
+#else
+#define ugeth_vdbg(fmt, args...) do { } while (0)
+#endif                          /* UGETH_VERBOSE_DEBUG */
+
+static DEFINE_SPINLOCK(ugeth_lock);
+
+static ucc_geth_info_t ugeth_primary_info = {
+        .uf_info = {
+                    .bd_mem_part = MEM_PART_SYSTEM,
+                    .rtsm = UCC_FAST_SEND_IDLES_BETWEEN_FRAMES,
+                    .max_rx_buf_length = 1536,
+/* FIXME: should be changed in run time for 1G and 100M */
+#ifdef CONFIG_UGETH_HAS_GIGA
+                    .urfs = UCC_GETH_URFS_GIGA_INIT,
+                    .urfet = UCC_GETH_URFET_GIGA_INIT,
+                    .urfset = UCC_GETH_URFSET_GIGA_INIT,
+                    .utfs = UCC_GETH_UTFS_GIGA_INIT,
+                    .utfet = UCC_GETH_UTFET_GIGA_INIT,
+                    .utftt = UCC_GETH_UTFTT_GIGA_INIT,
+#else
+                    .urfs = UCC_GETH_URFS_INIT,
+                    .urfet = UCC_GETH_URFET_INIT,
+                    .urfset = UCC_GETH_URFSET_INIT,
+                    .utfs = UCC_GETH_UTFS_INIT,
+                    .utfet = UCC_GETH_UTFET_INIT,
+                    .utftt = UCC_GETH_UTFTT_INIT,
+#endif
+                    .ufpt = 256,
+                    .mode = UCC_FAST_PROTOCOL_MODE_ETHERNET,
+                    .ttx_trx = UCC_FAST_GUMR_TRANSPARENT_TTX_TRX_NORMAL,
+                    .tenc = UCC_FAST_TX_ENCODING_NRZ,
+                    .renc = UCC_FAST_RX_ENCODING_NRZ,
+                    .tcrc = UCC_FAST_16_BIT_CRC,
+                    .synl = UCC_FAST_SYNC_LEN_NOT_USED,
+                    },
+        .numQueuesTx = 1,
+        .numQueuesRx = 1,
+        .extendedFilteringChainPointer = ((uint32_t) NULL),
+        .typeorlen = 3072 /*1536 */ ,
+        .nonBackToBackIfgPart1 = 0x40,
+        .nonBackToBackIfgPart2 = 0x60,
+        .miminumInterFrameGapEnforcement = 0x50,
+        .backToBackInterFrameGap = 0x60,
+        .mblinterval = 128,
+        .nortsrbytetime = 5,
+        .fracsiz = 1,
+        .strictpriorityq = 0xff,
+        .altBebTruncation = 0xa,
+        .excessDefer = 1,
+        .maxRetransmission = 0xf,
+        .collisionWindow = 0x37,
+        .receiveFlowControl = 1,
+        .maxGroupAddrInHash = 4,
+        .maxIndAddrInHash = 4,
+        .prel = 7,
+        .maxFrameLength = 1518,
+        .minFrameLength = 64,
+        .maxD1Length = 1520,
+        .maxD2Length = 1520,
+        .vlantype = 0x8100,
+        .ecamptr = ((uint32_t) NULL),
+        .eventRegMask = UCCE_OTHER,
+        .pausePeriod = 0xf000,
+        .interruptcoalescingmaxvalue = {1, 1, 1, 1, 1, 1, 1, 1},
+        .bdRingLenTx = {
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN,
+                        TX_BD_RING_LEN},
+
+        .bdRingLenRx = {
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN,
+                        RX_BD_RING_LEN},
+
+        .numStationAddresses = UCC_GETH_NUM_OF_STATION_ADDRESSES_1,
+        .largestexternallookupkeysize =
+            QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_NONE,
+        .statisticsMode = UCC_GETH_STATISTICS_GATHERING_MODE_NONE,
+        .vlanOperationTagged = UCC_GETH_VLAN_OPERATION_TAGGED_NOP,
+        .vlanOperationNonTagged = UCC_GETH_VLAN_OPERATION_NON_TAGGED_NOP,
+        .rxQoSMode = UCC_GETH_QOS_MODE_DEFAULT,
+        .aufc = UPSMR_AUTOMATIC_FLOW_CONTROL_MODE_NONE,
+        .padAndCrc = MACCFG2_PAD_AND_CRC_MODE_PAD_AND_CRC,
+        .numThreadsTx = UCC_GETH_NUM_OF_THREADS_4,
+        .numThreadsRx = UCC_GETH_NUM_OF_THREADS_4,
+        .riscTx = QE_RISC_ALLOCATION_RISC1_AND_RISC2,
+        .riscRx = QE_RISC_ALLOCATION_RISC1_AND_RISC2,
+};
+
+static ucc_geth_info_t ugeth_info[8];
+
+#ifdef DEBUG
+static void mem_disp(u8 *addr, int size)
+{
+        u8 *i;
+        int size16Aling = (size >> 4) << 4;
+        int size4Aling = (size >> 2) << 2;
+        int notAlign = 0;
+        if (size % 16)
+                notAlign = 1;
+
+        for (i = addr; (u32) i < (u32) addr + size16Aling; i += 16)
+                printk("0x%08x: %08x %08x %08x %08x\r\n",
+                       (u32) i,
+                       *((u32 *) (i)),
+                       *((u32 *) (i + 4)),
+                       *((u32 *) (i + 8)), *((u32 *) (i + 12)));
+        if (notAlign == 1)
+                printk("0x%08x: ", (u32) i);
+        for (; (u32) i < (u32) addr + size4Aling; i += 4)
+                printk("%08x ", *((u32 *) (i)));
+        for (; (u32) i < (u32) addr + size; i++)
+                printk("%02x", *((u8 *) (i)));
+        if (notAlign == 1)
+                printk("\r\n");
+}
+#endif /* DEBUG */
+
+#ifdef CONFIG_UGETH_FILTERING
+static void enqueue(struct list_head *node, struct list_head *lh)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(ugeth_lock, flags);
+        list_add_tail(node, lh);
+        spin_unlock_irqrestore(ugeth_lock, flags);
+}
+#endif /* CONFIG_UGETH_FILTERING */
+
+static struct list_head *dequeue(struct list_head *lh)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(ugeth_lock, flags);
+        if (!list_empty(lh)) {
+                struct list_head *node = lh->next;
+                list_del(node);
+                spin_unlock_irqrestore(ugeth_lock, flags);
+                return node;
+        } else {
+                spin_unlock_irqrestore(ugeth_lock, flags);
+                return NULL;
+        }
+}
+
+static int get_interface_details(enet_interface_e enet_interface,
+                                 enet_speed_e *speed,
+                                 int *r10m,
+                                 int *rmm,
+                                 int *rpm,
+                                 int *tbi, int *limited_to_full_duplex)
+{
+        /* Analyze enet_interface according to Interface Mode
+        Configuration table */
+        switch (enet_interface) {
+        case ENET_10_MII:
+                *speed = ENET_SPEED_10BT;
+                break;
+        case ENET_10_RMII:
+                *speed = ENET_SPEED_10BT;
+                *r10m = 1;
+                *rmm = 1;
+                break;
+        case ENET_10_RGMII:
+                *speed = ENET_SPEED_10BT;
+                *rpm = 1;
+                *r10m = 1;
+                *limited_to_full_duplex = 1;
+                break;
+        case ENET_100_MII:
+                *speed = ENET_SPEED_100BT;
+                break;
+        case ENET_100_RMII:
+                *speed = ENET_SPEED_100BT;
+                *rmm = 1;
+                break;
+        case ENET_100_RGMII:
+                *speed = ENET_SPEED_100BT;
+                *rpm = 1;
+                *limited_to_full_duplex = 1;
+                break;
+        case ENET_1000_GMII:
+                *speed = ENET_SPEED_1000BT;
+                *limited_to_full_duplex = 1;
+                break;
+        case ENET_1000_RGMII:
+                *speed = ENET_SPEED_1000BT;
+                *rpm = 1;
+                *limited_to_full_duplex = 1;
+                break;
+        case ENET_1000_TBI:
+                *speed = ENET_SPEED_1000BT;
+                *tbi = 1;
+                *limited_to_full_duplex = 1;
+                break;
+        case ENET_1000_RTBI:
+                *speed = ENET_SPEED_1000BT;
+                *rpm = 1;
+                *tbi = 1;
+                *limited_to_full_duplex = 1;
+                break;
+        default:
+                return -EINVAL;
+                break;
+        }
+
+        return 0;
+}
+
+static struct sk_buff *get_new_skb(ucc_geth_private_t *ugeth, u8 *bd)
+{
+        struct sk_buff *skb = NULL;
+
+        skb = dev_alloc_skb(ugeth->ug_info->uf_info.max_rx_buf_length +
+                                  UCC_GETH_RX_DATA_BUF_ALIGNMENT);
+
+        if (skb == NULL)
+                return NULL;
+
+        /* We need the data buffer to be aligned properly.  We will reserve
+         * as many bytes as needed to align the data properly
+         */
+        skb_reserve(skb,
+                    UCC_GETH_RX_DATA_BUF_ALIGNMENT -
+                    (((unsigned)skb->data) & (UCC_GETH_RX_DATA_BUF_ALIGNMENT -
+                                              1)));
+
+        skb->dev = ugeth->dev;
+
+        BD_BUFFER_SET(bd,
+                      dma_map_single(NULL,
+                                     skb->data,
+                                     ugeth->ug_info->uf_info.max_rx_buf_length +
+                                     UCC_GETH_RX_DATA_BUF_ALIGNMENT,
+                                     DMA_FROM_DEVICE));
+
+        BD_STATUS_AND_LENGTH_SET(bd,
+                                 (R_E | R_I |
+                                  (BD_STATUS_AND_LENGTH(bd) & R_W)));
+
+        return skb;
+}
+
+static int rx_bd_buffer_set(ucc_geth_private_t *ugeth, u8 rxQ)
+{
+        u8 *bd;
+        u32 bd_status;
+        struct sk_buff *skb;
+        int i;
+
+        bd = ugeth->p_rx_bd_ring[rxQ];
+        i = 0;
+
+        do {
+                bd_status = BD_STATUS_AND_LENGTH(bd);
+                skb = get_new_skb(ugeth, bd);
+
+                if (!skb)       /* If can not allocate data buffer,
+                                abort. Cleanup will be elsewhere */
+                        return -ENOMEM;
+
+                ugeth->rx_skbuff[rxQ][i] = skb;
+
+                /* advance the BD pointer */
+                bd += UCC_GETH_SIZE_OF_BD;
+                i++;
+        } while (!(bd_status & R_W));
+
+        return 0;
+}
+
+static int fill_init_enet_entries(ucc_geth_private_t *ugeth,
+                                  volatile u32 *p_start,
+                                  u8 num_entries,
+                                  u32 thread_size,
+                                  u32 thread_alignment,
+                                  qe_risc_allocation_e risc,
+                                  int skip_page_for_first_entry)
+{
+        u32 init_enet_offset;
+        u8 i;
+        int snum;
+
+        for (i = 0; i < num_entries; i++) {
+                if ((snum = qe_get_snum()) < 0) {
+                        ugeth_err("fill_init_enet_entries: Can not get SNUM.");
+                        return snum;
+                }
+                if ((i == 0) && skip_page_for_first_entry)
+                /* First entry of Rx does not have page */
+                        init_enet_offset = 0;
+                else {
+                        init_enet_offset =
+                            qe_muram_alloc(thread_size, thread_alignment);
+                        if (IS_MURAM_ERR(init_enet_offset)) {
+                                ugeth_err
+                ("fill_init_enet_entries: Can not allocate DPRAM memory.");
+                                qe_put_snum((u8) snum);
+                                return -ENOMEM;
+                        }
+                }
+                *(p_start++) =
+                    ((u8) snum << ENET_INIT_PARAM_SNUM_SHIFT) | init_enet_offset
+                    | risc;
+        }
+
+        return 0;
+}
+
+static int return_init_enet_entries(ucc_geth_private_t *ugeth,
+                                    volatile u32 *p_start,
+                                    u8 num_entries,
+                                    qe_risc_allocation_e risc,
+                                    int skip_page_for_first_entry)
+{
+        u32 init_enet_offset;
+        u8 i;
+        int snum;
+
+        for (i = 0; i < num_entries; i++) {
+                /* Check that this entry was actually valid --
+                needed in case failed in allocations */
+                if ((*p_start & ENET_INIT_PARAM_RISC_MASK) == risc) {
+                        snum =
+                            (u32) (*p_start & ENET_INIT_PARAM_SNUM_MASK) >>
+                            ENET_INIT_PARAM_SNUM_SHIFT;
+                        qe_put_snum((u8) snum);
+                        if (!((i == 0) && skip_page_for_first_entry)) {
+                        /* First entry of Rx does not have page */
+                                init_enet_offset =
+                                    (in_be32(p_start) &
+                                     ENET_INIT_PARAM_PTR_MASK);
+                                qe_muram_free(init_enet_offset);
+                        }
+                        *(p_start++) = 0;       /* Just for cosmetics */
+                }
+        }
+
+        return 0;
+}
+
+#ifdef DEBUG
+static int dump_init_enet_entries(ucc_geth_private_t *ugeth,
+                                  volatile u32 *p_start,
+                                  u8 num_entries,
+                                  u32 thread_size,
+                                  qe_risc_allocation_e risc,
+                                  int skip_page_for_first_entry)
+{
+        u32 init_enet_offset;
+        u8 i;
+        int snum;
+
+        for (i = 0; i < num_entries; i++) {
+                /* Check that this entry was actually valid --
+                needed in case failed in allocations */
+                if ((*p_start & ENET_INIT_PARAM_RISC_MASK) == risc) {
+                        snum =
+                            (u32) (*p_start & ENET_INIT_PARAM_SNUM_MASK) >>
+                            ENET_INIT_PARAM_SNUM_SHIFT;
+                        qe_put_snum((u8) snum);
+                        if (!((i == 0) && skip_page_for_first_entry)) {
+                        /* First entry of Rx does not have page */
+                                init_enet_offset =
+                                    (in_be32(p_start) &
+                                     ENET_INIT_PARAM_PTR_MASK);
+                                ugeth_info("Init enet entry %d:", i);
+                                ugeth_info("Base address: 0x%08x",
+                                           (u32)
+                                           qe_muram_addr(init_enet_offset));
+                                mem_disp(qe_muram_addr(init_enet_offset),
+                                         thread_size);
+                        }
+                        p_start++;
+                }
+        }
+
+        return 0;
+}
+#endif
+
+#ifdef CONFIG_UGETH_FILTERING
+static enet_addr_container_t *get_enet_addr_container(void)
+{
+        enet_addr_container_t *enet_addr_cont;
+
+        /* allocate memory */
+        enet_addr_cont = kmalloc(sizeof(enet_addr_container_t), GFP_KERNEL);
+        if (!enet_addr_cont) {
+                ugeth_err("%s: No memory for enet_addr_container_t object.",
+                          __FUNCTION__);
+                return NULL;
+        }
+
+        return enet_addr_cont;
+}
+#endif /* CONFIG_UGETH_FILTERING */
+
+static void put_enet_addr_container(enet_addr_container_t *enet_addr_cont)
+{
+        kfree(enet_addr_cont);
+}
+
+#ifdef CONFIG_UGETH_FILTERING
+static int hw_add_addr_in_paddr(ucc_geth_private_t *ugeth,
+                                enet_addr_t *p_enet_addr, u8 paddr_num)
+{
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+
+        if (!(paddr_num < NUM_OF_PADDRS)) {
+                ugeth_warn("%s: Illagel paddr_num.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        p_82xx_addr_filt =
+            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            addressfiltering;
+
+        /* Ethernet frames are defined in Little Endian mode,    */
+        /* therefore to insert the address we reverse the bytes. */
+        out_be16(&p_82xx_addr_filt->paddr[paddr_num].h,
+                 (u16) (((u16) (((u16) ((*p_enet_addr)[5])) << 8)) |
+                        (u16) (*p_enet_addr)[4]));
+        out_be16(&p_82xx_addr_filt->paddr[paddr_num].m,
+                 (u16) (((u16) (((u16) ((*p_enet_addr)[3])) << 8)) |
+                        (u16) (*p_enet_addr)[2]));
+        out_be16(&p_82xx_addr_filt->paddr[paddr_num].l,
+                 (u16) (((u16) (((u16) ((*p_enet_addr)[1])) << 8)) |
+                        (u16) (*p_enet_addr)[0]));
+
+        return 0;
+}
+#endif /* CONFIG_UGETH_FILTERING */
+
+static int hw_clear_addr_in_paddr(ucc_geth_private_t *ugeth, u8 paddr_num)
+{
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+
+        if (!(paddr_num < NUM_OF_PADDRS)) {
+                ugeth_warn("%s: Illagel paddr_num.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        p_82xx_addr_filt =
+            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            addressfiltering;
+
+        /* Writing address ff.ff.ff.ff.ff.ff disables address
+        recognition for this register */
+        out_be16(&p_82xx_addr_filt->paddr[paddr_num].h, 0xffff);
+        out_be16(&p_82xx_addr_filt->paddr[paddr_num].m, 0xffff);
+        out_be16(&p_82xx_addr_filt->paddr[paddr_num].l, 0xffff);
+
+        return 0;
+}
+
+static void hw_add_addr_in_hash(ucc_geth_private_t *ugeth,
+                                enet_addr_t *p_enet_addr)
+{
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        u32 cecr_subblock;
+
+        p_82xx_addr_filt =
+            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            addressfiltering;
+
+        cecr_subblock =
+            ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
+
+        /* Ethernet frames are defined in Little Endian mode,
+        therefor to insert */
+        /* the address to the hash (Big Endian mode), we reverse the bytes.*/
+        out_be16(&p_82xx_addr_filt->taddr.h,
+                 (u16) (((u16) (((u16) ((*p_enet_addr)[5])) << 8)) |
+                        (u16) (*p_enet_addr)[4]));
+        out_be16(&p_82xx_addr_filt->taddr.m,
+                 (u16) (((u16) (((u16) ((*p_enet_addr)[3])) << 8)) |
+                        (u16) (*p_enet_addr)[2]));
+        out_be16(&p_82xx_addr_filt->taddr.l,
+                 (u16) (((u16) (((u16) ((*p_enet_addr)[1])) << 8)) |
+                        (u16) (*p_enet_addr)[0]));
+
+        qe_issue_cmd(QE_SET_GROUP_ADDRESS, cecr_subblock,
+                     (u8) QE_CR_PROTOCOL_ETHERNET, 0);
+}
+
+#ifdef CONFIG_UGETH_MAGIC_PACKET
+static void magic_packet_detection_enable(ucc_geth_private_t *ugeth)
+{
+        ucc_fast_private_t *uccf;
+        ucc_geth_t *ug_regs;
+        u32 maccfg2, uccm;
+
+        uccf = ugeth->uccf;
+        ug_regs = ugeth->ug_regs;
+
+        /* Enable interrupts for magic packet detection */
+        uccm = in_be32(uccf->p_uccm);
+        uccm |= UCCE_MPD;
+        out_be32(uccf->p_uccm, uccm);
+
+        /* Enable magic packet detection */
+        maccfg2 = in_be32(&ug_regs->maccfg2);
+        maccfg2 |= MACCFG2_MPE;
+        out_be32(&ug_regs->maccfg2, maccfg2);
+}
+
+static void magic_packet_detection_disable(ucc_geth_private_t *ugeth)
+{
+        ucc_fast_private_t *uccf;
+        ucc_geth_t *ug_regs;
+        u32 maccfg2, uccm;
+
+        uccf = ugeth->uccf;
+        ug_regs = ugeth->ug_regs;
+
+        /* Disable interrupts for magic packet detection */
+        uccm = in_be32(uccf->p_uccm);
+        uccm &= ~UCCE_MPD;
+        out_be32(uccf->p_uccm, uccm);
+
+        /* Disable magic packet detection */
+        maccfg2 = in_be32(&ug_regs->maccfg2);
+        maccfg2 &= ~MACCFG2_MPE;
+        out_be32(&ug_regs->maccfg2, maccfg2);
+}
+#endif /* MAGIC_PACKET */
+
+static inline int compare_addr(enet_addr_t *addr1, enet_addr_t *addr2)
+{
+        return memcmp(addr1, addr2, ENET_NUM_OCTETS_PER_ADDRESS);
+}
+
+#ifdef DEBUG
+static void get_statistics(ucc_geth_private_t *ugeth,
+                           ucc_geth_tx_firmware_statistics_t *
+                           tx_firmware_statistics,
+                           ucc_geth_rx_firmware_statistics_t *
+                           rx_firmware_statistics,
+                           ucc_geth_hardware_statistics_t *hardware_statistics)
+{
+        ucc_fast_t *uf_regs;
+        ucc_geth_t *ug_regs;
+        ucc_geth_tx_firmware_statistics_pram_t *p_tx_fw_statistics_pram;
+        ucc_geth_rx_firmware_statistics_pram_t *p_rx_fw_statistics_pram;
+
+        ug_regs = ugeth->ug_regs;
+        uf_regs = (ucc_fast_t *) ug_regs;
+        p_tx_fw_statistics_pram = ugeth->p_tx_fw_statistics_pram;
+        p_rx_fw_statistics_pram = ugeth->p_rx_fw_statistics_pram;
+
+        /* Tx firmware only if user handed pointer and driver actually
+        gathers Tx firmware statistics */
+        if (tx_firmware_statistics && p_tx_fw_statistics_pram) {
+                tx_firmware_statistics->sicoltx =
+                    in_be32(&p_tx_fw_statistics_pram->sicoltx);
+                tx_firmware_statistics->mulcoltx =
+                    in_be32(&p_tx_fw_statistics_pram->mulcoltx);
+                tx_firmware_statistics->latecoltxfr =
+                    in_be32(&p_tx_fw_statistics_pram->latecoltxfr);
+                tx_firmware_statistics->frabortduecol =
+                    in_be32(&p_tx_fw_statistics_pram->frabortduecol);
+                tx_firmware_statistics->frlostinmactxer =
+                    in_be32(&p_tx_fw_statistics_pram->frlostinmactxer);
+                tx_firmware_statistics->carriersenseertx =
+                    in_be32(&p_tx_fw_statistics_pram->carriersenseertx);
+                tx_firmware_statistics->frtxok =
+                    in_be32(&p_tx_fw_statistics_pram->frtxok);
+                tx_firmware_statistics->txfrexcessivedefer =
+                    in_be32(&p_tx_fw_statistics_pram->txfrexcessivedefer);
+                tx_firmware_statistics->txpkts256 =
+                    in_be32(&p_tx_fw_statistics_pram->txpkts256);
+                tx_firmware_statistics->txpkts512 =
+                    in_be32(&p_tx_fw_statistics_pram->txpkts512);
+                tx_firmware_statistics->txpkts1024 =
+                    in_be32(&p_tx_fw_statistics_pram->txpkts1024);
+                tx_firmware_statistics->txpktsjumbo =
+                    in_be32(&p_tx_fw_statistics_pram->txpktsjumbo);
+        }
+
+        /* Rx firmware only if user handed pointer and driver actually
+         * gathers Rx firmware statistics */
+        if (rx_firmware_statistics && p_rx_fw_statistics_pram) {
+                int i;
+                rx_firmware_statistics->frrxfcser =
+                    in_be32(&p_rx_fw_statistics_pram->frrxfcser);
+                rx_firmware_statistics->fraligner =
+                    in_be32(&p_rx_fw_statistics_pram->fraligner);
+                rx_firmware_statistics->inrangelenrxer =
+                    in_be32(&p_rx_fw_statistics_pram->inrangelenrxer);
+                rx_firmware_statistics->outrangelenrxer =
+                    in_be32(&p_rx_fw_statistics_pram->outrangelenrxer);
+                rx_firmware_statistics->frtoolong =
+                    in_be32(&p_rx_fw_statistics_pram->frtoolong);
+                rx_firmware_statistics->runt =
+                    in_be32(&p_rx_fw_statistics_pram->runt);
+                rx_firmware_statistics->verylongevent =
+                    in_be32(&p_rx_fw_statistics_pram->verylongevent);
+                rx_firmware_statistics->symbolerror =
+                    in_be32(&p_rx_fw_statistics_pram->symbolerror);
+                rx_firmware_statistics->dropbsy =
+                    in_be32(&p_rx_fw_statistics_pram->dropbsy);
+                for (i = 0; i < 0x8; i++)
+                        rx_firmware_statistics->res0[i] =
+                            p_rx_fw_statistics_pram->res0[i];
+                rx_firmware_statistics->mismatchdrop =
+                    in_be32(&p_rx_fw_statistics_pram->mismatchdrop);
+                rx_firmware_statistics->underpkts =
+                    in_be32(&p_rx_fw_statistics_pram->underpkts);
+                rx_firmware_statistics->pkts256 =
+                    in_be32(&p_rx_fw_statistics_pram->pkts256);
+                rx_firmware_statistics->pkts512 =
+                    in_be32(&p_rx_fw_statistics_pram->pkts512);
+                rx_firmware_statistics->pkts1024 =
+                    in_be32(&p_rx_fw_statistics_pram->pkts1024);
+                rx_firmware_statistics->pktsjumbo =
+                    in_be32(&p_rx_fw_statistics_pram->pktsjumbo);
+                rx_firmware_statistics->frlossinmacer =
+                    in_be32(&p_rx_fw_statistics_pram->frlossinmacer);
+                rx_firmware_statistics->pausefr =
+                    in_be32(&p_rx_fw_statistics_pram->pausefr);
+                for (i = 0; i < 0x4; i++)
+                        rx_firmware_statistics->res1[i] =
+                            p_rx_fw_statistics_pram->res1[i];
+                rx_firmware_statistics->removevlan =
+                    in_be32(&p_rx_fw_statistics_pram->removevlan);
+                rx_firmware_statistics->replacevlan =
+                    in_be32(&p_rx_fw_statistics_pram->replacevlan);
+                rx_firmware_statistics->insertvlan =
+                    in_be32(&p_rx_fw_statistics_pram->insertvlan);
+        }
+
+        /* Hardware only if user handed pointer and driver actually
+        gathers hardware statistics */
+        if (hardware_statistics && (in_be32(&uf_regs->upsmr) & UPSMR_HSE)) {
+                hardware_statistics->tx64 = in_be32(&ug_regs->tx64);
+                hardware_statistics->tx127 = in_be32(&ug_regs->tx127);
+                hardware_statistics->tx255 = in_be32(&ug_regs->tx255);
+                hardware_statistics->rx64 = in_be32(&ug_regs->rx64);
+                hardware_statistics->rx127 = in_be32(&ug_regs->rx127);
+                hardware_statistics->rx255 = in_be32(&ug_regs->rx255);
+                hardware_statistics->txok = in_be32(&ug_regs->txok);
+                hardware_statistics->txcf = in_be16(&ug_regs->txcf);
+                hardware_statistics->tmca = in_be32(&ug_regs->tmca);
+                hardware_statistics->tbca = in_be32(&ug_regs->tbca);
+                hardware_statistics->rxfok = in_be32(&ug_regs->rxfok);
+                hardware_statistics->rxbok = in_be32(&ug_regs->rxbok);
+                hardware_statistics->rbyt = in_be32(&ug_regs->rbyt);
+                hardware_statistics->rmca = in_be32(&ug_regs->rmca);
+                hardware_statistics->rbca = in_be32(&ug_regs->rbca);
+        }
+}
+
+static void dump_bds(ucc_geth_private_t *ugeth)
+{
+        int i;
+        int length;
+
+        for (i = 0; i < ugeth->ug_info->numQueuesTx; i++) {
+                if (ugeth->p_tx_bd_ring[i]) {
+                        length =
+                            (ugeth->ug_info->bdRingLenTx[i] *
+                             UCC_GETH_SIZE_OF_BD);
+                        ugeth_info("TX BDs[%d]", i);
+                        mem_disp(ugeth->p_tx_bd_ring[i], length);
+                }
+        }
+        for (i = 0; i < ugeth->ug_info->numQueuesRx; i++) {
+                if (ugeth->p_rx_bd_ring[i]) {
+                        length =
+                            (ugeth->ug_info->bdRingLenRx[i] *
+                             UCC_GETH_SIZE_OF_BD);
+                        ugeth_info("RX BDs[%d]", i);
+                        mem_disp(ugeth->p_rx_bd_ring[i], length);
+                }
+        }
+}
+
+static void dump_regs(ucc_geth_private_t *ugeth)
+{
+        int i;
+
+        ugeth_info("UCC%d Geth registers:", ugeth->ug_info->uf_info.ucc_num);
+        ugeth_info("Base address: 0x%08x", (u32) ugeth->ug_regs);
+
+        ugeth_info("maccfg1    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->maccfg1,
+                   in_be32(&ugeth->ug_regs->maccfg1));
+        ugeth_info("maccfg2    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->maccfg2,
+                   in_be32(&ugeth->ug_regs->maccfg2));
+        ugeth_info("ipgifg     : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->ipgifg,
+                   in_be32(&ugeth->ug_regs->ipgifg));
+        ugeth_info("hafdup     : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->hafdup,
+                   in_be32(&ugeth->ug_regs->hafdup));
+        ugeth_info("miimcfg    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->miimng.miimcfg,
+                   in_be32(&ugeth->ug_regs->miimng.miimcfg));
+        ugeth_info("miimcom    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->miimng.miimcom,
+                   in_be32(&ugeth->ug_regs->miimng.miimcom));
+        ugeth_info("miimadd    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->miimng.miimadd,
+                   in_be32(&ugeth->ug_regs->miimng.miimadd));
+        ugeth_info("miimcon    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->miimng.miimcon,
+                   in_be32(&ugeth->ug_regs->miimng.miimcon));
+        ugeth_info("miimstat   : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->miimng.miimstat,
+                   in_be32(&ugeth->ug_regs->miimng.miimstat));
+        ugeth_info("miimmind   : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->miimng.miimind,
+                   in_be32(&ugeth->ug_regs->miimng.miimind));
+        ugeth_info("ifctl      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->ifctl,
+                   in_be32(&ugeth->ug_regs->ifctl));
+        ugeth_info("ifstat     : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->ifstat,
+                   in_be32(&ugeth->ug_regs->ifstat));
+        ugeth_info("macstnaddr1: addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->macstnaddr1,
+                   in_be32(&ugeth->ug_regs->macstnaddr1));
+        ugeth_info("macstnaddr2: addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->macstnaddr2,
+                   in_be32(&ugeth->ug_regs->macstnaddr2));
+        ugeth_info("uempr      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->uempr,
+                   in_be32(&ugeth->ug_regs->uempr));
+        ugeth_info("utbipar    : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->utbipar,
+                   in_be32(&ugeth->ug_regs->utbipar));
+        ugeth_info("uescr      : addr - 0x%08x, val - 0x%04x",
+                   (u32) & ugeth->ug_regs->uescr,
+                   in_be16(&ugeth->ug_regs->uescr));
+        ugeth_info("tx64       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->tx64,
+                   in_be32(&ugeth->ug_regs->tx64));
+        ugeth_info("tx127      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->tx127,
+                   in_be32(&ugeth->ug_regs->tx127));
+        ugeth_info("tx255      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->tx255,
+                   in_be32(&ugeth->ug_regs->tx255));
+        ugeth_info("rx64       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rx64,
+                   in_be32(&ugeth->ug_regs->rx64));
+        ugeth_info("rx127      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rx127,
+                   in_be32(&ugeth->ug_regs->rx127));
+        ugeth_info("rx255      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rx255,
+                   in_be32(&ugeth->ug_regs->rx255));
+        ugeth_info("txok       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->txok,
+                   in_be32(&ugeth->ug_regs->txok));
+        ugeth_info("txcf       : addr - 0x%08x, val - 0x%04x",
+                   (u32) & ugeth->ug_regs->txcf,
+                   in_be16(&ugeth->ug_regs->txcf));
+        ugeth_info("tmca       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->tmca,
+                   in_be32(&ugeth->ug_regs->tmca));
+        ugeth_info("tbca       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->tbca,
+                   in_be32(&ugeth->ug_regs->tbca));
+        ugeth_info("rxfok      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rxfok,
+                   in_be32(&ugeth->ug_regs->rxfok));
+        ugeth_info("rxbok      : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rxbok,
+                   in_be32(&ugeth->ug_regs->rxbok));
+        ugeth_info("rbyt       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rbyt,
+                   in_be32(&ugeth->ug_regs->rbyt));
+        ugeth_info("rmca       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rmca,
+                   in_be32(&ugeth->ug_regs->rmca));
+        ugeth_info("rbca       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->rbca,
+                   in_be32(&ugeth->ug_regs->rbca));
+        ugeth_info("scar       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->scar,
+                   in_be32(&ugeth->ug_regs->scar));
+        ugeth_info("scam       : addr - 0x%08x, val - 0x%08x",
+                   (u32) & ugeth->ug_regs->scam,
+                   in_be32(&ugeth->ug_regs->scam));
+
+        if (ugeth->p_thread_data_tx) {
+                int numThreadsTxNumerical;
+                switch (ugeth->ug_info->numThreadsTx) {
+                case UCC_GETH_NUM_OF_THREADS_1:
+                        numThreadsTxNumerical = 1;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_2:
+                        numThreadsTxNumerical = 2;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_4:
+                        numThreadsTxNumerical = 4;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_6:
+                        numThreadsTxNumerical = 6;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_8:
+                        numThreadsTxNumerical = 8;
+                        break;
+                default:
+                        numThreadsTxNumerical = 0;
+                        break;
+                }
+
+                ugeth_info("Thread data TXs:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_thread_data_tx);
+                for (i = 0; i < numThreadsTxNumerical; i++) {
+                        ugeth_info("Thread data TX[%d]:", i);
+                        ugeth_info("Base address: 0x%08x",
+                                   (u32) & ugeth->p_thread_data_tx[i]);
+                        mem_disp((u8 *) & ugeth->p_thread_data_tx[i],
+                                 sizeof(ucc_geth_thread_data_tx_t));
+                }
+        }
+        if (ugeth->p_thread_data_rx) {
+                int numThreadsRxNumerical;
+                switch (ugeth->ug_info->numThreadsRx) {
+                case UCC_GETH_NUM_OF_THREADS_1:
+                        numThreadsRxNumerical = 1;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_2:
+                        numThreadsRxNumerical = 2;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_4:
+                        numThreadsRxNumerical = 4;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_6:
+                        numThreadsRxNumerical = 6;
+                        break;
+                case UCC_GETH_NUM_OF_THREADS_8:
+                        numThreadsRxNumerical = 8;
+                        break;
+                default:
+                        numThreadsRxNumerical = 0;
+                        break;
+                }
+
+                ugeth_info("Thread data RX:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_thread_data_rx);
+                for (i = 0; i < numThreadsRxNumerical; i++) {
+                        ugeth_info("Thread data RX[%d]:", i);
+                        ugeth_info("Base address: 0x%08x",
+                                   (u32) & ugeth->p_thread_data_rx[i]);
+                        mem_disp((u8 *) & ugeth->p_thread_data_rx[i],
+                                 sizeof(ucc_geth_thread_data_rx_t));
+                }
+        }
+        if (ugeth->p_exf_glbl_param) {
+                ugeth_info("EXF global param:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_exf_glbl_param);
+                mem_disp((u8 *) ugeth->p_exf_glbl_param,
+                         sizeof(*ugeth->p_exf_glbl_param));
+        }
+        if (ugeth->p_tx_glbl_pram) {
+                ugeth_info("TX global param:");
+                ugeth_info("Base address: 0x%08x", (u32) ugeth->p_tx_glbl_pram);
+                ugeth_info("temoder      : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_tx_glbl_pram->temoder,
+                           in_be16(&ugeth->p_tx_glbl_pram->temoder));
+                ugeth_info("sqptr        : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->sqptr,
+                           in_be32(&ugeth->p_tx_glbl_pram->sqptr));
+                ugeth_info("schedulerbasepointer: addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->schedulerbasepointer,
+                           in_be32(&ugeth->p_tx_glbl_pram->
+                                   schedulerbasepointer));
+                ugeth_info("txrmonbaseptr: addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->txrmonbaseptr,
+                           in_be32(&ugeth->p_tx_glbl_pram->txrmonbaseptr));
+                ugeth_info("tstate       : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->tstate,
+                           in_be32(&ugeth->p_tx_glbl_pram->tstate));
+                ugeth_info("iphoffset[0] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[0],
+                           ugeth->p_tx_glbl_pram->iphoffset[0]);
+                ugeth_info("iphoffset[1] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[1],
+                           ugeth->p_tx_glbl_pram->iphoffset[1]);
+                ugeth_info("iphoffset[2] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[2],
+                           ugeth->p_tx_glbl_pram->iphoffset[2]);
+                ugeth_info("iphoffset[3] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[3],
+                           ugeth->p_tx_glbl_pram->iphoffset[3]);
+                ugeth_info("iphoffset[4] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[4],
+                           ugeth->p_tx_glbl_pram->iphoffset[4]);
+                ugeth_info("iphoffset[5] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[5],
+                           ugeth->p_tx_glbl_pram->iphoffset[5]);
+                ugeth_info("iphoffset[6] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[6],
+                           ugeth->p_tx_glbl_pram->iphoffset[6]);
+                ugeth_info("iphoffset[7] : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_tx_glbl_pram->iphoffset[7],
+                           ugeth->p_tx_glbl_pram->iphoffset[7]);
+                ugeth_info("vtagtable[0] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[0],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[0]));
+                ugeth_info("vtagtable[1] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[1],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[1]));
+                ugeth_info("vtagtable[2] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[2],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[2]));
+                ugeth_info("vtagtable[3] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[3],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[3]));
+                ugeth_info("vtagtable[4] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[4],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[4]));
+                ugeth_info("vtagtable[5] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[5],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[5]));
+                ugeth_info("vtagtable[6] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[6],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[6]));
+                ugeth_info("vtagtable[7] : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->vtagtable[7],
+                           in_be32(&ugeth->p_tx_glbl_pram->vtagtable[7]));
+                ugeth_info("tqptr        : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_tx_glbl_pram->tqptr,
+                           in_be32(&ugeth->p_tx_glbl_pram->tqptr));
+        }
+        if (ugeth->p_rx_glbl_pram) {
+                ugeth_info("RX global param:");
+                ugeth_info("Base address: 0x%08x", (u32) ugeth->p_rx_glbl_pram);
+                ugeth_info("remoder         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->remoder,
+                           in_be32(&ugeth->p_rx_glbl_pram->remoder));
+                ugeth_info("rqptr           : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->rqptr,
+                           in_be32(&ugeth->p_rx_glbl_pram->rqptr));
+                ugeth_info("typeorlen       : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->typeorlen,
+                           in_be16(&ugeth->p_rx_glbl_pram->typeorlen));
+                ugeth_info("rxgstpack       : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_rx_glbl_pram->rxgstpack,
+                           ugeth->p_rx_glbl_pram->rxgstpack);
+                ugeth_info("rxrmonbaseptr   : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->rxrmonbaseptr,
+                           in_be32(&ugeth->p_rx_glbl_pram->rxrmonbaseptr));
+                ugeth_info("intcoalescingptr: addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->intcoalescingptr,
+                           in_be32(&ugeth->p_rx_glbl_pram->intcoalescingptr));
+                ugeth_info("rstate          : addr - 0x%08x, val - 0x%02x",
+                           (u32) & ugeth->p_rx_glbl_pram->rstate,
+                           ugeth->p_rx_glbl_pram->rstate);
+                ugeth_info("mrblr           : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->mrblr,
+                           in_be16(&ugeth->p_rx_glbl_pram->mrblr));
+                ugeth_info("rbdqptr         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->rbdqptr,
+                           in_be32(&ugeth->p_rx_glbl_pram->rbdqptr));
+                ugeth_info("mflr            : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->mflr,
+                           in_be16(&ugeth->p_rx_glbl_pram->mflr));
+                ugeth_info("minflr          : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->minflr,
+                           in_be16(&ugeth->p_rx_glbl_pram->minflr));
+                ugeth_info("maxd1           : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->maxd1,
+                           in_be16(&ugeth->p_rx_glbl_pram->maxd1));
+                ugeth_info("maxd2           : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->maxd2,
+                           in_be16(&ugeth->p_rx_glbl_pram->maxd2));
+                ugeth_info("ecamptr         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->ecamptr,
+                           in_be32(&ugeth->p_rx_glbl_pram->ecamptr));
+                ugeth_info("l2qt            : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l2qt,
+                           in_be32(&ugeth->p_rx_glbl_pram->l2qt));
+                ugeth_info("l3qt[0]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[0],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[0]));
+                ugeth_info("l3qt[1]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[1],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[1]));
+                ugeth_info("l3qt[2]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[2],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[2]));
+                ugeth_info("l3qt[3]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[3],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[3]));
+                ugeth_info("l3qt[4]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[4],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[4]));
+                ugeth_info("l3qt[5]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[5],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[5]));
+                ugeth_info("l3qt[6]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[6],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[6]));
+                ugeth_info("l3qt[7]         : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->l3qt[7],
+                           in_be32(&ugeth->p_rx_glbl_pram->l3qt[7]));
+                ugeth_info("vlantype        : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->vlantype,
+                           in_be16(&ugeth->p_rx_glbl_pram->vlantype));
+                ugeth_info("vlantci         : addr - 0x%08x, val - 0x%04x",
+                           (u32) & ugeth->p_rx_glbl_pram->vlantci,
+                           in_be16(&ugeth->p_rx_glbl_pram->vlantci));
+                for (i = 0; i < 64; i++)
+                        ugeth_info
+                    ("addressfiltering[%d]: addr - 0x%08x, val - 0x%02x",
+                             i,
+                             (u32) & ugeth->p_rx_glbl_pram->addressfiltering[i],
+                             ugeth->p_rx_glbl_pram->addressfiltering[i]);
+                ugeth_info("exfGlobalParam  : addr - 0x%08x, val - 0x%08x",
+                           (u32) & ugeth->p_rx_glbl_pram->exfGlobalParam,
+                           in_be32(&ugeth->p_rx_glbl_pram->exfGlobalParam));
+        }
+        if (ugeth->p_send_q_mem_reg) {
+                ugeth_info("Send Q memory registers:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_send_q_mem_reg);
+                for (i = 0; i < ugeth->ug_info->numQueuesTx; i++) {
+                        ugeth_info("SQQD[%d]:", i);
+                        ugeth_info("Base address: 0x%08x",
+                                   (u32) & ugeth->p_send_q_mem_reg->sqqd[i]);
+                        mem_disp((u8 *) & ugeth->p_send_q_mem_reg->sqqd[i],
+                                 sizeof(ucc_geth_send_queue_qd_t));
+                }
+        }
+        if (ugeth->p_scheduler) {
+                ugeth_info("Scheduler:");
+                ugeth_info("Base address: 0x%08x", (u32) ugeth->p_scheduler);
+                mem_disp((u8 *) ugeth->p_scheduler,
+                         sizeof(*ugeth->p_scheduler));
+        }
+        if (ugeth->p_tx_fw_statistics_pram) {
+                ugeth_info("TX FW statistics pram:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_tx_fw_statistics_pram);
+                mem_disp((u8 *) ugeth->p_tx_fw_statistics_pram,
+                         sizeof(*ugeth->p_tx_fw_statistics_pram));
+        }
+        if (ugeth->p_rx_fw_statistics_pram) {
+                ugeth_info("RX FW statistics pram:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_rx_fw_statistics_pram);
+                mem_disp((u8 *) ugeth->p_rx_fw_statistics_pram,
+                         sizeof(*ugeth->p_rx_fw_statistics_pram));
+        }
+        if (ugeth->p_rx_irq_coalescing_tbl) {
+                ugeth_info("RX IRQ coalescing tables:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_rx_irq_coalescing_tbl);
+                for (i = 0; i < ugeth->ug_info->numQueuesRx; i++) {
+                        ugeth_info("RX IRQ coalescing table entry[%d]:", i);
+                        ugeth_info("Base address: 0x%08x",
+                                   (u32) & ugeth->p_rx_irq_coalescing_tbl->
+                                   coalescingentry[i]);
+                        ugeth_info
+                ("interruptcoalescingmaxvalue: addr - 0x%08x, val - 0x%08x",
+                             (u32) & ugeth->p_rx_irq_coalescing_tbl->
+                             coalescingentry[i].interruptcoalescingmaxvalue,
+                             in_be32(&ugeth->p_rx_irq_coalescing_tbl->
+                                     coalescingentry[i].
+                                     interruptcoalescingmaxvalue));
+                        ugeth_info
+                ("interruptcoalescingcounter : addr - 0x%08x, val - 0x%08x",
+                             (u32) & ugeth->p_rx_irq_coalescing_tbl->
+                             coalescingentry[i].interruptcoalescingcounter,
+                             in_be32(&ugeth->p_rx_irq_coalescing_tbl->
+                                     coalescingentry[i].
+                                     interruptcoalescingcounter));
+                }
+        }
+        if (ugeth->p_rx_bd_qs_tbl) {
+                ugeth_info("RX BD QS tables:");
+                ugeth_info("Base address: 0x%08x", (u32) ugeth->p_rx_bd_qs_tbl);
+                for (i = 0; i < ugeth->ug_info->numQueuesRx; i++) {
+                        ugeth_info("RX BD QS table[%d]:", i);
+                        ugeth_info("Base address: 0x%08x",
+                                   (u32) & ugeth->p_rx_bd_qs_tbl[i]);
+                        ugeth_info
+                            ("bdbaseptr        : addr - 0x%08x, val - 0x%08x",
+                             (u32) & ugeth->p_rx_bd_qs_tbl[i].bdbaseptr,
+                             in_be32(&ugeth->p_rx_bd_qs_tbl[i].bdbaseptr));
+                        ugeth_info
+                            ("bdptr            : addr - 0x%08x, val - 0x%08x",
+                             (u32) & ugeth->p_rx_bd_qs_tbl[i].bdptr,
+                             in_be32(&ugeth->p_rx_bd_qs_tbl[i].bdptr));
+                        ugeth_info
+                            ("externalbdbaseptr: addr - 0x%08x, val - 0x%08x",
+                             (u32) & ugeth->p_rx_bd_qs_tbl[i].externalbdbaseptr,
+                             in_be32(&ugeth->p_rx_bd_qs_tbl[i].
+                                     externalbdbaseptr));
+                        ugeth_info
+                            ("externalbdptr    : addr - 0x%08x, val - 0x%08x",
+                             (u32) & ugeth->p_rx_bd_qs_tbl[i].externalbdptr,
+                             in_be32(&ugeth->p_rx_bd_qs_tbl[i].externalbdptr));
+                        ugeth_info("ucode RX Prefetched BDs:");
+                        ugeth_info("Base address: 0x%08x",
+                                   (u32)
+                                   qe_muram_addr(in_be32
+                                                 (&ugeth->p_rx_bd_qs_tbl[i].
+                                                  bdbaseptr)));
+                        mem_disp((u8 *)
+                                 qe_muram_addr(in_be32
+                                               (&ugeth->p_rx_bd_qs_tbl[i].
+                                                bdbaseptr)),
+                                 sizeof(ucc_geth_rx_prefetched_bds_t));
+                }
+        }
+        if (ugeth->p_init_enet_param_shadow) {
+                int size;
+                ugeth_info("Init enet param shadow:");
+                ugeth_info("Base address: 0x%08x",
+                           (u32) ugeth->p_init_enet_param_shadow);
+                mem_disp((u8 *) ugeth->p_init_enet_param_shadow,
+                         sizeof(*ugeth->p_init_enet_param_shadow));
+
+                size = sizeof(ucc_geth_thread_rx_pram_t);
+                if (ugeth->ug_info->rxExtendedFiltering) {
+                        size +=
+                            THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING;
+                        if (ugeth->ug_info->largestexternallookupkeysize ==
+                            QE_FLTR_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
+                                size +=
+                        THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_8;
+                        if (ugeth->ug_info->largestexternallookupkeysize ==
+                            QE_FLTR_TABLE_LOOKUP_KEY_SIZE_16_BYTES)
+                                size +=
+                        THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_16;
+                }
+
+                dump_init_enet_entries(ugeth,
+                                       &(ugeth->p_init_enet_param_shadow->
+                                         txthread[0]),
+                                       ENET_INIT_PARAM_MAX_ENTRIES_TX,
+                                       sizeof(ucc_geth_thread_tx_pram_t),
+                                       ugeth->ug_info->riscTx, 0);
+                dump_init_enet_entries(ugeth,
+                                       &(ugeth->p_init_enet_param_shadow->
+                                         rxthread[0]),
+                                       ENET_INIT_PARAM_MAX_ENTRIES_RX, size,
+                                       ugeth->ug_info->riscRx, 1);
+        }
+}
+#endif /* DEBUG */
+
+static void init_default_reg_vals(volatile u32 *upsmr_register,
+                                  volatile u32 *maccfg1_register,
+                                  volatile u32 *maccfg2_register)
+{
+        out_be32(upsmr_register, UCC_GETH_UPSMR_INIT);
+        out_be32(maccfg1_register, UCC_GETH_MACCFG1_INIT);
+        out_be32(maccfg2_register, UCC_GETH_MACCFG2_INIT);
+}
+
+static int init_half_duplex_params(int alt_beb,
+                                   int back_pressure_no_backoff,
+                                   int no_backoff,
+                                   int excess_defer,
+                                   u8 alt_beb_truncation,
+                                   u8 max_retransmissions,
+                                   u8 collision_window,
+                                   volatile u32 *hafdup_register)
+{
+        u32 value = 0;
+
+        if ((alt_beb_truncation > HALFDUP_ALT_BEB_TRUNCATION_MAX) ||
+            (max_retransmissions > HALFDUP_MAX_RETRANSMISSION_MAX) ||
+            (collision_window > HALFDUP_COLLISION_WINDOW_MAX))
+                return -EINVAL;
+
+        value = (u32) (alt_beb_truncation << HALFDUP_ALT_BEB_TRUNCATION_SHIFT);
+
+        if (alt_beb)
+                value |= HALFDUP_ALT_BEB;
+        if (back_pressure_no_backoff)
+                value |= HALFDUP_BACK_PRESSURE_NO_BACKOFF;
+        if (no_backoff)
+                value |= HALFDUP_NO_BACKOFF;
+        if (excess_defer)
+                value |= HALFDUP_EXCESSIVE_DEFER;
+
+        value |= (max_retransmissions << HALFDUP_MAX_RETRANSMISSION_SHIFT);
+
+        value |= collision_window;
+
+        out_be32(hafdup_register, value);
+        return 0;
+}
+
+static int init_inter_frame_gap_params(u8 non_btb_cs_ipg,
+                                       u8 non_btb_ipg,
+                                       u8 min_ifg,
+                                       u8 btb_ipg,
+                                       volatile u32 *ipgifg_register)
+{
+        u32 value = 0;
+
+        /* Non-Back-to-back IPG part 1 should be <= Non-Back-to-back
+        IPG part 2 */
+        if (non_btb_cs_ipg > non_btb_ipg)
+                return -EINVAL;
+
+        if ((non_btb_cs_ipg > IPGIFG_NON_BACK_TO_BACK_IFG_PART1_MAX) ||
+            (non_btb_ipg > IPGIFG_NON_BACK_TO_BACK_IFG_PART2_MAX) ||
+            /*(min_ifg        > IPGIFG_MINIMUM_IFG_ENFORCEMENT_MAX) || */
+            (btb_ipg > IPGIFG_BACK_TO_BACK_IFG_MAX))
+                return -EINVAL;
+
+        value |=
+            ((non_btb_cs_ipg << IPGIFG_NON_BACK_TO_BACK_IFG_PART1_SHIFT) &
+             IPGIFG_NBTB_CS_IPG_MASK);
+        value |=
+            ((non_btb_ipg << IPGIFG_NON_BACK_TO_BACK_IFG_PART2_SHIFT) &
+             IPGIFG_NBTB_IPG_MASK);
+        value |=
+            ((min_ifg << IPGIFG_MINIMUM_IFG_ENFORCEMENT_SHIFT) &
+             IPGIFG_MIN_IFG_MASK);
+        value |= (btb_ipg & IPGIFG_BTB_IPG_MASK);
+
+        out_be32(ipgifg_register, value);
+        return 0;
+}
+
+static int init_flow_control_params(u32 automatic_flow_control_mode,
+                                    int rx_flow_control_enable,
+                                    int tx_flow_control_enable,
+                                    u16 pause_period,
+                                    u16 extension_field,
+                                    volatile u32 *upsmr_register,
+                                    volatile u32 *uempr_register,
+                                    volatile u32 *maccfg1_register)
+{
+        u32 value = 0;
+
+        /* Set UEMPR register */
+        value = (u32) pause_period << UEMPR_PAUSE_TIME_VALUE_SHIFT;
+        value |= (u32) extension_field << UEMPR_EXTENDED_PAUSE_TIME_VALUE_SHIFT;
+        out_be32(uempr_register, value);
+
+        /* Set UPSMR register */
+        value = in_be32(upsmr_register);
+        value |= automatic_flow_control_mode;
+        out_be32(upsmr_register, value);
+
+        value = in_be32(maccfg1_register);
+        if (rx_flow_control_enable)
+                value |= MACCFG1_FLOW_RX;
+        if (tx_flow_control_enable)
+                value |= MACCFG1_FLOW_TX;
+        out_be32(maccfg1_register, value);
+
+        return 0;
+}
+
+static int init_hw_statistics_gathering_mode(int enable_hardware_statistics,
+                                             int auto_zero_hardware_statistics,
+                                             volatile u32 *upsmr_register,
+                                             volatile u16 *uescr_register)
+{
+        u32 upsmr_value = 0;
+        u16 uescr_value = 0;
+        /* Enable hardware statistics gathering if requested */
+        if (enable_hardware_statistics) {
+                upsmr_value = in_be32(upsmr_register);
+                upsmr_value |= UPSMR_HSE;
+                out_be32(upsmr_register, upsmr_value);
+        }
+
+        /* Clear hardware statistics counters */
+        uescr_value = in_be16(uescr_register);
+        uescr_value |= UESCR_CLRCNT;
+        /* Automatically zero hardware statistics counters on read,
+        if requested */
+        if (auto_zero_hardware_statistics)
+                uescr_value |= UESCR_AUTOZ;
+        out_be16(uescr_register, uescr_value);
+
+        return 0;
+}
+
+static int init_firmware_statistics_gathering_mode(int
+                enable_tx_firmware_statistics,
+                int enable_rx_firmware_statistics,
+                volatile u32 *tx_rmon_base_ptr,
+                u32 tx_firmware_statistics_structure_address,
+                volatile u32 *rx_rmon_base_ptr,
+                u32 rx_firmware_statistics_structure_address,
+                volatile u16 *temoder_register,
+                volatile u32 *remoder_register)
+{
+        /* Note: this function does not check if */
+        /* the parameters it receives are NULL   */
+        u16 temoder_value;
+        u32 remoder_value;
+
+        if (enable_tx_firmware_statistics) {
+                out_be32(tx_rmon_base_ptr,
+                         tx_firmware_statistics_structure_address);
+                temoder_value = in_be16(temoder_register);
+                temoder_value |= TEMODER_TX_RMON_STATISTICS_ENABLE;
+                out_be16(temoder_register, temoder_value);
+        }
+
+        if (enable_rx_firmware_statistics) {
+                out_be32(rx_rmon_base_ptr,
+                         rx_firmware_statistics_structure_address);
+                remoder_value = in_be32(remoder_register);
+                remoder_value |= REMODER_RX_RMON_STATISTICS_ENABLE;
+                out_be32(remoder_register, remoder_value);
+        }
+
+        return 0;
+}
+
+static int init_mac_station_addr_regs(u8 address_byte_0,
+                                      u8 address_byte_1,
+                                      u8 address_byte_2,
+                                      u8 address_byte_3,
+                                      u8 address_byte_4,
+                                      u8 address_byte_5,
+                                      volatile u32 *macstnaddr1_register,
+                                      volatile u32 *macstnaddr2_register)
+{
+        u32 value = 0;
+
+        /* Example: for a station address of 0x12345678ABCD, */
+        /* 0x12 is byte 0, 0x34 is byte 1 and so on and 0xCD is byte 5 */
+
+        /* MACSTNADDR1 Register: */
+
+        /* 0                      7   8                      15  */
+        /* station address byte 5     station address byte 4     */
+        /* 16                     23  24                     31  */
+        /* station address byte 3     station address byte 2     */
+        value |= (u32) ((address_byte_2 << 0) & 0x000000FF);
+        value |= (u32) ((address_byte_3 << 8) & 0x0000FF00);
+        value |= (u32) ((address_byte_4 << 16) & 0x00FF0000);
+        value |= (u32) ((address_byte_5 << 24) & 0xFF000000);
+
+        out_be32(macstnaddr1_register, value);
+
+        /* MACSTNADDR2 Register: */
+
+        /* 0                      7   8                      15  */
+        /* station address byte 1     station address byte 0     */
+        /* 16                     23  24                     31  */
+        /*         reserved                   reserved           */
+        value = 0;
+        value |= (u32) ((address_byte_0 << 16) & 0x00FF0000);
+        value |= (u32) ((address_byte_1 << 24) & 0xFF000000);
+
+        out_be32(macstnaddr2_register, value);
+
+        return 0;
+}
+
+static int init_mac_duplex_mode(int full_duplex,
+                                int limited_to_full_duplex,
+                                volatile u32 *maccfg2_register)
+{
+        u32 value = 0;
+
+        /* some interfaces must work in full duplex mode */
+        if ((full_duplex == 0) && (limited_to_full_duplex == 1))
+                return -EINVAL;
+
+        value = in_be32(maccfg2_register);
+
+        if (full_duplex)
+                value |= MACCFG2_FDX;
+        else
+                value &= ~MACCFG2_FDX;
+
+        out_be32(maccfg2_register, value);
+        return 0;
+}
+
+static int init_check_frame_length_mode(int length_check,
+                                        volatile u32 *maccfg2_register)
+{
+        u32 value = 0;
+
+        value = in_be32(maccfg2_register);
+
+        if (length_check)
+                value |= MACCFG2_LC;
+        else
+                value &= ~MACCFG2_LC;
+
+        out_be32(maccfg2_register, value);
+        return 0;
+}
+
+static int init_preamble_length(u8 preamble_length,
+                                volatile u32 *maccfg2_register)
+{
+        u32 value = 0;
+
+        if ((preamble_length < 3) || (preamble_length > 7))
+                return -EINVAL;
+
+        value = in_be32(maccfg2_register);
+        value &= ~MACCFG2_PREL_MASK;
+        value |= (preamble_length << MACCFG2_PREL_SHIFT);
+        out_be32(maccfg2_register, value);
+        return 0;
+}
+
+static int init_mii_management_configuration(int reset_mgmt,
+                                             int preamble_supress,
+                                             volatile u32 *miimcfg_register,
+                                             volatile u32 *miimind_register)
+{
+        unsigned int timeout = PHY_INIT_TIMEOUT;
+        u32 value = 0;
+
+        value = in_be32(miimcfg_register);
+        if (reset_mgmt) {
+                value |= MIIMCFG_RESET_MANAGEMENT;
+                out_be32(miimcfg_register, value);
+        }
+
+        value = 0;
+
+        if (preamble_supress)
+                value |= MIIMCFG_NO_PREAMBLE;
+
+        value |= UCC_GETH_MIIMCFG_MNGMNT_CLC_DIV_INIT;
+        out_be32(miimcfg_register, value);
+
+        /* Wait until the bus is free */
+        while ((in_be32(miimind_register) & MIIMIND_BUSY) && timeout--)
+                cpu_relax();
+
+        if (timeout <= 0) {
+                ugeth_err("%s: The MII Bus is stuck!", __FUNCTION__);
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static int init_rx_parameters(int reject_broadcast,
+                              int receive_short_frames,
+                              int promiscuous, volatile u32 *upsmr_register)
+{
+        u32 value = 0;
+
+        value = in_be32(upsmr_register);
+
+        if (reject_broadcast)
+                value |= UPSMR_BRO;
+        else
+                value &= ~UPSMR_BRO;
+
+        if (receive_short_frames)
+                value |= UPSMR_RSH;
+        else
+                value &= ~UPSMR_RSH;
+
+        if (promiscuous)
+                value |= UPSMR_PRO;
+        else
+                value &= ~UPSMR_PRO;
+
+        out_be32(upsmr_register, value);
+
+        return 0;
+}
+
+static int init_max_rx_buff_len(u16 max_rx_buf_len,
+                                volatile u16 *mrblr_register)
+{
+        /* max_rx_buf_len value must be a multiple of 128 */
+        if ((max_rx_buf_len == 0)
+            || (max_rx_buf_len % UCC_GETH_MRBLR_ALIGNMENT))
+                return -EINVAL;
+
+        out_be16(mrblr_register, max_rx_buf_len);
+        return 0;
+}
+
+static int init_min_frame_len(u16 min_frame_length,
+                              volatile u16 *minflr_register,
+                              volatile u16 *mrblr_register)
+{
+        u16 mrblr_value = 0;
+
+        mrblr_value = in_be16(mrblr_register);
+        if (min_frame_length >= (mrblr_value - 4))
+                return -EINVAL;
+
+        out_be16(minflr_register, min_frame_length);
+        return 0;
+}
+
+static int adjust_enet_interface(ucc_geth_private_t *ugeth)
+{
+        ucc_geth_info_t *ug_info;
+        ucc_geth_t *ug_regs;
+        ucc_fast_t *uf_regs;
+        enet_speed_e speed;
+        int ret_val, rpm = 0, tbi = 0, r10m = 0, rmm =
+            0, limited_to_full_duplex = 0;
+        u32 upsmr, maccfg2, utbipar, tbiBaseAddress;
+        u16 value;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        ug_info = ugeth->ug_info;
+        ug_regs = ugeth->ug_regs;
+        uf_regs = ugeth->uccf->uf_regs;
+
+        /* Analyze enet_interface according to Interface Mode Configuration
+        table */
+        ret_val =
+            get_interface_details(ug_info->enet_interface, &speed, &r10m, &rmm,
+                                  &rpm, &tbi, &limited_to_full_duplex);
+        if (ret_val != 0) {
+                ugeth_err
+                  ("%s: half duplex not supported in requested configuration.",
+                     __FUNCTION__);
+                return ret_val;
+        }
+
+        /*                    Set MACCFG2                    */
+        maccfg2 = in_be32(&ug_regs->maccfg2);
+        maccfg2 &= ~MACCFG2_INTERFACE_MODE_MASK;
+        if ((speed == ENET_SPEED_10BT) || (speed == ENET_SPEED_100BT))
+                maccfg2 |= MACCFG2_INTERFACE_MODE_NIBBLE;
+        else if (speed == ENET_SPEED_1000BT)
+                maccfg2 |= MACCFG2_INTERFACE_MODE_BYTE;
+        maccfg2 |= ug_info->padAndCrc;
+        out_be32(&ug_regs->maccfg2, maccfg2);
+
+        /*                    Set UPSMR                      */
+        upsmr = in_be32(&uf_regs->upsmr);
+        upsmr &= ~(UPSMR_RPM | UPSMR_R10M | UPSMR_TBIM | UPSMR_RMM);
+        if (rpm)
+                upsmr |= UPSMR_RPM;
+        if (r10m)
+                upsmr |= UPSMR_R10M;
+        if (tbi)
+                upsmr |= UPSMR_TBIM;
+        if (rmm)
+                upsmr |= UPSMR_RMM;
+        out_be32(&uf_regs->upsmr, upsmr);
+
+        /*                    Set UTBIPAR                    */
+        utbipar = in_be32(&ug_regs->utbipar);
+        utbipar &= ~UTBIPAR_PHY_ADDRESS_MASK;
+        if (tbi)
+                utbipar |=
+                    (ug_info->phy_address +
+                     ugeth->ug_info->uf_info.
+                     ucc_num) << UTBIPAR_PHY_ADDRESS_SHIFT;
+        else
+                utbipar |=
+                    (0x10 +
+                     ugeth->ug_info->uf_info.
+                     ucc_num) << UTBIPAR_PHY_ADDRESS_SHIFT;
+        out_be32(&ug_regs->utbipar, utbipar);
+
+        /* Disable autonegotiation in tbi mode, because by default it
+        comes up in autonegotiation mode. */
+        /* Note that this depends on proper setting in utbipar register. */
+        if (tbi) {
+                tbiBaseAddress = in_be32(&ug_regs->utbipar);
+                tbiBaseAddress &= UTBIPAR_PHY_ADDRESS_MASK;
+                tbiBaseAddress >>= UTBIPAR_PHY_ADDRESS_SHIFT;
+                value =
+                    ugeth->mii_info->mdio_read(ugeth->dev, (u8) tbiBaseAddress,
+                                               ENET_TBI_MII_CR);
+                value &= ~0x1000;       /* Turn off autonegotiation */
+                ugeth->mii_info->mdio_write(ugeth->dev, (u8) tbiBaseAddress,
+                                            ENET_TBI_MII_CR, value);
+        }
+
+        ret_val = init_mac_duplex_mode(1,
+                                       limited_to_full_duplex,
+                                       &ug_regs->maccfg2);
+        if (ret_val != 0) {
+                ugeth_err
+                ("%s: half duplex not supported in requested configuration.",
+                     __FUNCTION__);
+                return ret_val;
+        }
+
+        init_check_frame_length_mode(ug_info->lengthCheckRx, &ug_regs->maccfg2);
+
+        ret_val = init_preamble_length(ug_info->prel, &ug_regs->maccfg2);
+        if (ret_val != 0) {
+                ugeth_err
+                    ("%s: Preamble length must be between 3 and 7 inclusive.",
+                     __FUNCTION__);
+                return ret_val;
+        }
+
+        return 0;
+}
+
+/* Called every time the controller might need to be made
+ * aware of new link state.  The PHY code conveys this
+ * information through variables in the ugeth structure, and this
+ * function converts those variables into the appropriate
+ * register values, and can bring down the device if needed.
+ */
+static void adjust_link(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        ucc_geth_t *ug_regs;
+        u32 tempval;
+        struct ugeth_mii_info *mii_info = ugeth->mii_info;
+
+        ug_regs = ugeth->ug_regs;
+
+        if (mii_info->link) {
+                /* Now we make sure that we can be in full duplex mode.
+                 * If not, we operate in half-duplex mode. */
+                if (mii_info->duplex != ugeth->oldduplex) {
+                        if (!(mii_info->duplex)) {
+                                tempval = in_be32(&ug_regs->maccfg2);
+                                tempval &= ~(MACCFG2_FDX);
+                                out_be32(&ug_regs->maccfg2, tempval);
+
+                                ugeth_info("%s: Half Duplex", dev->name);
+                        } else {
+                                tempval = in_be32(&ug_regs->maccfg2);
+                                tempval |= MACCFG2_FDX;
+                                out_be32(&ug_regs->maccfg2, tempval);
+
+                                ugeth_info("%s: Full Duplex", dev->name);
+                        }
+
+                        ugeth->oldduplex = mii_info->duplex;
+                }
+
+                if (mii_info->speed != ugeth->oldspeed) {
+                        switch (mii_info->speed) {
+                        case 1000:
+#ifdef CONFIG_MPC836x
+/* FIXME: This code is for 100Mbs BUG fixing,
+remove this when it is fixed!!! */
+                                if (ugeth->ug_info->enet_interface ==
+                                    ENET_1000_GMII)
+                                /* Run the commands which initialize the PHY */
+                                {
+                                        tempval =
+                                            (u32) mii_info->mdio_read(ugeth->
+                                                dev, mii_info->mii_id, 0x1b);
+                                        tempval |= 0x000f;
+                                        mii_info->mdio_write(ugeth->dev,
+                                                mii_info->mii_id, 0x1b,
+                                                (u16) tempval);
+                                        tempval =
+                                            (u32) mii_info->mdio_read(ugeth->
+                                                dev, mii_info->mii_id,
+                                                MII_BMCR);
+                                        mii_info->mdio_write(ugeth->dev,
+                                                mii_info->mii_id, MII_BMCR,
+                                                (u16) (tempval | BMCR_RESET));
+                                } else if (ugeth->ug_info->enet_interface ==
+                                           ENET_1000_RGMII)
+                                /* Run the commands which initialize the PHY */
+                                {
+                                        tempval =
+                                            (u32) mii_info->mdio_read(ugeth->
+                                                dev, mii_info->mii_id, 0x1b);
+                                        tempval = (tempval & ~0x000f) | 0x000b;
+                                        mii_info->mdio_write(ugeth->dev,
+                                                mii_info->mii_id, 0x1b,
+                                                (u16) tempval);
+                                        tempval =
+                                            (u32) mii_info->mdio_read(ugeth->
+                                                dev, mii_info->mii_id,
+                                                MII_BMCR);
+                                        mii_info->mdio_write(ugeth->dev,
+                                                mii_info->mii_id, MII_BMCR,
+                                                (u16) (tempval | BMCR_RESET));
+                                }
+                                msleep(4000);
+#endif                          /* CONFIG_MPC8360 */
+                                adjust_enet_interface(ugeth);
+                                break;
+                        case 100:
+                        case 10:
+#ifdef CONFIG_MPC836x
+/* FIXME: This code is for 100Mbs BUG fixing,
+remove this lines when it will be fixed!!! */
+                                ugeth->ug_info->enet_interface = ENET_100_RGMII;
+                                tempval =
+                                    (u32) mii_info->mdio_read(ugeth->dev,
+                                                              mii_info->mii_id,
+                                                              0x1b);
+                                tempval = (tempval & ~0x000f) | 0x000b;
+                                mii_info->mdio_write(ugeth->dev,
+                                                     mii_info->mii_id, 0x1b,
+                                                     (u16) tempval);
+                                tempval =
+                                    (u32) mii_info->mdio_read(ugeth->dev,
+                                                              mii_info->mii_id,
+                                                              MII_BMCR);
+                                mii_info->mdio_write(ugeth->dev,
+                                                     mii_info->mii_id, MII_BMCR,
+                                                     (u16) (tempval |
+                                                            BMCR_RESET));
+                                msleep(4000);
+#endif                          /* CONFIG_MPC8360 */
+                                adjust_enet_interface(ugeth);
+                                break;
+                        default:
+                                ugeth_warn
+                                    ("%s: Ack!  Speed (%d) is not 10/100/1000!",
+                                     dev->name, mii_info->speed);
+                                break;
+                        }
+
+                        ugeth_info("%s: Speed %dBT", dev->name,
+                                   mii_info->speed);
+
+                        ugeth->oldspeed = mii_info->speed;
+                }
+
+                if (!ugeth->oldlink) {
+                        ugeth_info("%s: Link is up", dev->name);
+                        ugeth->oldlink = 1;
+                        netif_carrier_on(dev);
+                        netif_schedule(dev);
+                }
+        } else {
+                if (ugeth->oldlink) {
+                        ugeth_info("%s: Link is down", dev->name);
+                        ugeth->oldlink = 0;
+                        ugeth->oldspeed = 0;
+                        ugeth->oldduplex = -1;
+                        netif_carrier_off(dev);
+                }
+        }
+}
+
+/* Configure the PHY for dev.
+ * returns 0 if success.  -1 if failure
+ */
+static int init_phy(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct phy_info *curphy;
+        ucc_mii_mng_t *mii_regs;
+        struct ugeth_mii_info *mii_info;
+        int err;
+
+        mii_regs = &ugeth->ug_regs->miimng;
+
+        ugeth->oldlink = 0;
+        ugeth->oldspeed = 0;
+        ugeth->oldduplex = -1;
+
+        mii_info = kmalloc(sizeof(struct ugeth_mii_info), GFP_KERNEL);
+
+        if (NULL == mii_info) {
+                ugeth_err("%s: Could not allocate mii_info", dev->name);
+                return -ENOMEM;
+        }
+
+        mii_info->mii_regs = mii_regs;
+        mii_info->speed = SPEED_1000;
+        mii_info->duplex = DUPLEX_FULL;
+        mii_info->pause = 0;
+        mii_info->link = 0;
+
+        mii_info->advertising = (ADVERTISED_10baseT_Half |
+                                 ADVERTISED_10baseT_Full |
+                                 ADVERTISED_100baseT_Half |
+                                 ADVERTISED_100baseT_Full |
+                                 ADVERTISED_1000baseT_Full);
+        mii_info->autoneg = 1;
+
+        mii_info->mii_id = ugeth->ug_info->phy_address;
+
+        mii_info->dev = dev;
+
+        mii_info->mdio_read = &read_phy_reg;
+        mii_info->mdio_write = &write_phy_reg;
+
+        ugeth->mii_info = mii_info;
+
+        spin_lock_irq(&ugeth->lock);
+
+        /* Set this UCC to be the master of the MII managment */
+        ucc_set_qe_mux_mii_mng(ugeth->ug_info->uf_info.ucc_num);
+
+        if (init_mii_management_configuration(1,
+                                              ugeth->ug_info->
+                                              miiPreambleSupress,
+                                              &mii_regs->miimcfg,
+                                              &mii_regs->miimind)) {
+                ugeth_err("%s: The MII Bus is stuck!", dev->name);
+                err = -1;
+                goto bus_fail;
+        }
+
+        spin_unlock_irq(&ugeth->lock);
+
+        /* get info for this PHY */
+        curphy = get_phy_info(ugeth->mii_info);
+
+        if (curphy == NULL) {
+                ugeth_err("%s: No PHY found", dev->name);
+                err = -1;
+                goto no_phy;
+        }
+
+        mii_info->phyinfo = curphy;
+
+        /* Run the commands which initialize the PHY */
+        if (curphy->init) {
+                err = curphy->init(ugeth->mii_info);
+                if (err)
+                        goto phy_init_fail;
+        }
+
+        return 0;
+
+      phy_init_fail:
+      no_phy:
+      bus_fail:
+        kfree(mii_info);
+
+        return err;
+}
+
+#ifdef CONFIG_UGETH_TX_ON_DEMOND
+static int ugeth_transmit_on_demand(ucc_geth_private_t *ugeth)
+{
+        ucc_fast_transmit_on_demand(ugeth->uccf);
+
+        return 0;
+}
+#endif
+
+static int ugeth_graceful_stop_tx(ucc_geth_private_t *ugeth)
+{
+        ucc_fast_private_t *uccf;
+        u32 cecr_subblock;
+        u32 temp;
+
+        uccf = ugeth->uccf;
+
+        /* Mask GRACEFUL STOP TX interrupt bit and clear it */
+        temp = in_be32(uccf->p_uccm);
+        temp &= ~UCCE_GRA;
+        out_be32(uccf->p_uccm, temp);
+        out_be32(uccf->p_ucce, UCCE_GRA);       /* clear by writing 1 */
+
+        /* Issue host command */
+        cecr_subblock =
+            ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
+        qe_issue_cmd(QE_GRACEFUL_STOP_TX, cecr_subblock,
+                     (u8) QE_CR_PROTOCOL_ETHERNET, 0);
+
+        /* Wait for command to complete */
+        do {
+                temp = in_be32(uccf->p_ucce);
+        } while (!(temp & UCCE_GRA));
+
+        uccf->stopped_tx = 1;
+
+        return 0;
+}
+
+static int ugeth_graceful_stop_rx(ucc_geth_private_t * ugeth)
+{
+        ucc_fast_private_t *uccf;
+        u32 cecr_subblock;
+        u8 temp;
+
+        uccf = ugeth->uccf;
+
+        /* Clear acknowledge bit */
+        temp = ugeth->p_rx_glbl_pram->rxgstpack;
+        temp &= ~GRACEFUL_STOP_ACKNOWLEDGE_RX;
+        ugeth->p_rx_glbl_pram->rxgstpack = temp;
+
+        /* Keep issuing command and checking acknowledge bit until
+        it is asserted, according to spec */
+        do {
+                /* Issue host command */
+                cecr_subblock =
+                    ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.
+                                                ucc_num);
+                qe_issue_cmd(QE_GRACEFUL_STOP_RX, cecr_subblock,
+                             (u8) QE_CR_PROTOCOL_ETHERNET, 0);
+
+                temp = ugeth->p_rx_glbl_pram->rxgstpack;
+        } while (!(temp & GRACEFUL_STOP_ACKNOWLEDGE_RX));
+
+        uccf->stopped_rx = 1;
+
+        return 0;
+}
+
+static int ugeth_restart_tx(ucc_geth_private_t *ugeth)
+{
+        ucc_fast_private_t *uccf;
+        u32 cecr_subblock;
+
+        uccf = ugeth->uccf;
+
+        cecr_subblock =
+            ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
+        qe_issue_cmd(QE_RESTART_TX, cecr_subblock, (u8) QE_CR_PROTOCOL_ETHERNET,
+                     0);
+        uccf->stopped_tx = 0;
+
+        return 0;
+}
+
+static int ugeth_restart_rx(ucc_geth_private_t *ugeth)
+{
+        ucc_fast_private_t *uccf;
+        u32 cecr_subblock;
+
+        uccf = ugeth->uccf;
+
+        cecr_subblock =
+            ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
+        qe_issue_cmd(QE_RESTART_RX, cecr_subblock, (u8) QE_CR_PROTOCOL_ETHERNET,
+                     0);
+        uccf->stopped_rx = 0;
+
+        return 0;
+}
+
+static int ugeth_enable(ucc_geth_private_t *ugeth, comm_dir_e mode)
+{
+        ucc_fast_private_t *uccf;
+        int enabled_tx, enabled_rx;
+
+        uccf = ugeth->uccf;
+
+        /* check if the UCC number is in range. */
+        if (ugeth->ug_info->uf_info.ucc_num >= UCC_MAX_NUM) {
+                ugeth_err("%s: ucc_num out of range.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        enabled_tx = uccf->enabled_tx;
+        enabled_rx = uccf->enabled_rx;
+
+        /* Get Tx and Rx going again, in case this channel was actively
+        disabled. */
+        if ((mode & COMM_DIR_TX) && (!enabled_tx) && uccf->stopped_tx)
+                ugeth_restart_tx(ugeth);
+        if ((mode & COMM_DIR_RX) && (!enabled_rx) && uccf->stopped_rx)
+                ugeth_restart_rx(ugeth);
+
+        ucc_fast_enable(uccf, mode);    /* OK to do even if not disabled */
+
+        return 0;
+
+}
+
+static int ugeth_disable(ucc_geth_private_t * ugeth, comm_dir_e mode)
+{
+        ucc_fast_private_t *uccf;
+
+        uccf = ugeth->uccf;
+
+        /* check if the UCC number is in range. */
+        if (ugeth->ug_info->uf_info.ucc_num >= UCC_MAX_NUM) {
+                ugeth_err("%s: ucc_num out of range.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        /* Stop any transmissions */
+        if ((mode & COMM_DIR_TX) && uccf->enabled_tx && !uccf->stopped_tx)
+                ugeth_graceful_stop_tx(ugeth);
+
+        /* Stop any receptions */
+        if ((mode & COMM_DIR_RX) && uccf->enabled_rx && !uccf->stopped_rx)
+                ugeth_graceful_stop_rx(ugeth);
+
+        ucc_fast_disable(ugeth->uccf, mode); /* OK to do even if not enabled */
+
+        return 0;
+}
+
+static void ugeth_dump_regs(ucc_geth_private_t *ugeth)
+{
+#ifdef DEBUG
+        ucc_fast_dump_regs(ugeth->uccf);
+        dump_regs(ugeth);
+        dump_bds(ugeth);
+#endif
+}
+
+#ifdef CONFIG_UGETH_FILTERING
+static int ugeth_ext_filtering_serialize_tad(ucc_geth_tad_params_t *
+                                             p_UccGethTadParams,
+                                             qe_fltr_tad_t *qe_fltr_tad)
+{
+        u16 temp;
+
+        /* Zero serialized TAD */
+        memset(qe_fltr_tad, 0, QE_FLTR_TAD_SIZE);
+
+        qe_fltr_tad->serialized[0] |= UCC_GETH_TAD_V;   /* Must have this */
+        if (p_UccGethTadParams->rx_non_dynamic_extended_features_mode ||
+            (p_UccGethTadParams->vtag_op != UCC_GETH_VLAN_OPERATION_TAGGED_NOP)
+            || (p_UccGethTadParams->vnontag_op !=
+                UCC_GETH_VLAN_OPERATION_NON_TAGGED_NOP)
+            )
+                qe_fltr_tad->serialized[0] |= UCC_GETH_TAD_EF;
+        if (p_UccGethTadParams->reject_frame)
+                qe_fltr_tad->serialized[0] |= UCC_GETH_TAD_REJ;
+        temp =
+            (u16) (((u16) p_UccGethTadParams->
+                    vtag_op) << UCC_GETH_TAD_VTAG_OP_SHIFT);
+        qe_fltr_tad->serialized[0] |= (u8) (temp >> 8); /* upper bits */
+
+        qe_fltr_tad->serialized[1] |= (u8) (temp & 0x00ff);     /* lower bits */
+        if (p_UccGethTadParams->vnontag_op ==
+            UCC_GETH_VLAN_OPERATION_NON_TAGGED_Q_TAG_INSERT)
+                qe_fltr_tad->serialized[1] |= UCC_GETH_TAD_V_NON_VTAG_OP;
+        qe_fltr_tad->serialized[1] |=
+            p_UccGethTadParams->rqos << UCC_GETH_TAD_RQOS_SHIFT;
+
+        qe_fltr_tad->serialized[2] |=
+            p_UccGethTadParams->vpri << UCC_GETH_TAD_V_PRIORITY_SHIFT;
+        /* upper bits */
+        qe_fltr_tad->serialized[2] |= (u8) (p_UccGethTadParams->vid >> 8);
+        /* lower bits */
+        qe_fltr_tad->serialized[3] |= (u8) (p_UccGethTadParams->vid & 0x00ff);
+
+        return 0;
+}
+
+static enet_addr_container_t
+    *ugeth_82xx_filtering_get_match_addr_in_hash(ucc_geth_private_t *ugeth,
+                                                 enet_addr_t *p_enet_addr)
+{
+        enet_addr_container_t *enet_addr_cont;
+        struct list_head *p_lh;
+        u16 i, num;
+        int32_t j;
+        u8 *p_counter;
+
+        if ((*p_enet_addr)[0] & ENET_GROUP_ADDR) {
+                p_lh = &ugeth->group_hash_q;
+                p_counter = &(ugeth->numGroupAddrInHash);
+        } else {
+                p_lh = &ugeth->ind_hash_q;
+                p_counter = &(ugeth->numIndAddrInHash);
+        }
+
+        if (!p_lh)
+                return NULL;
+
+        num = *p_counter;
+
+        for (i = 0; i < num; i++) {
+                enet_addr_cont =
+                    (enet_addr_container_t *)
+                    ENET_ADDR_CONT_ENTRY(dequeue(p_lh));
+                for (j = ENET_NUM_OCTETS_PER_ADDRESS - 1; j >= 0; j--) {
+                        if ((*p_enet_addr)[j] != (enet_addr_cont->address)[j])
+                                break;
+                        if (j == 0)
+                                return enet_addr_cont;  /* Found */
+                }
+                enqueue(p_lh, &enet_addr_cont->node);   /* Put it back */
+        }
+        return NULL;
+}
+
+static int ugeth_82xx_filtering_add_addr_in_hash(ucc_geth_private_t *ugeth,
+                                                 enet_addr_t *p_enet_addr)
+{
+        ucc_geth_enet_address_recognition_location_e location;
+        enet_addr_container_t *enet_addr_cont;
+        struct list_head *p_lh;
+        u8 i;
+        u32 limit;
+        u8 *p_counter;
+
+        if ((*p_enet_addr)[0] & ENET_GROUP_ADDR) {
+                p_lh = &ugeth->group_hash_q;
+                limit = ugeth->ug_info->maxGroupAddrInHash;
+                location =
+                    UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_GROUP_HASH;
+                p_counter = &(ugeth->numGroupAddrInHash);
+        } else {
+                p_lh = &ugeth->ind_hash_q;
+                limit = ugeth->ug_info->maxIndAddrInHash;
+                location =
+                    UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_INDIVIDUAL_HASH;
+                p_counter = &(ugeth->numIndAddrInHash);
+        }
+
+        if ((enet_addr_cont =
+             ugeth_82xx_filtering_get_match_addr_in_hash(ugeth, p_enet_addr))) {
+                list_add(p_lh, &enet_addr_cont->node);  /* Put it back */
+                return 0;
+        }
+        if ((!p_lh) || (!(*p_counter < limit)))
+                return -EBUSY;
+        if (!(enet_addr_cont = get_enet_addr_container()))
+                return -ENOMEM;
+        for (i = 0; i < ENET_NUM_OCTETS_PER_ADDRESS; i++)
+                (enet_addr_cont->address)[i] = (*p_enet_addr)[i];
+        enet_addr_cont->location = location;
+        enqueue(p_lh, &enet_addr_cont->node);   /* Put it back */
+        ++(*p_counter);
+
+        hw_add_addr_in_hash(ugeth, &(enet_addr_cont->address));
+
+        return 0;
+}
+
+static int ugeth_82xx_filtering_clear_addr_in_hash(ucc_geth_private_t *ugeth,
+                                                   enet_addr_t *p_enet_addr)
+{
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        enet_addr_container_t *enet_addr_cont;
+        ucc_fast_private_t *uccf;
+        comm_dir_e comm_dir;
+        u16 i, num;
+        struct list_head *p_lh;
+        u32 *addr_h, *addr_l;
+        u8 *p_counter;
+
+        uccf = ugeth->uccf;
+
+        p_82xx_addr_filt =
+            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            addressfiltering;
+
+        if (!
+            (enet_addr_cont =
+             ugeth_82xx_filtering_get_match_addr_in_hash(ugeth, p_enet_addr)))
+                return -ENOENT;
+
+        /* It's been found and removed from the CQ. */
+        /* Now destroy its container */
+        put_enet_addr_container(enet_addr_cont);
+
+        if ((*p_enet_addr)[0] & ENET_GROUP_ADDR) {
+                addr_h = &(p_82xx_addr_filt->gaddr_h);
+                addr_l = &(p_82xx_addr_filt->gaddr_l);
+                p_lh = &ugeth->group_hash_q;
+                p_counter = &(ugeth->numGroupAddrInHash);
+        } else {
+                addr_h = &(p_82xx_addr_filt->iaddr_h);
+                addr_l = &(p_82xx_addr_filt->iaddr_l);
+                p_lh = &ugeth->ind_hash_q;
+                p_counter = &(ugeth->numIndAddrInHash);
+        }
+
+        comm_dir = 0;
+        if (uccf->enabled_tx)
+                comm_dir |= COMM_DIR_TX;
+        if (uccf->enabled_rx)
+                comm_dir |= COMM_DIR_RX;
+        if (comm_dir)
+                ugeth_disable(ugeth, comm_dir);
+
+        /* Clear the hash table. */
+        out_be32(addr_h, 0x00000000);
+        out_be32(addr_l, 0x00000000);
+
+        /* Add all remaining CQ elements back into hash */
+        num = --(*p_counter);
+        for (i = 0; i < num; i++) {
+                enet_addr_cont =
+                    (enet_addr_container_t *)
+                    ENET_ADDR_CONT_ENTRY(dequeue(p_lh));
+                hw_add_addr_in_hash(ugeth, &(enet_addr_cont->address));
+                enqueue(p_lh, &enet_addr_cont->node);   /* Put it back */
+        }
+
+        if (comm_dir)
+                ugeth_enable(ugeth, comm_dir);
+
+        return 0;
+}
+#endif /* CONFIG_UGETH_FILTERING */
+
+static int ugeth_82xx_filtering_clear_all_addr_in_hash(ucc_geth_private_t *
+                                                       ugeth,
+                                                       enet_addr_type_e
+                                                       enet_addr_type)
+{
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        ucc_fast_private_t *uccf;
+        comm_dir_e comm_dir;
+        struct list_head *p_lh;
+        u16 i, num;
+        u32 *addr_h, *addr_l;
+        u8 *p_counter;
+
+        uccf = ugeth->uccf;
+
+        p_82xx_addr_filt =
+            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            addressfiltering;
+
+        if (enet_addr_type == ENET_ADDR_TYPE_GROUP) {
+                addr_h = &(p_82xx_addr_filt->gaddr_h);
+                addr_l = &(p_82xx_addr_filt->gaddr_l);
+                p_lh = &ugeth->group_hash_q;
+                p_counter = &(ugeth->numGroupAddrInHash);
+        } else if (enet_addr_type == ENET_ADDR_TYPE_INDIVIDUAL) {
+                addr_h = &(p_82xx_addr_filt->iaddr_h);
+                addr_l = &(p_82xx_addr_filt->iaddr_l);
+                p_lh = &ugeth->ind_hash_q;
+                p_counter = &(ugeth->numIndAddrInHash);
+        } else
+                return -EINVAL;
+
+        comm_dir = 0;
+        if (uccf->enabled_tx)
+                comm_dir |= COMM_DIR_TX;
+        if (uccf->enabled_rx)
+                comm_dir |= COMM_DIR_RX;
+        if (comm_dir)
+                ugeth_disable(ugeth, comm_dir);
+
+        /* Clear the hash table. */
+        out_be32(addr_h, 0x00000000);
+        out_be32(addr_l, 0x00000000);
+
+        if (!p_lh)
+                return 0;
+
+        num = *p_counter;
+
+        /* Delete all remaining CQ elements */
+        for (i = 0; i < num; i++)
+                put_enet_addr_container(ENET_ADDR_CONT_ENTRY(dequeue(p_lh)));
+
+        *p_counter = 0;
+
+        if (comm_dir)
+                ugeth_enable(ugeth, comm_dir);
+
+        return 0;
+}
+
+#ifdef CONFIG_UGETH_FILTERING
+static int ugeth_82xx_filtering_add_addr_in_paddr(ucc_geth_private_t *ugeth,
+                                                  enet_addr_t *p_enet_addr,
+                                                  u8 paddr_num)
+{
+        int i;
+
+        if ((*p_enet_addr)[0] & ENET_GROUP_ADDR)
+                ugeth_warn
+                    ("%s: multicast address added to paddr will have no "
+                     "effect - is this what you wanted?",
+                     __FUNCTION__);
+
+        ugeth->indAddrRegUsed[paddr_num] = 1;   /* mark this paddr as used */
+        /* store address in our database */
+        for (i = 0; i < ENET_NUM_OCTETS_PER_ADDRESS; i++)
+                ugeth->paddr[paddr_num][i] = (*p_enet_addr)[i];
+        /* put in hardware */
+        return hw_add_addr_in_paddr(ugeth, p_enet_addr, paddr_num);
+}
+#endif /* CONFIG_UGETH_FILTERING */
+
+static int ugeth_82xx_filtering_clear_addr_in_paddr(ucc_geth_private_t *ugeth,
+                                                    u8 paddr_num)
+{
+        ugeth->indAddrRegUsed[paddr_num] = 0; /* mark this paddr as not used */
+        return hw_clear_addr_in_paddr(ugeth, paddr_num);/* clear in hardware */
+}
+
+static void ucc_geth_memclean(ucc_geth_private_t *ugeth)
+{
+        u16 i, j;
+        u8 *bd;
+
+        if (!ugeth)
+                return;
+
+        if (ugeth->uccf)
+                ucc_fast_free(ugeth->uccf);
+
+        if (ugeth->p_thread_data_tx) {
+                qe_muram_free(ugeth->thread_dat_tx_offset);
+                ugeth->p_thread_data_tx = NULL;
+        }
+        if (ugeth->p_thread_data_rx) {
+                qe_muram_free(ugeth->thread_dat_rx_offset);
+                ugeth->p_thread_data_rx = NULL;
+        }
+        if (ugeth->p_exf_glbl_param) {
+                qe_muram_free(ugeth->exf_glbl_param_offset);
+                ugeth->p_exf_glbl_param = NULL;
+        }
+        if (ugeth->p_rx_glbl_pram) {
+                qe_muram_free(ugeth->rx_glbl_pram_offset);
+                ugeth->p_rx_glbl_pram = NULL;
+        }
+        if (ugeth->p_tx_glbl_pram) {
+                qe_muram_free(ugeth->tx_glbl_pram_offset);
+                ugeth->p_tx_glbl_pram = NULL;
+        }
+        if (ugeth->p_send_q_mem_reg) {
+                qe_muram_free(ugeth->send_q_mem_reg_offset);
+                ugeth->p_send_q_mem_reg = NULL;
+        }
+        if (ugeth->p_scheduler) {
+                qe_muram_free(ugeth->scheduler_offset);
+                ugeth->p_scheduler = NULL;
+        }
+        if (ugeth->p_tx_fw_statistics_pram) {
+                qe_muram_free(ugeth->tx_fw_statistics_pram_offset);
+                ugeth->p_tx_fw_statistics_pram = NULL;
+        }
+        if (ugeth->p_rx_fw_statistics_pram) {
+                qe_muram_free(ugeth->rx_fw_statistics_pram_offset);
+                ugeth->p_rx_fw_statistics_pram = NULL;
+        }
+        if (ugeth->p_rx_irq_coalescing_tbl) {
+                qe_muram_free(ugeth->rx_irq_coalescing_tbl_offset);
+                ugeth->p_rx_irq_coalescing_tbl = NULL;
+        }
+        if (ugeth->p_rx_bd_qs_tbl) {
+                qe_muram_free(ugeth->rx_bd_qs_tbl_offset);
+                ugeth->p_rx_bd_qs_tbl = NULL;
+        }
+        if (ugeth->p_init_enet_param_shadow) {
+                return_init_enet_entries(ugeth,
+                                         &(ugeth->p_init_enet_param_shadow->
+                                           rxthread[0]),
+                                         ENET_INIT_PARAM_MAX_ENTRIES_RX,
+                                         ugeth->ug_info->riscRx, 1);
+                return_init_enet_entries(ugeth,
+                                         &(ugeth->p_init_enet_param_shadow->
+                                           txthread[0]),
+                                         ENET_INIT_PARAM_MAX_ENTRIES_TX,
+                                         ugeth->ug_info->riscTx, 0);
+                kfree(ugeth->p_init_enet_param_shadow);
+                ugeth->p_init_enet_param_shadow = NULL;
+        }
+        for (i = 0; i < ugeth->ug_info->numQueuesTx; i++) {
+                bd = ugeth->p_tx_bd_ring[i];
+                for (j = 0; j < ugeth->ug_info->bdRingLenTx[i]; j++) {
+                        if (ugeth->tx_skbuff[i][j]) {
+                                dma_unmap_single(NULL,
+                                                 BD_BUFFER_ARG(bd),
+                                                 (BD_STATUS_AND_LENGTH(bd) &
+                                                  BD_LENGTH_MASK),
+                                                 DMA_TO_DEVICE);
+                                dev_kfree_skb_any(ugeth->tx_skbuff[i][j]);
+                                ugeth->tx_skbuff[i][j] = NULL;
+                        }
+                }
+
+                kfree(ugeth->tx_skbuff[i]);
+
+                if (ugeth->p_tx_bd_ring[i]) {
+                        if (ugeth->ug_info->uf_info.bd_mem_part ==
+                            MEM_PART_SYSTEM)
+                                kfree((void *)ugeth->tx_bd_ring_offset[i]);
+                        else if (ugeth->ug_info->uf_info.bd_mem_part ==
+                                 MEM_PART_MURAM)
+                                qe_muram_free(ugeth->tx_bd_ring_offset[i]);
+                        ugeth->p_tx_bd_ring[i] = NULL;
+                }
+        }
+        for (i = 0; i < ugeth->ug_info->numQueuesRx; i++) {
+                if (ugeth->p_rx_bd_ring[i]) {
+                        /* Return existing data buffers in ring */
+                        bd = ugeth->p_rx_bd_ring[i];
+                        for (j = 0; j < ugeth->ug_info->bdRingLenRx[i]; j++) {
+                                if (ugeth->rx_skbuff[i][j]) {
+                                        dma_unmap_single(NULL, BD_BUFFER(bd),
+                                                 ugeth->ug_info->
+                                                 uf_info.
+                                                 max_rx_buf_length +
+                                                 UCC_GETH_RX_DATA_BUF_ALIGNMENT,
+                                                 DMA_FROM_DEVICE);
+
+                                        dev_kfree_skb_any(ugeth->
+                                                          rx_skbuff[i][j]);
+                                        ugeth->rx_skbuff[i][j] = NULL;
+                                }
+                                bd += UCC_GETH_SIZE_OF_BD;
+                        }
+
+                        kfree(ugeth->rx_skbuff[i]);
+
+                        if (ugeth->ug_info->uf_info.bd_mem_part ==
+                            MEM_PART_SYSTEM)
+                                kfree((void *)ugeth->rx_bd_ring_offset[i]);
+                        else if (ugeth->ug_info->uf_info.bd_mem_part ==
+                                 MEM_PART_MURAM)
+                                qe_muram_free(ugeth->rx_bd_ring_offset[i]);
+                        ugeth->p_rx_bd_ring[i] = NULL;
+                }
+        }
+        while (!list_empty(&ugeth->group_hash_q))
+                put_enet_addr_container(ENET_ADDR_CONT_ENTRY
+                                        (dequeue(&ugeth->group_hash_q)));
+        while (!list_empty(&ugeth->ind_hash_q))
+                put_enet_addr_container(ENET_ADDR_CONT_ENTRY
+                                        (dequeue(&ugeth->ind_hash_q)));
+
+}
+
+static void ucc_geth_set_multi(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth;
+        struct dev_mc_list *dmi;
+        ucc_fast_t *uf_regs;
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        enet_addr_t tempaddr;
+        u8 *mcptr, *tdptr;
+        int i, j;
+
+        ugeth = netdev_priv(dev);
+
+        uf_regs = ugeth->uccf->uf_regs;
+
+        if (dev->flags & IFF_PROMISC) {
+
+                /* Log any net taps. */
+                printk("%s: Promiscuous mode enabled.\n", dev->name);
+                uf_regs->upsmr |= UPSMR_PRO;
+
+        } else {
+
+                uf_regs->upsmr &= ~UPSMR_PRO;
+
+                p_82xx_addr_filt =
+                    (ucc_geth_82xx_address_filtering_pram_t *) ugeth->
+                    p_rx_glbl_pram->addressfiltering;
+
+                if (dev->flags & IFF_ALLMULTI) {
+                        /* Catch all multicast addresses, so set the
+                         * filter to all 1's.
+                         */
+                        out_be32(&p_82xx_addr_filt->gaddr_h, 0xffffffff);
+                        out_be32(&p_82xx_addr_filt->gaddr_l, 0xffffffff);
+                } else {
+                        /* Clear filter and add the addresses in the list.
+                         */
+                        out_be32(&p_82xx_addr_filt->gaddr_h, 0x0);
+                        out_be32(&p_82xx_addr_filt->gaddr_l, 0x0);
+
+                        dmi = dev->mc_list;
+
+                        for (i = 0; i < dev->mc_count; i++, dmi = dmi->next) {
+
+                                /* Only support group multicast for now.
+                                 */
+                                if (!(dmi->dmi_addr[0] & 1))
+                                        continue;
+
+                                /* The address in dmi_addr is LSB first,
+                                 * and taddr is MSB first.  We have to
+                                 * copy bytes MSB first from dmi_addr.
+                                 */
+                                mcptr = (u8 *) dmi->dmi_addr + 5;
+                                tdptr = (u8 *) & tempaddr;
+                                for (j = 0; j < 6; j++)
+                                        *tdptr++ = *mcptr--;
+
+                                /* Ask CPM to run CRC and set bit in
+                                 * filter mask.
+                                 */
+                                hw_add_addr_in_hash(ugeth, &tempaddr);
+
+                        }
+                }
+        }
+}
+
+static void ucc_geth_stop(ucc_geth_private_t *ugeth)
+{
+        ucc_geth_t *ug_regs = ugeth->ug_regs;
+        u32 tempval;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        /* Disable the controller */
+        ugeth_disable(ugeth, COMM_DIR_RX_AND_TX);
+
+        /* Tell the kernel the link is down */
+        ugeth->mii_info->link = 0;
+        adjust_link(ugeth->dev);
+
+        /* Mask all interrupts */
+        out_be32(ugeth->uccf->p_ucce, 0x00000000);
+
+        /* Clear all interrupts */
+        out_be32(ugeth->uccf->p_ucce, 0xffffffff);
+
+        /* Disable Rx and Tx */
+        tempval = in_be32(&ug_regs->maccfg1);
+        tempval &= ~(MACCFG1_ENABLE_RX | MACCFG1_ENABLE_TX);
+        out_be32(&ug_regs->maccfg1, tempval);
+
+        if (ugeth->ug_info->board_flags & FSL_UGETH_BRD_HAS_PHY_INTR) {
+                /* Clear any pending interrupts */
+                mii_clear_phy_interrupt(ugeth->mii_info);
+
+                /* Disable PHY Interrupts */
+                mii_configure_phy_interrupt(ugeth->mii_info,
+                                            MII_INTERRUPT_DISABLED);
+        }
+
+        free_irq(ugeth->ug_info->uf_info.irq, ugeth->dev);
+
+        if (ugeth->ug_info->board_flags & FSL_UGETH_BRD_HAS_PHY_INTR) {
+                free_irq(ugeth->ug_info->phy_interrupt, ugeth->dev);
+        } else {
+                del_timer_sync(&ugeth->phy_info_timer);
+        }
+
+        ucc_geth_memclean(ugeth);
+}
+
+static int ucc_geth_startup(ucc_geth_private_t *ugeth)
+{
+        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        ucc_geth_init_pram_t *p_init_enet_pram;
+        ucc_fast_private_t *uccf;
+        ucc_geth_info_t *ug_info;
+        ucc_fast_info_t *uf_info;
+        ucc_fast_t *uf_regs;
+        ucc_geth_t *ug_regs;
+        int ret_val = -EINVAL;
+        u32 remoder = UCC_GETH_REMODER_INIT;
+        u32 init_enet_pram_offset, cecr_subblock, command, maccfg1;
+        u32 ifstat, i, j, size, l2qt, l3qt, length;
+        u16 temoder = UCC_GETH_TEMODER_INIT;
+        u16 test;
+        u8 function_code = 0;
+        u8 *bd, *endOfRing;
+        u8 numThreadsRxNumerical, numThreadsTxNumerical;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        ug_info = ugeth->ug_info;
+        uf_info = &ug_info->uf_info;
+
+        if (!((uf_info->bd_mem_part == MEM_PART_SYSTEM) ||
+              (uf_info->bd_mem_part == MEM_PART_MURAM))) {
+                ugeth_err("%s: Bad memory partition value.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        /* Rx BD lengths */
+        for (i = 0; i < ug_info->numQueuesRx; i++) {
+                if ((ug_info->bdRingLenRx[i] < UCC_GETH_RX_BD_RING_SIZE_MIN) ||
+                    (ug_info->bdRingLenRx[i] %
+                     UCC_GETH_RX_BD_RING_SIZE_ALIGNMENT)) {
+                        ugeth_err
+                            ("%s: Rx BD ring length must be multiple of 4,"
+                                " no smaller than 8.", __FUNCTION__);
+                        return -EINVAL;
+                }
+        }
+
+        /* Tx BD lengths */
+        for (i = 0; i < ug_info->numQueuesTx; i++) {
+                if (ug_info->bdRingLenTx[i] < UCC_GETH_TX_BD_RING_SIZE_MIN) {
+                        ugeth_err
+                            ("%s: Tx BD ring length must be no smaller than 2.",
+                             __FUNCTION__);
+                        return -EINVAL;
+                }
+        }
+
+        /* mrblr */
+        if ((uf_info->max_rx_buf_length == 0) ||
+            (uf_info->max_rx_buf_length % UCC_GETH_MRBLR_ALIGNMENT)) {
+                ugeth_err
+                    ("%s: max_rx_buf_length must be non-zero multiple of 128.",
+                     __FUNCTION__);
+                return -EINVAL;
+        }
+
+        /* num Tx queues */
+        if (ug_info->numQueuesTx > NUM_TX_QUEUES) {
+                ugeth_err("%s: number of tx queues too large.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        /* num Rx queues */
+        if (ug_info->numQueuesRx > NUM_RX_QUEUES) {
+                ugeth_err("%s: number of rx queues too large.", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        /* l2qt */
+        for (i = 0; i < UCC_GETH_VLAN_PRIORITY_MAX; i++) {
+                if (ug_info->l2qt[i] >= ug_info->numQueuesRx) {
+                        ugeth_err
+                            ("%s: VLAN priority table entry must not be"
+                                " larger than number of Rx queues.",
+                             __FUNCTION__);
+                        return -EINVAL;
+                }
+        }
+
+        /* l3qt */
+        for (i = 0; i < UCC_GETH_IP_PRIORITY_MAX; i++) {
+                if (ug_info->l3qt[i] >= ug_info->numQueuesRx) {
+                        ugeth_err
+                            ("%s: IP priority table entry must not be"
+                                " larger than number of Rx queues.",
+                             __FUNCTION__);
+                        return -EINVAL;
+                }
+        }
+
+        if (ug_info->cam && !ug_info->ecamptr) {
+                ugeth_err("%s: If cam mode is chosen, must supply cam ptr.",
+                          __FUNCTION__);
+                return -EINVAL;
+        }
+
+        if ((ug_info->numStationAddresses !=
+             UCC_GETH_NUM_OF_STATION_ADDRESSES_1)
+            && ug_info->rxExtendedFiltering) {
+                ugeth_err("%s: Number of station addresses greater than 1 "
+                          "not allowed in extended parsing mode.",
+                          __FUNCTION__);
+                return -EINVAL;
+        }
+
+        /* Generate uccm_mask for receive */
+        uf_info->uccm_mask = ug_info->eventRegMask & UCCE_OTHER;/* Errors */
+        for (i = 0; i < ug_info->numQueuesRx; i++)
+                uf_info->uccm_mask |= (UCCE_RXBF_SINGLE_MASK << i);
+
+        for (i = 0; i < ug_info->numQueuesTx; i++)
+                uf_info->uccm_mask |= (UCCE_TXBF_SINGLE_MASK << i);
+        /* Initialize the general fast UCC block. */
+        if (ucc_fast_init(uf_info, &uccf)) {
+                ugeth_err("%s: Failed to init uccf.", __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+        ugeth->uccf = uccf;
+
+        switch (ug_info->numThreadsRx) {
+        case UCC_GETH_NUM_OF_THREADS_1:
+                numThreadsRxNumerical = 1;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_2:
+                numThreadsRxNumerical = 2;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_4:
+                numThreadsRxNumerical = 4;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_6:
+                numThreadsRxNumerical = 6;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_8:
+                numThreadsRxNumerical = 8;
+                break;
+        default:
+                ugeth_err("%s: Bad number of Rx threads value.", __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -EINVAL;
+                break;
+        }
+
+        switch (ug_info->numThreadsTx) {
+        case UCC_GETH_NUM_OF_THREADS_1:
+                numThreadsTxNumerical = 1;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_2:
+                numThreadsTxNumerical = 2;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_4:
+                numThreadsTxNumerical = 4;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_6:
+                numThreadsTxNumerical = 6;
+                break;
+        case UCC_GETH_NUM_OF_THREADS_8:
+                numThreadsTxNumerical = 8;
+                break;
+        default:
+                ugeth_err("%s: Bad number of Tx threads value.", __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -EINVAL;
+                break;
+        }
+
+        /* Calculate rx_extended_features */
+        ugeth->rx_non_dynamic_extended_features = ug_info->ipCheckSumCheck ||
+            ug_info->ipAddressAlignment ||
+            (ug_info->numStationAddresses !=
+             UCC_GETH_NUM_OF_STATION_ADDRESSES_1);
+
+        ugeth->rx_extended_features = ugeth->rx_non_dynamic_extended_features ||
+            (ug_info->vlanOperationTagged != UCC_GETH_VLAN_OPERATION_TAGGED_NOP)
+            || (ug_info->vlanOperationNonTagged !=
+                UCC_GETH_VLAN_OPERATION_NON_TAGGED_NOP);
+
+        uf_regs = uccf->uf_regs;
+        ug_regs = (ucc_geth_t *) (uccf->uf_regs);
+        ugeth->ug_regs = ug_regs;
+
+        init_default_reg_vals(&uf_regs->upsmr,
+                              &ug_regs->maccfg1, &ug_regs->maccfg2);
+
+        /*                    Set UPSMR                      */
+        /* For more details see the hardware spec.           */
+        init_rx_parameters(ug_info->bro,
+                           ug_info->rsh, ug_info->pro, &uf_regs->upsmr);
+
+        /* We're going to ignore other registers for now, */
+        /* except as needed to get up and running         */
+
+        /*                    Set MACCFG1                    */
+        /* For more details see the hardware spec.           */
+        init_flow_control_params(ug_info->aufc,
+                                 ug_info->receiveFlowControl,
+                                 1,
+                                 ug_info->pausePeriod,
+                                 ug_info->extensionField,
+                                 &uf_regs->upsmr,
+                                 &ug_regs->uempr, &ug_regs->maccfg1);
+
+        maccfg1 = in_be32(&ug_regs->maccfg1);
+        maccfg1 |= MACCFG1_ENABLE_RX;
+        maccfg1 |= MACCFG1_ENABLE_TX;
+        out_be32(&ug_regs->maccfg1, maccfg1);
+
+        /*                    Set IPGIFG                     */
+        /* For more details see the hardware spec.           */
+        ret_val = init_inter_frame_gap_params(ug_info->nonBackToBackIfgPart1,
+                                              ug_info->nonBackToBackIfgPart2,
+                                              ug_info->
+                                              miminumInterFrameGapEnforcement,
+                                              ug_info->backToBackInterFrameGap,
+                                              &ug_regs->ipgifg);
+        if (ret_val != 0) {
+                ugeth_err("%s: IPGIFG initialization parameter too large.",
+                          __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return ret_val;
+        }
+
+        /*                    Set HAFDUP                     */
+        /* For more details see the hardware spec.           */
+        ret_val = init_half_duplex_params(ug_info->altBeb,
+                                          ug_info->backPressureNoBackoff,
+                                          ug_info->noBackoff,
+                                          ug_info->excessDefer,
+                                          ug_info->altBebTruncation,
+                                          ug_info->maxRetransmission,
+                                          ug_info->collisionWindow,
+                                          &ug_regs->hafdup);
+        if (ret_val != 0) {
+                ugeth_err("%s: Half Duplex initialization parameter too large.",
+                          __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return ret_val;
+        }
+
+        /*                    Set IFSTAT                     */
+        /* For more details see the hardware spec.           */
+        /* Read only - resets upon read                      */
+        ifstat = in_be32(&ug_regs->ifstat);
+
+        /*                    Clear UEMPR                    */
+        /* For more details see the hardware spec.           */
+        out_be32(&ug_regs->uempr, 0);
+
+        /*                    Set UESCR                      */
+        /* For more details see the hardware spec.           */
+        init_hw_statistics_gathering_mode((ug_info->statisticsMode &
+                                UCC_GETH_STATISTICS_GATHERING_MODE_HARDWARE),
+                                0, &uf_regs->upsmr, &ug_regs->uescr);
+
+        /* Allocate Tx bds */
+        for (j = 0; j < ug_info->numQueuesTx; j++) {
+                /* Allocate in multiple of
+                   UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT,
+                   according to spec */
+                length = ((ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD)
+                          / UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT)
+                    * UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT;
+                if ((ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD) %
+                    UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT)
+                        length += UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT;
+                if (uf_info->bd_mem_part == MEM_PART_SYSTEM) {
+                        u32 align = 4;
+                        if (UCC_GETH_TX_BD_RING_ALIGNMENT > 4)
+                                align = UCC_GETH_TX_BD_RING_ALIGNMENT;
+                        ugeth->tx_bd_ring_offset[j] =
+                                (u32) (kmalloc((u32) (length + align),
+                                GFP_KERNEL));
+                        if (ugeth->tx_bd_ring_offset[j] != 0)
+                                ugeth->p_tx_bd_ring[j] =
+                                        (void*)((ugeth->tx_bd_ring_offset[j] +
+                                        align) & ~(align - 1));
+                } else if (uf_info->bd_mem_part == MEM_PART_MURAM) {
+                        ugeth->tx_bd_ring_offset[j] =
+                            qe_muram_alloc(length,
+                                           UCC_GETH_TX_BD_RING_ALIGNMENT);
+                        if (!IS_MURAM_ERR(ugeth->tx_bd_ring_offset[j]))
+                                ugeth->p_tx_bd_ring[j] =
+                                    (u8 *) qe_muram_addr(ugeth->
+                                                         tx_bd_ring_offset[j]);
+                }
+                if (!ugeth->p_tx_bd_ring[j]) {
+                        ugeth_err
+                            ("%s: Can not allocate memory for Tx bd rings.",
+                             __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+                /* Zero unused end of bd ring, according to spec */
+                memset(ugeth->p_tx_bd_ring[j] +
+                       ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD, 0,
+                       length - ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD);
+        }
+
+        /* Allocate Rx bds */
+        for (j = 0; j < ug_info->numQueuesRx; j++) {
+                length = ug_info->bdRingLenRx[j] * UCC_GETH_SIZE_OF_BD;
+                if (uf_info->bd_mem_part == MEM_PART_SYSTEM) {
+                        u32 align = 4;
+                        if (UCC_GETH_RX_BD_RING_ALIGNMENT > 4)
+                                align = UCC_GETH_RX_BD_RING_ALIGNMENT;
+                        ugeth->rx_bd_ring_offset[j] =
+                            (u32) (kmalloc((u32) (length + align), GFP_KERNEL));
+                        if (ugeth->rx_bd_ring_offset[j] != 0)
+                                ugeth->p_rx_bd_ring[j] =
+                                        (void*)((ugeth->rx_bd_ring_offset[j] +
+                                        align) & ~(align - 1));
+                } else if (uf_info->bd_mem_part == MEM_PART_MURAM) {
+                        ugeth->rx_bd_ring_offset[j] =
+                            qe_muram_alloc(length,
+                                           UCC_GETH_RX_BD_RING_ALIGNMENT);
+                        if (!IS_MURAM_ERR(ugeth->rx_bd_ring_offset[j]))
+                                ugeth->p_rx_bd_ring[j] =
+                                    (u8 *) qe_muram_addr(ugeth->
+                                                         rx_bd_ring_offset[j]);
+                }
+                if (!ugeth->p_rx_bd_ring[j]) {
+                        ugeth_err
+                            ("%s: Can not allocate memory for Rx bd rings.",
+                             __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+        }
+
+        /* Init Tx bds */
+        for (j = 0; j < ug_info->numQueuesTx; j++) {
+                /* Setup the skbuff rings */
+                ugeth->tx_skbuff[j] =
+                    (struct sk_buff **)kmalloc(sizeof(struct sk_buff *) *
+                                               ugeth->ug_info->bdRingLenTx[j],
+                                               GFP_KERNEL);
+
+                if (ugeth->tx_skbuff[j] == NULL) {
+                        ugeth_err("%s: Could not allocate tx_skbuff",
+                                  __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+
+                for (i = 0; i < ugeth->ug_info->bdRingLenTx[j]; i++)
+                        ugeth->tx_skbuff[j][i] = NULL;
+
+                ugeth->skb_curtx[j] = ugeth->skb_dirtytx[j] = 0;
+                bd = ugeth->confBd[j] = ugeth->txBd[j] = ugeth->p_tx_bd_ring[j];
+                for (i = 0; i < ug_info->bdRingLenTx[j]; i++) {
+                        BD_BUFFER_CLEAR(bd);
+                        BD_STATUS_AND_LENGTH_SET(bd, 0);
+                        bd += UCC_GETH_SIZE_OF_BD;
+                }
+                bd -= UCC_GETH_SIZE_OF_BD;
+                BD_STATUS_AND_LENGTH_SET(bd, T_W);/* for last BD set Wrap bit */
+        }
+
+        /* Init Rx bds */
+        for (j = 0; j < ug_info->numQueuesRx; j++) {
+                /* Setup the skbuff rings */
+                ugeth->rx_skbuff[j] =
+                    (struct sk_buff **)kmalloc(sizeof(struct sk_buff *) *
+                                               ugeth->ug_info->bdRingLenRx[j],
+                                               GFP_KERNEL);
+
+                if (ugeth->rx_skbuff[j] == NULL) {
+                        ugeth_err("%s: Could not allocate rx_skbuff",
+                                  __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+
+                for (i = 0; i < ugeth->ug_info->bdRingLenRx[j]; i++)
+                        ugeth->rx_skbuff[j][i] = NULL;
+
+                ugeth->skb_currx[j] = 0;
+                bd = ugeth->rxBd[j] = ugeth->p_rx_bd_ring[j];
+                for (i = 0; i < ug_info->bdRingLenRx[j]; i++) {
+                        BD_STATUS_AND_LENGTH_SET(bd, R_I);
+                        BD_BUFFER_CLEAR(bd);
+                        bd += UCC_GETH_SIZE_OF_BD;
+                }
+                bd -= UCC_GETH_SIZE_OF_BD;
+                BD_STATUS_AND_LENGTH_SET(bd, R_W);/* for last BD set Wrap bit */
+        }
+
+        /*
+         * Global PRAM
+         */
+        /* Tx global PRAM */
+        /* Allocate global tx parameter RAM page */
+        ugeth->tx_glbl_pram_offset =
+            qe_muram_alloc(sizeof(ucc_geth_tx_global_pram_t),
+                           UCC_GETH_TX_GLOBAL_PRAM_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->tx_glbl_pram_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_tx_glbl_pram.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+        ugeth->p_tx_glbl_pram =
+            (ucc_geth_tx_global_pram_t *) qe_muram_addr(ugeth->
+                                                        tx_glbl_pram_offset);
+        /* Zero out p_tx_glbl_pram */
+        memset(ugeth->p_tx_glbl_pram, 0, sizeof(ucc_geth_tx_global_pram_t));
+
+        /* Fill global PRAM */
+
+        /* TQPTR */
+        /* Size varies with number of Tx threads */
+        ugeth->thread_dat_tx_offset =
+            qe_muram_alloc(numThreadsTxNumerical *
+                           sizeof(ucc_geth_thread_data_tx_t) +
+                           32 * (numThreadsTxNumerical == 1),
+                           UCC_GETH_THREAD_DATA_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->thread_dat_tx_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_thread_data_tx.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+
+        ugeth->p_thread_data_tx =
+            (ucc_geth_thread_data_tx_t *) qe_muram_addr(ugeth->
+                                                        thread_dat_tx_offset);
+        out_be32(&ugeth->p_tx_glbl_pram->tqptr, ugeth->thread_dat_tx_offset);
+
+        /* vtagtable */
+        for (i = 0; i < UCC_GETH_TX_VTAG_TABLE_ENTRY_MAX; i++)
+                out_be32(&ugeth->p_tx_glbl_pram->vtagtable[i],
+                         ug_info->vtagtable[i]);
+
+        /* iphoffset */
+        for (i = 0; i < TX_IP_OFFSET_ENTRY_MAX; i++)
+                ugeth->p_tx_glbl_pram->iphoffset[i] = ug_info->iphoffset[i];
+
+        /* SQPTR */
+        /* Size varies with number of Tx queues */
+        ugeth->send_q_mem_reg_offset =
+            qe_muram_alloc(ug_info->numQueuesTx *
+                           sizeof(ucc_geth_send_queue_qd_t),
+                           UCC_GETH_SEND_QUEUE_QUEUE_DESCRIPTOR_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->send_q_mem_reg_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_send_q_mem_reg.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+
+        ugeth->p_send_q_mem_reg =
+            (ucc_geth_send_queue_mem_region_t *) qe_muram_addr(ugeth->
+                        send_q_mem_reg_offset);
+        out_be32(&ugeth->p_tx_glbl_pram->sqptr, ugeth->send_q_mem_reg_offset);
+
+        /* Setup the table */
+        /* Assume BD rings are already established */
+        for (i = 0; i < ug_info->numQueuesTx; i++) {
+                endOfRing =
+                    ugeth->p_tx_bd_ring[i] + (ug_info->bdRingLenTx[i] -
+                                              1) * UCC_GETH_SIZE_OF_BD;
+                if (ugeth->ug_info->uf_info.bd_mem_part == MEM_PART_SYSTEM) {
+                        out_be32(&ugeth->p_send_q_mem_reg->sqqd[i].bd_ring_base,
+                                 (u32) virt_to_phys(ugeth->p_tx_bd_ring[i]));
+                        out_be32(&ugeth->p_send_q_mem_reg->sqqd[i].
+                                 last_bd_completed_address,
+                                 (u32) virt_to_phys(endOfRing));
+                } else if (ugeth->ug_info->uf_info.bd_mem_part ==
+                           MEM_PART_MURAM) {
+                        out_be32(&ugeth->p_send_q_mem_reg->sqqd[i].bd_ring_base,
+                                 (u32) immrbar_virt_to_phys(ugeth->
+                                                            p_tx_bd_ring[i]));
+                        out_be32(&ugeth->p_send_q_mem_reg->sqqd[i].
+                                 last_bd_completed_address,
+                                 (u32) immrbar_virt_to_phys(endOfRing));
+                }
+        }
+
+        /* schedulerbasepointer */
+
+        if (ug_info->numQueuesTx > 1) {
+        /* scheduler exists only if more than 1 tx queue */
+                ugeth->scheduler_offset =
+                    qe_muram_alloc(sizeof(ucc_geth_scheduler_t),
+                                   UCC_GETH_SCHEDULER_ALIGNMENT);
+                if (IS_MURAM_ERR(ugeth->scheduler_offset)) {
+                        ugeth_err
+                         ("%s: Can not allocate DPRAM memory for p_scheduler.",
+                             __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+
+                ugeth->p_scheduler =
+                    (ucc_geth_scheduler_t *) qe_muram_addr(ugeth->
+                                                           scheduler_offset);
+                out_be32(&ugeth->p_tx_glbl_pram->schedulerbasepointer,
+                         ugeth->scheduler_offset);
+                /* Zero out p_scheduler */
+                memset(ugeth->p_scheduler, 0, sizeof(ucc_geth_scheduler_t));
+
+                /* Set values in scheduler */
+                out_be32(&ugeth->p_scheduler->mblinterval,
+                         ug_info->mblinterval);
+                out_be16(&ugeth->p_scheduler->nortsrbytetime,
+                         ug_info->nortsrbytetime);
+                ugeth->p_scheduler->fracsiz = ug_info->fracsiz;
+                ugeth->p_scheduler->strictpriorityq = ug_info->strictpriorityq;
+                ugeth->p_scheduler->txasap = ug_info->txasap;
+                ugeth->p_scheduler->extrabw = ug_info->extrabw;
+                for (i = 0; i < NUM_TX_QUEUES; i++)
+                        ugeth->p_scheduler->weightfactor[i] =
+                            ug_info->weightfactor[i];
+
+                /* Set pointers to cpucount registers in scheduler */
+                ugeth->p_cpucount[0] = &(ugeth->p_scheduler->cpucount0);
+                ugeth->p_cpucount[1] = &(ugeth->p_scheduler->cpucount1);
+                ugeth->p_cpucount[2] = &(ugeth->p_scheduler->cpucount2);
+                ugeth->p_cpucount[3] = &(ugeth->p_scheduler->cpucount3);
+                ugeth->p_cpucount[4] = &(ugeth->p_scheduler->cpucount4);
+                ugeth->p_cpucount[5] = &(ugeth->p_scheduler->cpucount5);
+                ugeth->p_cpucount[6] = &(ugeth->p_scheduler->cpucount6);
+                ugeth->p_cpucount[7] = &(ugeth->p_scheduler->cpucount7);
+        }
+
+        /* schedulerbasepointer */
+        /* TxRMON_PTR (statistics) */
+        if (ug_info->
+            statisticsMode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX) {
+                ugeth->tx_fw_statistics_pram_offset =
+                    qe_muram_alloc(sizeof
+                                   (ucc_geth_tx_firmware_statistics_pram_t),
+                                   UCC_GETH_TX_STATISTICS_ALIGNMENT);
+                if (IS_MURAM_ERR(ugeth->tx_fw_statistics_pram_offset)) {
+                        ugeth_err
+                            ("%s: Can not allocate DPRAM memory for"
+                                " p_tx_fw_statistics_pram.", __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+                ugeth->p_tx_fw_statistics_pram =
+                    (ucc_geth_tx_firmware_statistics_pram_t *)
+                    qe_muram_addr(ugeth->tx_fw_statistics_pram_offset);
+                /* Zero out p_tx_fw_statistics_pram */
+                memset(ugeth->p_tx_fw_statistics_pram,
+                       0, sizeof(ucc_geth_tx_firmware_statistics_pram_t));
+        }
+
+        /* temoder */
+        /* Already has speed set */
+
+        if (ug_info->numQueuesTx > 1)
+                temoder |= TEMODER_SCHEDULER_ENABLE;
+        if (ug_info->ipCheckSumGenerate)
+                temoder |= TEMODER_IP_CHECKSUM_GENERATE;
+        temoder |= ((ug_info->numQueuesTx - 1) << TEMODER_NUM_OF_QUEUES_SHIFT);
+        out_be16(&ugeth->p_tx_glbl_pram->temoder, temoder);
+
+        test = in_be16(&ugeth->p_tx_glbl_pram->temoder);
+
+        /* Function code register value to be used later */
+        function_code = QE_BMR_BYTE_ORDER_BO_MOT | UCC_FAST_FUNCTION_CODE_GBL;
+        /* Required for QE */
+
+        /* function code register */
+        out_be32(&ugeth->p_tx_glbl_pram->tstate, ((u32) function_code) << 24);
+
+        /* Rx global PRAM */
+        /* Allocate global rx parameter RAM page */
+        ugeth->rx_glbl_pram_offset =
+            qe_muram_alloc(sizeof(ucc_geth_rx_global_pram_t),
+                           UCC_GETH_RX_GLOBAL_PRAM_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->rx_glbl_pram_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_rx_glbl_pram.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+        ugeth->p_rx_glbl_pram =
+            (ucc_geth_rx_global_pram_t *) qe_muram_addr(ugeth->
+                                                        rx_glbl_pram_offset);
+        /* Zero out p_rx_glbl_pram */
+        memset(ugeth->p_rx_glbl_pram, 0, sizeof(ucc_geth_rx_global_pram_t));
+
+        /* Fill global PRAM */
+
+        /* RQPTR */
+        /* Size varies with number of Rx threads */
+        ugeth->thread_dat_rx_offset =
+            qe_muram_alloc(numThreadsRxNumerical *
+                           sizeof(ucc_geth_thread_data_rx_t),
+                           UCC_GETH_THREAD_DATA_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->thread_dat_rx_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_thread_data_rx.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+
+        ugeth->p_thread_data_rx =
+            (ucc_geth_thread_data_rx_t *) qe_muram_addr(ugeth->
+                                                        thread_dat_rx_offset);
+        out_be32(&ugeth->p_rx_glbl_pram->rqptr, ugeth->thread_dat_rx_offset);
+
+        /* typeorlen */
+        out_be16(&ugeth->p_rx_glbl_pram->typeorlen, ug_info->typeorlen);
+
+        /* rxrmonbaseptr (statistics) */
+        if (ug_info->
+            statisticsMode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX) {
+                ugeth->rx_fw_statistics_pram_offset =
+                    qe_muram_alloc(sizeof
+                                   (ucc_geth_rx_firmware_statistics_pram_t),
+                                   UCC_GETH_RX_STATISTICS_ALIGNMENT);
+                if (IS_MURAM_ERR(ugeth->rx_fw_statistics_pram_offset)) {
+                        ugeth_err
+                                ("%s: Can not allocate DPRAM memory for"
+                                " p_rx_fw_statistics_pram.", __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+                ugeth->p_rx_fw_statistics_pram =
+                    (ucc_geth_rx_firmware_statistics_pram_t *)
+                    qe_muram_addr(ugeth->rx_fw_statistics_pram_offset);
+                /* Zero out p_rx_fw_statistics_pram */
+                memset(ugeth->p_rx_fw_statistics_pram, 0,
+                       sizeof(ucc_geth_rx_firmware_statistics_pram_t));
+        }
+
+        /* intCoalescingPtr */
+
+        /* Size varies with number of Rx queues */
+        ugeth->rx_irq_coalescing_tbl_offset =
+            qe_muram_alloc(ug_info->numQueuesRx *
+                           sizeof(ucc_geth_rx_interrupt_coalescing_entry_t),
+                           UCC_GETH_RX_INTERRUPT_COALESCING_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->rx_irq_coalescing_tbl_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for"
+                        " p_rx_irq_coalescing_tbl.", __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+
+        ugeth->p_rx_irq_coalescing_tbl =
+            (ucc_geth_rx_interrupt_coalescing_table_t *)
+            qe_muram_addr(ugeth->rx_irq_coalescing_tbl_offset);
+        out_be32(&ugeth->p_rx_glbl_pram->intcoalescingptr,
+                 ugeth->rx_irq_coalescing_tbl_offset);
+
+        /* Fill interrupt coalescing table */
+        for (i = 0; i < ug_info->numQueuesRx; i++) {
+                out_be32(&ugeth->p_rx_irq_coalescing_tbl->coalescingentry[i].
+                         interruptcoalescingmaxvalue,
+                         ug_info->interruptcoalescingmaxvalue[i]);
+                out_be32(&ugeth->p_rx_irq_coalescing_tbl->coalescingentry[i].
+                         interruptcoalescingcounter,
+                         ug_info->interruptcoalescingmaxvalue[i]);
+        }
+
+        /* MRBLR */
+        init_max_rx_buff_len(uf_info->max_rx_buf_length,
+                             &ugeth->p_rx_glbl_pram->mrblr);
+        /* MFLR */
+        out_be16(&ugeth->p_rx_glbl_pram->mflr, ug_info->maxFrameLength);
+        /* MINFLR */
+        init_min_frame_len(ug_info->minFrameLength,
+                           &ugeth->p_rx_glbl_pram->minflr,
+                           &ugeth->p_rx_glbl_pram->mrblr);
+        /* MAXD1 */
+        out_be16(&ugeth->p_rx_glbl_pram->maxd1, ug_info->maxD1Length);
+        /* MAXD2 */
+        out_be16(&ugeth->p_rx_glbl_pram->maxd2, ug_info->maxD2Length);
+
+        /* l2qt */
+        l2qt = 0;
+        for (i = 0; i < UCC_GETH_VLAN_PRIORITY_MAX; i++)
+                l2qt |= (ug_info->l2qt[i] << (28 - 4 * i));
+        out_be32(&ugeth->p_rx_glbl_pram->l2qt, l2qt);
+
+        /* l3qt */
+        for (j = 0; j < UCC_GETH_IP_PRIORITY_MAX; j += 8) {
+                l3qt = 0;
+                for (i = 0; i < 8; i++)
+                        l3qt |= (ug_info->l3qt[j + i] << (28 - 4 * i));
+                out_be32(&ugeth->p_rx_glbl_pram->l3qt[j], l3qt);
+        }
+
+        /* vlantype */
+        out_be16(&ugeth->p_rx_glbl_pram->vlantype, ug_info->vlantype);
+
+        /* vlantci */
+        out_be16(&ugeth->p_rx_glbl_pram->vlantci, ug_info->vlantci);
+
+        /* ecamptr */
+        out_be32(&ugeth->p_rx_glbl_pram->ecamptr, ug_info->ecamptr);
+
+        /* RBDQPTR */
+        /* Size varies with number of Rx queues */
+        ugeth->rx_bd_qs_tbl_offset =
+            qe_muram_alloc(ug_info->numQueuesRx *
+                           (sizeof(ucc_geth_rx_bd_queues_entry_t) +
+                            sizeof(ucc_geth_rx_prefetched_bds_t)),
+                           UCC_GETH_RX_BD_QUEUES_ALIGNMENT);
+        if (IS_MURAM_ERR(ugeth->rx_bd_qs_tbl_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_rx_bd_qs_tbl.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+
+        ugeth->p_rx_bd_qs_tbl =
+            (ucc_geth_rx_bd_queues_entry_t *) qe_muram_addr(ugeth->
+                                    rx_bd_qs_tbl_offset);
+        out_be32(&ugeth->p_rx_glbl_pram->rbdqptr, ugeth->rx_bd_qs_tbl_offset);
+        /* Zero out p_rx_bd_qs_tbl */
+        memset(ugeth->p_rx_bd_qs_tbl,
+               0,
+               ug_info->numQueuesRx * (sizeof(ucc_geth_rx_bd_queues_entry_t) +
+                                       sizeof(ucc_geth_rx_prefetched_bds_t)));
+
+        /* Setup the table */
+        /* Assume BD rings are already established */
+        for (i = 0; i < ug_info->numQueuesRx; i++) {
+                if (ugeth->ug_info->uf_info.bd_mem_part == MEM_PART_SYSTEM) {
+                        out_be32(&ugeth->p_rx_bd_qs_tbl[i].externalbdbaseptr,
+                                 (u32) virt_to_phys(ugeth->p_rx_bd_ring[i]));
+                } else if (ugeth->ug_info->uf_info.bd_mem_part ==
+                           MEM_PART_MURAM) {
+                        out_be32(&ugeth->p_rx_bd_qs_tbl[i].externalbdbaseptr,
+                                 (u32) immrbar_virt_to_phys(ugeth->
+                                                            p_rx_bd_ring[i]));
+                }
+                /* rest of fields handled by QE */
+        }
+
+        /* remoder */
+        /* Already has speed set */
+
+        if (ugeth->rx_extended_features)
+                remoder |= REMODER_RX_EXTENDED_FEATURES;
+        if (ug_info->rxExtendedFiltering)
+                remoder |= REMODER_RX_EXTENDED_FILTERING;
+        if (ug_info->dynamicMaxFrameLength)
+                remoder |= REMODER_DYNAMIC_MAX_FRAME_LENGTH;
+        if (ug_info->dynamicMinFrameLength)
+                remoder |= REMODER_DYNAMIC_MIN_FRAME_LENGTH;
+        remoder |=
+            ug_info->vlanOperationTagged << REMODER_VLAN_OPERATION_TAGGED_SHIFT;
+        remoder |=
+            ug_info->
+            vlanOperationNonTagged << REMODER_VLAN_OPERATION_NON_TAGGED_SHIFT;
+        remoder |= ug_info->rxQoSMode << REMODER_RX_QOS_MODE_SHIFT;
+        remoder |= ((ug_info->numQueuesRx - 1) << REMODER_NUM_OF_QUEUES_SHIFT);
+        if (ug_info->ipCheckSumCheck)
+                remoder |= REMODER_IP_CHECKSUM_CHECK;
+        if (ug_info->ipAddressAlignment)
+                remoder |= REMODER_IP_ADDRESS_ALIGNMENT;
+        out_be32(&ugeth->p_rx_glbl_pram->remoder, remoder);
+
+        /* Note that this function must be called */
+        /* ONLY AFTER p_tx_fw_statistics_pram */
+        /* andp_UccGethRxFirmwareStatisticsPram are allocated ! */
+        init_firmware_statistics_gathering_mode((ug_info->
+                statisticsMode &
+                UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX),
+                (ug_info->statisticsMode &
+                UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX),
+                &ugeth->p_tx_glbl_pram->txrmonbaseptr,
+                ugeth->tx_fw_statistics_pram_offset,
+                &ugeth->p_rx_glbl_pram->rxrmonbaseptr,
+                ugeth->rx_fw_statistics_pram_offset,
+                &ugeth->p_tx_glbl_pram->temoder,
+                &ugeth->p_rx_glbl_pram->remoder);
+
+        /* function code register */
+        ugeth->p_rx_glbl_pram->rstate = function_code;
+
+        /* initialize extended filtering */
+        if (ug_info->rxExtendedFiltering) {
+                if (!ug_info->extendedFilteringChainPointer) {
+                        ugeth_err("%s: Null Extended Filtering Chain Pointer.",
+                                  __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -EINVAL;
+                }
+
+                /* Allocate memory for extended filtering Mode Global
+                Parameters */
+                ugeth->exf_glbl_param_offset =
+                    qe_muram_alloc(sizeof(ucc_geth_exf_global_pram_t),
+                UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT);
+                if (IS_MURAM_ERR(ugeth->exf_glbl_param_offset)) {
+                        ugeth_err
+                                ("%s: Can not allocate DPRAM memory for"
+                                " p_exf_glbl_param.", __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return -ENOMEM;
+                }
+
+                ugeth->p_exf_glbl_param =
+                    (ucc_geth_exf_global_pram_t *) qe_muram_addr(ugeth->
+                                 exf_glbl_param_offset);
+                out_be32(&ugeth->p_rx_glbl_pram->exfGlobalParam,
+                         ugeth->exf_glbl_param_offset);
+                out_be32(&ugeth->p_exf_glbl_param->l2pcdptr,
+                         (u32) ug_info->extendedFilteringChainPointer);
+
+        } else {                /* initialize 82xx style address filtering */
+
+                /* Init individual address recognition registers to disabled */
+
+                for (j = 0; j < NUM_OF_PADDRS; j++)
+                        ugeth_82xx_filtering_clear_addr_in_paddr(ugeth, (u8) j);
+
+                /* Create CQs for hash tables */
+                if (ug_info->maxGroupAddrInHash > 0) {
+                        INIT_LIST_HEAD(&ugeth->group_hash_q);
+                }
+                if (ug_info->maxIndAddrInHash > 0) {
+                        INIT_LIST_HEAD(&ugeth->ind_hash_q);
+                }
+                p_82xx_addr_filt =
+                    (ucc_geth_82xx_address_filtering_pram_t *) ugeth->
+                    p_rx_glbl_pram->addressfiltering;
+
+                ugeth_82xx_filtering_clear_all_addr_in_hash(ugeth,
+                        ENET_ADDR_TYPE_GROUP);
+                ugeth_82xx_filtering_clear_all_addr_in_hash(ugeth,
+                        ENET_ADDR_TYPE_INDIVIDUAL);
+        }
+
+        /*
+         * Initialize UCC at QE level
+         */
+
+        command = QE_INIT_TX_RX;
+
+        /* Allocate shadow InitEnet command parameter structure.
+         * This is needed because after the InitEnet command is executed,
+         * the structure in DPRAM is released, because DPRAM is a premium
+         * resource.
+         * This shadow structure keeps a copy of what was done so that the
+         * allocated resources can be released when the channel is freed.
+         */
+        if (!(ugeth->p_init_enet_param_shadow =
+             (ucc_geth_init_pram_t *) kmalloc(sizeof(ucc_geth_init_pram_t),
+                                              GFP_KERNEL))) {
+                ugeth_err
+                    ("%s: Can not allocate memory for"
+                        " p_UccInitEnetParamShadows.", __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+        /* Zero out *p_init_enet_param_shadow */
+        memset((char *)ugeth->p_init_enet_param_shadow,
+               0, sizeof(ucc_geth_init_pram_t));
+
+        /* Fill shadow InitEnet command parameter structure */
+
+        ugeth->p_init_enet_param_shadow->resinit1 =
+            ENET_INIT_PARAM_MAGIC_RES_INIT1;
+        ugeth->p_init_enet_param_shadow->resinit2 =
+            ENET_INIT_PARAM_MAGIC_RES_INIT2;
+        ugeth->p_init_enet_param_shadow->resinit3 =
+            ENET_INIT_PARAM_MAGIC_RES_INIT3;
+        ugeth->p_init_enet_param_shadow->resinit4 =
+            ENET_INIT_PARAM_MAGIC_RES_INIT4;
+        ugeth->p_init_enet_param_shadow->resinit5 =
+            ENET_INIT_PARAM_MAGIC_RES_INIT5;
+        ugeth->p_init_enet_param_shadow->rgftgfrxglobal |=
+            ((u32) ug_info->numThreadsRx) << ENET_INIT_PARAM_RGF_SHIFT;
+        ugeth->p_init_enet_param_shadow->rgftgfrxglobal |=
+            ((u32) ug_info->numThreadsTx) << ENET_INIT_PARAM_TGF_SHIFT;
+
+        ugeth->p_init_enet_param_shadow->rgftgfrxglobal |=
+            ugeth->rx_glbl_pram_offset | ug_info->riscRx;
+        if ((ug_info->largestexternallookupkeysize !=
+             QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_NONE)
+            && (ug_info->largestexternallookupkeysize !=
+                QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
+            && (ug_info->largestexternallookupkeysize !=
+                QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_16_BYTES)) {
+                ugeth_err("%s: Invalid largest External Lookup Key Size.",
+                          __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -EINVAL;
+        }
+        ugeth->p_init_enet_param_shadow->largestexternallookupkeysize =
+            ug_info->largestexternallookupkeysize;
+        size = sizeof(ucc_geth_thread_rx_pram_t);
+        if (ug_info->rxExtendedFiltering) {
+                size += THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING;
+                if (ug_info->largestexternallookupkeysize ==
+                    QE_FLTR_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
+                        size +=
+                            THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_8;
+                if (ug_info->largestexternallookupkeysize ==
+                    QE_FLTR_TABLE_LOOKUP_KEY_SIZE_16_BYTES)
+                        size +=
+                            THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_16;
+        }
+
+        if ((ret_val = fill_init_enet_entries(ugeth, &(ugeth->
+                p_init_enet_param_shadow->rxthread[0]),
+                (u8) (numThreadsRxNumerical + 1)
+                /* Rx needs one extra for terminator */
+                , size, UCC_GETH_THREAD_RX_PRAM_ALIGNMENT,
+                ug_info->riscRx, 1)) != 0) {
+                        ugeth_err("%s: Can not fill p_init_enet_param_shadow.",
+                                __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return ret_val;
+        }
+
+        ugeth->p_init_enet_param_shadow->txglobal =
+            ugeth->tx_glbl_pram_offset | ug_info->riscTx;
+        if ((ret_val =
+             fill_init_enet_entries(ugeth,
+                                    &(ugeth->p_init_enet_param_shadow->
+                                      txthread[0]), numThreadsTxNumerical,
+                                    sizeof(ucc_geth_thread_tx_pram_t),
+                                    UCC_GETH_THREAD_TX_PRAM_ALIGNMENT,
+                                    ug_info->riscTx, 0)) != 0) {
+                ugeth_err("%s: Can not fill p_init_enet_param_shadow.",
+                          __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return ret_val;
+        }
+
+        /* Load Rx bds with buffers */
+        for (i = 0; i < ug_info->numQueuesRx; i++) {
+                if ((ret_val = rx_bd_buffer_set(ugeth, (u8) i)) != 0) {
+                        ugeth_err("%s: Can not fill Rx bds with buffers.",
+                                  __FUNCTION__);
+                        ucc_geth_memclean(ugeth);
+                        return ret_val;
+                }
+        }
+
+        /* Allocate InitEnet command parameter structure */
+        init_enet_pram_offset = qe_muram_alloc(sizeof(ucc_geth_init_pram_t), 4);
+        if (IS_MURAM_ERR(init_enet_pram_offset)) {
+                ugeth_err
+                    ("%s: Can not allocate DPRAM memory for p_init_enet_pram.",
+                     __FUNCTION__);
+                ucc_geth_memclean(ugeth);
+                return -ENOMEM;
+        }
+        p_init_enet_pram =
+            (ucc_geth_init_pram_t *) qe_muram_addr(init_enet_pram_offset);
+
+        /* Copy shadow InitEnet command parameter structure into PRAM */
+        p_init_enet_pram->resinit1 = ugeth->p_init_enet_param_shadow->resinit1;
+        p_init_enet_pram->resinit2 = ugeth->p_init_enet_param_shadow->resinit2;
+        p_init_enet_pram->resinit3 = ugeth->p_init_enet_param_shadow->resinit3;
+        p_init_enet_pram->resinit4 = ugeth->p_init_enet_param_shadow->resinit4;
+        out_be16(&p_init_enet_pram->resinit5,
+                 ugeth->p_init_enet_param_shadow->resinit5);
+        p_init_enet_pram->largestexternallookupkeysize =
+            ugeth->p_init_enet_param_shadow->largestexternallookupkeysize;
+        out_be32(&p_init_enet_pram->rgftgfrxglobal,
+                 ugeth->p_init_enet_param_shadow->rgftgfrxglobal);
+        for (i = 0; i < ENET_INIT_PARAM_MAX_ENTRIES_RX; i++)
+                out_be32(&p_init_enet_pram->rxthread[i],
+                         ugeth->p_init_enet_param_shadow->rxthread[i]);
+        out_be32(&p_init_enet_pram->txglobal,
+                 ugeth->p_init_enet_param_shadow->txglobal);
+        for (i = 0; i < ENET_INIT_PARAM_MAX_ENTRIES_TX; i++)
+                out_be32(&p_init_enet_pram->txthread[i],
+                         ugeth->p_init_enet_param_shadow->txthread[i]);
+
+        /* Issue QE command */
+        cecr_subblock =
+            ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
+        qe_issue_cmd(command, cecr_subblock, (u8) QE_CR_PROTOCOL_ETHERNET,
+                     init_enet_pram_offset);
+
+        /* Free InitEnet command parameter */
+        qe_muram_free(init_enet_pram_offset);
+
+        return 0;
+}
+
+/* returns a net_device_stats structure pointer */
+static struct net_device_stats *ucc_geth_get_stats(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+
+        return &(ugeth->stats);
+}
+
+/* ucc_geth_timeout gets called when a packet has not been
+ * transmitted after a set amount of time.
+ * For now, assume that clearing out all the structures, and
+ * starting over will fix the problem. */
+static void ucc_geth_timeout(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        ugeth->stats.tx_errors++;
+
+        ugeth_dump_regs(ugeth);
+
+        if (dev->flags & IFF_UP) {
+                ucc_geth_stop(ugeth);
+                ucc_geth_startup(ugeth);
+        }
+
+        netif_schedule(dev);
+}
+
+/* This is called by the kernel when a frame is ready for transmission. */
+/* It is pointed to by the dev->hard_start_xmit function pointer */
+static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        u8 *bd;                 /* BD pointer */
+        u32 bd_status;
+        u8 txQ = 0;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        spin_lock_irq(&ugeth->lock);
+
+        ugeth->stats.tx_bytes += skb->len;
+
+        /* Start from the next BD that should be filled */
+        bd = ugeth->txBd[txQ];
+        bd_status = BD_STATUS_AND_LENGTH(bd);
+        /* Save the skb pointer so we can free it later */
+        ugeth->tx_skbuff[txQ][ugeth->skb_curtx[txQ]] = skb;
+
+        /* Update the current skb pointer (wrapping if this was the last) */
+        ugeth->skb_curtx[txQ] =
+            (ugeth->skb_curtx[txQ] +
+             1) & TX_RING_MOD_MASK(ugeth->ug_info->bdRingLenTx[txQ]);
+
+        /* set up the buffer descriptor */
+        BD_BUFFER_SET(bd,
+                      dma_map_single(NULL, skb->data, skb->len, DMA_TO_DEVICE));
+
+        //printk(KERN_DEBUG"skb->data is 0x%x\n",skb->data);
+
+        bd_status = (bd_status & T_W) | T_R | T_I | T_L | skb->len;
+
+        BD_STATUS_AND_LENGTH_SET(bd, bd_status);
+
+        dev->trans_start = jiffies;
+
+        /* Move to next BD in the ring */
+        if (!(bd_status & T_W))
+                ugeth->txBd[txQ] = bd + UCC_GETH_SIZE_OF_BD;
+        else
+                ugeth->txBd[txQ] = ugeth->p_tx_bd_ring[txQ];
+
+        /* If the next BD still needs to be cleaned up, then the bds
+           are full.  We need to tell the kernel to stop sending us stuff. */
+        if (bd == ugeth->confBd[txQ]) {
+                if (!netif_queue_stopped(dev))
+                        netif_stop_queue(dev);
+        }
+
+        if (ugeth->p_scheduler) {
+                ugeth->cpucount[txQ]++;
+                /* Indicate to QE that there are more Tx bds ready for
+                transmission */
+                /* This is done by writing a running counter of the bd
+                count to the scheduler PRAM. */
+                out_be16(ugeth->p_cpucount[txQ], ugeth->cpucount[txQ]);
+        }
+
+        spin_unlock_irq(&ugeth->lock);
+
+        return 0;
+}
+
+static int ucc_geth_rx(ucc_geth_private_t *ugeth, u8 rxQ, int rx_work_limit)
+{
+        struct sk_buff *skb;
+        u8 *bd;
+        u16 length, howmany = 0;
+        u32 bd_status;
+        u8 *bdBuffer;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        spin_lock(&ugeth->lock);
+        /* collect received buffers */
+        bd = ugeth->rxBd[rxQ];
+
+        bd_status = BD_STATUS_AND_LENGTH(bd);
+
+        /* while there are received buffers and BD is full (~R_E) */
+        while (!((bd_status & (R_E)) || (--rx_work_limit < 0))) {
+                bdBuffer = (u8 *) BD_BUFFER(bd);
+                length = (u16) ((bd_status & BD_LENGTH_MASK) - 4);
+                skb = ugeth->rx_skbuff[rxQ][ugeth->skb_currx[rxQ]];
+
+                /* determine whether buffer is first, last, first and last
+                (single buffer frame) or middle (not first and not last) */
+                if (!skb ||
+                    (!(bd_status & (R_F | R_L))) ||
+                    (bd_status & R_ERRORS_FATAL)) {
+                        ugeth_vdbg("%s, %d: ERROR!!! skb - 0x%08x",
+                                   __FUNCTION__, __LINE__, (u32) skb);
+                        if (skb)
+                                dev_kfree_skb_any(skb);
+
+                        ugeth->rx_skbuff[rxQ][ugeth->skb_currx[rxQ]] = NULL;
+                        ugeth->stats.rx_dropped++;
+                } else {
+                        ugeth->stats.rx_packets++;
+                        howmany++;
+
+                        /* Prep the skb for the packet */
+                        skb_put(skb, length);
+
+                        /* Tell the skb what kind of packet this is */
+                        skb->protocol = eth_type_trans(skb, ugeth->dev);
+
+                        ugeth->stats.rx_bytes += length;
+                        /* Send the packet up the stack */
+#ifdef CONFIG_UGETH_NAPI
+                        netif_receive_skb(skb);
+#else
+                        netif_rx(skb);
+#endif                          /* CONFIG_UGETH_NAPI */
+                }
+
+                ugeth->dev->last_rx = jiffies;
+
+                skb = get_new_skb(ugeth, bd);
+                if (!skb) {
+                        ugeth_warn("%s: No Rx Data Buffer", __FUNCTION__);
+                        spin_unlock(&ugeth->lock);
+                        ugeth->stats.rx_dropped++;
+                        break;
+                }
+
+                ugeth->rx_skbuff[rxQ][ugeth->skb_currx[rxQ]] = skb;
+
+                /* update to point at the next skb */
+                ugeth->skb_currx[rxQ] =
+                    (ugeth->skb_currx[rxQ] +
+                     1) & RX_RING_MOD_MASK(ugeth->ug_info->bdRingLenRx[rxQ]);
+
+                if (bd_status & R_W)
+                        bd = ugeth->p_rx_bd_ring[rxQ];
+                else
+                        bd += UCC_GETH_SIZE_OF_BD;
+
+                bd_status = BD_STATUS_AND_LENGTH(bd);
+        }
+
+        ugeth->rxBd[rxQ] = bd;
+        spin_unlock(&ugeth->lock);
+        return howmany;
+}
+
+static int ucc_geth_tx(struct net_device *dev, u8 txQ)
+{
+        /* Start from the next BD that should be filled */
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        u8 *bd;                 /* BD pointer */
+        u32 bd_status;
+
+        bd = ugeth->confBd[txQ];
+        bd_status = BD_STATUS_AND_LENGTH(bd);
+
+        /* Normal processing. */
+        while ((bd_status & T_R) == 0) {
+                /* BD contains already transmitted buffer.   */
+                /* Handle the transmitted buffer and release */
+                /* the BD to be used with the current frame  */
+
+                if ((bd = ugeth->txBd[txQ]) && (netif_queue_stopped(dev) == 0))
+                        break;
+
+                ugeth->stats.tx_packets++;
+
+                /* Free the sk buffer associated with this TxBD */
+                dev_kfree_skb_irq(ugeth->
+                                  tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]]);
+                ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]] = NULL;
+                ugeth->skb_dirtytx[txQ] =
+                    (ugeth->skb_dirtytx[txQ] +
+                     1) & TX_RING_MOD_MASK(ugeth->ug_info->bdRingLenTx[txQ]);
+
+                /* We freed a buffer, so now we can restart transmission */
+                if (netif_queue_stopped(dev))
+                        netif_wake_queue(dev);
+
+                /* Advance the confirmation BD pointer */
+                if (!(bd_status & T_W))
+                        ugeth->confBd[txQ] += UCC_GETH_SIZE_OF_BD;
+                else
+                        ugeth->confBd[txQ] = ugeth->p_tx_bd_ring[txQ];
+        }
+        return 0;
+}
+
+#ifdef CONFIG_UGETH_NAPI
+static int ucc_geth_poll(struct net_device *dev, int *budget)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        int howmany;
+        int rx_work_limit = *budget;
+        u8 rxQ = 0;
+
+        if (rx_work_limit > dev->quota)
+                rx_work_limit = dev->quota;
+
+        howmany = ucc_geth_rx(ugeth, rxQ, rx_work_limit);
+
+        dev->quota -= howmany;
+        rx_work_limit -= howmany;
+        *budget -= howmany;
+
+        if (rx_work_limit >= 0)
+                netif_rx_complete(dev);
+
+        return (rx_work_limit < 0) ? 1 : 0;
+}
+#endif                          /* CONFIG_UGETH_NAPI */
+
+static irqreturn_t ucc_geth_irq_handler(int irq, void *info,
+                                        struct pt_regs *regs)
+{
+        struct net_device *dev = (struct net_device *)info;
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        ucc_fast_private_t *uccf;
+        ucc_geth_info_t *ug_info;
+        register u32 ucce = 0;
+        register u32 bit_mask = UCCE_RXBF_SINGLE_MASK;
+        register u32 tx_mask = UCCE_TXBF_SINGLE_MASK;
+        register u8 i;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        if (!ugeth)
+                return IRQ_NONE;
+
+        uccf = ugeth->uccf;
+        ug_info = ugeth->ug_info;
+
+        do {
+                ucce |= (u32) (in_be32(uccf->p_ucce) & in_be32(uccf->p_uccm));
+
+                /* clear event bits for next time */
+                /* Side effect here is to mask ucce variable
+                for future processing below. */
+                out_be32(uccf->p_ucce, ucce);   /* Clear with ones,
+                                                but only bits in UCCM */
+
+                /* We ignore Tx interrupts because Tx confirmation is
+                done inside Tx routine */
+
+                for (i = 0; i < ug_info->numQueuesRx; i++) {
+                        if (ucce & bit_mask)
+                                ucc_geth_rx(ugeth, i,
+                                            (int)ugeth->ug_info->
+                                            bdRingLenRx[i]);
+                        ucce &= ~bit_mask;
+                        bit_mask <<= 1;
+                }
+
+                for (i = 0; i < ug_info->numQueuesTx; i++) {
+                        if (ucce & tx_mask)
+                                ucc_geth_tx(dev, i);
+                        ucce &= ~tx_mask;
+                        tx_mask <<= 1;
+                }
+
+                /* Exceptions */
+                if (ucce & UCCE_BSY) {
+                        ugeth_vdbg("Got BUSY irq!!!!");
+                        ugeth->stats.rx_errors++;
+                        ucce &= ~UCCE_BSY;
+                }
+                if (ucce & UCCE_OTHER) {
+                        ugeth_vdbg("Got frame with error (ucce - 0x%08x)!!!!",
+                                   ucce);
+                        ugeth->stats.rx_errors++;
+                        ucce &= ~ucce;
+                }
+        }
+        while (ucce);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t phy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct net_device *dev = (struct net_device *)dev_id;
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        /* Clear the interrupt */
+        mii_clear_phy_interrupt(ugeth->mii_info);
+
+        /* Disable PHY interrupts */
+        mii_configure_phy_interrupt(ugeth->mii_info, MII_INTERRUPT_DISABLED);
+
+        /* Schedule the phy change */
+        schedule_work(&ugeth->tq);
+
+        return IRQ_HANDLED;
+}
+
+/* Scheduled by the phy_interrupt/timer to handle PHY changes */
+static void ugeth_phy_change(void *data)
+{
+        struct net_device *dev = (struct net_device *)data;
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        ucc_geth_t *ug_regs;
+        int result = 0;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        ug_regs = ugeth->ug_regs;
+
+        /* Delay to give the PHY a chance to change the
+         * register state */
+        msleep(1);
+
+        /* Update the link, speed, duplex */
+        result = ugeth->mii_info->phyinfo->read_status(ugeth->mii_info);
+
+        /* Adjust the known status as long as the link
+         * isn't still coming up */
+        if ((0 == result) || (ugeth->mii_info->link == 0))
+                adjust_link(dev);
+
+        /* Reenable interrupts, if needed */
+        if (ugeth->ug_info->board_flags & FSL_UGETH_BRD_HAS_PHY_INTR)
+                mii_configure_phy_interrupt(ugeth->mii_info,
+                                            MII_INTERRUPT_ENABLED);
+}
+
+/* Called every so often on systems that don't interrupt
+ * the core for PHY changes */
+static void ugeth_phy_timer(unsigned long data)
+{
+        struct net_device *dev = (struct net_device *)data;
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+
+        schedule_work(&ugeth->tq);
+
+        mod_timer(&ugeth->phy_info_timer, jiffies + PHY_CHANGE_TIME * HZ);
+}
+
+/* Keep trying aneg for some time
+ * If, after GFAR_AN_TIMEOUT seconds, it has not
+ * finished, we switch to forced.
+ * Either way, once the process has completed, we either
+ * request the interrupt, or switch the timer over to
+ * using ugeth_phy_timer to check status */
+static void ugeth_phy_startup_timer(unsigned long data)
+{
+        struct ugeth_mii_info *mii_info = (struct ugeth_mii_info *)data;
+        ucc_geth_private_t *ugeth = netdev_priv(mii_info->dev);
+        static int secondary = UGETH_AN_TIMEOUT;
+        int result;
+
+        /* Configure the Auto-negotiation */
+        result = mii_info->phyinfo->config_aneg(mii_info);
+
+        /* If autonegotiation failed to start, and
+         * we haven't timed out, reset the timer, and return */
+        if (result && secondary--) {
+                mod_timer(&ugeth->phy_info_timer, jiffies + HZ);
+                return;
+        } else if (result) {
+                /* Couldn't start autonegotiation.
+                 * Try switching to forced */
+                mii_info->autoneg = 0;
+                result = mii_info->phyinfo->config_aneg(mii_info);
+
+                /* Forcing failed!  Give up */
+                if (result) {
+                        ugeth_err("%s: Forcing failed!", mii_info->dev->name);
+                        return;
+                }
+        }
+
+        /* Kill the timer so it can be restarted */
+        del_timer_sync(&ugeth->phy_info_timer);
+
+        /* Grab the PHY interrupt, if necessary/possible */
+        if (ugeth->ug_info->board_flags & FSL_UGETH_BRD_HAS_PHY_INTR) {
+                if (request_irq(ugeth->ug_info->phy_interrupt,
+                                phy_interrupt,
+                                SA_SHIRQ, "phy_interrupt", mii_info->dev) < 0) {
+                        ugeth_err("%s: Can't get IRQ %d (PHY)",
+                                  mii_info->dev->name,
+                                  ugeth->ug_info->phy_interrupt);
+                } else {
+                        mii_configure_phy_interrupt(ugeth->mii_info,
+                                                    MII_INTERRUPT_ENABLED);
+                        return;
+                }
+        }
+
+        /* Start the timer again, this time in order to
+         * handle a change in status */
+        init_timer(&ugeth->phy_info_timer);
+        ugeth->phy_info_timer.function = &ugeth_phy_timer;
+        ugeth->phy_info_timer.data = (unsigned long)mii_info->dev;
+        mod_timer(&ugeth->phy_info_timer, jiffies + PHY_CHANGE_TIME * HZ);
+}
+
+/* Called when something needs to use the ethernet device */
+/* Returns 0 for success. */
+static int ucc_geth_open(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        int err;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        /* Test station address */
+        if (dev->dev_addr[0] & ENET_GROUP_ADDR) {
+                ugeth_err("%s: Multicast address used for station address"
+                          " - is this what you wanted?", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        err = ucc_geth_startup(ugeth);
+        if (err) {
+                ugeth_err("%s: Cannot configure net device, aborting.",
+                          dev->name);
+                return err;
+        }
+
+        err = adjust_enet_interface(ugeth);
+        if (err) {
+                ugeth_err("%s: Cannot configure net device, aborting.",
+                          dev->name);
+                return err;
+        }
+
+        /*       Set MACSTNADDR1, MACSTNADDR2                */
+        /* For more details see the hardware spec.           */
+        init_mac_station_addr_regs(dev->dev_addr[0],
+                                   dev->dev_addr[1],
+                                   dev->dev_addr[2],
+                                   dev->dev_addr[3],
+                                   dev->dev_addr[4],
+                                   dev->dev_addr[5],
+                                   &ugeth->ug_regs->macstnaddr1,
+                                   &ugeth->ug_regs->macstnaddr2);
+
+        err = init_phy(dev);
+        if (err) {
+                ugeth_err("%s: Cannot initialzie PHY, aborting.", dev->name);
+                return err;
+        }
+#ifndef CONFIG_UGETH_NAPI
+        err =
+            request_irq(ugeth->ug_info->uf_info.irq, ucc_geth_irq_handler, 0,
+                        "UCC Geth", dev);
+        if (err) {
+                ugeth_err("%s: Cannot get IRQ for net device, aborting.",
+                          dev->name);
+                ucc_geth_stop(ugeth);
+                return err;
+        }
+#endif                          /* CONFIG_UGETH_NAPI */
+
+        /* Set up the PHY change work queue */
+        INIT_WORK(&ugeth->tq, ugeth_phy_change, dev);
+
+        init_timer(&ugeth->phy_info_timer);
+        ugeth->phy_info_timer.function = &ugeth_phy_startup_timer;
+        ugeth->phy_info_timer.data = (unsigned long)ugeth->mii_info;
+        mod_timer(&ugeth->phy_info_timer, jiffies + HZ);
+
+        err = ugeth_enable(ugeth, COMM_DIR_RX_AND_TX);
+        if (err) {
+                ugeth_err("%s: Cannot enable net device, aborting.", dev->name);
+                ucc_geth_stop(ugeth);
+                return err;
+        }
+
+        netif_start_queue(dev);
+
+        return err;
+}
+
+/* Stops the kernel queue, and halts the controller */
+static int ucc_geth_close(struct net_device *dev)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        ucc_geth_stop(ugeth);
+
+        /* Shutdown the PHY */
+        if (ugeth->mii_info->phyinfo->close)
+                ugeth->mii_info->phyinfo->close(ugeth->mii_info);
+
+        kfree(ugeth->mii_info);
+
+        netif_stop_queue(dev);
+
+        return 0;
+}
+
+struct ethtool_ops ucc_geth_ethtool_ops = {
+        .get_settings = NULL,
+        .get_drvinfo = NULL,
+        .get_regs_len = NULL,
+        .get_regs = NULL,
+        .get_link = NULL,
+        .get_coalesce = NULL,
+        .set_coalesce = NULL,
+        .get_ringparam = NULL,
+        .set_ringparam = NULL,
+        .get_strings = NULL,
+        .get_stats_count = NULL,
+        .get_ethtool_stats = NULL,
+};
+
+static int ucc_geth_probe(struct device *device)
+{
+        struct platform_device *pdev = to_platform_device(device);
+        struct ucc_geth_platform_data *ugeth_pdata;
+        struct net_device *dev = NULL;
+        struct ucc_geth_private *ugeth = NULL;
+        struct ucc_geth_info *ug_info;
+        int err;
+        static int mii_mng_configured = 0;
+
+        ugeth_vdbg("%s: IN", __FUNCTION__);
+
+        ugeth_pdata = (struct ucc_geth_platform_data *)pdev->dev.platform_data;
+
+        ug_info = &ugeth_info[pdev->id];
+        ug_info->uf_info.ucc_num = pdev->id;
+        ug_info->uf_info.rx_clock = ugeth_pdata->rx_clock;
+        ug_info->uf_info.tx_clock = ugeth_pdata->tx_clock;
+        ug_info->uf_info.regs = ugeth_pdata->phy_reg_addr;
+        ug_info->uf_info.irq = platform_get_irq(pdev, 0);
+        ug_info->phy_address = ugeth_pdata->phy_id;
+        ug_info->enet_interface = ugeth_pdata->phy_interface;
+        ug_info->board_flags = ugeth_pdata->board_flags;
+        ug_info->phy_interrupt = ugeth_pdata->phy_interrupt;
+
+        printk(KERN_INFO "ucc_geth: UCC%1d at 0x%8x (irq = %d) \n",
+                ug_info->uf_info.ucc_num + 1, ug_info->uf_info.regs,
+                ug_info->uf_info.irq);
+
+        if (ug_info == NULL) {
+                ugeth_err("%s: [%d] Missing additional data!", __FUNCTION__,
+                          pdev->id);
+                return -ENODEV;
+        }
+
+        if (!mii_mng_configured) {
+                ucc_set_qe_mux_mii_mng(ug_info->uf_info.ucc_num);
+                mii_mng_configured = 1;
+        }
+
+        /* Create an ethernet device instance */
+        dev = alloc_etherdev(sizeof(*ugeth));
+
+        if (dev == NULL)
+                return -ENOMEM;
+
+        ugeth = netdev_priv(dev);
+        spin_lock_init(&ugeth->lock);
+
+        dev_set_drvdata(device, dev);
+
+        /* Set the dev->base_addr to the gfar reg region */
+        dev->base_addr = (unsigned long)(ug_info->uf_info.regs);
+
+        SET_MODULE_OWNER(dev);
+        SET_NETDEV_DEV(dev, device);
+
+        /* Fill in the dev structure */
+        dev->open = ucc_geth_open;
+        dev->hard_start_xmit = ucc_geth_start_xmit;
+        dev->tx_timeout = ucc_geth_timeout;
+        dev->watchdog_timeo = TX_TIMEOUT;
+#ifdef CONFIG_UGETH_NAPI
+        dev->poll = ucc_geth_poll;
+        dev->weight = UCC_GETH_DEV_WEIGHT;
+#endif                          /* CONFIG_UGETH_NAPI */
+        dev->stop = ucc_geth_close;
+        dev->get_stats = ucc_geth_get_stats;
+//    dev->change_mtu = ucc_geth_change_mtu;
+        dev->mtu = 1500;
+        dev->set_multicast_list = ucc_geth_set_multi;
+        dev->ethtool_ops = &ucc_geth_ethtool_ops;
+
+        err = register_netdev(dev);
+        if (err) {
+                ugeth_err("%s: Cannot register net device, aborting.",
+                          dev->name);
+                free_netdev(dev);
+                return err;
+        }
+
+        ugeth->ug_info = ug_info;
+        ugeth->dev = dev;
+        memcpy(dev->dev_addr, ugeth_pdata->mac_addr, 6);
+
+        return 0;
+}
+
+static int ucc_geth_remove(struct device *device)
+{
+        struct net_device *dev = dev_get_drvdata(device);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
+
+        dev_set_drvdata(device, NULL);
+        ucc_geth_memclean(ugeth);
+        free_netdev(dev);
+
+        return 0;
+}
+
+/* Structure for a device driver */
+static struct device_driver ucc_geth_driver = {
+        .name = DRV_NAME,
+        .bus = &platform_bus_type,
+        .probe = ucc_geth_probe,
+        .remove = ucc_geth_remove,
+};
+
+static int __init ucc_geth_init(void)
+{
+        int i;
+        printk(KERN_INFO "ucc_geth: " DRV_DESC "\n");
+        for (i = 0; i < 8; i++)
+                memcpy(&(ugeth_info[i]), &ugeth_primary_info,
+                       sizeof(ugeth_primary_info));
+
+        return driver_register(&ucc_geth_driver);
+}
+
+static void __exit ucc_geth_exit(void)
+{
+        driver_unregister(&ucc_geth_driver);
+}
+
+module_init(ucc_geth_init);
+module_exit(ucc_geth_exit);
+
+MODULE_AUTHOR("Freescale Semiconductor, Inc");
+MODULE_DESCRIPTION(DRV_DESC);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
new file mode 100644
index 000000000000..005965f5dd9b
--- /dev/null
+++ b/drivers/net/ucc_geth.h
@@ -0,0 +1,1339 @@
+/*
+ * Copyright (C) Freescale Semicondutor, Inc. 2006. All rights reserved.
+ *
+ * Author: Shlomi Gridish <gridish@freescale.com>
+ *
+ * Description:
+ * Internal header file for UCC Gigabit Ethernet unit routines.
+ *
+ * Changelog:
+ * Jun 28, 2006 Li Yang <LeoLi@freescale.com>
+ * - Rearrange code and style fixes
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#ifndef __UCC_GETH_H__
+#define __UCC_GETH_H__
+
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/fsl_devices.h>
+
+#include <asm/immap_qe.h>
+#include <asm/qe.h>
+
+#include <asm/ucc.h>
+#include <asm/ucc_fast.h>
+
+#define NUM_TX_QUEUES                   8
+#define NUM_RX_QUEUES                   8
+#define NUM_BDS_IN_PREFETCHED_BDS       4
+#define TX_IP_OFFSET_ENTRY_MAX          8
+#define NUM_OF_PADDRS                   4
+#define ENET_INIT_PARAM_MAX_ENTRIES_RX  9
+#define ENET_INIT_PARAM_MAX_ENTRIES_TX  8
+
+typedef struct ucc_mii_mng {
+        u32 miimcfg;            /* MII management configuration reg */
+        u32 miimcom;            /* MII management command reg */
+        u32 miimadd;            /* MII management address reg */
+        u32 miimcon;            /* MII management control reg */
+        u32 miimstat;           /* MII management status reg */
+        u32 miimind;            /* MII management indication reg */
+} __attribute__ ((packed)) ucc_mii_mng_t;
+
+typedef struct ucc_geth {
+        ucc_fast_t uccf;
+
+        u32 maccfg1;            /* mac configuration reg. 1 */
+        u32 maccfg2;            /* mac configuration reg. 2 */
+        u32 ipgifg;             /* interframe gap reg.  */
+        u32 hafdup;             /* half-duplex reg.  */
+        u8 res1[0x10];
+        ucc_mii_mng_t miimng;   /* MII management structure */
+        u32 ifctl;              /* interface control reg */
+        u32 ifstat;             /* interface statux reg */
+        u32 macstnaddr1;        /* mac station address part 1 reg */
+        u32 macstnaddr2;        /* mac station address part 2 reg */
+        u8 res2[0x8];
+        u32 uempr;              /* UCC Ethernet Mac parameter reg */
+        u32 utbipar;            /* UCC tbi address reg */
+        u16 uescr;              /* UCC Ethernet statistics control reg */
+        u8 res3[0x180 - 0x15A];
+        u32 tx64;               /* Total number of frames (including bad
+                                   frames) transmitted that were exactly of the
+                                   minimal length (64 for un tagged, 68 for
+                                   tagged, or with length exactly equal to the
+                                   parameter MINLength */
+        u32 tx127;              /* Total number of frames (including bad
+                                   frames) transmitted that were between
+                                   MINLength (Including FCS length==4) and 127
+                                   octets */
+        u32 tx255;              /* Total number of frames (including bad
+                                   frames) transmitted that were between 128
+                                   (Including FCS length==4) and 255 octets */
+        u32 rx64;               /* Total number of frames received including
+                                   bad frames that were exactly of the mninimal
+                                   length (64 bytes) */
+        u32 rx127;              /* Total number of frames (including bad
+                                   frames) received that were between MINLength
+                                   (Including FCS length==4) and 127 octets */
+        u32 rx255;              /* Total number of frames (including bad
+                                   frames) received that were between 128
+                                   (Including FCS length==4) and 255 octets */
+        u32 txok;               /* Total number of octets residing in frames
+                                   that where involved in succesfull
+                                   transmission */
+        u16 txcf;               /* Total number of PAUSE control frames
+                                   transmitted by this MAC */
+        u8 res4[0x2];
+        u32 tmca;               /* Total number of frames that were transmitted
+                                   succesfully with the group address bit set
+                                   that are not broadcast frames */
+        u32 tbca;               /* Total number of frames transmitted
+                                   succesfully that had destination address
+                                   field equal to the broadcast address */
+        u32 rxfok;              /* Total number of frames received OK */
+        u32 rxbok;              /* Total number of octets received OK */
+        u32 rbyt;               /* Total number of octets received including
+                                   octets in bad frames. Must be implemented in
+                                   HW because it includes octets in frames that
+                                   never even reach the UCC */
+        u32 rmca;               /* Total number of frames that were received
+                                   succesfully with the group address bit set
+                                   that are not broadcast frames */
+        u32 rbca;               /* Total number of frames received succesfully
+                                   that had destination address equal to the
+                                   broadcast address */
+        u32 scar;               /* Statistics carry register */
+        u32 scam;               /* Statistics caryy mask register */
+        u8 res5[0x200 - 0x1c4];
+} __attribute__ ((packed)) ucc_geth_t;
+
+/* UCC GETH TEMODR Register */
+#define TEMODER_TX_RMON_STATISTICS_ENABLE       0x0100  /* enable Tx statistics
+                                                         */
+#define TEMODER_SCHEDULER_ENABLE                0x2000  /* enable scheduler */
+#define TEMODER_IP_CHECKSUM_GENERATE            0x0400  /* generate IPv4
+                                                           checksums */
+#define TEMODER_PERFORMANCE_OPTIMIZATION_MODE1  0x0200  /* enable performance
+                                                           optimization
+                                                           enhancement (mode1) */
+#define TEMODER_RMON_STATISTICS                 0x0100  /* enable tx statistics
+                                                         */
+#define TEMODER_NUM_OF_QUEUES_SHIFT             (15-15) /* Number of queues <<
+                                                           shift */
+
+/* UCC GETH TEMODR Register */
+#define REMODER_RX_RMON_STATISTICS_ENABLE       0x00001000      /* enable Rx
+                                                                   statistics */
+#define REMODER_RX_EXTENDED_FEATURES            0x80000000      /* enable
+                                                                   extended
+                                                                   features */
+#define REMODER_VLAN_OPERATION_TAGGED_SHIFT     (31-9 ) /* vlan operation
+                                                           tagged << shift */
+#define REMODER_VLAN_OPERATION_NON_TAGGED_SHIFT (31-10) /* vlan operation non
+                                                           tagged << shift */
+#define REMODER_RX_QOS_MODE_SHIFT               (31-15) /* rx QoS mode << shift
+                                                         */
+#define REMODER_RMON_STATISTICS                 0x00001000      /* enable rx
+                                                                   statistics */
+#define REMODER_RX_EXTENDED_FILTERING           0x00000800      /* extended
+                                                                   filtering
+                                                                   vs.
+                                                                   mpc82xx-like
+                                                                   filtering */
+#define REMODER_NUM_OF_QUEUES_SHIFT             (31-23) /* Number of queues <<
+                                                           shift */
+#define REMODER_DYNAMIC_MAX_FRAME_LENGTH        0x00000008      /* enable
+                                                                   dynamic max
+                                                                   frame length
+                                                                 */
+#define REMODER_DYNAMIC_MIN_FRAME_LENGTH        0x00000004      /* enable
+                                                                   dynamic min
+                                                                   frame length
+                                                                 */
+#define REMODER_IP_CHECKSUM_CHECK               0x00000002      /* check IPv4
+                                                                   checksums */
+#define REMODER_IP_ADDRESS_ALIGNMENT            0x00000001      /* align ip
+                                                                   address to
+                                                                   4-byte
+                                                                   boundary */
+
+/* UCC GETH Event Register */
+#define UCCE_MPD                                0x80000000      /* Magic packet
+                                                                   detection */
+#define UCCE_SCAR                               0x40000000
+#define UCCE_GRA                                0x20000000      /* Tx graceful
+                                                                   stop
+                                                                   complete */
+#define UCCE_CBPR                               0x10000000
+#define UCCE_BSY                                0x08000000
+#define UCCE_RXC                                0x04000000
+#define UCCE_TXC                                0x02000000
+#define UCCE_TXE                                0x01000000
+#define UCCE_TXB7                               0x00800000
+#define UCCE_TXB6                               0x00400000
+#define UCCE_TXB5                               0x00200000
+#define UCCE_TXB4                               0x00100000
+#define UCCE_TXB3                               0x00080000
+#define UCCE_TXB2                               0x00040000
+#define UCCE_TXB1                               0x00020000
+#define UCCE_TXB0                               0x00010000
+#define UCCE_RXB7                               0x00008000
+#define UCCE_RXB6                               0x00004000
+#define UCCE_RXB5                               0x00002000
+#define UCCE_RXB4                               0x00001000
+#define UCCE_RXB3                               0x00000800
+#define UCCE_RXB2                               0x00000400
+#define UCCE_RXB1                               0x00000200
+#define UCCE_RXB0                               0x00000100
+#define UCCE_RXF7                               0x00000080
+#define UCCE_RXF6                               0x00000040
+#define UCCE_RXF5                               0x00000020
+#define UCCE_RXF4                               0x00000010
+#define UCCE_RXF3                               0x00000008
+#define UCCE_RXF2                               0x00000004
+#define UCCE_RXF1                               0x00000002
+#define UCCE_RXF0                               0x00000001
+
+#define UCCE_RXBF_SINGLE_MASK                   (UCCE_RXF0)
+#define UCCE_TXBF_SINGLE_MASK                   (UCCE_TXB0)
+
+#define UCCE_TXB         (UCCE_TXB7 | UCCE_TXB6 | UCCE_TXB5 | UCCE_TXB4 |\
+                        UCCE_TXB3 | UCCE_TXB2 | UCCE_TXB1 | UCCE_TXB0)
+#define UCCE_RXB         (UCCE_RXB7 | UCCE_RXB6 | UCCE_RXB5 | UCCE_RXB4 |\
+                        UCCE_RXB3 | UCCE_RXB2 | UCCE_RXB1 | UCCE_RXB0)
+#define UCCE_RXF         (UCCE_RXF7 | UCCE_RXF6 | UCCE_RXF5 | UCCE_RXF4 |\
+                        UCCE_RXF3 | UCCE_RXF2 | UCCE_RXF1 | UCCE_RXF0)
+#define UCCE_OTHER       (UCCE_SCAR | UCCE_GRA  | UCCE_CBPR | UCCE_BSY  |\
+                        UCCE_RXC  | UCCE_TXC  | UCCE_TXE)
+
+/* UCC GETH UPSMR (Protocol Specific Mode Register) */
+#define UPSMR_ECM                               0x04000000      /* Enable CAM
+                                                                   Miss or
+                                                                   Enable
+                                                                   Filtering
+                                                                   Miss */
+#define UPSMR_HSE                               0x02000000      /* Hardware
+                                                                   Statistics
+                                                                   Enable */
+#define UPSMR_PRO                               0x00400000      /* Promiscuous*/
+#define UPSMR_CAP                               0x00200000      /* CAM polarity
+                                                                 */
+#define UPSMR_RSH                               0x00100000      /* Receive
+                                                                   Short Frames
+                                                                 */
+#define UPSMR_RPM                               0x00080000      /* Reduced Pin
+                                                                   Mode
+                                                                   interfaces */
+#define UPSMR_R10M                              0x00040000      /* RGMII/RMII
+                                                                   10 Mode */
+#define UPSMR_RLPB                              0x00020000      /* RMII
+                                                                   Loopback
+                                                                   Mode */
+#define UPSMR_TBIM                              0x00010000      /* Ten-bit
+                                                                   Interface
+                                                                   Mode */
+#define UPSMR_RMM                               0x00001000      /* RMII/RGMII
+                                                                   Mode */
+#define UPSMR_CAM                               0x00000400      /* CAM Address
+                                                                   Matching */
+#define UPSMR_BRO                               0x00000200      /* Broadcast
+                                                                   Address */
+#define UPSMR_RES1                              0x00002000      /* Reserved
+                                                                   feild - must
+                                                                   be 1 */
+
+/* UCC GETH MACCFG1 (MAC Configuration 1 Register) */
+#define MACCFG1_FLOW_RX                         0x00000020      /* Flow Control
+                                                                   Rx */
+#define MACCFG1_FLOW_TX                         0x00000010      /* Flow Control
+                                                                   Tx */
+#define MACCFG1_ENABLE_SYNCHED_RX               0x00000008      /* Rx Enable
+                                                                   synchronized
+                                                                   to Rx stream
+                                                                 */
+#define MACCFG1_ENABLE_RX                       0x00000004      /* Enable Rx */
+#define MACCFG1_ENABLE_SYNCHED_TX               0x00000002      /* Tx Enable
+                                                                   synchronized
+                                                                   to Tx stream
+                                                                 */
+#define MACCFG1_ENABLE_TX                       0x00000001      /* Enable Tx */
+
+/* UCC GETH MACCFG2 (MAC Configuration 2 Register) */
+#define MACCFG2_PREL_SHIFT                      (31 - 19)       /* Preamble
+                                                                   Length <<
+                                                                   shift */
+#define MACCFG2_PREL_MASK                       0x0000f000      /* Preamble
+                                                                   Length mask */
+#define MACCFG2_SRP                             0x00000080      /* Soft Receive
+                                                                   Preamble */
+#define MACCFG2_STP                             0x00000040      /* Soft
+                                                                   Transmit
+                                                                   Preamble */
+#define MACCFG2_RESERVED_1                      0x00000020      /* Reserved -
+                                                                   must be set
+                                                                   to 1 */
+#define MACCFG2_LC                              0x00000010      /* Length Check
+                                                                 */
+#define MACCFG2_MPE                             0x00000008      /* Magic packet
+                                                                   detect */
+#define MACCFG2_FDX                             0x00000001      /* Full Duplex */
+#define MACCFG2_FDX_MASK                        0x00000001      /* Full Duplex
+                                                                   mask */
+#define MACCFG2_PAD_CRC                         0x00000004
+#define MACCFG2_CRC_EN                          0x00000002
+#define MACCFG2_PAD_AND_CRC_MODE_NONE           0x00000000      /* Neither
+                                                                   Padding
+                                                                   short frames
+                                                                   nor CRC */
+#define MACCFG2_PAD_AND_CRC_MODE_CRC_ONLY       0x00000002      /* Append CRC
+                                                                   only */
+#define MACCFG2_PAD_AND_CRC_MODE_PAD_AND_CRC    0x00000004
+#define MACCFG2_INTERFACE_MODE_NIBBLE           0x00000100      /* nibble mode
+                                                                   (MII/RMII/RGMII
+                                                                   10/100bps) */
+#define MACCFG2_INTERFACE_MODE_BYTE             0x00000200      /* byte mode
+                                                                   (GMII/TBI/RTB/RGMII
+                                                                   1000bps ) */
+#define MACCFG2_INTERFACE_MODE_MASK             0x00000300      /* mask
+                                                                   covering all
+                                                                   relevant
+                                                                   bits */
+
+/* UCC GETH IPGIFG (Inter-frame Gap / Inter-Frame Gap Register) */
+#define IPGIFG_NON_BACK_TO_BACK_IFG_PART1_SHIFT (31 -  7)       /* Non
+                                                                   back-to-back
+                                                                   inter frame
+                                                                   gap part 1.
+                                                                   << shift */
+#define IPGIFG_NON_BACK_TO_BACK_IFG_PART2_SHIFT (31 - 15)       /* Non
+                                                                   back-to-back
+                                                                   inter frame
+                                                                   gap part 2.
+                                                                   << shift */
+#define IPGIFG_MINIMUM_IFG_ENFORCEMENT_SHIFT    (31 - 23)       /* Mimimum IFG
+                                                                   Enforcement
+                                                                   << shift */
+#define IPGIFG_BACK_TO_BACK_IFG_SHIFT           (31 - 31)       /* back-to-back
+                                                                   inter frame
+                                                                   gap << shift
+                                                                 */
+#define IPGIFG_NON_BACK_TO_BACK_IFG_PART1_MAX   127     /* Non back-to-back
+                                                           inter frame gap part
+                                                           1. max val */
+#define IPGIFG_NON_BACK_TO_BACK_IFG_PART2_MAX   127     /* Non back-to-back
+                                                           inter frame gap part
+                                                           2. max val */
+#define IPGIFG_MINIMUM_IFG_ENFORCEMENT_MAX      255     /* Mimimum IFG
+                                                           Enforcement max val */
+#define IPGIFG_BACK_TO_BACK_IFG_MAX             127     /* back-to-back inter
+                                                           frame gap max val */
+#define IPGIFG_NBTB_CS_IPG_MASK                 0x7F000000
+#define IPGIFG_NBTB_IPG_MASK                    0x007F0000
+#define IPGIFG_MIN_IFG_MASK                     0x0000FF00
+#define IPGIFG_BTB_IPG_MASK                     0x0000007F
+
+/* UCC GETH HAFDUP (Half Duplex Register) */
+#define HALFDUP_ALT_BEB_TRUNCATION_SHIFT        (31 - 11)       /* Alternate
+                                                                   Binary
+                                                                   Exponential
+                                                                   Backoff
+                                                                   Truncation
+                                                                   << shift */
+#define HALFDUP_ALT_BEB_TRUNCATION_MAX          0xf     /* Alternate Binary
+                                                           Exponential Backoff
+                                                           Truncation max val */
+#define HALFDUP_ALT_BEB                         0x00080000      /* Alternate
+                                                                   Binary
+                                                                   Exponential
+                                                                   Backoff */
+#define HALFDUP_BACK_PRESSURE_NO_BACKOFF        0x00040000      /* Back
+                                                                   pressure no
+                                                                   backoff */
+#define HALFDUP_NO_BACKOFF                      0x00020000      /* No Backoff */
+#define HALFDUP_EXCESSIVE_DEFER                 0x00010000      /* Excessive
+                                                                   Defer */
+#define HALFDUP_MAX_RETRANSMISSION_SHIFT        (31 - 19)       /* Maximum
+                                                                   Retransmission
+                                                                   << shift */
+#define HALFDUP_MAX_RETRANSMISSION_MAX          0xf     /* Maximum
+                                                           Retransmission max
+                                                           val */
+#define HALFDUP_COLLISION_WINDOW_SHIFT          (31 - 31)       /* Collision
+                                                                   Window <<
+                                                                   shift */
+#define HALFDUP_COLLISION_WINDOW_MAX            0x3f    /* Collision Window max
+                                                           val */
+#define HALFDUP_ALT_BEB_TR_MASK                 0x00F00000
+#define HALFDUP_RETRANS_MASK                    0x0000F000
+#define HALFDUP_COL_WINDOW_MASK                 0x0000003F
+
+/* UCC GETH UCCS (Ethernet Status Register) */
+#define UCCS_BPR                                0x02    /* Back pressure (in
+                                                           half duplex mode) */
+#define UCCS_PAU                                0x02    /* Pause state (in full
+                                                           duplex mode) */
+#define UCCS_MPD                                0x01    /* Magic Packet
+                                                           Detected */
+
+/* UCC GETH MIIMCFG (MII Management Configuration Register) */
+#define MIIMCFG_RESET_MANAGEMENT                0x80000000      /* Reset
+                                                                   management */
+#define MIIMCFG_NO_PREAMBLE                     0x00000010      /* Preamble
+                                                                   suppress */
+#define MIIMCFG_CLOCK_DIVIDE_SHIFT              (31 - 31)       /* clock divide
+                                                                   << shift */
+#define MIIMCFG_CLOCK_DIVIDE_MAX                0xf     /* clock divide max val
+                                                         */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_2    0x00000000      /* divide by 2 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_4    0x00000001      /* divide by 4 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_6    0x00000002      /* divide by 6 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_8    0x00000003      /* divide by 8 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_10   0x00000004      /* divide by 10
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_14   0x00000005      /* divide by 14
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_16   0x00000008      /* divide by 16
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_20   0x00000006      /* divide by 20
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_28   0x00000007      /* divide by 28
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_32   0x00000009      /* divide by 32
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_48   0x0000000a      /* divide by 48
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_64   0x0000000b      /* divide by 64
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_80   0x0000000c      /* divide by 80
+                                                                 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_112  0x0000000d      /* divide by
+                                                                   112 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_160  0x0000000e      /* divide by
+                                                                   160 */
+#define MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_224  0x0000000f      /* divide by
+                                                                   224 */
+
+/* UCC GETH MIIMCOM (MII Management Command Register) */
+#define MIIMCOM_SCAN_CYCLE                      0x00000002      /* Scan cycle */
+#define MIIMCOM_READ_CYCLE                      0x00000001      /* Read cycle */
+
+/* UCC GETH MIIMADD (MII Management Address Register) */
+#define MIIMADD_PHY_ADDRESS_SHIFT               (31 - 23)       /* PHY Address
+                                                                   << shift */
+#define MIIMADD_PHY_REGISTER_SHIFT              (31 - 31)       /* PHY Register
+                                                                   << shift */
+
+/* UCC GETH MIIMCON (MII Management Control Register) */
+#define MIIMCON_PHY_CONTROL_SHIFT               (31 - 31)       /* PHY Control
+                                                                   << shift */
+#define MIIMCON_PHY_STATUS_SHIFT                (31 - 31)       /* PHY Status
+                                                                   << shift */
+
+/* UCC GETH MIIMIND (MII Management Indicator Register) */
+#define MIIMIND_NOT_VALID                       0x00000004      /* Not valid */
+#define MIIMIND_SCAN                            0x00000002      /* Scan in
+                                                                   progress */
+#define MIIMIND_BUSY                            0x00000001
+
+/* UCC GETH IFSTAT (Interface Status Register) */
+#define IFSTAT_EXCESS_DEFER                     0x00000200      /* Excessive
+                                                                   transmission
+                                                                   defer */
+
+/* UCC GETH MACSTNADDR1 (Station Address Part 1 Register) */
+#define MACSTNADDR1_OCTET_6_SHIFT               (31 -  7)       /* Station
+                                                                   address 6th
+                                                                   octet <<
+                                                                   shift */
+#define MACSTNADDR1_OCTET_5_SHIFT               (31 - 15)       /* Station
+                                                                   address 5th
+                                                                   octet <<
+                                                                   shift */
+#define MACSTNADDR1_OCTET_4_SHIFT               (31 - 23)       /* Station
+                                                                   address 4th
+                                                                   octet <<
+                                                                   shift */
+#define MACSTNADDR1_OCTET_3_SHIFT               (31 - 31)       /* Station
+                                                                   address 3rd
+                                                                   octet <<
+                                                                   shift */
+
+/* UCC GETH MACSTNADDR2 (Station Address Part 2 Register) */
+#define MACSTNADDR2_OCTET_2_SHIFT               (31 -  7)       /* Station
+                                                                   address 2nd
+                                                                   octet <<
+                                                                   shift */
+#define MACSTNADDR2_OCTET_1_SHIFT               (31 - 15)       /* Station
+                                                                   address 1st
+                                                                   octet <<
+                                                                   shift */
+
+/* UCC GETH UEMPR (Ethernet Mac Parameter Register) */
+#define UEMPR_PAUSE_TIME_VALUE_SHIFT            (31 - 15)       /* Pause time
+                                                                   value <<
+                                                                   shift */
+#define UEMPR_EXTENDED_PAUSE_TIME_VALUE_SHIFT   (31 - 31)       /* Extended
+                                                                   pause time
+                                                                   value <<
+                                                                   shift */
+
+/* UCC GETH UTBIPAR (Ten Bit Interface Physical Address Register) */
+#define UTBIPAR_PHY_ADDRESS_SHIFT               (31 - 31)       /* Phy address
+                                                                   << shift */
+#define UTBIPAR_PHY_ADDRESS_MASK                0x0000001f      /* Phy address
+                                                                   mask */
+
+/* UCC GETH UESCR (Ethernet Statistics Control Register) */
+#define UESCR_AUTOZ                             0x8000  /* Automatically zero
+                                                           addressed
+                                                           statistical counter
+                                                           values */
+#define UESCR_CLRCNT                            0x4000  /* Clear all statistics
+                                                           counters */
+#define UESCR_MAXCOV_SHIFT                      (15 -  7)       /* Max
+                                                                   Coalescing
+                                                                   Value <<
+                                                                   shift */
+#define UESCR_SCOV_SHIFT                        (15 - 15)       /* Status
+                                                                   Coalescing
+                                                                   Value <<
+                                                                   shift */
+
+/* UCC GETH UDSR (Data Synchronization Register) */
+#define UDSR_MAGIC                              0x067E
+
+typedef struct ucc_geth_thread_data_tx {
+        u8 res0[104];
+} __attribute__ ((packed)) ucc_geth_thread_data_tx_t;
+
+typedef struct ucc_geth_thread_data_rx {
+        u8 res0[40];
+} __attribute__ ((packed)) ucc_geth_thread_data_rx_t;
+
+/* Send Queue Queue-Descriptor */
+typedef struct ucc_geth_send_queue_qd {
+        u32 bd_ring_base;       /* pointer to BD ring base address */
+        u8 res0[0x8];
+        u32 last_bd_completed_address;/* initialize to last entry in BD ring */
+        u8 res1[0x30];
+} __attribute__ ((packed)) ucc_geth_send_queue_qd_t;
+
+typedef struct ucc_geth_send_queue_mem_region {
+        ucc_geth_send_queue_qd_t sqqd[NUM_TX_QUEUES];
+} __attribute__ ((packed)) ucc_geth_send_queue_mem_region_t;
+
+typedef struct ucc_geth_thread_tx_pram {
+        u8 res0[64];
+} __attribute__ ((packed)) ucc_geth_thread_tx_pram_t;
+
+typedef struct ucc_geth_thread_rx_pram {
+        u8 res0[128];
+} __attribute__ ((packed)) ucc_geth_thread_rx_pram_t;
+
+#define THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING        64
+#define THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_8      64
+#define THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_16     96
+
+typedef struct ucc_geth_scheduler {
+        u16 cpucount0;          /* CPU packet counter */
+        u16 cpucount1;          /* CPU packet counter */
+        u16 cecount0;           /* QE packet counter */
+        u16 cecount1;           /* QE packet counter */
+        u16 cpucount2;          /* CPU packet counter */
+        u16 cpucount3;          /* CPU packet counter */
+        u16 cecount2;           /* QE packet counter */
+        u16 cecount3;           /* QE packet counter */
+        u16 cpucount4;          /* CPU packet counter */
+        u16 cpucount5;          /* CPU packet counter */
+        u16 cecount4;           /* QE packet counter */
+        u16 cecount5;           /* QE packet counter */
+        u16 cpucount6;          /* CPU packet counter */
+        u16 cpucount7;          /* CPU packet counter */
+        u16 cecount6;           /* QE packet counter */
+        u16 cecount7;           /* QE packet counter */
+        u32 weightstatus[NUM_TX_QUEUES];        /* accumulated weight factor */
+        u32 rtsrshadow;         /* temporary variable handled by QE */
+        u32 time;               /* temporary variable handled by QE */
+        u32 ttl;                /* temporary variable handled by QE */
+        u32 mblinterval;        /* max burst length interval */
+        u16 nortsrbytetime;     /* normalized value of byte time in tsr units */
+        u8 fracsiz;             /* radix 2 log value of denom. of
+                                   NorTSRByteTime */
+        u8 res0[1];
+        u8 strictpriorityq;     /* Strict Priority Mask register */
+        u8 txasap;              /* Transmit ASAP register */
+        u8 extrabw;             /* Extra BandWidth register */
+        u8 oldwfqmask;          /* temporary variable handled by QE */
+        u8 weightfactor[NUM_TX_QUEUES];
+                                      /**< weight factor for queues   */
+        u32 minw;               /* temporary variable handled by QE */
+        u8 res1[0x70 - 0x64];
+} __attribute__ ((packed)) ucc_geth_scheduler_t;
+
+typedef struct ucc_geth_tx_firmware_statistics_pram {
+        u32 sicoltx;            /* single collision */
+        u32 mulcoltx;           /* multiple collision */
+        u32 latecoltxfr;        /* late collision */
+        u32 frabortduecol;      /* frames aborted due to transmit collision */
+        u32 frlostinmactxer;    /* frames lost due to internal MAC error
+                                   transmission that are not counted on any
+                                   other counter */
+        u32 carriersenseertx;   /* carrier sense error */
+        u32 frtxok;             /* frames transmitted OK */
+        u32 txfrexcessivedefer; /* frames with defferal time greater than
+                                   specified threshold */
+        u32 txpkts256;          /* total packets (including bad) between 256
+                                   and 511 octets */
+        u32 txpkts512;          /* total packets (including bad) between 512
+                                   and 1023 octets */
+        u32 txpkts1024;         /* total packets (including bad) between 1024
+                                   and 1518 octets */
+        u32 txpktsjumbo;        /* total packets (including bad) between 1024
+                                   and MAXLength octets */
+} __attribute__ ((packed)) ucc_geth_tx_firmware_statistics_pram_t;
+
+typedef struct ucc_geth_rx_firmware_statistics_pram {
+        u32 frrxfcser;          /* frames with crc error */
+        u32 fraligner;          /* frames with alignment error */
+        u32 inrangelenrxer;     /* in range length error */
+        u32 outrangelenrxer;    /* out of range length error */
+        u32 frtoolong;          /* frame too long */
+        u32 runt;               /* runt */
+        u32 verylongevent;      /* very long event */
+        u32 symbolerror;        /* symbol error */
+        u32 dropbsy;            /* drop because of BD not ready */
+        u8 res0[0x8];
+        u32 mismatchdrop;       /* drop because of MAC filtering (e.g. address
+                                   or type mismatch) */
+        u32 underpkts;          /* total frames less than 64 octets */
+        u32 pkts256;            /* total frames (including bad) between 256 and
+                                   511 octets */
+        u32 pkts512;            /* total frames (including bad) between 512 and
+                                   1023 octets */
+        u32 pkts1024;           /* total frames (including bad) between 1024
+                                   and 1518 octets */
+        u32 pktsjumbo;          /* total frames (including bad) between 1024
+                                   and MAXLength octets */
+        u32 frlossinmacer;      /* frames lost because of internal MAC error
+                                   that is not counted in any other counter */
+        u32 pausefr;            /* pause frames */
+        u8 res1[0x4];
+        u32 removevlan;         /* total frames that had their VLAN tag removed
+                                 */
+        u32 replacevlan;        /* total frames that had their VLAN tag
+                                   replaced */
+        u32 insertvlan;         /* total frames that had their VLAN tag
+                                   inserted */
+} __attribute__ ((packed)) ucc_geth_rx_firmware_statistics_pram_t;
+
+typedef struct ucc_geth_rx_interrupt_coalescing_entry {
+        u32 interruptcoalescingmaxvalue;        /* interrupt coalescing max
+                                                   value */
+        u32 interruptcoalescingcounter; /* interrupt coalescing counter,
+                                           initialize to
+                                           interruptcoalescingmaxvalue */
+} __attribute__ ((packed)) ucc_geth_rx_interrupt_coalescing_entry_t;
+
+typedef struct ucc_geth_rx_interrupt_coalescing_table {
+        ucc_geth_rx_interrupt_coalescing_entry_t coalescingentry[NUM_RX_QUEUES];
+                                       /**< interrupt coalescing entry */
+} __attribute__ ((packed)) ucc_geth_rx_interrupt_coalescing_table_t;
+
+typedef struct ucc_geth_rx_prefetched_bds {
+        qe_bd_t bd[NUM_BDS_IN_PREFETCHED_BDS];  /* prefetched bd */
+} __attribute__ ((packed)) ucc_geth_rx_prefetched_bds_t;
+
+typedef struct ucc_geth_rx_bd_queues_entry {
+        u32 bdbaseptr;          /* BD base pointer */
+        u32 bdptr;              /* BD pointer */
+        u32 externalbdbaseptr;  /* external BD base pointer */
+        u32 externalbdptr;      /* external BD pointer */
+} __attribute__ ((packed)) ucc_geth_rx_bd_queues_entry_t;
+
+typedef struct ucc_geth_tx_global_pram {
+        u16 temoder;
+        u8 res0[0x38 - 0x02];
+        u32 sqptr;              /* a base pointer to send queue memory region */
+        u32 schedulerbasepointer;       /* a base pointer to scheduler memory
+                                           region */
+        u32 txrmonbaseptr;      /* base pointer to Tx RMON statistics counter */
+        u32 tstate;             /* tx internal state. High byte contains
+                                   function code */
+        u8 iphoffset[TX_IP_OFFSET_ENTRY_MAX];
+        u32 vtagtable[0x8];     /* 8 4-byte VLAN tags */
+        u32 tqptr;              /* a base pointer to the Tx Queues Memory
+                                   Region */
+        u8 res2[0x80 - 0x74];
+} __attribute__ ((packed)) ucc_geth_tx_global_pram_t;
+
+/* structure representing Extended Filtering Global Parameters in PRAM */
+typedef struct ucc_geth_exf_global_pram {
+        u32 l2pcdptr;           /* individual address filter, high */
+        u8 res0[0x10 - 0x04];
+} __attribute__ ((packed)) ucc_geth_exf_global_pram_t;
+
+typedef struct ucc_geth_rx_global_pram {
+        u32 remoder;            /* ethernet mode reg. */
+        u32 rqptr;              /* base pointer to the Rx Queues Memory Region*/
+        u32 res0[0x1];
+        u8 res1[0x20 - 0xC];
+        u16 typeorlen;          /* cutoff point less than which, type/len field
+                                   is considered length */
+        u8 res2[0x1];
+        u8 rxgstpack;           /* acknowledgement on GRACEFUL STOP RX command*/
+        u32 rxrmonbaseptr;      /* base pointer to Rx RMON statistics counter */
+        u8 res3[0x30 - 0x28];
+        u32 intcoalescingptr;   /* Interrupt coalescing table pointer */
+        u8 res4[0x36 - 0x34];
+        u8 rstate;              /* rx internal state. High byte contains
+                                   function code */
+        u8 res5[0x46 - 0x37];
+        u16 mrblr;              /* max receive buffer length reg. */
+        u32 rbdqptr;            /* base pointer to RxBD parameter table
+                                   description */
+        u16 mflr;               /* max frame length reg. */
+        u16 minflr;             /* min frame length reg. */
+        u16 maxd1;              /* max dma1 length reg. */
+        u16 maxd2;              /* max dma2 length reg. */
+        u32 ecamptr;            /* external CAM address */
+        u32 l2qt;               /* VLAN priority mapping table. */
+        u32 l3qt[0x8];          /* IP priority mapping table. */
+        u16 vlantype;           /* vlan type */
+        u16 vlantci;            /* default vlan tci */
+        u8 addressfiltering[64];        /* address filtering data structure */
+        u32 exfGlobalParam;     /* base address for extended filtering global
+                                   parameters */
+        u8 res6[0x100 - 0xC4];  /* Initialize to zero */
+} __attribute__ ((packed)) ucc_geth_rx_global_pram_t;
+
+#define GRACEFUL_STOP_ACKNOWLEDGE_RX            0x01
+
+/* structure representing InitEnet command */
+typedef struct ucc_geth_init_pram {
+        u8 resinit1;
+        u8 resinit2;
+        u8 resinit3;
+        u8 resinit4;
+        u16 resinit5;
+        u8 res1[0x1];
+        u8 largestexternallookupkeysize;
+        u32 rgftgfrxglobal;
+        u32 rxthread[ENET_INIT_PARAM_MAX_ENTRIES_RX];   /* rx threads */
+        u8 res2[0x38 - 0x30];
+        u32 txglobal;           /* tx global */
+        u32 txthread[ENET_INIT_PARAM_MAX_ENTRIES_TX];   /* tx threads */
+        u8 res3[0x1];
+} __attribute__ ((packed)) ucc_geth_init_pram_t;
+
+#define ENET_INIT_PARAM_RGF_SHIFT               (32 - 4)
+#define ENET_INIT_PARAM_TGF_SHIFT               (32 - 8)
+
+#define ENET_INIT_PARAM_RISC_MASK               0x0000003f
+#define ENET_INIT_PARAM_PTR_MASK                0x00ffffc0
+#define ENET_INIT_PARAM_SNUM_MASK               0xff000000
+#define ENET_INIT_PARAM_SNUM_SHIFT              24
+
+#define ENET_INIT_PARAM_MAGIC_RES_INIT1         0x06
+#define ENET_INIT_PARAM_MAGIC_RES_INIT2         0x30
+#define ENET_INIT_PARAM_MAGIC_RES_INIT3         0xff
+#define ENET_INIT_PARAM_MAGIC_RES_INIT4         0x00
+#define ENET_INIT_PARAM_MAGIC_RES_INIT5         0x0400
+
+/* structure representing 82xx Address Filtering Enet Address in PRAM */
+typedef struct ucc_geth_82xx_enet_address {
+        u8 res1[0x2];
+        u16 h;                  /* address (MSB) */
+        u16 m;                  /* address */
+        u16 l;                  /* address (LSB) */
+} __attribute__ ((packed)) ucc_geth_82xx_enet_address_t;
+
+/* structure representing 82xx Address Filtering PRAM */
+typedef struct ucc_geth_82xx_address_filtering_pram {
+        u32 iaddr_h;            /* individual address filter, high */
+        u32 iaddr_l;            /* individual address filter, low */
+        u32 gaddr_h;            /* group address filter, high */
+        u32 gaddr_l;            /* group address filter, low */
+        ucc_geth_82xx_enet_address_t taddr;
+        ucc_geth_82xx_enet_address_t paddr[NUM_OF_PADDRS];
+        u8 res0[0x40 - 0x38];
+} __attribute__ ((packed)) ucc_geth_82xx_address_filtering_pram_t;
+
+/* GETH Tx firmware statistics structure, used when calling
+   UCC_GETH_GetStatistics. */
+typedef struct ucc_geth_tx_firmware_statistics {
+        u32 sicoltx;            /* single collision */
+        u32 mulcoltx;           /* multiple collision */
+        u32 latecoltxfr;        /* late collision */
+        u32 frabortduecol;      /* frames aborted due to transmit collision */
+        u32 frlostinmactxer;    /* frames lost due to internal MAC error
+                                   transmission that are not counted on any
+                                   other counter */
+        u32 carriersenseertx;   /* carrier sense error */
+        u32 frtxok;             /* frames transmitted OK */
+        u32 txfrexcessivedefer; /* frames with defferal time greater than
+                                   specified threshold */
+        u32 txpkts256;          /* total packets (including bad) between 256
+                                   and 511 octets */
+        u32 txpkts512;          /* total packets (including bad) between 512
+                                   and 1023 octets */
+        u32 txpkts1024;         /* total packets (including bad) between 1024
+                                   and 1518 octets */
+        u32 txpktsjumbo;        /* total packets (including bad) between 1024
+                                   and MAXLength octets */
+} __attribute__ ((packed)) ucc_geth_tx_firmware_statistics_t;
+
+/* GETH Rx firmware statistics structure, used when calling
+   UCC_GETH_GetStatistics. */
+typedef struct ucc_geth_rx_firmware_statistics {
+        u32 frrxfcser;          /* frames with crc error */
+        u32 fraligner;          /* frames with alignment error */
+        u32 inrangelenrxer;     /* in range length error */
+        u32 outrangelenrxer;    /* out of range length error */
+        u32 frtoolong;          /* frame too long */
+        u32 runt;               /* runt */
+        u32 verylongevent;      /* very long event */
+        u32 symbolerror;        /* symbol error */
+        u32 dropbsy;            /* drop because of BD not ready */
+        u8 res0[0x8];
+        u32 mismatchdrop;       /* drop because of MAC filtering (e.g. address
+                                   or type mismatch) */
+        u32 underpkts;          /* total frames less than 64 octets */
+        u32 pkts256;            /* total frames (including bad) between 256 and
+                                   511 octets */
+        u32 pkts512;            /* total frames (including bad) between 512 and
+                                   1023 octets */
+        u32 pkts1024;           /* total frames (including bad) between 1024
+                                   and 1518 octets */
+        u32 pktsjumbo;          /* total frames (including bad) between 1024
+                                   and MAXLength octets */
+        u32 frlossinmacer;      /* frames lost because of internal MAC error
+                                   that is not counted in any other counter */
+        u32 pausefr;            /* pause frames */
+        u8 res1[0x4];
+        u32 removevlan;         /* total frames that had their VLAN tag removed
+                                 */
+        u32 replacevlan;        /* total frames that had their VLAN tag
+                                   replaced */
+        u32 insertvlan;         /* total frames that had their VLAN tag
+                                   inserted */
+} __attribute__ ((packed)) ucc_geth_rx_firmware_statistics_t;
+
+/* GETH hardware statistics structure, used when calling
+   UCC_GETH_GetStatistics. */
+typedef struct ucc_geth_hardware_statistics {
+        u32 tx64;               /* Total number of frames (including bad
+                                   frames) transmitted that were exactly of the
+                                   minimal length (64 for un tagged, 68 for
+                                   tagged, or with length exactly equal to the
+                                   parameter MINLength */
+        u32 tx127;              /* Total number of frames (including bad
+                                   frames) transmitted that were between
+                                   MINLength (Including FCS length==4) and 127
+                                   octets */
+        u32 tx255;              /* Total number of frames (including bad
+                                   frames) transmitted that were between 128
+                                   (Including FCS length==4) and 255 octets */
+        u32 rx64;               /* Total number of frames received including
+                                   bad frames that were exactly of the mninimal
+                                   length (64 bytes) */
+        u32 rx127;              /* Total number of frames (including bad
+                                   frames) received that were between MINLength
+                                   (Including FCS length==4) and 127 octets */
+        u32 rx255;              /* Total number of frames (including bad
+                                   frames) received that were between 128
+                                   (Including FCS length==4) and 255 octets */
+        u32 txok;               /* Total number of octets residing in frames
+                                   that where involved in succesfull
+                                   transmission */
+        u16 txcf;               /* Total number of PAUSE control frames
+                                   transmitted by this MAC */
+        u32 tmca;               /* Total number of frames that were transmitted
+                                   succesfully with the group address bit set
+                                   that are not broadcast frames */
+        u32 tbca;               /* Total number of frames transmitted
+                                   succesfully that had destination address
+                                   field equal to the broadcast address */
+        u32 rxfok;              /* Total number of frames received OK */
+        u32 rxbok;              /* Total number of octets received OK */
+        u32 rbyt;               /* Total number of octets received including
+                                   octets in bad frames. Must be implemented in
+                                   HW because it includes octets in frames that
+                                   never even reach the UCC */
+        u32 rmca;               /* Total number of frames that were received
+                                   succesfully with the group address bit set
+                                   that are not broadcast frames */
+        u32 rbca;               /* Total number of frames received succesfully
+                                   that had destination address equal to the
+                                   broadcast address */
+} __attribute__ ((packed)) ucc_geth_hardware_statistics_t;
+
+/* UCC GETH Tx errors returned via TxConf callback */
+#define TX_ERRORS_DEF      0x0200
+#define TX_ERRORS_EXDEF    0x0100
+#define TX_ERRORS_LC       0x0080
+#define TX_ERRORS_RL       0x0040
+#define TX_ERRORS_RC_MASK  0x003C
+#define TX_ERRORS_RC_SHIFT 2
+#define TX_ERRORS_UN       0x0002
+#define TX_ERRORS_CSL      0x0001
+
+/* UCC GETH Rx errors returned via RxStore callback */
+#define RX_ERRORS_CMR      0x0200
+#define RX_ERRORS_M        0x0100
+#define RX_ERRORS_BC       0x0080
+#define RX_ERRORS_MC       0x0040
+
+/* Transmit BD. These are in addition to values defined in uccf. */
+#define T_VID      0x003c0000   /* insert VLAN id index mask. */
+#define T_DEF      (((u32) TX_ERRORS_DEF     ) << 16)
+#define T_EXDEF    (((u32) TX_ERRORS_EXDEF   ) << 16)
+#define T_LC       (((u32) TX_ERRORS_LC      ) << 16)
+#define T_RL       (((u32) TX_ERRORS_RL      ) << 16)
+#define T_RC_MASK  (((u32) TX_ERRORS_RC_MASK ) << 16)
+#define T_UN       (((u32) TX_ERRORS_UN      ) << 16)
+#define T_CSL      (((u32) TX_ERRORS_CSL     ) << 16)
+#define T_ERRORS_REPORT  (T_DEF | T_EXDEF | T_LC | T_RL | T_RC_MASK \
+                | T_UN | T_CSL) /* transmit errors to report */
+
+/* Receive BD. These are in addition to values defined in uccf. */
+#define R_LG    0x00200000      /* Frame length violation.  */
+#define R_NO    0x00100000      /* Non-octet aligned frame.  */
+#define R_SH    0x00080000      /* Short frame.  */
+#define R_CR    0x00040000      /* CRC error.  */
+#define R_OV    0x00020000      /* Overrun.  */
+#define R_IPCH  0x00010000      /* IP checksum check failed. */
+#define R_CMR   (((u32) RX_ERRORS_CMR  ) << 16)
+#define R_M     (((u32) RX_ERRORS_M    ) << 16)
+#define R_BC    (((u32) RX_ERRORS_BC   ) << 16)
+#define R_MC    (((u32) RX_ERRORS_MC   ) << 16)
+#define R_ERRORS_REPORT (R_CMR | R_M | R_BC | R_MC)     /* receive errors to
+                                                           report */
+#define R_ERRORS_FATAL  (R_LG  | R_NO | R_SH | R_CR | \
+                R_OV | R_IPCH)  /* receive errors to discard */
+
+/* Alignments */
+#define UCC_GETH_RX_GLOBAL_PRAM_ALIGNMENT       256
+#define UCC_GETH_TX_GLOBAL_PRAM_ALIGNMENT       128
+#define UCC_GETH_THREAD_RX_PRAM_ALIGNMENT       128
+#define UCC_GETH_THREAD_TX_PRAM_ALIGNMENT       64
+#define UCC_GETH_THREAD_DATA_ALIGNMENT          256     /* spec gives values
+                                                           based on num of
+                                                           threads, but always
+                                                           using the maximum is
+                                                           easier */
+#define UCC_GETH_SEND_QUEUE_QUEUE_DESCRIPTOR_ALIGNMENT  32
+#define UCC_GETH_SCHEDULER_ALIGNMENT            4       /* This is a guess */
+#define UCC_GETH_TX_STATISTICS_ALIGNMENT        4       /* This is a guess */
+#define UCC_GETH_RX_STATISTICS_ALIGNMENT        4       /* This is a guess */
+#define UCC_GETH_RX_INTERRUPT_COALESCING_ALIGNMENT      4       /* This is a
+                                                                   guess */
+#define UCC_GETH_RX_BD_QUEUES_ALIGNMENT         8       /* This is a guess */
+#define UCC_GETH_RX_PREFETCHED_BDS_ALIGNMENT    128     /* This is a guess */
+#define UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT 4    /* This
+                                                                           is a
+                                                                           guess
+                                                                         */
+#define UCC_GETH_RX_BD_RING_ALIGNMENT           32
+#define UCC_GETH_TX_BD_RING_ALIGNMENT           32
+#define UCC_GETH_MRBLR_ALIGNMENT                128
+#define UCC_GETH_RX_BD_RING_SIZE_ALIGNMENT      4
+#define UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT       32
+#define UCC_GETH_RX_DATA_BUF_ALIGNMENT          64
+
+#define UCC_GETH_TAD_EF                         0x80
+#define UCC_GETH_TAD_V                          0x40
+#define UCC_GETH_TAD_REJ                        0x20
+#define UCC_GETH_TAD_VTAG_OP_RIGHT_SHIFT        2
+#define UCC_GETH_TAD_VTAG_OP_SHIFT              6
+#define UCC_GETH_TAD_V_NON_VTAG_OP              0x20
+#define UCC_GETH_TAD_RQOS_SHIFT                 0
+#define UCC_GETH_TAD_V_PRIORITY_SHIFT           5
+#define UCC_GETH_TAD_CFI                        0x10
+
+#define UCC_GETH_VLAN_PRIORITY_MAX              8
+#define UCC_GETH_IP_PRIORITY_MAX                64
+#define UCC_GETH_TX_VTAG_TABLE_ENTRY_MAX        8
+#define UCC_GETH_RX_BD_RING_SIZE_MIN            8
+#define UCC_GETH_TX_BD_RING_SIZE_MIN            2
+
+#define UCC_GETH_SIZE_OF_BD                     QE_SIZEOF_BD
+
+/* Driver definitions */
+#define TX_BD_RING_LEN                          0x10
+#define RX_BD_RING_LEN                          0x10
+#define UCC_GETH_DEV_WEIGHT                     TX_BD_RING_LEN
+
+#define TX_RING_MOD_MASK(size)                  (size-1)
+#define RX_RING_MOD_MASK(size)                  (size-1)
+
+#define ENET_NUM_OCTETS_PER_ADDRESS             6
+#define ENET_GROUP_ADDR                         0x01    /* Group address mask
+                                                           for ethernet
+                                                           addresses */
+
+#define TX_TIMEOUT                              (1*HZ)
+#define SKB_ALLOC_TIMEOUT                       100000
+#define PHY_INIT_TIMEOUT                        100000
+#define PHY_CHANGE_TIME                         2
+
+/* Fast Ethernet (10/100 Mbps) */
+#define UCC_GETH_URFS_INIT                      512     /* Rx virtual FIFO size
+                                                         */
+#define UCC_GETH_URFET_INIT                     256     /* 1/2 urfs */
+#define UCC_GETH_URFSET_INIT                    384     /* 3/4 urfs */
+#define UCC_GETH_UTFS_INIT                      512     /* Tx virtual FIFO size
+                                                         */
+#define UCC_GETH_UTFET_INIT                     256     /* 1/2 utfs */
+#define UCC_GETH_UTFTT_INIT                     128
+/* Gigabit Ethernet (1000 Mbps) */
+#define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/    /* Rx virtual
+                                                                   FIFO size */
+#define UCC_GETH_URFET_GIGA_INIT                2048/*1024*/    /* 1/2 urfs */
+#define UCC_GETH_URFSET_GIGA_INIT               3072/*1536*/    /* 3/4 urfs */
+#define UCC_GETH_UTFS_GIGA_INIT                 8192/*2048*/    /* Tx virtual
+                                                                   FIFO size */
+#define UCC_GETH_UTFET_GIGA_INIT                4096/*1024*/    /* 1/2 utfs */
+#define UCC_GETH_UTFTT_GIGA_INIT                0x400/*0x40*/   /* */
+
+#define UCC_GETH_REMODER_INIT                   0       /* bits that must be
+                                                           set */
+#define UCC_GETH_TEMODER_INIT                   0xC000  /* bits that must */
+#define UCC_GETH_UPSMR_INIT                     (UPSMR_RES1)    /* Start value
+                                                                   for this
+                                                                   register */
+#define UCC_GETH_MACCFG1_INIT                   0
+#define UCC_GETH_MACCFG2_INIT                   (MACCFG2_RESERVED_1)
+#define UCC_GETH_MIIMCFG_MNGMNT_CLC_DIV_INIT    \
+                                (MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_112)
+
+/* Ethernet speed */
+typedef enum enet_speed {
+        ENET_SPEED_10BT,        /* 10 Base T */
+        ENET_SPEED_100BT,       /* 100 Base T */
+        ENET_SPEED_1000BT       /* 1000 Base T */
+} enet_speed_e;
+
+/* Ethernet Address Type. */
+typedef enum enet_addr_type {
+        ENET_ADDR_TYPE_INDIVIDUAL,
+        ENET_ADDR_TYPE_GROUP,
+        ENET_ADDR_TYPE_BROADCAST
+} enet_addr_type_e;
+
+/* TBI / MII Set Register */
+typedef enum enet_tbi_mii_reg {
+        ENET_TBI_MII_CR = 0x00, /* Control (CR ) */
+        ENET_TBI_MII_SR = 0x01, /* Status (SR ) */
+        ENET_TBI_MII_ANA = 0x04,        /* AN advertisement (ANA ) */
+        ENET_TBI_MII_ANLPBPA = 0x05,    /* AN link partner base page ability
+                                           (ANLPBPA) */
+        ENET_TBI_MII_ANEX = 0x06,       /* AN expansion (ANEX ) */
+        ENET_TBI_MII_ANNPT = 0x07,      /* AN next page transmit (ANNPT ) */
+        ENET_TBI_MII_ANLPANP = 0x08,    /* AN link partner ability next page
+                                           (ANLPANP) */
+        ENET_TBI_MII_EXST = 0x0F,       /* Extended status (EXST ) */
+        ENET_TBI_MII_JD = 0x10, /* Jitter diagnostics (JD ) */
+        ENET_TBI_MII_TBICON = 0x11      /* TBI control (TBICON ) */
+} enet_tbi_mii_reg_e;
+
+/* UCC GETH 82xx Ethernet Address Recognition Location */
+typedef enum ucc_geth_enet_address_recognition_location {
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_STATION_ADDRESS,/* station
+                                                                      address */
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_PADDR_FIRST, /* additional
+                                                                   station
+                                                                   address
+                                                                   paddr1 */
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_PADDR2,      /* additional
+                                                                   station
+                                                                   address
+                                                                   paddr2 */
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_PADDR3,      /* additional
+                                                                   station
+                                                                   address
+                                                                   paddr3 */
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_PADDR_LAST,  /* additional
+                                                                   station
+                                                                   address
+                                                                   paddr4 */
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_GROUP_HASH,  /* group hash */
+        UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_INDIVIDUAL_HASH /* individual
+                                                                      hash */
+} ucc_geth_enet_address_recognition_location_e;
+
+/* UCC GETH vlan operation tagged */
+typedef enum ucc_geth_vlan_operation_tagged {
+        UCC_GETH_VLAN_OPERATION_TAGGED_NOP = 0x0,       /* Tagged - nop */
+        UCC_GETH_VLAN_OPERATION_TAGGED_REPLACE_VID_PORTION_OF_Q_TAG
+                = 0x1,  /* Tagged - replace vid portion of q tag */
+        UCC_GETH_VLAN_OPERATION_TAGGED_IF_VID0_REPLACE_VID_WITH_DEFAULT_VALUE
+                = 0x2,  /* Tagged - if vid0 replace vid with default value  */
+        UCC_GETH_VLAN_OPERATION_TAGGED_EXTRACT_Q_TAG_FROM_FRAME
+                = 0x3   /* Tagged - extract q tag from frame */
+} ucc_geth_vlan_operation_tagged_e;
+
+/* UCC GETH vlan operation non-tagged */
+typedef enum ucc_geth_vlan_operation_non_tagged {
+        UCC_GETH_VLAN_OPERATION_NON_TAGGED_NOP = 0x0,   /* Non tagged - nop */
+        UCC_GETH_VLAN_OPERATION_NON_TAGGED_Q_TAG_INSERT = 0x1   /* Non tagged -
+                                                                   q tag insert
+                                                                 */
+} ucc_geth_vlan_operation_non_tagged_e;
+
+/* UCC GETH Rx Quality of Service Mode */
+typedef enum ucc_geth_qos_mode {
+        UCC_GETH_QOS_MODE_DEFAULT = 0x0,        /* default queue */
+        UCC_GETH_QOS_MODE_QUEUE_NUM_FROM_L2_CRITERIA = 0x1,     /* queue
+                                                                   determined
+                                                                   by L2
+                                                                   criteria */
+        UCC_GETH_QOS_MODE_QUEUE_NUM_FROM_L3_CRITERIA = 0x2      /* queue
+                                                                   determined
+                                                                   by L3
+                                                                   criteria */
+} ucc_geth_qos_mode_e;
+
+/* UCC GETH Statistics Gathering Mode - These are bit flags, 'or' them together
+   for combined functionality */
+typedef enum ucc_geth_statistics_gathering_mode {
+        UCC_GETH_STATISTICS_GATHERING_MODE_NONE = 0x00000000,   /* No
+                                                                   statistics
+                                                                   gathering */
+        UCC_GETH_STATISTICS_GATHERING_MODE_HARDWARE = 0x00000001,/* Enable
+                                                                    hardware
+                                                                    statistics
+                                                                    gathering
+                                                                  */
+        UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX = 0x00000004,/*Enable
+                                                                      firmware
+                                                                      tx
+                                                                      statistics
+                                                                      gathering
+                                                                     */
+        UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX = 0x00000008/* Enable
+                                                                      firmware
+                                                                      rx
+                                                                      statistics
+                                                                      gathering
+                                                                    */
+} ucc_geth_statistics_gathering_mode_e;
+
+/* UCC GETH Pad and CRC Mode - Note, Padding without CRC is not possible */
+typedef enum ucc_geth_maccfg2_pad_and_crc_mode {
+        UCC_GETH_PAD_AND_CRC_MODE_NONE
+                = MACCFG2_PAD_AND_CRC_MODE_NONE,        /* Neither Padding
+                                                           short frames
+                                                           nor CRC */
+        UCC_GETH_PAD_AND_CRC_MODE_CRC_ONLY
+                = MACCFG2_PAD_AND_CRC_MODE_CRC_ONLY,    /* Append
+                                                           CRC only */
+        UCC_GETH_PAD_AND_CRC_MODE_PAD_AND_CRC =
+            MACCFG2_PAD_AND_CRC_MODE_PAD_AND_CRC
+} ucc_geth_maccfg2_pad_and_crc_mode_e;
+
+/* UCC GETH upsmr Flow Control Mode */
+typedef enum ucc_geth_flow_control_mode {
+        UPSMR_AUTOMATIC_FLOW_CONTROL_MODE_NONE = 0x00000000,    /* No automatic
+                                                                   flow control
+                                                                 */
+        UPSMR_AUTOMATIC_FLOW_CONTROL_MODE_PAUSE_WHEN_EMERGENCY
+                = 0x00004000    /* Send pause frame when RxFIFO reaches its
+                                   emergency threshold */
+} ucc_geth_flow_control_mode_e;
+
+/* UCC GETH number of threads */
+typedef enum ucc_geth_num_of_threads {
+        UCC_GETH_NUM_OF_THREADS_1 = 0x1,        /* 1 */
+        UCC_GETH_NUM_OF_THREADS_2 = 0x2,        /* 2 */
+        UCC_GETH_NUM_OF_THREADS_4 = 0x0,        /* 4 */
+        UCC_GETH_NUM_OF_THREADS_6 = 0x3,        /* 6 */
+        UCC_GETH_NUM_OF_THREADS_8 = 0x4 /* 8 */
+} ucc_geth_num_of_threads_e;
+
+/* UCC GETH number of station addresses */
+typedef enum ucc_geth_num_of_station_addresses {
+        UCC_GETH_NUM_OF_STATION_ADDRESSES_1,    /* 1 */
+        UCC_GETH_NUM_OF_STATION_ADDRESSES_5     /* 5 */
+} ucc_geth_num_of_station_addresses_e;
+
+typedef u8 enet_addr_t[ENET_NUM_OCTETS_PER_ADDRESS];
+
+/* UCC GETH 82xx Ethernet Address Container */
+typedef struct enet_addr_container {
+        enet_addr_t address;    /* ethernet address */
+        ucc_geth_enet_address_recognition_location_e location;  /* location in
+                                                                   82xx address
+                                                                   recognition
+                                                                   hardware */
+        struct list_head node;
+} enet_addr_container_t;
+
+#define ENET_ADDR_CONT_ENTRY(ptr) list_entry(ptr, enet_addr_container_t, node)
+
+/* UCC GETH Termination Action Descriptor (TAD) structure. */
+typedef struct ucc_geth_tad_params {
+        int rx_non_dynamic_extended_features_mode;
+        int reject_frame;
+        ucc_geth_vlan_operation_tagged_e vtag_op;
+        ucc_geth_vlan_operation_non_tagged_e vnontag_op;
+        ucc_geth_qos_mode_e rqos;
+        u8 vpri;
+        u16 vid;
+} ucc_geth_tad_params_t;
+
+/* GETH protocol initialization structure */
+typedef struct ucc_geth_info {
+        ucc_fast_info_t uf_info;
+        u8 numQueuesTx;
+        u8 numQueuesRx;
+        int ipCheckSumCheck;
+        int ipCheckSumGenerate;
+        int rxExtendedFiltering;
+        u32 extendedFilteringChainPointer;
+        u16 typeorlen;
+        int dynamicMaxFrameLength;
+        int dynamicMinFrameLength;
+        u8 nonBackToBackIfgPart1;
+        u8 nonBackToBackIfgPart2;
+        u8 miminumInterFrameGapEnforcement;
+        u8 backToBackInterFrameGap;
+        int ipAddressAlignment;
+        int lengthCheckRx;
+        u32 mblinterval;
+        u16 nortsrbytetime;
+        u8 fracsiz;
+        u8 strictpriorityq;
+        u8 txasap;
+        u8 extrabw;
+        int miiPreambleSupress;
+        u8 altBebTruncation;
+        int altBeb;
+        int backPressureNoBackoff;
+        int noBackoff;
+        int excessDefer;
+        u8 maxRetransmission;
+        u8 collisionWindow;
+        int pro;
+        int cap;
+        int rsh;
+        int rlpb;
+        int cam;
+        int bro;
+        int ecm;
+        int receiveFlowControl;
+        u8 maxGroupAddrInHash;
+        u8 maxIndAddrInHash;
+        u8 prel;
+        u16 maxFrameLength;
+        u16 minFrameLength;
+        u16 maxD1Length;
+        u16 maxD2Length;
+        u16 vlantype;
+        u16 vlantci;
+        u32 ecamptr;
+        u32 eventRegMask;
+        u16 pausePeriod;
+        u16 extensionField;
+        u8 phy_address;
+        u32 board_flags;
+        u32 phy_interrupt;
+        u8 weightfactor[NUM_TX_QUEUES];
+        u8 interruptcoalescingmaxvalue[NUM_RX_QUEUES];
+        u8 l2qt[UCC_GETH_VLAN_PRIORITY_MAX];
+        u8 l3qt[UCC_GETH_IP_PRIORITY_MAX];
+        u32 vtagtable[UCC_GETH_TX_VTAG_TABLE_ENTRY_MAX];
+        u8 iphoffset[TX_IP_OFFSET_ENTRY_MAX];
+        u16 bdRingLenTx[NUM_TX_QUEUES];
+        u16 bdRingLenRx[NUM_RX_QUEUES];
+        enet_interface_e enet_interface;
+        ucc_geth_num_of_station_addresses_e numStationAddresses;
+         qe_fltr_largest_external_tbl_lookup_key_size_e
+            largestexternallookupkeysize;
+        ucc_geth_statistics_gathering_mode_e statisticsMode;
+        ucc_geth_vlan_operation_tagged_e vlanOperationTagged;
+        ucc_geth_vlan_operation_non_tagged_e vlanOperationNonTagged;
+        ucc_geth_qos_mode_e rxQoSMode;
+        ucc_geth_flow_control_mode_e aufc;
+        ucc_geth_maccfg2_pad_and_crc_mode_e padAndCrc;
+        ucc_geth_num_of_threads_e numThreadsTx;
+        ucc_geth_num_of_threads_e numThreadsRx;
+        qe_risc_allocation_e riscTx;
+        qe_risc_allocation_e riscRx;
+} ucc_geth_info_t;
+
+/* structure representing UCC GETH */
+typedef struct ucc_geth_private {
+        ucc_geth_info_t *ug_info;
+        ucc_fast_private_t *uccf;
+        struct net_device *dev;
+        struct net_device_stats stats;  /* linux network statistics */
+        ucc_geth_t *ug_regs;
+        ucc_geth_init_pram_t *p_init_enet_param_shadow;
+        ucc_geth_exf_global_pram_t *p_exf_glbl_param;
+        u32 exf_glbl_param_offset;
+        ucc_geth_rx_global_pram_t *p_rx_glbl_pram;
+        u32 rx_glbl_pram_offset;
+        ucc_geth_tx_global_pram_t *p_tx_glbl_pram;
+        u32 tx_glbl_pram_offset;
+        ucc_geth_send_queue_mem_region_t *p_send_q_mem_reg;
+        u32 send_q_mem_reg_offset;
+        ucc_geth_thread_data_tx_t *p_thread_data_tx;
+        u32 thread_dat_tx_offset;
+        ucc_geth_thread_data_rx_t *p_thread_data_rx;
+        u32 thread_dat_rx_offset;
+        ucc_geth_scheduler_t *p_scheduler;
+        u32 scheduler_offset;
+        ucc_geth_tx_firmware_statistics_pram_t *p_tx_fw_statistics_pram;
+        u32 tx_fw_statistics_pram_offset;
+        ucc_geth_rx_firmware_statistics_pram_t *p_rx_fw_statistics_pram;
+        u32 rx_fw_statistics_pram_offset;
+        ucc_geth_rx_interrupt_coalescing_table_t *p_rx_irq_coalescing_tbl;
+        u32 rx_irq_coalescing_tbl_offset;
+        ucc_geth_rx_bd_queues_entry_t *p_rx_bd_qs_tbl;
+        u32 rx_bd_qs_tbl_offset;
+        u8 *p_tx_bd_ring[NUM_TX_QUEUES];
+        u32 tx_bd_ring_offset[NUM_TX_QUEUES];
+        u8 *p_rx_bd_ring[NUM_RX_QUEUES];
+        u32 rx_bd_ring_offset[NUM_RX_QUEUES];
+        u8 *confBd[NUM_TX_QUEUES];
+        u8 *txBd[NUM_TX_QUEUES];
+        u8 *rxBd[NUM_RX_QUEUES];
+        int badFrame[NUM_RX_QUEUES];
+        u16 cpucount[NUM_TX_QUEUES];
+        volatile u16 *p_cpucount[NUM_TX_QUEUES];
+        int indAddrRegUsed[NUM_OF_PADDRS];
+        enet_addr_t paddr[NUM_OF_PADDRS];
+        u8 numGroupAddrInHash;
+        u8 numIndAddrInHash;
+        u8 numIndAddrInReg;
+        int rx_extended_features;
+        int rx_non_dynamic_extended_features;
+        struct list_head conf_skbs;
+        struct list_head group_hash_q;
+        struct list_head ind_hash_q;
+        u32 saved_uccm;
+        spinlock_t lock;
+        /* pointers to arrays of skbuffs for tx and rx */
+        struct sk_buff **tx_skbuff[NUM_TX_QUEUES];
+        struct sk_buff **rx_skbuff[NUM_RX_QUEUES];
+        /* indices pointing to the next free sbk in skb arrays */
+        u16 skb_curtx[NUM_TX_QUEUES];
+        u16 skb_currx[NUM_RX_QUEUES];
+        /* index of the first skb which hasn't been transmitted yet. */
+        u16 skb_dirtytx[NUM_TX_QUEUES];
+
+        struct work_struct tq;
+        struct timer_list phy_info_timer;
+        struct ugeth_mii_info *mii_info;
+        int oldspeed;
+        int oldduplex;
+        int oldlink;
+} ucc_geth_private_t;
+
+#endif                          /* __UCC_GETH_H__ */
diff --git a/drivers/net/ucc_geth_phy.c b/drivers/net/ucc_geth_phy.c
new file mode 100644
index 000000000000..f91028c5386d
--- /dev/null
+++ b/drivers/net/ucc_geth_phy.c
@@ -0,0 +1,801 @@
+/*
+ * Copyright (C) Freescale Semicondutor, Inc. 2006. All rights reserved.
+ *
+ * Author: Shlomi Gridish <gridish@freescale.com>
+ *
+ * Description:
+ * UCC GETH Driver -- PHY handling
+ *
+ * Changelog:
+ * Jun 28, 2006 Li Yang <LeoLi@freescale.com>
+ * - Rearrange code and style fixes
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/crc32.h>
+#include <linux/mii.h>
+#include <linux/ethtool.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+#include "ucc_geth.h"
+#include "ucc_geth_phy.h"
+#include <platforms/83xx/mpc8360e_pb.h>
+
+#define ugphy_printk(level, format, arg...)  \
+        printk(level format "\n", ## arg)
+
+#define ugphy_dbg(format, arg...)            \
+        ugphy_printk(KERN_DEBUG, format , ## arg)
+#define ugphy_err(format, arg...)            \
+        ugphy_printk(KERN_ERR, format , ## arg)
+#define ugphy_info(format, arg...)           \
+        ugphy_printk(KERN_INFO, format , ## arg)
+#define ugphy_warn(format, arg...)           \
+        ugphy_printk(KERN_WARNING, format , ## arg)
+
+#ifdef UGETH_VERBOSE_DEBUG
+#define ugphy_vdbg ugphy_dbg
+#else
+#define ugphy_vdbg(fmt, args...) do { } while (0)
+#endif                          /* UGETH_VERBOSE_DEBUG */
+
+static void config_genmii_advert(struct ugeth_mii_info *mii_info);
+static void genmii_setup_forced(struct ugeth_mii_info *mii_info);
+static void genmii_restart_aneg(struct ugeth_mii_info *mii_info);
+static int gbit_config_aneg(struct ugeth_mii_info *mii_info);
+static int genmii_config_aneg(struct ugeth_mii_info *mii_info);
+static int genmii_update_link(struct ugeth_mii_info *mii_info);
+static int genmii_read_status(struct ugeth_mii_info *mii_info);
+u16 phy_read(struct ugeth_mii_info *mii_info, u16 regnum);
+void phy_write(struct ugeth_mii_info *mii_info, u16 regnum, u16 val);
+
+static u8 *bcsr_regs = NULL;
+
+/* Write value to the PHY for this device to the register at regnum, */
+/* waiting until the write is done before it returns.  All PHY */
+/* configuration has to be done through the TSEC1 MIIM regs */
+void write_phy_reg(struct net_device *dev, int mii_id, int regnum, int value)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        ucc_mii_mng_t *mii_regs;
+        enet_tbi_mii_reg_e mii_reg = (enet_tbi_mii_reg_e) regnum;
+        u32 tmp_reg;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        spin_lock_irq(&ugeth->lock);
+
+        mii_regs = ugeth->mii_info->mii_regs;
+
+        /* Set this UCC to be the master of the MII managment */
+        ucc_set_qe_mux_mii_mng(ugeth->ug_info->uf_info.ucc_num);
+
+        /* Stop the MII management read cycle */
+        out_be32(&mii_regs->miimcom, 0);
+        /* Setting up the MII Mangement Address Register */
+        tmp_reg = ((u32) mii_id << MIIMADD_PHY_ADDRESS_SHIFT) | mii_reg;
+        out_be32(&mii_regs->miimadd, tmp_reg);
+
+        /* Setting up the MII Mangement Control Register with the value */
+        out_be32(&mii_regs->miimcon, (u32) value);
+
+        /* Wait till MII management write is complete */
+        while ((in_be32(&mii_regs->miimind)) & MIIMIND_BUSY)
+                cpu_relax();
+
+        spin_unlock_irq(&ugeth->lock);
+
+        udelay(10000);
+}
+
+/* Reads from register regnum in the PHY for device dev, */
+/* returning the value.  Clears miimcom first.  All PHY */
+/* configuration has to be done through the TSEC1 MIIM regs */
+int read_phy_reg(struct net_device *dev, int mii_id, int regnum)
+{
+        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        ucc_mii_mng_t *mii_regs;
+        enet_tbi_mii_reg_e mii_reg = (enet_tbi_mii_reg_e) regnum;
+        u32 tmp_reg;
+        u16 value;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        spin_lock_irq(&ugeth->lock);
+
+        mii_regs = ugeth->mii_info->mii_regs;
+
+        /* Setting up the MII Mangement Address Register */
+        tmp_reg = ((u32) mii_id << MIIMADD_PHY_ADDRESS_SHIFT) | mii_reg;
+        out_be32(&mii_regs->miimadd, tmp_reg);
+
+        /* Perform an MII management read cycle */
+        out_be32(&mii_regs->miimcom, MIIMCOM_READ_CYCLE);
+
+        /* Wait till MII management write is complete */
+        while ((in_be32(&mii_regs->miimind)) & MIIMIND_BUSY)
+                cpu_relax();
+
+        udelay(10000);
+
+        /* Read MII management status  */
+        value = (u16) in_be32(&mii_regs->miimstat);
+        out_be32(&mii_regs->miimcom, 0);
+        if (value == 0xffff)
+                ugphy_warn("read wrong value : mii_id %d,mii_reg %d, base %08x",
+                           mii_id, mii_reg, (u32) & (mii_regs->miimcfg));
+
+        spin_unlock_irq(&ugeth->lock);
+
+        return (value);
+}
+
+void mii_clear_phy_interrupt(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (mii_info->phyinfo->ack_interrupt)
+                mii_info->phyinfo->ack_interrupt(mii_info);
+}
+
+void mii_configure_phy_interrupt(struct ugeth_mii_info *mii_info,
+                                 u32 interrupts)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        mii_info->interrupts = interrupts;
+        if (mii_info->phyinfo->config_intr)
+                mii_info->phyinfo->config_intr(mii_info);
+}
+
+/* Writes MII_ADVERTISE with the appropriate values, after
+ * sanitizing advertise to make sure only supported features
+ * are advertised
+ */
+static void config_genmii_advert(struct ugeth_mii_info *mii_info)
+{
+        u32 advertise;
+        u16 adv;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Only allow advertising what this PHY supports */
+        mii_info->advertising &= mii_info->phyinfo->features;
+        advertise = mii_info->advertising;
+
+        /* Setup standard advertisement */
+        adv = phy_read(mii_info, MII_ADVERTISE);
+        adv &= ~(ADVERTISE_ALL | ADVERTISE_100BASE4);
+        if (advertise & ADVERTISED_10baseT_Half)
+                adv |= ADVERTISE_10HALF;
+        if (advertise & ADVERTISED_10baseT_Full)
+                adv |= ADVERTISE_10FULL;
+        if (advertise & ADVERTISED_100baseT_Half)
+                adv |= ADVERTISE_100HALF;
+        if (advertise & ADVERTISED_100baseT_Full)
+                adv |= ADVERTISE_100FULL;
+        phy_write(mii_info, MII_ADVERTISE, adv);
+}
+
+static void genmii_setup_forced(struct ugeth_mii_info *mii_info)
+{
+        u16 ctrl;
+        u32 features = mii_info->phyinfo->features;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        ctrl = phy_read(mii_info, MII_BMCR);
+
+        ctrl &=
+            ~(BMCR_FULLDPLX | BMCR_SPEED100 | BMCR_SPEED1000 | BMCR_ANENABLE);
+        ctrl |= BMCR_RESET;
+
+        switch (mii_info->speed) {
+        case SPEED_1000:
+                if (features & (SUPPORTED_1000baseT_Half
+                                | SUPPORTED_1000baseT_Full)) {
+                        ctrl |= BMCR_SPEED1000;
+                        break;
+                }
+                mii_info->speed = SPEED_100;
+        case SPEED_100:
+                if (features & (SUPPORTED_100baseT_Half
+                                | SUPPORTED_100baseT_Full)) {
+                        ctrl |= BMCR_SPEED100;
+                        break;
+                }
+                mii_info->speed = SPEED_10;
+        case SPEED_10:
+                if (features & (SUPPORTED_10baseT_Half
+                                | SUPPORTED_10baseT_Full))
+                        break;
+        default:                /* Unsupported speed! */
+                ugphy_err("%s: Bad speed!", mii_info->dev->name);
+                break;
+        }
+
+        phy_write(mii_info, MII_BMCR, ctrl);
+}
+
+/* Enable and Restart Autonegotiation */
+static void genmii_restart_aneg(struct ugeth_mii_info *mii_info)
+{
+        u16 ctl;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        ctl = phy_read(mii_info, MII_BMCR);
+        ctl |= (BMCR_ANENABLE | BMCR_ANRESTART);
+        phy_write(mii_info, MII_BMCR, ctl);
+}
+
+static int gbit_config_aneg(struct ugeth_mii_info *mii_info)
+{
+        u16 adv;
+        u32 advertise;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (mii_info->autoneg) {
+                /* Configure the ADVERTISE register */
+                config_genmii_advert(mii_info);
+                advertise = mii_info->advertising;
+
+                adv = phy_read(mii_info, MII_1000BASETCONTROL);
+                adv &= ~(MII_1000BASETCONTROL_FULLDUPLEXCAP |
+                         MII_1000BASETCONTROL_HALFDUPLEXCAP);
+                if (advertise & SUPPORTED_1000baseT_Half)
+                        adv |= MII_1000BASETCONTROL_HALFDUPLEXCAP;
+                if (advertise & SUPPORTED_1000baseT_Full)
+                        adv |= MII_1000BASETCONTROL_FULLDUPLEXCAP;
+                phy_write(mii_info, MII_1000BASETCONTROL, adv);
+
+                /* Start/Restart aneg */
+                genmii_restart_aneg(mii_info);
+        } else
+                genmii_setup_forced(mii_info);
+
+        return 0;
+}
+
+static int genmii_config_aneg(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (mii_info->autoneg) {
+                config_genmii_advert(mii_info);
+                genmii_restart_aneg(mii_info);
+        } else
+                genmii_setup_forced(mii_info);
+
+        return 0;
+}
+
+static int genmii_update_link(struct ugeth_mii_info *mii_info)
+{
+        u16 status;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Do a fake read */
+        phy_read(mii_info, MII_BMSR);
+
+        /* Read link and autonegotiation status */
+        status = phy_read(mii_info, MII_BMSR);
+        if ((status & BMSR_LSTATUS) == 0)
+                mii_info->link = 0;
+        else
+                mii_info->link = 1;
+
+        /* If we are autonegotiating, and not done,
+         * return an error */
+        if (mii_info->autoneg && !(status & BMSR_ANEGCOMPLETE))
+                return -EAGAIN;
+
+        return 0;
+}
+
+static int genmii_read_status(struct ugeth_mii_info *mii_info)
+{
+        u16 status;
+        int err;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Update the link, but return if there
+         * was an error */
+        err = genmii_update_link(mii_info);
+        if (err)
+                return err;
+
+        if (mii_info->autoneg) {
+                status = phy_read(mii_info, MII_LPA);
+
+                if (status & (LPA_10FULL | LPA_100FULL))
+                        mii_info->duplex = DUPLEX_FULL;
+                else
+                        mii_info->duplex = DUPLEX_HALF;
+                if (status & (LPA_100FULL | LPA_100HALF))
+                        mii_info->speed = SPEED_100;
+                else
+                        mii_info->speed = SPEED_10;
+                mii_info->pause = 0;
+        }
+        /* On non-aneg, we assume what we put in BMCR is the speed,
+         * though magic-aneg shouldn't prevent this case from occurring
+         */
+
+        return 0;
+}
+
+static int marvell_init(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        phy_write(mii_info, 0x14, 0x0cd2);
+        phy_write(mii_info, MII_BMCR,
+                  phy_read(mii_info, MII_BMCR) | BMCR_RESET);
+        msleep(4000);
+
+        return 0;
+}
+
+static int marvell_config_aneg(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* The Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation */
+        phy_write(mii_info, MII_BMCR, BMCR_RESET);
+
+        phy_write(mii_info, 0x1d, 0x1f);
+        phy_write(mii_info, 0x1e, 0x200c);
+        phy_write(mii_info, 0x1d, 0x5);
+        phy_write(mii_info, 0x1e, 0);
+        phy_write(mii_info, 0x1e, 0x100);
+
+        gbit_config_aneg(mii_info);
+
+        return 0;
+}
+
+static int marvell_read_status(struct ugeth_mii_info *mii_info)
+{
+        u16 status;
+        int err;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Update the link, but return if there
+         * was an error */
+        err = genmii_update_link(mii_info);
+        if (err)
+                return err;
+
+        /* If the link is up, read the speed and duplex */
+        /* If we aren't autonegotiating, assume speeds
+         * are as set */
+        if (mii_info->autoneg && mii_info->link) {
+                int speed;
+                status = phy_read(mii_info, MII_M1011_PHY_SPEC_STATUS);
+
+                /* Get the duplexity */
+                if (status & MII_M1011_PHY_SPEC_STATUS_FULLDUPLEX)
+                        mii_info->duplex = DUPLEX_FULL;
+                else
+                        mii_info->duplex = DUPLEX_HALF;
+
+                /* Get the speed */
+                speed = status & MII_M1011_PHY_SPEC_STATUS_SPD_MASK;
+                switch (speed) {
+                case MII_M1011_PHY_SPEC_STATUS_1000:
+                        mii_info->speed = SPEED_1000;
+                        break;
+                case MII_M1011_PHY_SPEC_STATUS_100:
+                        mii_info->speed = SPEED_100;
+                        break;
+                default:
+                        mii_info->speed = SPEED_10;
+                        break;
+                }
+                mii_info->pause = 0;
+        }
+
+        return 0;
+}
+
+static int marvell_ack_interrupt(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Clear the interrupts by reading the reg */
+        phy_read(mii_info, MII_M1011_IEVENT);
+
+        return 0;
+}
+
+static int marvell_config_intr(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (mii_info->interrupts == MII_INTERRUPT_ENABLED)
+                phy_write(mii_info, MII_M1011_IMASK, MII_M1011_IMASK_INIT);
+        else
+                phy_write(mii_info, MII_M1011_IMASK, MII_M1011_IMASK_CLEAR);
+
+        return 0;
+}
+
+static int cis820x_init(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        phy_write(mii_info, MII_CIS8201_AUX_CONSTAT,
+                  MII_CIS8201_AUXCONSTAT_INIT);
+        phy_write(mii_info, MII_CIS8201_EXT_CON1, MII_CIS8201_EXTCON1_INIT);
+
+        return 0;
+}
+
+static int cis820x_read_status(struct ugeth_mii_info *mii_info)
+{
+        u16 status;
+        int err;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Update the link, but return if there
+         * was an error */
+        err = genmii_update_link(mii_info);
+        if (err)
+                return err;
+
+        /* If the link is up, read the speed and duplex */
+        /* If we aren't autonegotiating, assume speeds
+         * are as set */
+        if (mii_info->autoneg && mii_info->link) {
+                int speed;
+
+                status = phy_read(mii_info, MII_CIS8201_AUX_CONSTAT);
+                if (status & MII_CIS8201_AUXCONSTAT_DUPLEX)
+                        mii_info->duplex = DUPLEX_FULL;
+                else
+                        mii_info->duplex = DUPLEX_HALF;
+
+                speed = status & MII_CIS8201_AUXCONSTAT_SPEED;
+
+                switch (speed) {
+                case MII_CIS8201_AUXCONSTAT_GBIT:
+                        mii_info->speed = SPEED_1000;
+                        break;
+                case MII_CIS8201_AUXCONSTAT_100:
+                        mii_info->speed = SPEED_100;
+                        break;
+                default:
+                        mii_info->speed = SPEED_10;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+static int cis820x_ack_interrupt(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        phy_read(mii_info, MII_CIS8201_ISTAT);
+
+        return 0;
+}
+
+static int cis820x_config_intr(struct ugeth_mii_info *mii_info)
+{
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (mii_info->interrupts == MII_INTERRUPT_ENABLED)
+                phy_write(mii_info, MII_CIS8201_IMASK, MII_CIS8201_IMASK_MASK);
+        else
+                phy_write(mii_info, MII_CIS8201_IMASK, 0);
+
+        return 0;
+}
+
+#define DM9161_DELAY 10
+
+static int dm9161_read_status(struct ugeth_mii_info *mii_info)
+{
+        u16 status;
+        int err;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Update the link, but return if there
+         * was an error */
+        err = genmii_update_link(mii_info);
+        if (err)
+                return err;
+
+        /* If the link is up, read the speed and duplex */
+        /* If we aren't autonegotiating, assume speeds
+         * are as set */
+        if (mii_info->autoneg && mii_info->link) {
+                status = phy_read(mii_info, MII_DM9161_SCSR);
+                if (status & (MII_DM9161_SCSR_100F | MII_DM9161_SCSR_100H))
+                        mii_info->speed = SPEED_100;
+                else
+                        mii_info->speed = SPEED_10;
+
+                if (status & (MII_DM9161_SCSR_100F | MII_DM9161_SCSR_10F))
+                        mii_info->duplex = DUPLEX_FULL;
+                else
+                        mii_info->duplex = DUPLEX_HALF;
+        }
+
+        return 0;
+}
+
+static int dm9161_config_aneg(struct ugeth_mii_info *mii_info)
+{
+        struct dm9161_private *priv = mii_info->priv;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (0 == priv->resetdone)
+                return -EAGAIN;
+
+        return 0;
+}
+
+static void dm9161_timer(unsigned long data)
+{
+        struct ugeth_mii_info *mii_info = (struct ugeth_mii_info *)data;
+        struct dm9161_private *priv = mii_info->priv;
+        u16 status = phy_read(mii_info, MII_BMSR);
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (status & BMSR_ANEGCOMPLETE) {
+                priv->resetdone = 1;
+        } else
+                mod_timer(&priv->timer, jiffies + DM9161_DELAY * HZ);
+}
+
+static int dm9161_init(struct ugeth_mii_info *mii_info)
+{
+        struct dm9161_private *priv;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Allocate the private data structure */
+        priv = kmalloc(sizeof(struct dm9161_private), GFP_KERNEL);
+
+        if (NULL == priv)
+                return -ENOMEM;
+
+        mii_info->priv = priv;
+
+        /* Reset is not done yet */
+        priv->resetdone = 0;
+
+        phy_write(mii_info, MII_BMCR,
+                  phy_read(mii_info, MII_BMCR) | BMCR_RESET);
+
+        phy_write(mii_info, MII_BMCR,
+                  phy_read(mii_info, MII_BMCR) & ~BMCR_ISOLATE);
+
+        config_genmii_advert(mii_info);
+        /* Start/Restart aneg */
+        genmii_config_aneg(mii_info);
+
+        /* Start a timer for DM9161_DELAY seconds to wait
+         * for the PHY to be ready */
+        init_timer(&priv->timer);
+        priv->timer.function = &dm9161_timer;
+        priv->timer.data = (unsigned long)mii_info;
+        mod_timer(&priv->timer, jiffies + DM9161_DELAY * HZ);
+
+        return 0;
+}
+
+static void dm9161_close(struct ugeth_mii_info *mii_info)
+{
+        struct dm9161_private *priv = mii_info->priv;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        del_timer_sync(&priv->timer);
+        kfree(priv);
+}
+
+static int dm9161_ack_interrupt(struct ugeth_mii_info *mii_info)
+{
+/* FIXME: This lines are for BUG fixing in the mpc8325.
+Remove this from here when it's fixed */
+        if (bcsr_regs == NULL)
+                bcsr_regs = (u8 *) ioremap(BCSR_PHYS_ADDR, BCSR_SIZE);
+        bcsr_regs[14] |= 0x40;
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Clear the interrupts by reading the reg */
+        phy_read(mii_info, MII_DM9161_INTR);
+
+
+        return 0;
+}
+
+static int dm9161_config_intr(struct ugeth_mii_info *mii_info)
+{
+/* FIXME: This lines are for BUG fixing in the mpc8325.
+Remove this from here when it's fixed */
+        if (bcsr_regs == NULL) {
+                bcsr_regs = (u8 *) ioremap(BCSR_PHYS_ADDR, BCSR_SIZE);
+                bcsr_regs[14] &= ~0x40;
+        }
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        if (mii_info->interrupts == MII_INTERRUPT_ENABLED)
+                phy_write(mii_info, MII_DM9161_INTR, MII_DM9161_INTR_INIT);
+        else
+                phy_write(mii_info, MII_DM9161_INTR, MII_DM9161_INTR_STOP);
+
+        return 0;
+}
+
+/* Cicada 820x */
+static struct phy_info phy_info_cis820x = {
+        .phy_id = 0x000fc440,
+        .name = "Cicada Cis8204",
+        .phy_id_mask = 0x000fffc0,
+        .features = MII_GBIT_FEATURES,
+        .init = &cis820x_init,
+        .config_aneg = &gbit_config_aneg,
+        .read_status = &cis820x_read_status,
+        .ack_interrupt = &cis820x_ack_interrupt,
+        .config_intr = &cis820x_config_intr,
+};
+
+static struct phy_info phy_info_dm9161 = {
+        .phy_id = 0x0181b880,
+        .phy_id_mask = 0x0ffffff0,
+        .name = "Davicom DM9161E",
+        .init = dm9161_init,
+        .config_aneg = dm9161_config_aneg,
+        .read_status = dm9161_read_status,
+        .close = dm9161_close,
+};
+
+static struct phy_info phy_info_dm9161a = {
+        .phy_id = 0x0181b8a0,
+        .phy_id_mask = 0x0ffffff0,
+        .name = "Davicom DM9161A",
+        .features = MII_BASIC_FEATURES,
+        .init = dm9161_init,
+        .config_aneg = dm9161_config_aneg,
+        .read_status = dm9161_read_status,
+        .ack_interrupt = dm9161_ack_interrupt,
+        .config_intr = dm9161_config_intr,
+        .close = dm9161_close,
+};
+
+static struct phy_info phy_info_marvell = {
+        .phy_id = 0x01410c00,
+        .phy_id_mask = 0xffffff00,
+        .name = "Marvell 88E11x1",
+        .features = MII_GBIT_FEATURES,
+        .init = &marvell_init,
+        .config_aneg = &marvell_config_aneg,
+        .read_status = &marvell_read_status,
+        .ack_interrupt = &marvell_ack_interrupt,
+        .config_intr = &marvell_config_intr,
+};
+
+static struct phy_info phy_info_genmii = {
+        .phy_id = 0x00000000,
+        .phy_id_mask = 0x00000000,
+        .name = "Generic MII",
+        .features = MII_BASIC_FEATURES,
+        .config_aneg = genmii_config_aneg,
+        .read_status = genmii_read_status,
+};
+
+static struct phy_info *phy_info[] = {
+        &phy_info_cis820x,
+        &phy_info_marvell,
+        &phy_info_dm9161,
+        &phy_info_dm9161a,
+        &phy_info_genmii,
+        NULL
+};
+
+u16 phy_read(struct ugeth_mii_info *mii_info, u16 regnum)
+{
+        u16 retval;
+        unsigned long flags;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        spin_lock_irqsave(&mii_info->mdio_lock, flags);
+        retval = mii_info->mdio_read(mii_info->dev, mii_info->mii_id, regnum);
+        spin_unlock_irqrestore(&mii_info->mdio_lock, flags);
+
+        return retval;
+}
+
+void phy_write(struct ugeth_mii_info *mii_info, u16 regnum, u16 val)
+{
+        unsigned long flags;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        spin_lock_irqsave(&mii_info->mdio_lock, flags);
+        mii_info->mdio_write(mii_info->dev, mii_info->mii_id, regnum, val);
+        spin_unlock_irqrestore(&mii_info->mdio_lock, flags);
+}
+
+/* Use the PHY ID registers to determine what type of PHY is attached
+ * to device dev.  return a struct phy_info structure describing that PHY
+ */
+struct phy_info *get_phy_info(struct ugeth_mii_info *mii_info)
+{
+        u16 phy_reg;
+        u32 phy_ID;
+        int i;
+        struct phy_info *theInfo = NULL;
+        struct net_device *dev = mii_info->dev;
+
+        ugphy_vdbg("%s: IN", __FUNCTION__);
+
+        /* Grab the bits from PHYIR1, and put them in the upper half */
+        phy_reg = phy_read(mii_info, MII_PHYSID1);
+        phy_ID = (phy_reg & 0xffff) << 16;
+
+        /* Grab the bits from PHYIR2, and put them in the lower half */
+        phy_reg = phy_read(mii_info, MII_PHYSID2);
+        phy_ID |= (phy_reg & 0xffff);
+
+        /* loop through all the known PHY types, and find one that */
+        /* matches the ID we read from the PHY. */
+        for (i = 0; phy_info[i]; i++)
+                if (phy_info[i]->phy_id == (phy_ID & phy_info[i]->phy_id_mask)){
+                        theInfo = phy_info[i];
+                        break;
+                }
+
+        /* This shouldn't happen, as we have generic PHY support */
+        if (theInfo == NULL) {
+                ugphy_info("%s: PHY id %x is not supported!", dev->name,
+                           phy_ID);
+                return NULL;
+        } else {
+                ugphy_info("%s: PHY is %s (%x)", dev->name, theInfo->name,
+                           phy_ID);
+        }
+
+        return theInfo;
+}
diff --git a/drivers/net/ucc_geth_phy.h b/drivers/net/ucc_geth_phy.h
new file mode 100644
index 000000000000..2f98b8f1bb0a
--- /dev/null
+++ b/drivers/net/ucc_geth_phy.h
@@ -0,0 +1,217 @@
+/*
+ * Copyright (C) Freescale Semicondutor, Inc. 2006. All rights reserved.
+ *
+ * Author: Shlomi Gridish <gridish@freescale.com>
+ *
+ * Description:
+ * UCC GETH Driver -- PHY handling
+ *
+ * Changelog:
+ * Jun 28, 2006 Li Yang <LeoLi@freescale.com>
+ * - Rearrange code and style fixes
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+#ifndef __UCC_GETH_PHY_H__
+#define __UCC_GETH_PHY_H__
+
+#define MII_end ((u32)-2)
+#define MII_read ((u32)-1)
+
+#define MIIMIND_BUSY            0x00000001
+#define MIIMIND_NOTVALID        0x00000004
+
+#define UGETH_AN_TIMEOUT        2000
+
+/* 1000BT control (Marvell & BCM54xx at least) */
+#define MII_1000BASETCONTROL                  0x09
+#define MII_1000BASETCONTROL_FULLDUPLEXCAP    0x0200
+#define MII_1000BASETCONTROL_HALFDUPLEXCAP    0x0100
+
+/* Cicada Extended Control Register 1 */
+#define MII_CIS8201_EXT_CON1        0x17
+#define MII_CIS8201_EXTCON1_INIT    0x0000
+
+/* Cicada Interrupt Mask Register */
+#define MII_CIS8201_IMASK           0x19
+#define MII_CIS8201_IMASK_IEN       0x8000
+#define MII_CIS8201_IMASK_SPEED     0x4000
+#define MII_CIS8201_IMASK_LINK      0x2000
+#define MII_CIS8201_IMASK_DUPLEX    0x1000
+#define MII_CIS8201_IMASK_MASK      0xf000
+
+/* Cicada Interrupt Status Register */
+#define MII_CIS8201_ISTAT           0x1a
+#define MII_CIS8201_ISTAT_STATUS    0x8000
+#define MII_CIS8201_ISTAT_SPEED     0x4000
+#define MII_CIS8201_ISTAT_LINK      0x2000
+#define MII_CIS8201_ISTAT_DUPLEX    0x1000
+
+/* Cicada Auxiliary Control/Status Register */
+#define MII_CIS8201_AUX_CONSTAT        0x1c
+#define MII_CIS8201_AUXCONSTAT_INIT    0x0004
+#define MII_CIS8201_AUXCONSTAT_DUPLEX  0x0020
+#define MII_CIS8201_AUXCONSTAT_SPEED   0x0018
+#define MII_CIS8201_AUXCONSTAT_GBIT    0x0010
+#define MII_CIS8201_AUXCONSTAT_100     0x0008
+
+/* 88E1011 PHY Status Register */
+#define MII_M1011_PHY_SPEC_STATUS               0x11
+#define MII_M1011_PHY_SPEC_STATUS_1000          0x8000
+#define MII_M1011_PHY_SPEC_STATUS_100           0x4000
+#define MII_M1011_PHY_SPEC_STATUS_SPD_MASK      0xc000
+#define MII_M1011_PHY_SPEC_STATUS_FULLDUPLEX    0x2000
+#define MII_M1011_PHY_SPEC_STATUS_RESOLVED      0x0800
+#define MII_M1011_PHY_SPEC_STATUS_LINK          0x0400
+
+#define MII_M1011_IEVENT                0x13
+#define MII_M1011_IEVENT_CLEAR          0x0000
+
+#define MII_M1011_IMASK                 0x12
+#define MII_M1011_IMASK_INIT            0x6400
+#define MII_M1011_IMASK_CLEAR           0x0000
+
+#define MII_DM9161_SCR                  0x10
+#define MII_DM9161_SCR_INIT             0x0610
+
+/* DM9161 Specified Configuration and Status Register */
+#define MII_DM9161_SCSR                 0x11
+#define MII_DM9161_SCSR_100F            0x8000
+#define MII_DM9161_SCSR_100H            0x4000
+#define MII_DM9161_SCSR_10F             0x2000
+#define MII_DM9161_SCSR_10H             0x1000
+
+/* DM9161 Interrupt Register */
+#define MII_DM9161_INTR                 0x15
+#define MII_DM9161_INTR_PEND            0x8000
+#define MII_DM9161_INTR_DPLX_MASK       0x0800
+#define MII_DM9161_INTR_SPD_MASK        0x0400
+#define MII_DM9161_INTR_LINK_MASK       0x0200
+#define MII_DM9161_INTR_MASK            0x0100
+#define MII_DM9161_INTR_DPLX_CHANGE     0x0010
+#define MII_DM9161_INTR_SPD_CHANGE      0x0008
+#define MII_DM9161_INTR_LINK_CHANGE     0x0004
+#define MII_DM9161_INTR_INIT            0x0000
+#define MII_DM9161_INTR_STOP    \
+(MII_DM9161_INTR_DPLX_MASK | MII_DM9161_INTR_SPD_MASK \
+ | MII_DM9161_INTR_LINK_MASK | MII_DM9161_INTR_MASK)
+
+/* DM9161 10BT Configuration/Status */
+#define MII_DM9161_10BTCSR              0x12
+#define MII_DM9161_10BTCSR_INIT         0x7800
+
+#define MII_BASIC_FEATURES    (SUPPORTED_10baseT_Half | \
+                 SUPPORTED_10baseT_Full | \
+                 SUPPORTED_100baseT_Half | \
+                 SUPPORTED_100baseT_Full | \
+                 SUPPORTED_Autoneg | \
+                 SUPPORTED_TP | \
+                 SUPPORTED_MII)
+
+#define MII_GBIT_FEATURES    (MII_BASIC_FEATURES | \
+                 SUPPORTED_1000baseT_Half | \
+                 SUPPORTED_1000baseT_Full)
+
+#define MII_READ_COMMAND                0x00000001
+
+#define MII_INTERRUPT_DISABLED          0x0
+#define MII_INTERRUPT_ENABLED           0x1
+/* Taken from mii_if_info and sungem_phy.h */
+struct ugeth_mii_info {
+        /* Information about the PHY type */
+        /* And management functions */
+        struct phy_info *phyinfo;
+
+        ucc_mii_mng_t *mii_regs;
+
+        /* forced speed & duplex (no autoneg)
+         * partner speed & duplex & pause (autoneg)
+         */
+        int speed;
+        int duplex;
+        int pause;
+
+        /* The most recently read link state */
+        int link;
+
+        /* Enabled Interrupts */
+        u32 interrupts;
+
+        u32 advertising;
+        int autoneg;
+        int mii_id;
+
+        /* private data pointer */
+        /* For use by PHYs to maintain extra state */
+        void *priv;
+
+        /* Provided by host chip */
+        struct net_device *dev;
+
+        /* A lock to ensure that only one thing can read/write
+         * the MDIO bus at a time */
+        spinlock_t mdio_lock;
+
+        /* Provided by ethernet driver */
+        int (*mdio_read) (struct net_device * dev, int mii_id, int reg);
+        void (*mdio_write) (struct net_device * dev, int mii_id, int reg,
+                            int val);
+};
+
+/* struct phy_info: a structure which defines attributes for a PHY
+ *
+ * id will contain a number which represents the PHY.  During
+ * startup, the driver will poll the PHY to find out what its
+ * UID--as defined by registers 2 and 3--is.  The 32-bit result
+ * gotten from the PHY will be ANDed with phy_id_mask to
+ * discard any bits which may change based on revision numbers
+ * unimportant to functionality
+ *
+ * There are 6 commands which take a ugeth_mii_info structure.
+ * Each PHY must declare config_aneg, and read_status.
+ */
+struct phy_info {
+        u32 phy_id;
+        char *name;
+        unsigned int phy_id_mask;
+        u32 features;
+
+        /* Called to initialize the PHY */
+        int (*init) (struct ugeth_mii_info * mii_info);
+
+        /* Called to suspend the PHY for power */
+        int (*suspend) (struct ugeth_mii_info * mii_info);
+
+        /* Reconfigures autonegotiation (or disables it) */
+        int (*config_aneg) (struct ugeth_mii_info * mii_info);
+
+        /* Determines the negotiated speed and duplex */
+        int (*read_status) (struct ugeth_mii_info * mii_info);
+
+        /* Clears any pending interrupts */
+        int (*ack_interrupt) (struct ugeth_mii_info * mii_info);
+
+        /* Enables or disables interrupts */
+        int (*config_intr) (struct ugeth_mii_info * mii_info);
+
+        /* Clears up any memory if needed */
+        void (*close) (struct ugeth_mii_info * mii_info);
+};
+
+struct phy_info *get_phy_info(struct ugeth_mii_info *mii_info);
+void write_phy_reg(struct net_device *dev, int mii_id, int regnum, int value);
+int read_phy_reg(struct net_device *dev, int mii_id, int regnum);
+void mii_clear_phy_interrupt(struct ugeth_mii_info *mii_info);
+void mii_configure_phy_interrupt(struct ugeth_mii_info *mii_info,
+                                 u32 interrupts);
+
+struct dm9161_private {
+        struct timer_list timer;
+        int resetdone;
+};
+
+#endif                          /* __UCC_GETH_PHY_H__ */
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 98b6f3207d3d..ae971080e2e4 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -25,117 +25,13 @@
         version. He may or may not be interested in bug reports on this
         code. You can find his versions at:
         http://www.scyld.com/network/via-rhine.html
-
-
-        Linux kernel version history:
-
-        LK1.1.0:
-        - Jeff Garzik: softnet 'n stuff
-
-        LK1.1.1:
-        - Justin Guyett: softnet and locking fixes
-        - Jeff Garzik: use PCI interface
-
-        LK1.1.2:
-        - Urban Widmark: minor cleanups, merges from Becker 1.03a/1.04 versions
-
-        LK1.1.3:
-        - Urban Widmark: use PCI DMA interface (with thanks to the eepro100.c
-                         code) update "Theory of Operation" with
-                         softnet/locking changes
-        - Dave Miller: PCI DMA and endian fixups
-        - Jeff Garzik: MOD_xxx race fixes, updated PCI resource allocation
-
-        LK1.1.4:
-        - Urban Widmark: fix gcc 2.95.2 problem and
-                         remove writel's to fixed address 0x7c
-
-        LK1.1.5:
-        - Urban Widmark: mdio locking, bounce buffer changes
-                         merges from Beckers 1.05 version
-                         added netif_running_on/off support
-
-        LK1.1.6:
-        - Urban Widmark: merges from Beckers 1.08b version (VT6102 + mdio)
-                         set netif_running_on/off on startup, del_timer_sync
-
-        LK1.1.7:
-        - Manfred Spraul: added reset into tx_timeout
-
-        LK1.1.9:
-        - Urban Widmark: merges from Beckers 1.10 version
-                         (media selection + eeprom reload)
-        - David Vrabel:  merges from D-Link "1.11" version
-                         (disable WOL and PME on startup)
-
-        LK1.1.10:
-        - Manfred Spraul: use "singlecopy" for unaligned buffers
-                          don't allocate bounce buffers for !ReqTxAlign cards
-
-        LK1.1.11:
-        - David Woodhouse: Set dev->base_addr before the first time we call
-                           wait_for_reset(). It's a lot happier that way.
-                           Free np->tx_bufs only if we actually allocated it.
-
-        LK1.1.12:
-        - Martin Eriksson: Allow Memory-Mapped IO to be enabled.
-
-        LK1.1.13 (jgarzik):
-        - Add ethtool support
-        - Replace some MII-related magic numbers with constants
-
-        LK1.1.14 (Ivan G.):
-        - fixes comments for Rhine-III
-        - removes W_MAX_TIMEOUT (unused)
-        - adds HasDavicomPhy for Rhine-I (basis: linuxfet driver; my card
-          is R-I and has Davicom chip, flag is referenced in kernel driver)
-        - sends chip_id as a parameter to wait_for_reset since np is not
-          initialized on first call
-        - changes mmio "else if (chip_id==VT6102)" to "else" so it will work
-          for Rhine-III's (documentation says same bit is correct)
-        - transmit frame queue message is off by one - fixed
-        - adds IntrNormalSummary to "Something Wicked" exclusion list
-          so normal interrupts will not trigger the message (src: Donald Becker)
-        (Roger Luethi)
-        - show confused chip where to continue after Tx error
-        - location of collision counter is chip specific
-        - allow selecting backoff algorithm (module parameter)
-
-        LK1.1.15 (jgarzik):
-        - Use new MII lib helper generic_mii_ioctl
-
-        LK1.1.16 (Roger Luethi)
-        - Etherleak fix
-        - Handle Tx buffer underrun
-        - Fix bugs in full duplex handling
-        - New reset code uses "force reset" cmd on Rhine-II
-        - Various clean ups
-
-        LK1.1.17 (Roger Luethi)
-        - Fix race in via_rhine_start_tx()
-        - On errors, wait for Tx engine to turn off before scavenging
-        - Handle Tx descriptor write-back race on Rhine-II
-        - Force flushing for PCI posted writes
-        - More reset code changes
-
-        LK1.1.18 (Roger Luethi)
-        - No filtering multicast in promisc mode (Edward Peng)
-        - Fix for Rhine-I Tx timeouts
-
-        LK1.1.19 (Roger Luethi)
-        - Increase Tx threshold for unspecified errors
-
-        LK1.2.0-2.6 (Roger Luethi)
-        - Massive clean-up
-        - Rewrite PHY, media handling (remove options, full_duplex, backoff)
-        - Fix Tx engine race for good
-        - Craig Brind: Zero padded aligned buffers for short packets.
+        [link no longer provides useful info -jgarzik]
 
 */
 
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.2.0-2.6"
-#define DRV_RELDATE     "June-10-2004"
+#define DRV_VERSION     "1.4.1"
+#define DRV_RELDATE     "July-24-2006"
 
 
 /* A few user-configurable values.
@@ -148,6 +44,10 @@ static int max_interrupt_work = 20;
    Setting to > 1518 effectively disables this feature. */
 static int rx_copybreak;
 
+/* Work-around for broken BIOSes: they are unable to get the chip back out of
+   power state D3 so PXE booting fails. bootparam(7): via-rhine.avoid_D3=1 */
+static int avoid_D3;
+
 /*
  * In case you are looking for 'options[]' or 'full_duplex[]', they
  * are gone. Use ethtool(8) instead.
@@ -167,7 +67,11 @@ static const int multicast_filter_limit = 32;
    There are no ill effects from too-large receive rings. */
 #define TX_RING_SIZE    16
 #define TX_QUEUE_LEN    10      /* Limit ring entries actually used. */
+#ifdef CONFIG_VIA_RHINE_NAPI
+#define RX_RING_SIZE    64
+#else
 #define RX_RING_SIZE    16
+#endif
 
 
 /* Operational parameters that usually are not changed. */
@@ -220,9 +124,11 @@ MODULE_LICENSE("GPL");
 module_param(max_interrupt_work, int, 0);
 module_param(debug, int, 0);
 module_param(rx_copybreak, int, 0);
+module_param(avoid_D3, bool, 0);
 MODULE_PARM_DESC(max_interrupt_work, "VIA Rhine maximum events handled per interrupt");
 MODULE_PARM_DESC(debug, "VIA Rhine debug level (0-7)");
 MODULE_PARM_DESC(rx_copybreak, "VIA Rhine copy breakpoint for copy-only-tiny-frames");
+MODULE_PARM_DESC(avoid_D3, "Avoid power state D3 (work-around for broken BIOSes)");
 
 /*
                 Theory of Operation
@@ -356,12 +262,11 @@ enum rhine_quirks {
 /* Beware of PCI posted writes */
 #define IOSYNC  do { ioread8(ioaddr + StationAddr); } while (0)
 
-static struct pci_device_id rhine_pci_tbl[] =
-{
-        {0x1106, 0x3043, PCI_ANY_ID, PCI_ANY_ID, 0, 0, }, /* VT86C100A */
-        {0x1106, 0x3065, PCI_ANY_ID, PCI_ANY_ID, 0, 0, }, /* VT6102 */
-        {0x1106, 0x3106, PCI_ANY_ID, PCI_ANY_ID, 0, 0, }, /* 6105{,L,LOM} */
-        {0x1106, 0x3053, PCI_ANY_ID, PCI_ANY_ID, 0, 0, }, /* VT6105M */
+static const struct pci_device_id rhine_pci_tbl[] = {
+        { 0x1106, 0x3043, PCI_ANY_ID, PCI_ANY_ID, },    /* VT86C100A */
+        { 0x1106, 0x3065, PCI_ANY_ID, PCI_ANY_ID, },    /* VT6102 */
+        { 0x1106, 0x3106, PCI_ANY_ID, PCI_ANY_ID, },    /* 6105{,L,LOM} */
+        { 0x1106, 0x3053, PCI_ANY_ID, PCI_ANY_ID, },    /* VT6105M */
         { }     /* terminate list */
 };
 MODULE_DEVICE_TABLE(pci, rhine_pci_tbl);
@@ -501,7 +406,7 @@ static void rhine_tx_timeout(struct net_device *dev);
 static int  rhine_start_tx(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t rhine_interrupt(int irq, void *dev_instance, struct pt_regs *regs);
 static void rhine_tx(struct net_device *dev);
-static void rhine_rx(struct net_device *dev);
+static int rhine_rx(struct net_device *dev, int limit);
 static void rhine_error(struct net_device *dev, int intr_status);
 static void rhine_set_rx_mode(struct net_device *dev);
 static struct net_device_stats *rhine_get_stats(struct net_device *dev);
@@ -669,6 +574,32 @@ static void rhine_poll(struct net_device *dev)
 }
 #endif
 
+#ifdef CONFIG_VIA_RHINE_NAPI
+static int rhine_napipoll(struct net_device *dev, int *budget)
+{
+        struct rhine_private *rp = netdev_priv(dev);
+        void __iomem *ioaddr = rp->base;
+        int done, limit = min(dev->quota, *budget);
+
+        done = rhine_rx(dev, limit);
+        *budget -= done;
+        dev->quota -= done;
+
+        if (done < limit) {
+                netif_rx_complete(dev);
+
+                iowrite16(IntrRxDone | IntrRxErr | IntrRxEmpty| IntrRxOverflow |
+                          IntrRxDropped | IntrRxNoBuf | IntrTxAborted |
+                          IntrTxDone | IntrTxError | IntrTxUnderrun |
+                          IntrPCIErr | IntrStatsMax | IntrLinkChange,
+                          ioaddr + IntrEnable);
+                return 0;
+        }
+        else
+                return 1;
+}
+#endif
+
 static void rhine_hw_init(struct net_device *dev, long pioaddr)
 {
         struct rhine_private *rp = netdev_priv(dev);
@@ -849,6 +780,10 @@ static int __devinit rhine_init_one(struct pci_dev *pdev,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         dev->poll_controller = rhine_poll;
 #endif
+#ifdef CONFIG_VIA_RHINE_NAPI
+        dev->poll = rhine_napipoll;
+        dev->weight = 64;
+#endif
         if (rp->quirks & rqRhineI)
                 dev->features |= NETIF_F_SG|NETIF_F_HW_CSUM;
 
@@ -894,6 +829,9 @@ static int __devinit rhine_init_one(struct pci_dev *pdev,
                 }
         }
         rp->mii_if.phy_id = phy_id;
+        if (debug > 1 && avoid_D3)
+                printk(KERN_INFO "%s: No D3 power state at shutdown.\n",
+                       dev->name);
 
         return 0;
 
@@ -1119,6 +1057,8 @@ static void init_registers(struct net_device *dev)
 
         rhine_set_rx_mode(dev);
 
+        netif_poll_enable(dev);
+
         /* Enable interrupts by setting the interrupt mask. */
         iowrite16(IntrRxDone | IntrRxErr | IntrRxEmpty| IntrRxOverflow |
                IntrRxDropped | IntrRxNoBuf | IntrTxAborted |
@@ -1373,8 +1313,18 @@ static irqreturn_t rhine_interrupt(int irq, void *dev_instance, struct pt_regs *
                                dev->name, intr_status);
 
                 if (intr_status & (IntrRxDone | IntrRxErr | IntrRxDropped |
-                    IntrRxWakeUp | IntrRxEmpty | IntrRxNoBuf))
-                        rhine_rx(dev);
+                                   IntrRxWakeUp | IntrRxEmpty | IntrRxNoBuf)) {
+#ifdef CONFIG_VIA_RHINE_NAPI
+                        iowrite16(IntrTxAborted |
+                                  IntrTxDone | IntrTxError | IntrTxUnderrun |
+                                  IntrPCIErr | IntrStatsMax | IntrLinkChange,
+                                  ioaddr + IntrEnable);
+
+                        netif_rx_schedule(dev);
+#else
+                        rhine_rx(dev, RX_RING_SIZE);
+#endif
+                }
 
                 if (intr_status & (IntrTxErrSummary | IntrTxDone)) {
                         if (intr_status & IntrTxErrSummary) {
@@ -1472,13 +1422,12 @@ static void rhine_tx(struct net_device *dev)
         spin_unlock(&rp->lock);
 }
 
-/* This routine is logically part of the interrupt handler, but isolated
-   for clarity and better register allocation. */
-static void rhine_rx(struct net_device *dev)
+/* Process up to limit frames from receive ring */
+static int rhine_rx(struct net_device *dev, int limit)
 {
         struct rhine_private *rp = netdev_priv(dev);
+        int count;
         int entry = rp->cur_rx % RX_RING_SIZE;
-        int boguscnt = rp->dirty_rx + RX_RING_SIZE - rp->cur_rx;
 
         if (debug > 4) {
                 printk(KERN_DEBUG "%s: rhine_rx(), entry %d status %8.8x.\n",
@@ -1487,16 +1436,18 @@ static void rhine_rx(struct net_device *dev)
         }
 
         /* If EOP is set on the next entry, it's a new packet. Send it up. */
-        while (!(rp->rx_head_desc->rx_status & cpu_to_le32(DescOwn))) {
+        for (count = 0; count < limit; ++count) {
                 struct rx_desc *desc = rp->rx_head_desc;
                 u32 desc_status = le32_to_cpu(desc->rx_status);
                 int data_size = desc_status >> 16;
 
+                if (desc_status & DescOwn)
+                        break;
+
                 if (debug > 4)
                         printk(KERN_DEBUG "rhine_rx() status is %8.8x.\n",
                                desc_status);
-                if (--boguscnt < 0)
-                        break;
+
                 if ((desc_status & (RxWholePkt | RxErr)) != RxWholePkt) {
                         if ((desc_status & RxWholePkt) != RxWholePkt) {
                                 printk(KERN_WARNING "%s: Oversized Ethernet "
@@ -1565,7 +1516,11 @@ static void rhine_rx(struct net_device *dev)
                                                  PCI_DMA_FROMDEVICE);
                         }
                         skb->protocol = eth_type_trans(skb, dev);
+#ifdef CONFIG_VIA_RHINE_NAPI
+                        netif_receive_skb(skb);
+#else
                         netif_rx(skb);
+#endif
                         dev->last_rx = jiffies;
                         rp->stats.rx_bytes += pkt_len;
                         rp->stats.rx_packets++;
@@ -1592,6 +1547,8 @@ static void rhine_rx(struct net_device *dev)
                 }
                 rp->rx_ring[entry].rx_status = cpu_to_le32(DescOwn);
         }
+
+        return count;
 }
 
 /*
@@ -1881,6 +1838,7 @@ static int rhine_close(struct net_device *dev)
         spin_lock_irq(&rp->lock);
 
         netif_stop_queue(dev);
+        netif_poll_disable(dev);
 
         if (debug > 1)
                 printk(KERN_DEBUG "%s: Shutting down ethercard, "
@@ -1962,7 +1920,8 @@ static void rhine_shutdown (struct pci_dev *pdev)
         }
 
         /* Hit power state D3 (sleep) */
-        iowrite8(ioread8(ioaddr + StickyHW) | 0x03, ioaddr + StickyHW);
+        if (!avoid_D3)
+                iowrite8(ioread8(ioaddr + StickyHW) | 0x03, ioaddr + StickyHW);
 
         /* TODO: Check use of pci_enable_wake() */
 
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index ba2972ba3757..aa9cd92f46b2 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -229,7 +229,8 @@ static int rx_copybreak = 200;
 module_param(rx_copybreak, int, 0644);
 MODULE_PARM_DESC(rx_copybreak, "Copy breakpoint for copy-only-tiny-frames");
 
-static void velocity_init_info(struct pci_dev *pdev, struct velocity_info *vptr, struct velocity_info_tbl *info);
+static void velocity_init_info(struct pci_dev *pdev, struct velocity_info *vptr,
+                               const struct velocity_info_tbl *info);
 static int velocity_get_pci_info(struct velocity_info *, struct pci_dev *pdev);
 static void velocity_print_info(struct velocity_info *vptr);
 static int velocity_open(struct net_device *dev);
@@ -294,9 +295,9 @@ static void velocity_unregister_notifier(void)
  *      Internal board variants. At the moment we have only one
  */
 
-static struct velocity_info_tbl chip_info_table[] = {
-        {CHIP_TYPE_VT6110, "VIA Networking Velocity Family Gigabit Ethernet Adapter", 256, 1, 0x00FFFFFFUL},
-        {0, NULL}
+static const struct velocity_info_tbl chip_info_table[] __devinitdata = {
+        {CHIP_TYPE_VT6110, "VIA Networking Velocity Family Gigabit Ethernet Adapter", 1, 0x00FFFFFFUL},
+        { }
 };
 
 /*
@@ -304,10 +305,9 @@ static struct velocity_info_tbl chip_info_table[] = {
  *      device driver. Used for hotplug autoloading.
  */
 
-static struct pci_device_id velocity_id_table[] __devinitdata = {
-        {PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_612X,
-         PCI_ANY_ID, PCI_ANY_ID, 0, 0, (unsigned long) chip_info_table},
-        {0, }
+static const struct pci_device_id velocity_id_table[] __devinitdata = {
+        { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_612X) },
+        { }
 };
 
 MODULE_DEVICE_TABLE(pci, velocity_id_table);
@@ -341,7 +341,7 @@ static char __devinit *get_chip_name(enum chip_type chip_id)
 static void __devexit velocity_remove1(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
 
 #ifdef CONFIG_PM
         unsigned long flags;
@@ -686,21 +686,23 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
         static int first = 1;
         struct net_device *dev;
         int i;
-        struct velocity_info_tbl *info = (struct velocity_info_tbl *) ent->driver_data;
+        const struct velocity_info_tbl *info = &chip_info_table[ent->driver_data];
         struct velocity_info *vptr;
         struct mac_regs __iomem * regs;
         int ret = -ENOMEM;
 
+        /* FIXME: this driver, like almost all other ethernet drivers,
+         * can support more than MAX_UNITS.
+         */
         if (velocity_nics >= MAX_UNITS) {
-                printk(KERN_NOTICE VELOCITY_NAME ": already found %d NICs.\n", 
-                                velocity_nics);
+                dev_notice(&pdev->dev, "already found %d NICs.\n", 
+                           velocity_nics);
                 return -ENODEV;
         }
 
         dev = alloc_etherdev(sizeof(struct velocity_info));
-
-        if (dev == NULL) {
-                printk(KERN_ERR VELOCITY_NAME ": allocate net device failed.\n");
+        if (!dev) {
+                dev_err(&pdev->dev, "allocate net device failed.\n");
                 goto out;
         }
         
@@ -708,7 +710,7 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
         
         SET_MODULE_OWNER(dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
-        vptr = dev->priv;
+        vptr = netdev_priv(dev);
 
 
         if (first) {
@@ -731,17 +733,17 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
 
         ret = velocity_get_pci_info(vptr, pdev);
         if (ret < 0) {
-                printk(KERN_ERR VELOCITY_NAME ": Failed to find PCI device.\n");
+                /* error message already printed */
                 goto err_disable;
         }
 
         ret = pci_request_regions(pdev, VELOCITY_NAME);
         if (ret < 0) {
-                printk(KERN_ERR VELOCITY_NAME ": Failed to find PCI device.\n");
+                dev_err(&pdev->dev, "No PCI resources.\n");
                 goto err_disable;
         }
 
-        regs = ioremap(vptr->memaddr, vptr->io_size);
+        regs = ioremap(vptr->memaddr, VELOCITY_IO_SIZE);
         if (regs == NULL) {
                 ret = -EIO;
                 goto err_release_res;
@@ -859,13 +861,14 @@ static void __devinit velocity_print_info(struct velocity_info *vptr)
  *      discovered.
  */
 
-static void __devinit velocity_init_info(struct pci_dev *pdev, struct velocity_info *vptr, struct velocity_info_tbl *info)
+static void __devinit velocity_init_info(struct pci_dev *pdev,
+                                         struct velocity_info *vptr,
+                                         const struct velocity_info_tbl *info)
 {
         memset(vptr, 0, sizeof(struct velocity_info));
 
         vptr->pdev = pdev;
         vptr->chip_id = info->chip_id;
-        vptr->io_size = info->io_size;
         vptr->num_txq = info->txqueue;
         vptr->multicast_limit = MCAM_SIZE;
         spin_lock_init(&vptr->lock);
@@ -883,8 +886,7 @@ static void __devinit velocity_init_info(struct pci_dev *pdev, struct velocity_i
 
 static int __devinit velocity_get_pci_info(struct velocity_info *vptr, struct pci_dev *pdev)
 {
-
-        if(pci_read_config_byte(pdev, PCI_REVISION_ID, &vptr->rev_id) < 0)
+        if (pci_read_config_byte(pdev, PCI_REVISION_ID, &vptr->rev_id) < 0)
                 return -EIO;
                 
         pci_set_master(pdev);
@@ -892,24 +894,20 @@ static int __devinit velocity_get_pci_info(struct velocity_info *vptr, struct pc
         vptr->ioaddr = pci_resource_start(pdev, 0);
         vptr->memaddr = pci_resource_start(pdev, 1);
         
-        if(!(pci_resource_flags(pdev, 0) & IORESOURCE_IO))
-        {
-                printk(KERN_ERR "%s: region #0 is not an I/O resource, aborting.\n",
-                                pci_name(pdev));
+        if (!(pci_resource_flags(pdev, 0) & IORESOURCE_IO)) {
+                dev_err(&pdev->dev,
+                           "region #0 is not an I/O resource, aborting.\n");
                 return -EINVAL;
         }
 
-        if((pci_resource_flags(pdev, 1) & IORESOURCE_IO))
-        {
-                printk(KERN_ERR "%s: region #1 is an I/O resource, aborting.\n",
-                                pci_name(pdev));
+        if ((pci_resource_flags(pdev, 1) & IORESOURCE_IO)) {
+                dev_err(&pdev->dev,
+                           "region #1 is an I/O resource, aborting.\n");
                 return -EINVAL;
         }
 
-        if(pci_resource_len(pdev, 1) < 256)
-        {
-                printk(KERN_ERR "%s: region #1 is too small.\n", 
-                                pci_name(pdev));
+        if (pci_resource_len(pdev, 1) < VELOCITY_IO_SIZE) {
+                dev_err(&pdev->dev, "region #1 is too small.\n");
                 return -EINVAL;
         }
         vptr->pdev = pdev;
@@ -1728,7 +1726,7 @@ static void velocity_free_tx_buf(struct velocity_info *vptr, struct velocity_td_
  
 static int velocity_open(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         int ret;
 
         vptr->rx_buf_sz = (dev->mtu <= 1504 ? PKT_BUF_SZ : dev->mtu + 32);
@@ -1785,7 +1783,7 @@ err_free_desc_rings:
  
 static int velocity_change_mtu(struct net_device *dev, int new_mtu)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         unsigned long flags;
         int oldmtu = dev->mtu;
         int ret = 0;
@@ -1861,7 +1859,7 @@ static void velocity_shutdown(struct velocity_info *vptr)
 
 static int velocity_close(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
 
         netif_stop_queue(dev);
         velocity_shutdown(vptr);
@@ -1894,7 +1892,7 @@ static int velocity_close(struct net_device *dev)
  
 static int velocity_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         int qnum = 0;
         struct tx_desc *td_ptr;
         struct velocity_td_info *tdinfo;
@@ -2049,7 +2047,7 @@ static int velocity_xmit(struct sk_buff *skb, struct net_device *dev)
 static int velocity_intr(int irq, void *dev_instance, struct pt_regs *regs)
 {
         struct net_device *dev = dev_instance;
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         u32 isr_status;
         int max_count = 0;
 
@@ -2104,7 +2102,7 @@ static int velocity_intr(int irq, void *dev_instance, struct pt_regs *regs)
  
 static void velocity_set_multi(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         struct mac_regs __iomem * regs = vptr->mac_regs;
         u8 rx_mode;
         int i;
@@ -2153,7 +2151,7 @@ static void velocity_set_multi(struct net_device *dev)
  
 static struct net_device_stats *velocity_get_stats(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         
         /* If the hardware is down, don't touch MII */
         if(!netif_running(dev))
@@ -2196,7 +2194,7 @@ static struct net_device_stats *velocity_get_stats(struct net_device *dev)
  
 static int velocity_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         int ret;
 
         /* If we are asked for information and the device is power
@@ -2744,7 +2742,7 @@ static u32 check_connection_type(struct mac_regs __iomem * regs)
 
         if (PHYSR0 & PHYSR0_SPDG)
                 status |= VELOCITY_SPEED_1000;
-        if (PHYSR0 & PHYSR0_SPD10)
+        else if (PHYSR0 & PHYSR0_SPD10)
                 status |= VELOCITY_SPEED_10;
         else
                 status |= VELOCITY_SPEED_100;
@@ -2825,7 +2823,7 @@ static void enable_flow_control_ability(struct velocity_info *vptr)
  
 static int velocity_ethtool_up(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         if (!netif_running(dev))
                 pci_set_power_state(vptr->pdev, PCI_D0);
         return 0;
@@ -2841,20 +2839,29 @@ static int velocity_ethtool_up(struct net_device *dev)
  
 static void velocity_ethtool_down(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         if (!netif_running(dev))
                 pci_set_power_state(vptr->pdev, PCI_D3hot);
 }
 
 static int velocity_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         struct mac_regs __iomem * regs = vptr->mac_regs;
         u32 status;
         status = check_connection_type(vptr->mac_regs);
 
-        cmd->supported = SUPPORTED_TP | SUPPORTED_Autoneg | SUPPORTED_10baseT_Half | SUPPORTED_10baseT_Full | SUPPORTED_100baseT_Half | SUPPORTED_100baseT_Full | SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full;
-        if (status & VELOCITY_SPEED_100)
+        cmd->supported = SUPPORTED_TP |
+                        SUPPORTED_Autoneg |
+                        SUPPORTED_10baseT_Half |
+                        SUPPORTED_10baseT_Full |
+                        SUPPORTED_100baseT_Half |
+                        SUPPORTED_100baseT_Full |
+                        SUPPORTED_1000baseT_Half |
+                        SUPPORTED_1000baseT_Full;
+        if (status & VELOCITY_SPEED_1000)
+                cmd->speed = SPEED_1000;
+        else if (status & VELOCITY_SPEED_100)
                 cmd->speed = SPEED_100;
         else
                 cmd->speed = SPEED_10;
@@ -2873,7 +2880,7 @@ static int velocity_get_settings(struct net_device *dev, struct ethtool_cmd *cmd
 
 static int velocity_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         u32 curr_status;
         u32 new_status = 0;
         int ret = 0;
@@ -2896,14 +2903,14 @@ static int velocity_set_settings(struct net_device *dev, struct ethtool_cmd *cmd
 
 static u32 velocity_get_link(struct net_device *dev)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         struct mac_regs __iomem * regs = vptr->mac_regs;
-        return BYTE_REG_BITS_IS_ON(PHYSR0_LINKGD, &regs->PHYSR0)  ? 0 : 1;
+        return BYTE_REG_BITS_IS_ON(PHYSR0_LINKGD, &regs->PHYSR0) ? 1 : 0;
 }
 
 static void velocity_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         strcpy(info->driver, VELOCITY_NAME);
         strcpy(info->version, VELOCITY_VERSION);
         strcpy(info->bus_info, pci_name(vptr->pdev));
@@ -2911,7 +2918,7 @@ static void velocity_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo
 
 static void velocity_ethtool_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         wol->supported = WAKE_PHY | WAKE_MAGIC | WAKE_UCAST | WAKE_ARP;
         wol->wolopts |= WAKE_MAGIC;
         /*
@@ -2927,7 +2934,7 @@ static void velocity_ethtool_get_wol(struct net_device *dev, struct ethtool_woli
 
 static int velocity_ethtool_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
 
         if (!(wol->wolopts & (WAKE_PHY | WAKE_MAGIC | WAKE_UCAST | WAKE_ARP)))
                 return -EFAULT;
@@ -2992,7 +2999,7 @@ static struct ethtool_ops velocity_ethtool_ops = {
  
 static int velocity_mii_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-        struct velocity_info *vptr = dev->priv;
+        struct velocity_info *vptr = netdev_priv(dev);
         struct mac_regs __iomem * regs = vptr->mac_regs;
         unsigned long flags;
         struct mii_ioctl_data *miidata = if_mii(ifr);
diff --git a/drivers/net/via-velocity.h b/drivers/net/via-velocity.h
index f1b2640ebdc6..496c3d597444 100644
--- a/drivers/net/via-velocity.h
+++ b/drivers/net/via-velocity.h
@@ -31,6 +31,8 @@
 #define VELOCITY_FULL_DRV_NAM  "VIA Networking Velocity Family Gigabit Ethernet Adapter Driver"
 #define VELOCITY_VERSION       "1.13"
 
+#define VELOCITY_IO_SIZE        256
+
 #define PKT_BUF_SZ          1540
 
 #define MAX_UNITS           8
@@ -1191,7 +1193,6 @@ enum chip_type {
 struct velocity_info_tbl {
         enum chip_type chip_id;
         char *name;
-        int io_size;
         int txqueue;
         u32 flags;
 };
@@ -1751,7 +1752,6 @@ struct velocity_info {
         struct mac_regs __iomem * mac_regs;
         unsigned long memaddr;
         unsigned long ioaddr;
-        u32 io_size;
 
         u8 rev_id;
 
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index b5328b0ff927..54b8e492ef97 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -134,18 +134,6 @@ config SEALEVEL_4021
           The driver will be compiled as a module: the
           module will be called sealevel.
 
-config SYNCLINK_SYNCPPP
-        tristate "SyncLink HDLC/SYNCPPP support"
-        depends on WAN
-        help
-          Enables HDLC/SYNCPPP support for the SyncLink WAN driver.
-
-          Normally the SyncLink WAN driver works with the main PPP driver
-          <file:drivers/net/ppp_generic.c> and pppd program.
-          HDLC/SYNCPPP support allows use of the Cisco HDLC/PPP driver
-          <file:drivers/net/wan/syncppp.c>. The SyncLink WAN driver (in
-          character devices) must also be enabled.
-
 # Generic HDLC
 config HDLC
         tristate "Generic HDLC layer"
diff --git a/drivers/net/wan/Makefile b/drivers/net/wan/Makefile
index 823c6d5ab90d..316ca6869d5e 100644
--- a/drivers/net/wan/Makefile
+++ b/drivers/net/wan/Makefile
@@ -28,7 +28,6 @@ obj-$(CONFIG_COSA)		+=		syncppp.o	cosa.o
 obj-$(CONFIG_FARSYNC)           +=              syncppp.o       farsync.o
 obj-$(CONFIG_DSCC4)             +=                              dscc4.o
 obj-$(CONFIG_LANMEDIA)          +=              syncppp.o
-obj-$(CONFIG_SYNCLINK_SYNCPPP)  +=              syncppp.o
 obj-$(CONFIG_X25_ASY)           += x25_asy.o
 
 obj-$(CONFIG_LANMEDIA)          += lmc/
diff --git a/drivers/net/wan/c101.c b/drivers/net/wan/c101.c
index c92ac9fde083..6b63b350cd52 100644
--- a/drivers/net/wan/c101.c
+++ b/drivers/net/wan/c101.c
@@ -116,27 +116,34 @@ static inline void openwin(card_t *card, u8 page)
 #include "hd6457x.c"
 
 
+static inline void set_carrier(port_t *port)
+{
+        if (!(sca_in(MSCI1_OFFSET + ST3, port) & ST3_DCD))
+                netif_carrier_on(port_to_dev(port));
+        else
+                netif_carrier_off(port_to_dev(port));
+}
+
+
 static void sca_msci_intr(port_t *port)
 {
-        struct net_device *dev = port_to_dev(port);
-        card_t* card = port_to_card(port);
-        u8 stat = sca_in(MSCI1_OFFSET + ST1, card); /* read MSCI ST1 status */
+        u8 stat = sca_in(MSCI0_OFFSET + ST1, port); /* read MSCI ST1 status */
 
-        /* Reset MSCI TX underrun status bit */
-        sca_out(stat & ST1_UDRN, MSCI0_OFFSET + ST1, card);
+        /* Reset MSCI TX underrun and CDCD (ignored) status bit */
+        sca_out(stat & (ST1_UDRN | ST1_CDCD), MSCI0_OFFSET + ST1, port);
 
         if (stat & ST1_UDRN) {
-                struct net_device_stats *stats = hdlc_stats(dev);
+                struct net_device_stats *stats = hdlc_stats(port_to_dev(port));
                 stats->tx_errors++; /* TX Underrun error detected */
                 stats->tx_fifo_errors++;
         }
 
+        stat = sca_in(MSCI1_OFFSET + ST1, port); /* read MSCI1 ST1 status */
         /* Reset MSCI CDCD status bit - uses ch#2 DCD input */
-        sca_out(stat & ST1_CDCD, MSCI1_OFFSET + ST1, card);
+        sca_out(stat & ST1_CDCD, MSCI1_OFFSET + ST1, port);
 
         if (stat & ST1_CDCD)
-                hdlc_set_carrier(!(sca_in(MSCI1_OFFSET + ST3, card) & ST3_DCD),
-                                 dev);
+                set_carrier(port);
 }
 
 
@@ -190,8 +197,7 @@ static int c101_open(struct net_device *dev)
         sca_out(IE1_UDRN, MSCI0_OFFSET + IE1, port);
         sca_out(IE0_TXINT, MSCI0_OFFSET + IE0, port);
 
-        hdlc_set_carrier(!(sca_in(MSCI1_OFFSET + ST3, port) & ST3_DCD), dev);
-        printk(KERN_DEBUG "0x%X\n", sca_in(MSCI1_OFFSET + ST3, port));
+        set_carrier(port);
 
         /* enable MSCI1 CDCD interrupt */
         sca_out(IE1_CDCD, MSCI1_OFFSET + IE1, port);
@@ -378,7 +384,7 @@ static int __init c101_run(unsigned long irq, unsigned long winbase)
         }
 
         sca_init_sync_port(card); /* Set up C101 memory */
-        hdlc_set_carrier(!(sca_in(MSCI1_OFFSET + ST3, card) & ST3_DCD), dev);
+        set_carrier(card);
 
         printk(KERN_INFO "%s: Moxa C101 on IRQ%u,"
                " using %u TX + %u RX packets rings\n",
@@ -443,4 +449,5 @@ module_exit(c101_cleanup);
 MODULE_AUTHOR("Krzysztof Halasa <khc@pm.waw.pl>");
 MODULE_DESCRIPTION("Moxa C101 serial port driver");
 MODULE_LICENSE("GPL v2");
-module_param(hw, charp, 0444);  /* hw=irq,ram:irq,... */
+module_param(hw, charp, 0444);
+MODULE_PARM_DESC(hw, "irq,ram:irq,...");
diff --git a/drivers/net/wan/hd6457x.c b/drivers/net/wan/hd6457x.c
index d3743321a977..dce2bb317b82 100644
--- a/drivers/net/wan/hd6457x.c
+++ b/drivers/net/wan/hd6457x.c
@@ -168,6 +168,23 @@ static inline u32 buffer_offset(port_t *port, u16 desc, int transmit)
 }
 
 
+static inline void sca_set_carrier(port_t *port)
+{
+        if (!(sca_in(get_msci(port) + ST3, port_to_card(port)) & ST3_DCD)) {
+#ifdef DEBUG_LINK
+                printk(KERN_DEBUG "%s: sca_set_carrier on\n",
+                       port_to_dev(port)->name);
+#endif
+                netif_carrier_on(port_to_dev(port));
+        } else {
+#ifdef DEBUG_LINK
+                printk(KERN_DEBUG "%s: sca_set_carrier off\n",
+                       port_to_dev(port)->name);
+#endif
+                netif_carrier_off(port_to_dev(port));
+        }
+}
+
 
 static void sca_init_sync_port(port_t *port)
 {
@@ -237,9 +254,7 @@ static void sca_init_sync_port(port_t *port)
                         sca_out(DIR_BOFE, DIR_TX(phy_node(port)), card);
                 }
         }
-
-        hdlc_set_carrier(!(sca_in(get_msci(port) + ST3, card) & ST3_DCD),
-                         port_to_dev(port));
+        sca_set_carrier(port);
 }
 
 
@@ -262,8 +277,7 @@ static inline void sca_msci_intr(port_t *port)
         }
 
         if (stat & ST1_CDCD)
-                hdlc_set_carrier(!(sca_in(msci + ST3, card) & ST3_DCD),
-                                 port_to_dev(port));
+                sca_set_carrier(port);
 }
 #endif
 
@@ -566,7 +580,7 @@ static void sca_open(struct net_device *dev)
    - all DMA interrupts
 */
 
-        hdlc_set_carrier(!(sca_in(msci + ST3, card) & ST3_DCD), dev);
+        sca_set_carrier(port);
 
 #ifdef __HD64570_H
         /* MSCI TX INT and RX INT A IRQ enable */
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index 1fd04662c4fc..f289daba0c7b 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -192,9 +192,7 @@ static int cisco_rx(struct sk_buff *skb)
                                                "uptime %ud%uh%um%us)\n",
                                                dev->name, days, hrs,
                                                min, sec);
-#if 0
-                                        netif_carrier_on(dev);
-#endif
+                                        netif_dormant_off(dev);
                                         hdlc->state.cisco.up = 1;
                                 }
                         }
@@ -227,9 +225,7 @@ static void cisco_timer(unsigned long arg)
                        hdlc->state.cisco.settings.timeout * HZ)) {
                 hdlc->state.cisco.up = 0;
                 printk(KERN_INFO "%s: Link down\n", dev->name);
-#if 0
-                netif_carrier_off(dev);
-#endif
+                netif_dormant_on(dev);
         }
 
         cisco_keepalive_send(dev, CISCO_KEEPALIVE_REQ,
@@ -265,10 +261,7 @@ static void cisco_stop(struct net_device *dev)
 {
         hdlc_device *hdlc = dev_to_hdlc(dev);
         del_timer_sync(&hdlc->state.cisco.timer);
-#if 0
-        if (netif_carrier_ok(dev))
-                netif_carrier_off(dev);
-#endif
+        netif_dormant_on(dev);
         hdlc->state.cisco.up = 0;
         hdlc->state.cisco.request_sent = 0;
 }
@@ -328,6 +321,7 @@ int hdlc_cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
                 dev->type = ARPHRD_CISCO;
                 dev->flags = IFF_POINTOPOINT | IFF_NOARP;
                 dev->addr_len = 0;
+                netif_dormant_on(dev);
                 return 0;
         }
 
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 523afe17564e..7bb737bbdeb9 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -301,7 +301,7 @@ static int pvc_open(struct net_device *dev)
         if (pvc->open_count++ == 0) {
                 hdlc_device *hdlc = dev_to_hdlc(pvc->master);
                 if (hdlc->state.fr.settings.lmi == LMI_NONE)
-                        pvc->state.active = hdlc->carrier;
+                        pvc->state.active = netif_carrier_ok(pvc->master);
 
                 pvc_carrier(pvc->state.active, pvc);
                 hdlc->state.fr.dce_changed = 1;
@@ -545,11 +545,7 @@ static void fr_set_link_state(int reliable, struct net_device *dev)
 
         hdlc->state.fr.reliable = reliable;
         if (reliable) {
-#if 0
-                if (!netif_carrier_ok(dev))
-                        netif_carrier_on(dev);
-#endif
-
+                netif_dormant_off(dev);
                 hdlc->state.fr.n391cnt = 0; /* Request full status */
                 hdlc->state.fr.dce_changed = 1;
 
@@ -562,11 +558,7 @@ static void fr_set_link_state(int reliable, struct net_device *dev)
                         }
                 }
         } else {
-#if 0
-                if (netif_carrier_ok(dev))
-                        netif_carrier_off(dev);
-#endif
-
+                netif_dormant_on(dev);
                 while (pvc) {           /* Deactivate all PVCs */
                         pvc_carrier(0, pvc);
                         pvc->state.exist = pvc->state.active = 0;
diff --git a/drivers/net/wan/hdlc_generic.c b/drivers/net/wan/hdlc_generic.c
index b7da55140fbd..04ca1f7b6424 100644
--- a/drivers/net/wan/hdlc_generic.c
+++ b/drivers/net/wan/hdlc_generic.c
@@ -34,10 +34,11 @@
 #include <linux/inetdevice.h>
 #include <linux/lapb.h>
 #include <linux/rtnetlink.h>
+#include <linux/notifier.h>
 #include <linux/hdlc.h>
 
 
-static const char* version = "HDLC support module revision 1.18";
+static const char* version = "HDLC support module revision 1.19";
 
 #undef DEBUG_LINK
 
@@ -73,57 +74,51 @@ static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
 
 
 
-static void __hdlc_set_carrier_on(struct net_device *dev)
+static inline void hdlc_proto_start(struct net_device *dev)
 {
         hdlc_device *hdlc = dev_to_hdlc(dev);
         if (hdlc->proto.start)
                 return hdlc->proto.start(dev);
-#if 0
-#ifdef DEBUG_LINK
-        if (netif_carrier_ok(dev))
-                printk(KERN_ERR "hdlc_set_carrier_on(): already on\n");
-#endif
-        netif_carrier_on(dev);
-#endif
 }
 
 
 
-static void __hdlc_set_carrier_off(struct net_device *dev)
+static inline void hdlc_proto_stop(struct net_device *dev)
 {
         hdlc_device *hdlc = dev_to_hdlc(dev);
         if (hdlc->proto.stop)
                 return hdlc->proto.stop(dev);
-
-#if 0
-#ifdef DEBUG_LINK
-        if (!netif_carrier_ok(dev))
-                printk(KERN_ERR "hdlc_set_carrier_off(): already off\n");
-#endif
-        netif_carrier_off(dev);
-#endif
 }
 
 
 
-void hdlc_set_carrier(int on, struct net_device *dev)
+static int hdlc_device_event(struct notifier_block *this, unsigned long event,
+                             void *ptr)
 {
-        hdlc_device *hdlc = dev_to_hdlc(dev);
+        struct net_device *dev = ptr;
+        hdlc_device *hdlc;
         unsigned long flags;
-        on = on ? 1 : 0;
+        int on;
+ 
+        if (dev->get_stats != hdlc_get_stats)
+                return NOTIFY_DONE; /* not an HDLC device */
+ 
+        if (event != NETDEV_CHANGE)
+                return NOTIFY_DONE; /* Only interrested in carrier changes */
+
+        on = netif_carrier_ok(dev);
 
 #ifdef DEBUG_LINK
-        printk(KERN_DEBUG "hdlc_set_carrier %i\n", on);
+        printk(KERN_DEBUG "%s: hdlc_device_event NETDEV_CHANGE, carrier %i\n",
+               dev->name, on);
 #endif
 
+        hdlc = dev_to_hdlc(dev);
         spin_lock_irqsave(&hdlc->state_lock, flags);
 
         if (hdlc->carrier == on)
                 goto carrier_exit; /* no change in DCD line level */
 
-#ifdef DEBUG_LINK
-        printk(KERN_INFO "%s: carrier %s\n", dev->name, on ? "ON" : "off");
-#endif
         hdlc->carrier = on;
 
         if (!hdlc->open)
@@ -131,14 +126,15 @@ void hdlc_set_carrier(int on, struct net_device *dev)
 
         if (hdlc->carrier) {
                 printk(KERN_INFO "%s: Carrier detected\n", dev->name);
-                __hdlc_set_carrier_on(dev);
+                hdlc_proto_start(dev);
         } else {
                 printk(KERN_INFO "%s: Carrier lost\n", dev->name);
-                __hdlc_set_carrier_off(dev);
+                hdlc_proto_stop(dev);
         }
 
 carrier_exit:
         spin_unlock_irqrestore(&hdlc->state_lock, flags);
+        return NOTIFY_DONE;
 }
 
 
@@ -165,7 +161,7 @@ int hdlc_open(struct net_device *dev)
 
         if (hdlc->carrier) {
                 printk(KERN_INFO "%s: Carrier detected\n", dev->name);
-                __hdlc_set_carrier_on(dev);
+                hdlc_proto_start(dev);
         } else
                 printk(KERN_INFO "%s: No carrier\n", dev->name);
 
@@ -190,7 +186,7 @@ void hdlc_close(struct net_device *dev)
 
         hdlc->open = 0;
         if (hdlc->carrier)
-                __hdlc_set_carrier_off(dev);
+                hdlc_proto_stop(dev);
 
         spin_unlock_irq(&hdlc->state_lock);
 
@@ -303,7 +299,6 @@ MODULE_LICENSE("GPL v2");
 
 EXPORT_SYMBOL(hdlc_open);
 EXPORT_SYMBOL(hdlc_close);
-EXPORT_SYMBOL(hdlc_set_carrier);
 EXPORT_SYMBOL(hdlc_ioctl);
 EXPORT_SYMBOL(hdlc_setup);
 EXPORT_SYMBOL(alloc_hdlcdev);
@@ -315,9 +310,18 @@ static struct packet_type hdlc_packet_type = {
 };
 
 
+static struct notifier_block hdlc_notifier = {
+        .notifier_call = hdlc_device_event,
+};
+
+
 static int __init hdlc_module_init(void)
 {
+        int result;
+
         printk(KERN_INFO "%s\n", version);
+        if ((result = register_netdevice_notifier(&hdlc_notifier)) != 0)
+                return result;
         dev_add_pack(&hdlc_packet_type);
         return 0;
 }
@@ -327,6 +331,7 @@ static int __init hdlc_module_init(void)
 static void __exit hdlc_module_exit(void)
 {
         dev_remove_pack(&hdlc_packet_type);
+        unregister_netdevice_notifier(&hdlc_notifier);
 }
 
 
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index b81263eaede0..fbaab5bf71eb 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -107,6 +107,7 @@ int hdlc_ppp_ioctl(struct net_device *dev, struct ifreq *ifr)
                 dev->hard_header = NULL;
                 dev->type = ARPHRD_PPP;
                 dev->addr_len = 0;
+                netif_dormant_off(dev);
                 return 0;
         }
 
diff --git a/drivers/net/wan/hdlc_raw.c b/drivers/net/wan/hdlc_raw.c
index 9456d31cb1c1..f15aa6ba77f1 100644
--- a/drivers/net/wan/hdlc_raw.c
+++ b/drivers/net/wan/hdlc_raw.c
@@ -82,6 +82,7 @@ int hdlc_raw_ioctl(struct net_device *dev, struct ifreq *ifr)
                 dev->type = ARPHRD_RAWHDLC;
                 dev->flags = IFF_POINTOPOINT | IFF_NOARP;
                 dev->addr_len = 0;
+                netif_dormant_off(dev);
                 return 0;
         }
 
diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
index b1285cc8fee6..d1884987f94e 100644
--- a/drivers/net/wan/hdlc_raw_eth.c
+++ b/drivers/net/wan/hdlc_raw_eth.c
@@ -100,6 +100,7 @@ int hdlc_raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
                 dev->tx_queue_len = old_qlen;
                 memcpy(dev->dev_addr, "\x00\x01", 2);
                 get_random_bytes(dev->dev_addr + 2, ETH_ALEN - 2);
+                netif_dormant_off(dev);
                 return 0;
         }
 
diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
index 07e5eef1fe0f..a867fb411f89 100644
--- a/drivers/net/wan/hdlc_x25.c
+++ b/drivers/net/wan/hdlc_x25.c
@@ -212,6 +212,7 @@ int hdlc_x25_ioctl(struct net_device *dev, struct ifreq *ifr)
                 dev->hard_header = NULL;
                 dev->type = ARPHRD_X25;
                 dev->addr_len = 0;
+                netif_dormant_off(dev);
                 return 0;
         }
 
diff --git a/drivers/net/wan/n2.c b/drivers/net/wan/n2.c
index e013b817cab8..dcf46add3adf 100644
--- a/drivers/net/wan/n2.c
+++ b/drivers/net/wan/n2.c
@@ -564,4 +564,5 @@ module_exit(n2_cleanup);
 MODULE_AUTHOR("Krzysztof Halasa <khc@pm.waw.pl>");
 MODULE_DESCRIPTION("RISCom/N2 serial port driver");
 MODULE_LICENSE("GPL v2");
-module_param(hw, charp, 0444);  /* hw=io,irq,ram,ports:io,irq,... */
+module_param(hw, charp, 0444);
+MODULE_PARM_DESC(hw, "io,irq,ram,ports:io,irq,...");
diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
index d564224cdca9..b2031dfc4bb1 100644
--- a/drivers/net/wan/wanxl.c
+++ b/drivers/net/wan/wanxl.c
@@ -149,7 +149,10 @@ static inline void wanxl_cable_intr(port_t *port)
         printk(KERN_INFO "%s: %s%s module, %s cable%s%s\n",
                port->dev->name, pm, dte, cable, dsr, dcd);
 
-        hdlc_set_carrier(value & STATUS_CABLE_DCD, port->dev);
+        if (value & STATUS_CABLE_DCD)
+                netif_carrier_on(port->dev);
+        else
+                netif_carrier_off(port->dev);
 }
 
 
diff --git a/drivers/net/wd.c b/drivers/net/wd.c
index 7caa8dc88a58..b1ba1872f315 100644
--- a/drivers/net/wd.c
+++ b/drivers/net/wd.c
@@ -500,8 +500,8 @@ MODULE_LICENSE("GPL");
 
 /* This is set up so that only a single autoprobe takes place per call.
 ISA device autoprobes on a running machine are not recommended. */
-int
-init_module(void)
+
+int __init init_module(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 30ec235e6935..2e8ac995d56f 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -447,6 +447,7 @@ config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
         depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
         select CRYPTO
+        select CRYPTO_AES
         ---help---
           This is the standard Linux driver to support Cisco/Aironet PCMCIA
           802.11 wireless cards.  This driver is the same as the Aironet
@@ -550,6 +551,7 @@ config USB_ZD1201
 
 source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/bcm43xx/Kconfig"
+source "drivers/net/wireless/zd1211rw/Kconfig"
 
 # yes, this works even when no drivers are selected
 config NET_WIRELESS
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 512603de309a..c613af17a159 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -36,6 +36,7 @@ obj-$(CONFIG_PRISM54)		+= prism54/
 
 obj-$(CONFIG_HOSTAP)            += hostap/
 obj-$(CONFIG_BCM43XX)           += bcm43xx/
+obj-$(CONFIG_ZD1211RW)          += zd1211rw/
 
 # 16-bit wireless PCMCIA client drivers
 obj-$(CONFIG_PCMCIA_RAYCS)      += ray_cs.o
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_ethtool.c b/drivers/net/wireless/bcm43xx/bcm43xx_ethtool.c
index b3ffcf501311..e386dcc32e8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_ethtool.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_ethtool.c
@@ -32,7 +32,7 @@
 #include <linux/netdevice.h>
 #include <linux/pci.h>
 #include <linux/string.h>
-#include <linux/version.h>
+#include <linux/utsrelease.h>
 
 
 static void bcm43xx_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index d8f5600578b4..df317c1e12a8 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm)
                 goto generate_new;
 
         /* Get the noise samples. */
-        assert(bcm->noisecalc.nr_samples <= 8);
+        assert(bcm->noisecalc.nr_samples < 8);
         i = bcm->noisecalc.nr_samples;
         noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
         noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
@@ -1885,6 +1885,15 @@ static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id, struct pt_re
 
         spin_lock(&bcm->irq_lock);
 
+        /* Only accept IRQs, if we are initialized properly.
+         * This avoids an RX race while initializing.
+         * We should probably not enable IRQs before we are initialized
+         * completely, but some careful work is needed to fix this. I think it
+         * is best to stay with this cheap workaround for now... .
+         */
+        if (unlikely(bcm43xx_status(bcm) != BCM43xx_STAT_INITIALIZED))
+                goto out;
+
         reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
         if (reason == 0xffffffff) {
                 /* irq not for us (shared irq) */
@@ -1906,19 +1915,11 @@ static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id, struct pt_re
 
         bcm43xx_interrupt_ack(bcm, reason);
 
-        /* Only accept IRQs, if we are initialized properly.
-         * This avoids an RX race while initializing.
-         * We should probably not enable IRQs before we are initialized
-         * completely, but some careful work is needed to fix this. I think it
-         * is best to stay with this cheap workaround for now... .
-         */
-        if (likely(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED)) {
-                /* disable all IRQs. They are enabled again in the bottom half. */
-                bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-                /* save the reason code and call our bottom half. */
-                bcm->irq_reason = reason;
-                tasklet_schedule(&bcm->isr_tasklet);
-        }
+        /* disable all IRQs. They are enabled again in the bottom half. */
+        bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+        /* save the reason code and call our bottom half. */
+        bcm->irq_reason = reason;
+        tasklet_schedule(&bcm->isr_tasklet);
 
 out:
         mmiowb();
@@ -3698,6 +3699,10 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
                 secinfo->encrypt = sec->encrypt;
                 dprintk(", .encrypt = %d", sec->encrypt);
         }
+        if (sec->flags & SEC_AUTH_MODE) {
+                secinfo->auth_mode = sec->auth_mode;
+                dprintk(", .auth_mode = %d", sec->auth_mode);
+        }
         dprintk("\n");
         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED &&
             !bcm->ieee->host_encrypt) {
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.h b/drivers/net/wireless/bcm43xx/bcm43xx_main.h
index 30a202b258b5..116493671f88 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.h
@@ -112,30 +112,6 @@ int bcm43xx_channel_to_freq(struct bcm43xx_private *bcm,
         return bcm43xx_channel_to_freq_bg(channel);
 }
 
-/* Lightweight function to check if a channel number is valid.
- * Note that this does _NOT_ check for geographical restrictions!
- */
-static inline
-int bcm43xx_is_valid_channel_a(u8 channel)
-{
-        return (channel >= IEEE80211_52GHZ_MIN_CHANNEL
-               && channel <= IEEE80211_52GHZ_MAX_CHANNEL);
-}
-static inline
-int bcm43xx_is_valid_channel_bg(u8 channel)
-{
-        return (channel >= IEEE80211_24GHZ_MIN_CHANNEL
-               && channel <= IEEE80211_24GHZ_MAX_CHANNEL);
-}
-static inline
-int bcm43xx_is_valid_channel(struct bcm43xx_private *bcm,
-                             u8 channel)
-{
-        if (bcm43xx_current_phy(bcm)->type == BCM43xx_PHYTYPE_A)
-                return bcm43xx_is_valid_channel_a(channel);
-        return bcm43xx_is_valid_channel_bg(channel);
-}
-
 void bcm43xx_tsf_read(struct bcm43xx_private *bcm, u64 *tsf);
 void bcm43xx_tsf_write(struct bcm43xx_private *bcm, u64 tsf);
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_radio.c b/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
index af5c0bff1696..bb9c484d7e19 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
@@ -1594,11 +1594,11 @@ int bcm43xx_radio_selectchannel(struct bcm43xx_private *bcm,
         u16 r8, tmp;
         u16 freq;
 
+        if (!ieee80211_is_valid_channel(bcm->ieee, channel))
+                return -EINVAL;
         if ((radio->manufact == 0x17F) &&
             (radio->version == 0x2060) &&
             (radio->revision == 1)) {
-                if (channel > 200)
-                        return -EINVAL;
                 freq = channel2freq_a(channel);
 
                 r8 = bcm43xx_radio_read16(bcm, 0x0008);
@@ -1651,9 +1651,6 @@ int bcm43xx_radio_selectchannel(struct bcm43xx_private *bcm,
                 TODO(); //TODO: TSSI2dbm workaround
                 bcm43xx_phy_xmitpower(bcm);//FIXME correct?
         } else {
-                if ((channel < 1) || (channel > 14))
-                        return -EINVAL;
-
                 if (synthetic_pu_workaround)
                         bcm43xx_synth_pu_workaround(bcm, channel);
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index c35cb3a0777e..5c36e29efff7 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -119,7 +119,7 @@ static int bcm43xx_wx_set_channelfreq(struct net_device *net_dev,
                 channel = bcm43xx_freq_to_channel(bcm, data->freq.m);
                 freq = data->freq.m;
         }
-        if (!bcm43xx_is_valid_channel(bcm, channel))
+        if (!ieee80211_is_valid_channel(bcm->ieee, channel))
                 goto out_unlock;
         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
                 //ieee80211softmac_disassoc(softmac, $REASON);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c b/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c
index d8ece28c079f..6dbd855b3647 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c
@@ -296,11 +296,14 @@ void bcm43xx_generate_txhdr(struct bcm43xx_private *bcm,
         u16 control = 0;
         u16 wsec_rate = 0;
         u16 encrypt_frame;
+        const u16 ftype = WLAN_FC_GET_TYPE(le16_to_cpu(wireless_header->frame_ctl));
+        const int is_mgt = (ftype == IEEE80211_FTYPE_MGMT);
 
         /* Now construct the TX header. */
         memset(txhdr, 0, sizeof(*txhdr));
 
-        bitrate = bcm->softmac->txrates.default_rate;
+        bitrate = ieee80211softmac_suggest_txrate(bcm->softmac,
+                is_multicast_ether_addr(wireless_header->addr1), is_mgt);
         ofdm_modulation = !(ieee80211_is_cck_rate(bitrate));
         fallback_bitrate = bcm43xx_calc_fallback_rate(bitrate);
         fallback_ofdm_modulation = !(ieee80211_is_cck_rate(fallback_bitrate));
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index b764cfda6e84..d500012fdc7a 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -1042,6 +1042,9 @@ static int prism2_reset_port(struct net_device *dev)
                        dev->name, local->fragm_threshold);
         }
 
+        /* Some firmwares lose antenna selection settings on reset */
+        (void) hostap_set_antsel(local);
+
         return res;
 }
 
@@ -3095,6 +3098,14 @@ static void prism2_clear_set_tim_queue(local_info_t *local)
 }
 
 
+/*
+ * HostAP uses two layers of net devices, where the inner
+ * layer gets called all the time from the outer layer.
+ * This is a natural nesting, which needs a split lock type.
+ */
+static struct lock_class_key hostap_netdev_xmit_lock_key;
+
+
 static struct net_device *
 prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
                        struct device *sdev)
@@ -3259,6 +3270,8 @@ while (0)
         SET_NETDEV_DEV(dev, sdev);
         if (ret >= 0)
                 ret = register_netdevice(dev);
+
+        lockdep_set_class(&dev->_xmit_lock, &hostap_netdev_xmit_lock_key);
         rtnl_unlock();
         if (ret < 0) {
                 printk(KERN_WARNING "%s: register netdevice failed!\n",
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index 49860fa61c30..6dfa041be66d 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -66,10 +66,12 @@ static struct pci_device_id prism2_plx_id_table[] __devinitdata = {
         PLXDEV(0x10b7, 0x7770, "3Com AirConnect PCI 777A"),
         PLXDEV(0x111a, 0x1023, "Siemens SpeedStream SS1023"),
         PLXDEV(0x126c, 0x8030, "Nortel emobility"),
+        PLXDEV(0x1562, 0x0001, "Symbol LA-4123"),
         PLXDEV(0x1385, 0x4100, "Netgear MA301"),
         PLXDEV(0x15e8, 0x0130, "National Datacomm NCP130 (PLX9052)"),
         PLXDEV(0x15e8, 0x0131, "National Datacomm NCP130 (TMD7160)"),
         PLXDEV(0x1638, 0x1100, "Eumitcom WL11000"),
+        PLXDEV(0x16ab, 0x1100, "Global Sun Tech GL24110P"),
         PLXDEV(0x16ab, 0x1101, "Global Sun Tech GL24110P (?)"),
         PLXDEV(0x16ab, 0x1102, "Linksys WPC11 with WDT11"),
         PLXDEV(0x16ab, 0x1103, "Longshine 8031"),
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index d6ed5781b93a..317ace7f9aae 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -2875,7 +2875,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
         if (orinoco_lock(priv, &flags) != 0)
                 return -EBUSY;
 
-        if (erq->pointer) {
+        if (erq->length > 0) {
                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
                         index = priv->tx_key;
 
@@ -2918,7 +2918,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
         if (erq->flags & IW_ENCODE_RESTRICTED)
                 restricted = 1;
 
-        if (erq->pointer) {
+        if (erq->pointer && erq->length > 0) {
                 priv->keys[index].len = cpu_to_le16(xlen);
                 memset(priv->keys[index].data, 0,
                        sizeof(priv->keys[index].data));
diff --git a/drivers/net/wireless/spectrum_cs.c b/drivers/net/wireless/spectrum_cs.c
index 15465278c789..bcc7038130f6 100644
--- a/drivers/net/wireless/spectrum_cs.c
+++ b/drivers/net/wireless/spectrum_cs.c
@@ -34,8 +34,6 @@
 
 #include "orinoco.h"
 
-static unsigned char *primsym;
-static unsigned char *secsym;
 static const char primary_fw_name[] = "symbol_sp24t_prim_fw";
 static const char secondary_fw_name[] = "symbol_sp24t_sec_fw";
 
@@ -244,7 +242,7 @@ spectrum_reset(struct pcmcia_device *link, int idle)
         u_int save_cor;
 
         /* Doing it if hardware is gone is guaranteed crash */
-        if (pcmcia_dev_present(link))
+        if (!pcmcia_dev_present(link))
                 return -ENODEV;
 
         /* Save original COR value */
@@ -440,7 +438,7 @@ spectrum_load_blocks(hermes_t *hw, const struct dblock *first_block)
  */
 static int
 spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
-                  const unsigned char *image)
+                  const unsigned char *image, int secondary)
 {
         int ret;
         const unsigned char *ptr;
@@ -455,7 +453,7 @@ spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
         first_block = (const struct dblock *) ptr;
 
         /* Read the PDA */
-        if (image != primsym) {
+        if (secondary) {
                 ret = spectrum_read_pda(hw, pda, sizeof(pda));
                 if (ret)
                         return ret;
@@ -472,7 +470,7 @@ spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
                 return ret;
 
         /* Write the PDA to the adapter */
-        if (image != primsym) {
+        if (secondary) {
                 ret = spectrum_apply_pda(hw, first_block, pda);
                 if (ret)
                         return ret;
@@ -487,7 +485,7 @@ spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
         ret = hermes_init(hw);
 
         /* hermes_reset() should return 0 with the secondary firmware */
-        if (image != primsym && ret != 0)
+        if (secondary && ret != 0)
                 return -ENODEV;
 
         /* And this should work with any firmware */
@@ -509,33 +507,30 @@ spectrum_dl_firmware(hermes_t *hw, struct pcmcia_device *link)
         const struct firmware *fw_entry;
 
         if (request_firmware(&fw_entry, primary_fw_name,
-                             &handle_to_dev(link)) == 0) {
-                primsym = fw_entry->data;
-        } else {
+                             &handle_to_dev(link)) != 0) {
                 printk(KERN_ERR PFX "Cannot find firmware: %s\n",
                        primary_fw_name);
                 return -ENOENT;
         }
 
-        if (request_firmware(&fw_entry, secondary_fw_name,
-                             &handle_to_dev(link)) == 0) {
-                secsym = fw_entry->data;
-        } else {
-                printk(KERN_ERR PFX "Cannot find firmware: %s\n",
-                       secondary_fw_name);
-                return -ENOENT;
-        }
-
         /* Load primary firmware */
-        ret = spectrum_dl_image(hw, link, primsym);
+        ret = spectrum_dl_image(hw, link, fw_entry->data, 0);
+        release_firmware(fw_entry);
         if (ret) {
                 printk(KERN_ERR PFX "Primary firmware download failed\n");
                 return ret;
         }
 
-        /* Load secondary firmware */
-        ret = spectrum_dl_image(hw, link, secsym);
+        if (request_firmware(&fw_entry, secondary_fw_name,
+                             &handle_to_dev(link)) != 0) {
+                printk(KERN_ERR PFX "Cannot find firmware: %s\n",
+                       secondary_fw_name);
+                return -ENOENT;
+        }
 
+        /* Load secondary firmware */
+        ret = spectrum_dl_image(hw, link, fw_entry->data, 1);
+        release_firmware(fw_entry);
         if (ret) {
                 printk(KERN_ERR PFX "Secondary firmware download failed\n");
         }
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index fd31885c6844..ccaf28e8db0a 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -467,6 +467,7 @@ static int arp_query(unsigned char *haddr, u32 paddr,
                      struct net_device *dev)
 {
         struct neighbour *neighbor_entry;
+        int ret = 0;
 
         neighbor_entry = neigh_lookup(&arp_tbl, &paddr, dev);
 
@@ -474,10 +475,11 @@ static int arp_query(unsigned char *haddr, u32 paddr,
                 neighbor_entry->used = jiffies;
                 if (neighbor_entry->nud_state & NUD_VALID) {
                         memcpy(haddr, neighbor_entry->ha, dev->addr_len);
-                        return 1;
+                        ret = 1;
                 }
+                neigh_release(neighbor_entry);
         }
-        return 0;
+        return ret;
 }
 
 static void DumpData(char *msg, struct strip *strip_info, __u8 * ptr,
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 662ecc8a33ff..c52e9bcf8d02 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -1820,6 +1820,8 @@ static int zd1201_probe(struct usb_interface *interface,
             zd->dev->name);
 
         usb_set_intfdata(interface, zd);
+        zd1201_enable(zd);      /* zd1201 likes to startup enabled, */
+        zd1201_disable(zd);     /* interfering with all the wifis in range */
         return 0;
 
 err_net:
diff --git a/drivers/net/wireless/zd1211rw/Kconfig b/drivers/net/wireless/zd1211rw/Kconfig
new file mode 100644
index 000000000000..66ed55bc5460
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/Kconfig
@@ -0,0 +1,19 @@
+config ZD1211RW
+        tristate "ZyDAS ZD1211/ZD1211B USB-wireless support"
+        depends on USB && IEEE80211 && IEEE80211_SOFTMAC && NET_RADIO && EXPERIMENTAL
+        select FW_LOADER
+        ---help---
+          This is an experimental driver for the ZyDAS ZD1211/ZD1211B wireless
+          chip, present in many USB-wireless adapters.
+
+          Device firmware is required alongside this driver. You can download the
+          firmware distribution from http://zd1211.ath.cx/get-firmware
+
+config ZD1211RW_DEBUG
+        bool "ZyDAS ZD1211 debugging"
+        depends on ZD1211RW
+        ---help---
+          ZD1211 debugging messages. Choosing Y will result in additional debug
+          messages being saved to your kernel logs, which may help debug any
+          problems.
+
diff --git a/drivers/net/wireless/zd1211rw/Makefile b/drivers/net/wireless/zd1211rw/Makefile
new file mode 100644
index 000000000000..500314fc74d2
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/Makefile
@@ -0,0 +1,11 @@
+obj-$(CONFIG_ZD1211RW) += zd1211rw.o
+
+zd1211rw-objs := zd_chip.o zd_ieee80211.o \
+                zd_mac.o zd_netdev.o \
+                zd_rf_al2230.o zd_rf_rf2959.o \
+                zd_rf.o zd_usb.o zd_util.o
+
+ifeq ($(CONFIG_ZD1211RW_DEBUG),y)
+EXTRA_CFLAGS += -DDEBUG
+endif
+
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
new file mode 100644
index 000000000000..aa792821854e
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -0,0 +1,1646 @@
+/* zd_chip.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+/* This file implements all the hardware specific functions for the ZD1211
+ * and ZD1211B chips. Support for the ZD1211B was possible after Timothy
+ * Legge sent me a ZD1211B device. Thank you Tim. -- Uli
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+
+#include "zd_def.h"
+#include "zd_chip.h"
+#include "zd_ieee80211.h"
+#include "zd_mac.h"
+#include "zd_rf.h"
+#include "zd_util.h"
+
+void zd_chip_init(struct zd_chip *chip,
+                 struct net_device *netdev,
+                 struct usb_interface *intf)
+{
+        memset(chip, 0, sizeof(*chip));
+        mutex_init(&chip->mutex);
+        zd_usb_init(&chip->usb, netdev, intf);
+        zd_rf_init(&chip->rf);
+}
+
+void zd_chip_clear(struct zd_chip *chip)
+{
+        mutex_lock(&chip->mutex);
+        zd_usb_clear(&chip->usb);
+        zd_rf_clear(&chip->rf);
+        mutex_unlock(&chip->mutex);
+        mutex_destroy(&chip->mutex);
+        memset(chip, 0, sizeof(*chip));
+}
+
+static int scnprint_mac_oui(const u8 *addr, char *buffer, size_t size)
+{
+        return scnprintf(buffer, size, "%02x-%02x-%02x",
+                         addr[0], addr[1], addr[2]);
+}
+
+/* Prints an identifier line, which will support debugging. */
+static int scnprint_id(struct zd_chip *chip, char *buffer, size_t size)
+{
+        int i = 0;
+
+        i = scnprintf(buffer, size, "zd1211%s chip ",
+                      chip->is_zd1211b ? "b" : "");
+        i += zd_usb_scnprint_id(&chip->usb, buffer+i, size-i);
+        i += scnprintf(buffer+i, size-i, " ");
+        i += scnprint_mac_oui(chip->e2p_mac, buffer+i, size-i);
+        i += scnprintf(buffer+i, size-i, " ");
+        i += zd_rf_scnprint_id(&chip->rf, buffer+i, size-i);
+        i += scnprintf(buffer+i, size-i, " pa%1x %c%c%c", chip->pa_type,
+                chip->patch_cck_gain ? 'g' : '-',
+                chip->patch_cr157 ? '7' : '-',
+                chip->patch_6m_band_edge ? '6' : '-');
+        return i;
+}
+
+static void print_id(struct zd_chip *chip)
+{
+        char buffer[80];
+
+        scnprint_id(chip, buffer, sizeof(buffer));
+        buffer[sizeof(buffer)-1] = 0;
+        dev_info(zd_chip_dev(chip), "%s\n", buffer);
+}
+
+/* Read a variable number of 32-bit values. Parameter count is not allowed to
+ * exceed USB_MAX_IOREAD32_COUNT.
+ */
+int zd_ioread32v_locked(struct zd_chip *chip, u32 *values, const zd_addr_t *addr,
+                 unsigned int count)
+{
+        int r;
+        int i;
+        zd_addr_t *a16 = (zd_addr_t *)NULL;
+        u16 *v16;
+        unsigned int count16;
+
+        if (count > USB_MAX_IOREAD32_COUNT)
+                return -EINVAL;
+
+        /* Allocate a single memory block for values and addresses. */
+        count16 = 2*count;
+        a16 = (zd_addr_t *)kmalloc(count16 * (sizeof(zd_addr_t) + sizeof(u16)),
+                                   GFP_NOFS);
+        if (!a16) {
+                dev_dbg_f(zd_chip_dev(chip),
+                          "error ENOMEM in allocation of a16\n");
+                r = -ENOMEM;
+                goto out;
+        }
+        v16 = (u16 *)(a16 + count16);
+
+        for (i = 0; i < count; i++) {
+                int j = 2*i;
+                /* We read the high word always first. */
+                a16[j] = zd_inc_word(addr[i]);
+                a16[j+1] = addr[i];
+        }
+
+        r = zd_ioread16v_locked(chip, v16, a16, count16);
+        if (r) {
+                dev_dbg_f(zd_chip_dev(chip),
+                          "error: zd_ioread16v_locked. Error number %d\n", r);
+                goto out;
+        }
+
+        for (i = 0; i < count; i++) {
+                int j = 2*i;
+                values[i] = (v16[j] << 16) | v16[j+1];
+        }
+
+out:
+        kfree((void *)a16);
+        return r;
+}
+
+int _zd_iowrite32v_locked(struct zd_chip *chip, const struct zd_ioreq32 *ioreqs,
+                   unsigned int count)
+{
+        int i, j, r;
+        struct zd_ioreq16 *ioreqs16;
+        unsigned int count16;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+
+        if (count == 0)
+                return 0;
+        if (count > USB_MAX_IOWRITE32_COUNT)
+                return -EINVAL;
+
+        /* Allocate a single memory block for values and addresses. */
+        count16 = 2*count;
+        ioreqs16 = kmalloc(count16 * sizeof(struct zd_ioreq16), GFP_NOFS);
+        if (!ioreqs16) {
+                r = -ENOMEM;
+                dev_dbg_f(zd_chip_dev(chip),
+                          "error %d in ioreqs16 allocation\n", r);
+                goto out;
+        }
+
+        for (i = 0; i < count; i++) {
+                j = 2*i;
+                /* We write the high word always first. */
+                ioreqs16[j].value   = ioreqs[i].value >> 16;
+                ioreqs16[j].addr    = zd_inc_word(ioreqs[i].addr);
+                ioreqs16[j+1].value = ioreqs[i].value;
+                ioreqs16[j+1].addr  = ioreqs[i].addr;
+        }
+
+        r = zd_usb_iowrite16v(&chip->usb, ioreqs16, count16);
+#ifdef DEBUG
+        if (r) {
+                dev_dbg_f(zd_chip_dev(chip),
+                          "error %d in zd_usb_write16v\n", r);
+        }
+#endif /* DEBUG */
+out:
+        kfree(ioreqs16);
+        return r;
+}
+
+int zd_iowrite16a_locked(struct zd_chip *chip,
+                  const struct zd_ioreq16 *ioreqs, unsigned int count)
+{
+        int r;
+        unsigned int i, j, t, max;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        for (i = 0; i < count; i += j + t) {
+                t = 0;
+                max = count-i;
+                if (max > USB_MAX_IOWRITE16_COUNT)
+                        max = USB_MAX_IOWRITE16_COUNT;
+                for (j = 0; j < max; j++) {
+                        if (!ioreqs[i+j].addr) {
+                                t = 1;
+                                break;
+                        }
+                }
+
+                r = zd_usb_iowrite16v(&chip->usb, &ioreqs[i], j);
+                if (r) {
+                        dev_dbg_f(zd_chip_dev(chip),
+                                  "error zd_usb_iowrite16v. Error number %d\n",
+                                  r);
+                        return r;
+                }
+        }
+
+        return 0;
+}
+
+/* Writes a variable number of 32 bit registers. The functions will split
+ * that in several USB requests. A split can be forced by inserting an IO
+ * request with an zero address field.
+ */
+int zd_iowrite32a_locked(struct zd_chip *chip,
+                  const struct zd_ioreq32 *ioreqs, unsigned int count)
+{
+        int r;
+        unsigned int i, j, t, max;
+
+        for (i = 0; i < count; i += j + t) {
+                t = 0;
+                max = count-i;
+                if (max > USB_MAX_IOWRITE32_COUNT)
+                        max = USB_MAX_IOWRITE32_COUNT;
+                for (j = 0; j < max; j++) {
+                        if (!ioreqs[i+j].addr) {
+                                t = 1;
+                                break;
+                        }
+                }
+
+                r = _zd_iowrite32v_locked(chip, &ioreqs[i], j);
+                if (r) {
+                        dev_dbg_f(zd_chip_dev(chip),
+                                "error _zd_iowrite32v_locked."
+                                " Error number %d\n", r);
+                        return r;
+                }
+        }
+
+        return 0;
+}
+
+int zd_ioread16(struct zd_chip *chip, zd_addr_t addr, u16 *value)
+{
+        int r;
+
+        ZD_ASSERT(!mutex_is_locked(&chip->mutex));
+        mutex_lock(&chip->mutex);
+        r = zd_ioread16_locked(chip, value, addr);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_ioread32(struct zd_chip *chip, zd_addr_t addr, u32 *value)
+{
+        int r;
+
+        ZD_ASSERT(!mutex_is_locked(&chip->mutex));
+        mutex_lock(&chip->mutex);
+        r = zd_ioread32_locked(chip, value, addr);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_iowrite16(struct zd_chip *chip, zd_addr_t addr, u16 value)
+{
+        int r;
+
+        ZD_ASSERT(!mutex_is_locked(&chip->mutex));
+        mutex_lock(&chip->mutex);
+        r = zd_iowrite16_locked(chip, value, addr);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_iowrite32(struct zd_chip *chip, zd_addr_t addr, u32 value)
+{
+        int r;
+
+        ZD_ASSERT(!mutex_is_locked(&chip->mutex));
+        mutex_lock(&chip->mutex);
+        r = zd_iowrite32_locked(chip, value, addr);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_ioread32v(struct zd_chip *chip, const zd_addr_t *addresses,
+                  u32 *values, unsigned int count)
+{
+        int r;
+
+        ZD_ASSERT(!mutex_is_locked(&chip->mutex));
+        mutex_lock(&chip->mutex);
+        r = zd_ioread32v_locked(chip, values, addresses, count);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_iowrite32a(struct zd_chip *chip, const struct zd_ioreq32 *ioreqs,
+                  unsigned int count)
+{
+        int r;
+
+        ZD_ASSERT(!mutex_is_locked(&chip->mutex));
+        mutex_lock(&chip->mutex);
+        r = zd_iowrite32a_locked(chip, ioreqs, count);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+static int read_pod(struct zd_chip *chip, u8 *rf_type)
+{
+        int r;
+        u32 value;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_ioread32_locked(chip, &value, E2P_POD);
+        if (r)
+                goto error;
+        dev_dbg_f(zd_chip_dev(chip), "E2P_POD %#010x\n", value);
+
+        /* FIXME: AL2230 handling (Bit 7 in POD) */
+        *rf_type = value & 0x0f;
+        chip->pa_type = (value >> 16) & 0x0f;
+        chip->patch_cck_gain = (value >> 8) & 0x1;
+        chip->patch_cr157 = (value >> 13) & 0x1;
+        chip->patch_6m_band_edge = (value >> 21) & 0x1;
+
+        dev_dbg_f(zd_chip_dev(chip),
+                "RF %s %#01x PA type %#01x patch CCK %d patch CR157 %d "
+                "patch 6M %d\n",
+                zd_rf_name(*rf_type), *rf_type,
+                chip->pa_type, chip->patch_cck_gain,
+                chip->patch_cr157, chip->patch_6m_band_edge);
+        return 0;
+error:
+        *rf_type = 0;
+        chip->pa_type = 0;
+        chip->patch_cck_gain = 0;
+        chip->patch_cr157 = 0;
+        chip->patch_6m_band_edge = 0;
+        return r;
+}
+
+static int _read_mac_addr(struct zd_chip *chip, u8 *mac_addr,
+                          const zd_addr_t *addr)
+{
+        int r;
+        u32 parts[2];
+
+        r = zd_ioread32v_locked(chip, parts, (const zd_addr_t *)addr, 2);
+        if (r) {
+                dev_dbg_f(zd_chip_dev(chip),
+                        "error: couldn't read e2p macs. Error number %d\n", r);
+                return r;
+        }
+
+        mac_addr[0] = parts[0];
+        mac_addr[1] = parts[0] >>  8;
+        mac_addr[2] = parts[0] >> 16;
+        mac_addr[3] = parts[0] >> 24;
+        mac_addr[4] = parts[1];
+        mac_addr[5] = parts[1] >>  8;
+
+        return 0;
+}
+
+static int read_e2p_mac_addr(struct zd_chip *chip)
+{
+        static const zd_addr_t addr[2] = { E2P_MAC_ADDR_P1, E2P_MAC_ADDR_P2 };
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        return _read_mac_addr(chip, chip->e2p_mac, (const zd_addr_t *)addr);
+}
+
+/* MAC address: if custom mac addresses are to to be used CR_MAC_ADDR_P1 and
+ *              CR_MAC_ADDR_P2 must be overwritten
+ */
+void zd_get_e2p_mac_addr(struct zd_chip *chip, u8 *mac_addr)
+{
+        mutex_lock(&chip->mutex);
+        memcpy(mac_addr, chip->e2p_mac, ETH_ALEN);
+        mutex_unlock(&chip->mutex);
+}
+
+static int read_mac_addr(struct zd_chip *chip, u8 *mac_addr)
+{
+        static const zd_addr_t addr[2] = { CR_MAC_ADDR_P1, CR_MAC_ADDR_P2 };
+        return _read_mac_addr(chip, mac_addr, (const zd_addr_t *)addr);
+}
+
+int zd_read_mac_addr(struct zd_chip *chip, u8 *mac_addr)
+{
+        int r;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+        mutex_lock(&chip->mutex);
+        r = read_mac_addr(chip, mac_addr);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_write_mac_addr(struct zd_chip *chip, const u8 *mac_addr)
+{
+        int r;
+        struct zd_ioreq32 reqs[2] = {
+                [0] = { .addr = CR_MAC_ADDR_P1 },
+                [1] = { .addr = CR_MAC_ADDR_P2 },
+        };
+
+        reqs[0].value = (mac_addr[3] << 24)
+                      | (mac_addr[2] << 16)
+                      | (mac_addr[1] <<  8)
+                      |  mac_addr[0];
+        reqs[1].value = (mac_addr[5] <<  8)
+                      |  mac_addr[4];
+
+        dev_dbg_f(zd_chip_dev(chip),
+                "mac addr " MAC_FMT "\n", MAC_ARG(mac_addr));
+
+        mutex_lock(&chip->mutex);
+        r = zd_iowrite32a_locked(chip, reqs, ARRAY_SIZE(reqs));
+#ifdef DEBUG
+        {
+                u8 tmp[ETH_ALEN];
+                read_mac_addr(chip, tmp);
+        }
+#endif /* DEBUG */
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_read_regdomain(struct zd_chip *chip, u8 *regdomain)
+{
+        int r;
+        u32 value;
+
+        mutex_lock(&chip->mutex);
+        r = zd_ioread32_locked(chip, &value, E2P_SUBID);
+        mutex_unlock(&chip->mutex);
+        if (r)
+                return r;
+
+        *regdomain = value >> 16;
+        dev_dbg_f(zd_chip_dev(chip), "regdomain: %#04x\n", *regdomain);
+
+        return 0;
+}
+
+static int read_values(struct zd_chip *chip, u8 *values, size_t count,
+                       zd_addr_t e2p_addr, u32 guard)
+{
+        int r;
+        int i;
+        u32 v;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        for (i = 0;;) {
+                r = zd_ioread32_locked(chip, &v, e2p_addr+i/2);
+                if (r)
+                        return r;
+                v -= guard;
+                if (i+4 < count) {
+                        values[i++] = v;
+                        values[i++] = v >>  8;
+                        values[i++] = v >> 16;
+                        values[i++] = v >> 24;
+                        continue;
+                }
+                for (;i < count; i++)
+                        values[i] = v >> (8*(i%3));
+                return 0;
+        }
+}
+
+static int read_pwr_cal_values(struct zd_chip *chip)
+{
+        return read_values(chip, chip->pwr_cal_values,
+                        E2P_CHANNEL_COUNT, E2P_PWR_CAL_VALUE1,
+                        0);
+}
+
+static int read_pwr_int_values(struct zd_chip *chip)
+{
+        return read_values(chip, chip->pwr_int_values,
+                        E2P_CHANNEL_COUNT, E2P_PWR_INT_VALUE1,
+                        E2P_PWR_INT_GUARD);
+}
+
+static int read_ofdm_cal_values(struct zd_chip *chip)
+{
+        int r;
+        int i;
+        static const zd_addr_t addresses[] = {
+                E2P_36M_CAL_VALUE1,
+                E2P_48M_CAL_VALUE1,
+                E2P_54M_CAL_VALUE1,
+        };
+
+        for (i = 0; i < 3; i++) {
+                r = read_values(chip, chip->ofdm_cal_values[i],
+                                E2P_CHANNEL_COUNT, addresses[i], 0);
+                if (r)
+                        return r;
+        }
+        return 0;
+}
+
+static int read_cal_int_tables(struct zd_chip *chip)
+{
+        int r;
+
+        r = read_pwr_cal_values(chip);
+        if (r)
+                return r;
+        r = read_pwr_int_values(chip);
+        if (r)
+                return r;
+        r = read_ofdm_cal_values(chip);
+        if (r)
+                return r;
+        return 0;
+}
+
+/* phy means physical registers */
+int zd_chip_lock_phy_regs(struct zd_chip *chip)
+{
+        int r;
+        u32 tmp;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_ioread32_locked(chip, &tmp, CR_REG1);
+        if (r) {
+                dev_err(zd_chip_dev(chip), "error ioread32(CR_REG1): %d\n", r);
+                return r;
+        }
+
+        dev_dbg_f(zd_chip_dev(chip),
+                "CR_REG1: 0x%02x -> 0x%02x\n", tmp, tmp & ~UNLOCK_PHY_REGS);
+        tmp &= ~UNLOCK_PHY_REGS;
+
+        r = zd_iowrite32_locked(chip, tmp, CR_REG1);
+        if (r)
+                dev_err(zd_chip_dev(chip), "error iowrite32(CR_REG1): %d\n", r);
+        return r;
+}
+
+int zd_chip_unlock_phy_regs(struct zd_chip *chip)
+{
+        int r;
+        u32 tmp;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_ioread32_locked(chip, &tmp, CR_REG1);
+        if (r) {
+                dev_err(zd_chip_dev(chip),
+                        "error ioread32(CR_REG1): %d\n", r);
+                return r;
+        }
+
+        dev_dbg_f(zd_chip_dev(chip),
+                "CR_REG1: 0x%02x -> 0x%02x\n", tmp, tmp | UNLOCK_PHY_REGS);
+        tmp |= UNLOCK_PHY_REGS;
+
+        r = zd_iowrite32_locked(chip, tmp, CR_REG1);
+        if (r)
+                dev_err(zd_chip_dev(chip), "error iowrite32(CR_REG1): %d\n", r);
+        return r;
+}
+
+/* CR157 can be optionally patched by the EEPROM */
+static int patch_cr157(struct zd_chip *chip)
+{
+        int r;
+        u32 value;
+
+        if (!chip->patch_cr157)
+                return 0;
+
+        r = zd_ioread32_locked(chip, &value, E2P_PHY_REG);
+        if (r)
+                return r;
+
+        dev_dbg_f(zd_chip_dev(chip), "patching value %x\n", value >> 8);
+        return zd_iowrite32_locked(chip, value >> 8, CR157);
+}
+
+/*
+ * 6M band edge can be optionally overwritten for certain RF's
+ * Vendor driver says: for FCC regulation, enabled per HWFeature 6M band edge
+ * bit (for AL2230, AL2230S)
+ */
+static int patch_6m_band_edge(struct zd_chip *chip, int channel)
+{
+        struct zd_ioreq16 ioreqs[] = {
+                { CR128, 0x14 }, { CR129, 0x12 }, { CR130, 0x10 },
+                { CR47,  0x1e },
+        };
+
+        if (!chip->patch_6m_band_edge || !chip->rf.patch_6m_band_edge)
+                return 0;
+
+        /* FIXME: Channel 11 is not the edge for all regulatory domains. */
+        if (channel == 1 || channel == 11)
+                ioreqs[0].value = 0x12;
+
+        dev_dbg_f(zd_chip_dev(chip), "patching for channel %d\n", channel);
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+static int zd1211_hw_reset_phy(struct zd_chip *chip)
+{
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR0,   0x0a }, { CR1,   0x06 }, { CR2,   0x26 },
+                { CR3,   0x38 }, { CR4,   0x80 }, { CR9,   0xa0 },
+                { CR10,  0x81 }, { CR11,  0x00 }, { CR12,  0x7f },
+                { CR13,  0x8c }, { CR14,  0x80 }, { CR15,  0x3d },
+                { CR16,  0x20 }, { CR17,  0x1e }, { CR18,  0x0a },
+                { CR19,  0x48 }, { CR20,  0x0c }, { CR21,  0x0c },
+                { CR22,  0x23 }, { CR23,  0x90 }, { CR24,  0x14 },
+                { CR25,  0x40 }, { CR26,  0x10 }, { CR27,  0x19 },
+                { CR28,  0x7f }, { CR29,  0x80 }, { CR30,  0x4b },
+                { CR31,  0x60 }, { CR32,  0x43 }, { CR33,  0x08 },
+                { CR34,  0x06 }, { CR35,  0x0a }, { CR36,  0x00 },
+                { CR37,  0x00 }, { CR38,  0x38 }, { CR39,  0x0c },
+                { CR40,  0x84 }, { CR41,  0x2a }, { CR42,  0x80 },
+                { CR43,  0x10 }, { CR44,  0x12 }, { CR46,  0xff },
+                { CR47,  0x1E }, { CR48,  0x26 }, { CR49,  0x5b },
+                { CR64,  0xd0 }, { CR65,  0x04 }, { CR66,  0x58 },
+                { CR67,  0xc9 }, { CR68,  0x88 }, { CR69,  0x41 },
+                { CR70,  0x23 }, { CR71,  0x10 }, { CR72,  0xff },
+                { CR73,  0x32 }, { CR74,  0x30 }, { CR75,  0x65 },
+                { CR76,  0x41 }, { CR77,  0x1b }, { CR78,  0x30 },
+                { CR79,  0x68 }, { CR80,  0x64 }, { CR81,  0x64 },
+                { CR82,  0x00 }, { CR83,  0x00 }, { CR84,  0x00 },
+                { CR85,  0x02 }, { CR86,  0x00 }, { CR87,  0x00 },
+                { CR88,  0xff }, { CR89,  0xfc }, { CR90,  0x00 },
+                { CR91,  0x00 }, { CR92,  0x00 }, { CR93,  0x08 },
+                { CR94,  0x00 }, { CR95,  0x00 }, { CR96,  0xff },
+                { CR97,  0xe7 }, { CR98,  0x00 }, { CR99,  0x00 },
+                { CR100, 0x00 }, { CR101, 0xae }, { CR102, 0x02 },
+                { CR103, 0x00 }, { CR104, 0x03 }, { CR105, 0x65 },
+                { CR106, 0x04 }, { CR107, 0x00 }, { CR108, 0x0a },
+                { CR109, 0xaa }, { CR110, 0xaa }, { CR111, 0x25 },
+                { CR112, 0x25 }, { CR113, 0x00 }, { CR119, 0x1e },
+                { CR125, 0x90 }, { CR126, 0x00 }, { CR127, 0x00 },
+                { },
+                { CR5,   0x00 }, { CR6,   0x00 }, { CR7,   0x00 },
+                { CR8,   0x00 }, { CR9,   0x20 }, { CR12,  0xf0 },
+                { CR20,  0x0e }, { CR21,  0x0e }, { CR27,  0x10 },
+                { CR44,  0x33 }, { CR47,  0x1E }, { CR83,  0x24 },
+                { CR84,  0x04 }, { CR85,  0x00 }, { CR86,  0x0C },
+                { CR87,  0x12 }, { CR88,  0x0C }, { CR89,  0x00 },
+                { CR90,  0x10 }, { CR91,  0x08 }, { CR93,  0x00 },
+                { CR94,  0x01 }, { CR95,  0x00 }, { CR96,  0x50 },
+                { CR97,  0x37 }, { CR98,  0x35 }, { CR101, 0x13 },
+                { CR102, 0x27 }, { CR103, 0x27 }, { CR104, 0x18 },
+                { CR105, 0x12 }, { CR109, 0x27 }, { CR110, 0x27 },
+                { CR111, 0x27 }, { CR112, 0x27 }, { CR113, 0x27 },
+                { CR114, 0x27 }, { CR115, 0x26 }, { CR116, 0x24 },
+                { CR117, 0xfc }, { CR118, 0xfa }, { CR120, 0x4f },
+                { CR123, 0x27 }, { CR125, 0xaa }, { CR127, 0x03 },
+                { CR128, 0x14 }, { CR129, 0x12 }, { CR130, 0x10 },
+                { CR131, 0x0C }, { CR136, 0xdf }, { CR137, 0x40 },
+                { CR138, 0xa0 }, { CR139, 0xb0 }, { CR140, 0x99 },
+                { CR141, 0x82 }, { CR142, 0x54 }, { CR143, 0x1c },
+                { CR144, 0x6c }, { CR147, 0x07 }, { CR148, 0x4c },
+                { CR149, 0x50 }, { CR150, 0x0e }, { CR151, 0x18 },
+                { CR160, 0xfe }, { CR161, 0xee }, { CR162, 0xaa },
+                { CR163, 0xfa }, { CR164, 0xfa }, { CR165, 0xea },
+                { CR166, 0xbe }, { CR167, 0xbe }, { CR168, 0x6a },
+                { CR169, 0xba }, { CR170, 0xba }, { CR171, 0xba },
+                /* Note: CR204 must lead the CR203 */
+                { CR204, 0x7d },
+                { },
+                { CR203, 0x30 },
+        };
+
+        int r, t;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+
+        r = zd_chip_lock_phy_regs(chip);
+        if (r)
+                goto out;
+
+        r = zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+        if (r)
+                goto unlock;
+
+        r = patch_cr157(chip);
+unlock:
+        t = zd_chip_unlock_phy_regs(chip);
+        if (t && !r)
+                r = t;
+out:
+        return r;
+}
+
+static int zd1211b_hw_reset_phy(struct zd_chip *chip)
+{
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR0,   0x14 }, { CR1,   0x06 }, { CR2,   0x26 },
+                { CR3,   0x38 }, { CR4,   0x80 }, { CR9,   0xe0 },
+                { CR10,  0x81 },
+                /* power control { { CR11,  1 << 6 }, */
+                { CR11,  0x00 },
+                { CR12,  0xf0 }, { CR13,  0x8c }, { CR14,  0x80 },
+                { CR15,  0x3d }, { CR16,  0x20 }, { CR17,  0x1e },
+                { CR18,  0x0a }, { CR19,  0x48 },
+                { CR20,  0x10 }, /* Org:0x0E, ComTrend:RalLink AP */
+                { CR21,  0x0e }, { CR22,  0x23 }, { CR23,  0x90 },
+                { CR24,  0x14 }, { CR25,  0x40 }, { CR26,  0x10 },
+                { CR27,  0x10 }, { CR28,  0x7f }, { CR29,  0x80 },
+                { CR30,  0x49 }, /* jointly decoder, no ASIC */
+                { CR31,  0x60 }, { CR32,  0x43 }, { CR33,  0x08 },
+                { CR34,  0x06 }, { CR35,  0x0a }, { CR36,  0x00 },
+                { CR37,  0x00 }, { CR38,  0x38 }, { CR39,  0x0c },
+                { CR40,  0x84 }, { CR41,  0x2a }, { CR42,  0x80 },
+                { CR43,  0x10 }, { CR44,  0x33 }, { CR46,  0xff },
+                { CR47,  0x1E }, { CR48,  0x26 }, { CR49,  0x5b },
+                { CR64,  0xd0 }, { CR65,  0x04 }, { CR66,  0x58 },
+                { CR67,  0xc9 }, { CR68,  0x88 }, { CR69,  0x41 },
+                { CR70,  0x23 }, { CR71,  0x10 }, { CR72,  0xff },
+                { CR73,  0x32 }, { CR74,  0x30 }, { CR75,  0x65 },
+                { CR76,  0x41 }, { CR77,  0x1b }, { CR78,  0x30 },
+                { CR79,  0xf0 }, { CR80,  0x64 }, { CR81,  0x64 },
+                { CR82,  0x00 }, { CR83,  0x24 }, { CR84,  0x04 },
+                { CR85,  0x00 }, { CR86,  0x0c }, { CR87,  0x12 },
+                { CR88,  0x0c }, { CR89,  0x00 }, { CR90,  0x58 },
+                { CR91,  0x04 }, { CR92,  0x00 }, { CR93,  0x00 },
+                { CR94,  0x01 },
+                { CR95,  0x20 }, /* ZD1211B */
+                { CR96,  0x50 }, { CR97,  0x37 }, { CR98,  0x35 },
+                { CR99,  0x00 }, { CR100, 0x01 }, { CR101, 0x13 },
+                { CR102, 0x27 }, { CR103, 0x27 }, { CR104, 0x18 },
+                { CR105, 0x12 }, { CR106, 0x04 }, { CR107, 0x00 },
+                { CR108, 0x0a }, { CR109, 0x27 }, { CR110, 0x27 },
+                { CR111, 0x27 }, { CR112, 0x27 }, { CR113, 0x27 },
+                { CR114, 0x27 }, { CR115, 0x26 }, { CR116, 0x24 },
+                { CR117, 0xfc }, { CR118, 0xfa }, { CR119, 0x1e },
+                { CR125, 0x90 }, { CR126, 0x00 }, { CR127, 0x00 },
+                { CR128, 0x14 }, { CR129, 0x12 }, { CR130, 0x10 },
+                { CR131, 0x0c }, { CR136, 0xdf }, { CR137, 0xa0 },
+                { CR138, 0xa8 }, { CR139, 0xb4 }, { CR140, 0x98 },
+                { CR141, 0x82 }, { CR142, 0x53 }, { CR143, 0x1c },
+                { CR144, 0x6c }, { CR147, 0x07 }, { CR148, 0x40 },
+                { CR149, 0x40 }, /* Org:0x50 ComTrend:RalLink AP */
+                { CR150, 0x14 }, /* Org:0x0E ComTrend:RalLink AP */
+                { CR151, 0x18 }, { CR159, 0x70 }, { CR160, 0xfe },
+                { CR161, 0xee }, { CR162, 0xaa }, { CR163, 0xfa },
+                { CR164, 0xfa }, { CR165, 0xea }, { CR166, 0xbe },
+                { CR167, 0xbe }, { CR168, 0x6a }, { CR169, 0xba },
+                { CR170, 0xba }, { CR171, 0xba },
+                /* Note: CR204 must lead the CR203 */
+                { CR204, 0x7d },
+                {},
+                { CR203, 0x30 },
+        };
+
+        int r, t;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+
+        r = zd_chip_lock_phy_regs(chip);
+        if (r)
+                goto out;
+
+        r = zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+        if (r)
+                goto unlock;
+
+        r = patch_cr157(chip);
+unlock:
+        t = zd_chip_unlock_phy_regs(chip);
+        if (t && !r)
+                r = t;
+out:
+        return r;
+}
+
+static int hw_reset_phy(struct zd_chip *chip)
+{
+        return chip->is_zd1211b ? zd1211b_hw_reset_phy(chip) :
+                                  zd1211_hw_reset_phy(chip);
+}
+
+static int zd1211_hw_init_hmac(struct zd_chip *chip)
+{
+        static const struct zd_ioreq32 ioreqs[] = {
+                { CR_ACK_TIMEOUT_EXT,           0x20 },
+                { CR_ADDA_MBIAS_WARMTIME,       0x30000808 },
+                { CR_ZD1211_RETRY_MAX,          0x2 },
+                { CR_SNIFFER_ON,                0 },
+                { CR_RX_FILTER,                 STA_RX_FILTER },
+                { CR_GROUP_HASH_P1,             0x00 },
+                { CR_GROUP_HASH_P2,             0x80000000 },
+                { CR_REG1,                      0xa4 },
+                { CR_ADDA_PWR_DWN,              0x7f },
+                { CR_BCN_PLCP_CFG,              0x00f00401 },
+                { CR_PHY_DELAY,                 0x00 },
+                { CR_ACK_TIMEOUT_EXT,           0x80 },
+                { CR_ADDA_PWR_DWN,              0x00 },
+                { CR_ACK_TIME_80211,            0x100 },
+                { CR_IFS_VALUE,                 0x547c032 },
+                { CR_RX_PE_DELAY,               0x70 },
+                { CR_PS_CTRL,                   0x10000000 },
+                { CR_RTS_CTS_RATE,              0x02030203 },
+                { CR_RX_THRESHOLD,              0x000c0640 },
+                { CR_AFTER_PNP,                 0x1 },
+                { CR_WEP_PROTECT,               0x114 },
+        };
+
+        int r;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_iowrite32a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+#ifdef DEBUG
+        if (r) {
+                dev_err(zd_chip_dev(chip),
+                        "error in zd_iowrite32a_locked. Error number %d\n", r);
+        }
+#endif /* DEBUG */
+        return r;
+}
+
+static int zd1211b_hw_init_hmac(struct zd_chip *chip)
+{
+        static const struct zd_ioreq32 ioreqs[] = {
+                { CR_ACK_TIMEOUT_EXT,           0x20 },
+                { CR_ADDA_MBIAS_WARMTIME,       0x30000808 },
+                { CR_ZD1211B_RETRY_MAX,         0x02020202 },
+                { CR_ZD1211B_TX_PWR_CTL4,       0x007f003f },
+                { CR_ZD1211B_TX_PWR_CTL3,       0x007f003f },
+                { CR_ZD1211B_TX_PWR_CTL2,       0x003f001f },
+                { CR_ZD1211B_TX_PWR_CTL1,       0x001f000f },
+                { CR_ZD1211B_AIFS_CTL1,         0x00280028 },
+                { CR_ZD1211B_AIFS_CTL2,         0x008C003C },
+                { CR_ZD1211B_TXOP,              0x01800824 },
+                { CR_SNIFFER_ON,                0 },
+                { CR_RX_FILTER,                 STA_RX_FILTER },
+                { CR_GROUP_HASH_P1,             0x00 },
+                { CR_GROUP_HASH_P2,             0x80000000 },
+                { CR_REG1,                      0xa4 },
+                { CR_ADDA_PWR_DWN,              0x7f },
+                { CR_BCN_PLCP_CFG,              0x00f00401 },
+                { CR_PHY_DELAY,                 0x00 },
+                { CR_ACK_TIMEOUT_EXT,           0x80 },
+                { CR_ADDA_PWR_DWN,              0x00 },
+                { CR_ACK_TIME_80211,            0x100 },
+                { CR_IFS_VALUE,                 0x547c032 },
+                { CR_RX_PE_DELAY,               0x70 },
+                { CR_PS_CTRL,                   0x10000000 },
+                { CR_RTS_CTS_RATE,              0x02030203 },
+                { CR_RX_THRESHOLD,              0x000c0640 },
+                { CR_AFTER_PNP,                 0x1 },
+                { CR_WEP_PROTECT,               0x114 },
+        };
+
+        int r;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_iowrite32a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+        if (r) {
+                dev_dbg_f(zd_chip_dev(chip),
+                        "error in zd_iowrite32a_locked. Error number %d\n", r);
+        }
+        return r;
+}
+
+static int hw_init_hmac(struct zd_chip *chip)
+{
+        return chip->is_zd1211b ?
+                zd1211b_hw_init_hmac(chip) : zd1211_hw_init_hmac(chip);
+}
+
+struct aw_pt_bi {
+        u32 atim_wnd_period;
+        u32 pre_tbtt;
+        u32 beacon_interval;
+};
+
+static int get_aw_pt_bi(struct zd_chip *chip, struct aw_pt_bi *s)
+{
+        int r;
+        static const zd_addr_t aw_pt_bi_addr[] =
+                { CR_ATIM_WND_PERIOD, CR_PRE_TBTT, CR_BCN_INTERVAL };
+        u32 values[3];
+
+        r = zd_ioread32v_locked(chip, values, (const zd_addr_t *)aw_pt_bi_addr,
+                         ARRAY_SIZE(aw_pt_bi_addr));
+        if (r) {
+                memset(s, 0, sizeof(*s));
+                return r;
+        }
+
+        s->atim_wnd_period = values[0];
+        s->pre_tbtt = values[1];
+        s->beacon_interval = values[2];
+        dev_dbg_f(zd_chip_dev(chip), "aw %u pt %u bi %u\n",
+                s->atim_wnd_period, s->pre_tbtt, s->beacon_interval);
+        return 0;
+}
+
+static int set_aw_pt_bi(struct zd_chip *chip, struct aw_pt_bi *s)
+{
+        struct zd_ioreq32 reqs[3];
+
+        if (s->beacon_interval <= 5)
+                s->beacon_interval = 5;
+        if (s->pre_tbtt < 4 || s->pre_tbtt >= s->beacon_interval)
+                s->pre_tbtt = s->beacon_interval - 1;
+        if (s->atim_wnd_period >= s->pre_tbtt)
+                s->atim_wnd_period = s->pre_tbtt - 1;
+
+        reqs[0].addr = CR_ATIM_WND_PERIOD;
+        reqs[0].value = s->atim_wnd_period;
+        reqs[1].addr = CR_PRE_TBTT;
+        reqs[1].value = s->pre_tbtt;
+        reqs[2].addr = CR_BCN_INTERVAL;
+        reqs[2].value = s->beacon_interval;
+
+        dev_dbg_f(zd_chip_dev(chip),
+                "aw %u pt %u bi %u\n", s->atim_wnd_period, s->pre_tbtt,
+                                       s->beacon_interval);
+        return zd_iowrite32a_locked(chip, reqs, ARRAY_SIZE(reqs));
+}
+
+
+static int set_beacon_interval(struct zd_chip *chip, u32 interval)
+{
+        int r;
+        struct aw_pt_bi s;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = get_aw_pt_bi(chip, &s);
+        if (r)
+                return r;
+        s.beacon_interval = interval;
+        return set_aw_pt_bi(chip, &s);
+}
+
+int zd_set_beacon_interval(struct zd_chip *chip, u32 interval)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = set_beacon_interval(chip, interval);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+static int hw_init(struct zd_chip *chip)
+{
+        int r;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = hw_reset_phy(chip);
+        if (r)
+                return r;
+
+        r = hw_init_hmac(chip);
+        if (r)
+                return r;
+        r = set_beacon_interval(chip, 100);
+        if (r)
+                return r;
+        return 0;
+}
+
+#ifdef DEBUG
+static int dump_cr(struct zd_chip *chip, const zd_addr_t addr,
+                   const char *addr_string)
+{
+        int r;
+        u32 value;
+
+        r = zd_ioread32_locked(chip, &value, addr);
+        if (r) {
+                dev_dbg_f(zd_chip_dev(chip),
+                        "error reading %s. Error number %d\n", addr_string, r);
+                return r;
+        }
+
+        dev_dbg_f(zd_chip_dev(chip), "%s %#010x\n",
+                addr_string, (unsigned int)value);
+        return 0;
+}
+
+static int test_init(struct zd_chip *chip)
+{
+        int r;
+
+        r = dump_cr(chip, CR_AFTER_PNP, "CR_AFTER_PNP");
+        if (r)
+                return r;
+        r = dump_cr(chip, CR_GPI_EN, "CR_GPI_EN");
+        if (r)
+                return r;
+        return dump_cr(chip, CR_INTERRUPT, "CR_INTERRUPT");
+}
+
+static void dump_fw_registers(struct zd_chip *chip)
+{
+        static const zd_addr_t addr[4] = {
+                FW_FIRMWARE_VER, FW_USB_SPEED, FW_FIX_TX_RATE,
+                FW_LINK_STATUS
+        };
+
+        int r;
+        u16 values[4];
+
+        r = zd_ioread16v_locked(chip, values, (const zd_addr_t*)addr,
+                         ARRAY_SIZE(addr));
+        if (r) {
+                dev_dbg_f(zd_chip_dev(chip), "error %d zd_ioread16v_locked\n",
+                         r);
+                return;
+        }
+
+        dev_dbg_f(zd_chip_dev(chip), "FW_FIRMWARE_VER %#06hx\n", values[0]);
+        dev_dbg_f(zd_chip_dev(chip), "FW_USB_SPEED %#06hx\n", values[1]);
+        dev_dbg_f(zd_chip_dev(chip), "FW_FIX_TX_RATE %#06hx\n", values[2]);
+        dev_dbg_f(zd_chip_dev(chip), "FW_LINK_STATUS %#06hx\n", values[3]);
+}
+#endif /* DEBUG */
+
+static int print_fw_version(struct zd_chip *chip)
+{
+        int r;
+        u16 version;
+
+        r = zd_ioread16_locked(chip, &version, FW_FIRMWARE_VER);
+        if (r)
+                return r;
+
+        dev_info(zd_chip_dev(chip),"firmware version %04hx\n", version);
+        return 0;
+}
+
+static int set_mandatory_rates(struct zd_chip *chip, enum ieee80211_std std)
+{
+        u32 rates;
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        /* This sets the mandatory rates, which only depend from the standard
+         * that the device is supporting. Until further notice we should try
+         * to support 802.11g also for full speed USB.
+         */
+        switch (std) {
+        case IEEE80211B:
+                rates = CR_RATE_1M|CR_RATE_2M|CR_RATE_5_5M|CR_RATE_11M;
+                break;
+        case IEEE80211G:
+                rates = CR_RATE_1M|CR_RATE_2M|CR_RATE_5_5M|CR_RATE_11M|
+                        CR_RATE_6M|CR_RATE_12M|CR_RATE_24M;
+                break;
+        default:
+                return -EINVAL;
+        }
+        return zd_iowrite32_locked(chip, rates, CR_MANDATORY_RATE_TBL);
+}
+
+int zd_chip_enable_hwint(struct zd_chip *chip)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = zd_iowrite32_locked(chip, HWINT_ENABLED, CR_INTERRUPT);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+static int disable_hwint(struct zd_chip *chip)
+{
+        return zd_iowrite32_locked(chip, HWINT_DISABLED, CR_INTERRUPT);
+}
+
+int zd_chip_disable_hwint(struct zd_chip *chip)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = disable_hwint(chip);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_chip_init_hw(struct zd_chip *chip, u8 device_type)
+{
+        int r;
+        u8 rf_type;
+
+        dev_dbg_f(zd_chip_dev(chip), "\n");
+
+        mutex_lock(&chip->mutex);
+        chip->is_zd1211b = (device_type == DEVICE_ZD1211B) != 0;
+
+#ifdef DEBUG
+        r = test_init(chip);
+        if (r)
+                goto out;
+#endif
+        r = zd_iowrite32_locked(chip, 1, CR_AFTER_PNP);
+        if (r)
+                goto out;
+
+        r = zd_usb_init_hw(&chip->usb);
+        if (r)
+                goto out;
+
+        /* GPI is always disabled, also in the other driver.
+         */
+        r = zd_iowrite32_locked(chip, 0, CR_GPI_EN);
+        if (r)
+                goto out;
+        r = zd_iowrite32_locked(chip, CWIN_SIZE, CR_CWMIN_CWMAX);
+        if (r)
+                goto out;
+        /* Currently we support IEEE 802.11g for full and high speed USB.
+         * It might be discussed, whether we should suppport pure b mode for
+         * full speed USB.
+         */
+        r = set_mandatory_rates(chip, IEEE80211G);
+        if (r)
+                goto out;
+        /* Disabling interrupts is certainly a smart thing here.
+         */
+        r = disable_hwint(chip);
+        if (r)
+                goto out;
+        r = read_pod(chip, &rf_type);
+        if (r)
+                goto out;
+        r = hw_init(chip);
+        if (r)
+                goto out;
+        r = zd_rf_init_hw(&chip->rf, rf_type);
+        if (r)
+                goto out;
+
+        r = print_fw_version(chip);
+        if (r)
+                goto out;
+
+#ifdef DEBUG
+        dump_fw_registers(chip);
+        r = test_init(chip);
+        if (r)
+                goto out;
+#endif /* DEBUG */
+
+        r = read_e2p_mac_addr(chip);
+        if (r)
+                goto out;
+
+        r = read_cal_int_tables(chip);
+        if (r)
+                goto out;
+
+        print_id(chip);
+out:
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+static int update_pwr_int(struct zd_chip *chip, u8 channel)
+{
+        u8 value = chip->pwr_int_values[channel - 1];
+        dev_dbg_f(zd_chip_dev(chip), "channel %d pwr_int %#04x\n",
+                 channel, value);
+        return zd_iowrite32_locked(chip, value, CR31);
+}
+
+static int update_pwr_cal(struct zd_chip *chip, u8 channel)
+{
+        u8 value = chip->pwr_cal_values[channel-1];
+        dev_dbg_f(zd_chip_dev(chip), "channel %d pwr_cal %#04x\n",
+                 channel, value);
+        return zd_iowrite32_locked(chip, value, CR68);
+}
+
+static int update_ofdm_cal(struct zd_chip *chip, u8 channel)
+{
+        struct zd_ioreq32 ioreqs[3];
+
+        ioreqs[0].addr = CR67;
+        ioreqs[0].value = chip->ofdm_cal_values[OFDM_36M_INDEX][channel-1];
+        ioreqs[1].addr = CR66;
+        ioreqs[1].value = chip->ofdm_cal_values[OFDM_48M_INDEX][channel-1];
+        ioreqs[2].addr = CR65;
+        ioreqs[2].value = chip->ofdm_cal_values[OFDM_54M_INDEX][channel-1];
+
+        dev_dbg_f(zd_chip_dev(chip),
+                "channel %d ofdm_cal 36M %#04x 48M %#04x 54M %#04x\n",
+                channel, ioreqs[0].value, ioreqs[1].value, ioreqs[2].value);
+        return zd_iowrite32a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+static int update_channel_integration_and_calibration(struct zd_chip *chip,
+                                                      u8 channel)
+{
+        int r;
+
+        r = update_pwr_int(chip, channel);
+        if (r)
+                return r;
+        if (chip->is_zd1211b) {
+                static const struct zd_ioreq32 ioreqs[] = {
+                        { CR69, 0x28 },
+                        {},
+                        { CR69, 0x2a },
+                };
+
+                r = update_ofdm_cal(chip, channel);
+                if (r)
+                        return r;
+                r = update_pwr_cal(chip, channel);
+                if (r)
+                        return r;
+                r = zd_iowrite32a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+                if (r)
+                        return r;
+        }
+
+        return 0;
+}
+
+/* The CCK baseband gain can be optionally patched by the EEPROM */
+static int patch_cck_gain(struct zd_chip *chip)
+{
+        int r;
+        u32 value;
+
+        if (!chip->patch_cck_gain)
+                return 0;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_ioread32_locked(chip, &value, E2P_PHY_REG);
+        if (r)
+                return r;
+        dev_dbg_f(zd_chip_dev(chip), "patching value %x\n", value & 0xff);
+        return zd_iowrite32_locked(chip, value & 0xff, CR47);
+}
+
+int zd_chip_set_channel(struct zd_chip *chip, u8 channel)
+{
+        int r, t;
+
+        mutex_lock(&chip->mutex);
+        r = zd_chip_lock_phy_regs(chip);
+        if (r)
+                goto out;
+        r = zd_rf_set_channel(&chip->rf, channel);
+        if (r)
+                goto unlock;
+        r = update_channel_integration_and_calibration(chip, channel);
+        if (r)
+                goto unlock;
+        r = patch_cck_gain(chip);
+        if (r)
+                goto unlock;
+        r = patch_6m_band_edge(chip, channel);
+        if (r)
+                goto unlock;
+        r = zd_iowrite32_locked(chip, 0, CR_CONFIG_PHILIPS);
+unlock:
+        t = zd_chip_unlock_phy_regs(chip);
+        if (t && !r)
+                r = t;
+out:
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+u8 zd_chip_get_channel(struct zd_chip *chip)
+{
+        u8 channel;
+
+        mutex_lock(&chip->mutex);
+        channel = chip->rf.channel;
+        mutex_unlock(&chip->mutex);
+        return channel;
+}
+
+static u16 led_mask(int led)
+{
+        switch (led) {
+        case 1:
+                return LED1;
+        case 2:
+                return LED2;
+        default:
+                return 0;
+        }
+}
+
+static int read_led_reg(struct zd_chip *chip, u16 *status)
+{
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        return zd_ioread16_locked(chip, status, CR_LED);
+}
+
+static int write_led_reg(struct zd_chip *chip, u16 status)
+{
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        return zd_iowrite16_locked(chip, status, CR_LED);
+}
+
+int zd_chip_led_status(struct zd_chip *chip, int led, enum led_status status)
+{
+        int r, ret;
+        u16 mask = led_mask(led);
+        u16 reg;
+
+        if (!mask)
+                return -EINVAL;
+        mutex_lock(&chip->mutex);
+        r = read_led_reg(chip, &reg);
+        if (r)
+                return r;
+        switch (status) {
+        case LED_STATUS:
+                return (reg & mask) ? LED_ON : LED_OFF;
+        case LED_OFF:
+                reg &= ~mask;
+                ret = LED_OFF;
+                break;
+        case LED_FLIP:
+                reg ^= mask;
+                ret = (reg&mask) ? LED_ON : LED_OFF;
+                break;
+        case LED_ON:
+                reg |= mask;
+                ret = LED_ON;
+                break;
+        default:
+                return -EINVAL;
+        }
+        r = write_led_reg(chip, reg);
+        if (r) {
+                ret = r;
+                goto out;
+        }
+out:
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_chip_led_flip(struct zd_chip *chip, int led,
+        const unsigned int *phases_msecs, unsigned int count)
+{
+        int i, r;
+        enum led_status status;
+
+        r = zd_chip_led_status(chip, led, LED_STATUS);
+        if (r)
+                return r;
+        status = r;
+        for (i = 0; i < count; i++) {
+                r = zd_chip_led_status(chip, led, LED_FLIP);
+                if (r < 0)
+                        goto out;
+                msleep(phases_msecs[i]);
+        }
+
+out:
+        zd_chip_led_status(chip, led, status);
+        return r;
+}
+
+int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates)
+{
+        int r;
+
+        if (cr_rates & ~(CR_RATES_80211B|CR_RATES_80211G))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        r = zd_iowrite32_locked(chip, cr_rates, CR_BASIC_RATE_TBL);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+static int ofdm_qual_db(u8 status_quality, u8 rate, unsigned int size)
+{
+        static const u16 constants[] = {
+                715, 655, 585, 540, 470, 410, 360, 315,
+                270, 235, 205, 175, 150, 125, 105,  85,
+                 65,  50,  40,  25,  15
+        };
+
+        int i;
+        u32 x;
+
+        /* It seems that their quality parameter is somehow per signal
+         * and is now transferred per bit.
+         */
+        switch (rate) {
+        case ZD_OFDM_RATE_6M:
+        case ZD_OFDM_RATE_12M:
+        case ZD_OFDM_RATE_24M:
+                size *= 2;
+                break;
+        case ZD_OFDM_RATE_9M:
+        case ZD_OFDM_RATE_18M:
+        case ZD_OFDM_RATE_36M:
+        case ZD_OFDM_RATE_54M:
+                size *= 4;
+                size /= 3;
+                break;
+        case ZD_OFDM_RATE_48M:
+                size *= 3;
+                size /= 2;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        x = (10000 * status_quality)/size;
+        for (i = 0; i < ARRAY_SIZE(constants); i++) {
+                if (x > constants[i])
+                        break;
+        }
+
+        switch (rate) {
+        case ZD_OFDM_RATE_6M:
+        case ZD_OFDM_RATE_9M:
+                i += 3;
+                break;
+        case ZD_OFDM_RATE_12M:
+        case ZD_OFDM_RATE_18M:
+                i += 5;
+                break;
+        case ZD_OFDM_RATE_24M:
+        case ZD_OFDM_RATE_36M:
+                i += 9;
+                break;
+        case ZD_OFDM_RATE_48M:
+        case ZD_OFDM_RATE_54M:
+                i += 15;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return i;
+}
+
+static int ofdm_qual_percent(u8 status_quality, u8 rate, unsigned int size)
+{
+        int r;
+
+        r = ofdm_qual_db(status_quality, rate, size);
+        ZD_ASSERT(r >= 0);
+        if (r < 0)
+                r = 0;
+
+        r = (r * 100)/29;
+        return r <= 100 ? r : 100;
+}
+
+static unsigned int log10times100(unsigned int x)
+{
+        static const u8 log10[] = {
+                  0,
+                  0,   30,   47,   60,   69,   77,   84,   90,   95,  100,
+                104,  107,  111,  114,  117,  120,  123,  125,  127,  130,
+                132,  134,  136,  138,  139,  141,  143,  144,  146,  147,
+                149,  150,  151,  153,  154,  155,  156,  157,  159,  160,
+                161,  162,  163,  164,  165,  166,  167,  168,  169,  169,
+                170,  171,  172,  173,  174,  174,  175,  176,  177,  177,
+                178,  179,  179,  180,  181,  181,  182,  183,  183,  184,
+                185,  185,  186,  186,  187,  188,  188,  189,  189,  190,
+                190,  191,  191,  192,  192,  193,  193,  194,  194,  195,
+                195,  196,  196,  197,  197,  198,  198,  199,  199,  200,
+                200,  200,  201,  201,  202,  202,  202,  203,  203,  204,
+                204,  204,  205,  205,  206,  206,  206,  207,  207,  207,
+                208,  208,  208,  209,  209,  210,  210,  210,  211,  211,
+                211,  212,  212,  212,  213,  213,  213,  213,  214,  214,
+                214,  215,  215,  215,  216,  216,  216,  217,  217,  217,
+                217,  218,  218,  218,  219,  219,  219,  219,  220,  220,
+                220,  220,  221,  221,  221,  222,  222,  222,  222,  223,
+                223,  223,  223,  224,  224,  224,  224,
+        };
+
+        return x < ARRAY_SIZE(log10) ? log10[x] : 225;
+}
+
+enum {
+        MAX_CCK_EVM_DB = 45,
+};
+
+static int cck_evm_db(u8 status_quality)
+{
+        return (20 * log10times100(status_quality)) / 100;
+}
+
+static int cck_snr_db(u8 status_quality)
+{
+        int r = MAX_CCK_EVM_DB - cck_evm_db(status_quality);
+        ZD_ASSERT(r >= 0);
+        return r;
+}
+
+static int cck_qual_percent(u8 status_quality)
+{
+        int r;
+
+        r = cck_snr_db(status_quality);
+        r = (100*r)/17;
+        return r <= 100 ? r : 100;
+}
+
+u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
+                      const struct rx_status *status)
+{
+        return (status->frame_status&ZD_RX_OFDM) ?
+                ofdm_qual_percent(status->signal_quality_ofdm,
+                                  zd_ofdm_plcp_header_rate(rx_frame),
+                                  size) :
+                cck_qual_percent(status->signal_quality_cck);
+}
+
+u8 zd_rx_strength_percent(u8 rssi)
+{
+        int r = (rssi*100) / 41;
+        if (r > 100)
+                r = 100;
+        return (u8) r;
+}
+
+u16 zd_rx_rate(const void *rx_frame, const struct rx_status *status)
+{
+        static const u16 ofdm_rates[] = {
+                [ZD_OFDM_RATE_6M]  = 60,
+                [ZD_OFDM_RATE_9M]  = 90,
+                [ZD_OFDM_RATE_12M] = 120,
+                [ZD_OFDM_RATE_18M] = 180,
+                [ZD_OFDM_RATE_24M] = 240,
+                [ZD_OFDM_RATE_36M] = 360,
+                [ZD_OFDM_RATE_48M] = 480,
+                [ZD_OFDM_RATE_54M] = 540,
+        };
+        u16 rate;
+        if (status->frame_status & ZD_RX_OFDM) {
+                u8 ofdm_rate = zd_ofdm_plcp_header_rate(rx_frame);
+                rate = ofdm_rates[ofdm_rate & 0xf];
+        } else {
+                u8 cck_rate = zd_cck_plcp_header_rate(rx_frame);
+                switch (cck_rate) {
+                case ZD_CCK_SIGNAL_1M:
+                        rate = 10;
+                        break;
+                case ZD_CCK_SIGNAL_2M:
+                        rate = 20;
+                        break;
+                case ZD_CCK_SIGNAL_5M5:
+                        rate = 55;
+                        break;
+                case ZD_CCK_SIGNAL_11M:
+                        rate = 110;
+                        break;
+                default:
+                        rate = 0;
+                }
+        }
+
+        return rate;
+}
+
+int zd_chip_switch_radio_on(struct zd_chip *chip)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = zd_switch_radio_on(&chip->rf);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_chip_switch_radio_off(struct zd_chip *chip)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = zd_switch_radio_off(&chip->rf);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+int zd_chip_enable_int(struct zd_chip *chip)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = zd_usb_enable_int(&chip->usb);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+void zd_chip_disable_int(struct zd_chip *chip)
+{
+        mutex_lock(&chip->mutex);
+        zd_usb_disable_int(&chip->usb);
+        mutex_unlock(&chip->mutex);
+}
+
+int zd_chip_enable_rx(struct zd_chip *chip)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = zd_usb_enable_rx(&chip->usb);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
+
+void zd_chip_disable_rx(struct zd_chip *chip)
+{
+        mutex_lock(&chip->mutex);
+        zd_usb_disable_rx(&chip->usb);
+        mutex_unlock(&chip->mutex);
+}
+
+int zd_rfwritev_locked(struct zd_chip *chip,
+                       const u32* values, unsigned int count, u8 bits)
+{
+        int r;
+        unsigned int i;
+
+        for (i = 0; i < count; i++) {
+                r = zd_rfwrite_locked(chip, values[i], bits);
+                if (r)
+                        return r;
+        }
+
+        return 0;
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
new file mode 100644
index 000000000000..069d2b467339
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -0,0 +1,827 @@
+/* zd_chip.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_CHIP_H
+#define _ZD_CHIP_H
+
+#include "zd_types.h"
+#include "zd_rf.h"
+#include "zd_usb.h"
+
+/* Header for the Media Access Controller (MAC) and the Baseband Processor
+ * (BBP). It appears that the ZD1211 wraps the old ZD1205 with USB glue and
+ * adds a processor for handling the USB protocol.
+ */
+
+/* 8-bit hardware registers */
+#define CR0   CTL_REG(0x0000)
+#define CR1   CTL_REG(0x0004)
+#define CR2   CTL_REG(0x0008)
+#define CR3   CTL_REG(0x000C)
+
+#define CR5   CTL_REG(0x0010)
+/*      bit 5: if set short preamble used
+ *      bit 6: filter band - Japan channel 14 on, else off
+ */
+#define CR6   CTL_REG(0x0014)
+#define CR7   CTL_REG(0x0018)
+#define CR8   CTL_REG(0x001C)
+
+#define CR4   CTL_REG(0x0020)
+
+#define CR9   CTL_REG(0x0024)
+/*      bit 2: antenna switch (together with CR10) */
+#define CR10  CTL_REG(0x0028)
+/*      bit 1: antenna switch (together with CR9)
+ *      RF2959 controls with CR11 radion on and off
+ */
+#define CR11  CTL_REG(0x002C)
+/*      bit 6:  TX power control for OFDM
+ *      RF2959 controls with CR10 radio on and off
+ */
+#define CR12  CTL_REG(0x0030)
+#define CR13  CTL_REG(0x0034)
+#define CR14  CTL_REG(0x0038)
+#define CR15  CTL_REG(0x003C)
+#define CR16  CTL_REG(0x0040)
+#define CR17  CTL_REG(0x0044)
+#define CR18  CTL_REG(0x0048)
+#define CR19  CTL_REG(0x004C)
+#define CR20  CTL_REG(0x0050)
+#define CR21  CTL_REG(0x0054)
+#define CR22  CTL_REG(0x0058)
+#define CR23  CTL_REG(0x005C)
+#define CR24  CTL_REG(0x0060)   /* CCA threshold */
+#define CR25  CTL_REG(0x0064)
+#define CR26  CTL_REG(0x0068)
+#define CR27  CTL_REG(0x006C)
+#define CR28  CTL_REG(0x0070)
+#define CR29  CTL_REG(0x0074)
+#define CR30  CTL_REG(0x0078)
+#define CR31  CTL_REG(0x007C)   /* TX power control for RF in CCK mode */
+#define CR32  CTL_REG(0x0080)
+#define CR33  CTL_REG(0x0084)
+#define CR34  CTL_REG(0x0088)
+#define CR35  CTL_REG(0x008C)
+#define CR36  CTL_REG(0x0090)
+#define CR37  CTL_REG(0x0094)
+#define CR38  CTL_REG(0x0098)
+#define CR39  CTL_REG(0x009C)
+#define CR40  CTL_REG(0x00A0)
+#define CR41  CTL_REG(0x00A4)
+#define CR42  CTL_REG(0x00A8)
+#define CR43  CTL_REG(0x00AC)
+#define CR44  CTL_REG(0x00B0)
+#define CR45  CTL_REG(0x00B4)
+#define CR46  CTL_REG(0x00B8)
+#define CR47  CTL_REG(0x00BC)   /* CCK baseband gain
+                                 * (patch value might be in EEPROM)
+                                 */
+#define CR48  CTL_REG(0x00C0)
+#define CR49  CTL_REG(0x00C4)
+#define CR50  CTL_REG(0x00C8)
+#define CR51  CTL_REG(0x00CC)   /* TX power control for RF in 6-36M modes */
+#define CR52  CTL_REG(0x00D0)   /* TX power control for RF in 48M mode */
+#define CR53  CTL_REG(0x00D4)   /* TX power control for RF in 54M mode */
+#define CR54  CTL_REG(0x00D8)
+#define CR55  CTL_REG(0x00DC)
+#define CR56  CTL_REG(0x00E0)
+#define CR57  CTL_REG(0x00E4)
+#define CR58  CTL_REG(0x00E8)
+#define CR59  CTL_REG(0x00EC)
+#define CR60  CTL_REG(0x00F0)
+#define CR61  CTL_REG(0x00F4)
+#define CR62  CTL_REG(0x00F8)
+#define CR63  CTL_REG(0x00FC)
+#define CR64  CTL_REG(0x0100)
+#define CR65  CTL_REG(0x0104) /* OFDM 54M calibration */
+#define CR66  CTL_REG(0x0108) /* OFDM 48M calibration */
+#define CR67  CTL_REG(0x010C) /* OFDM 36M calibration */
+#define CR68  CTL_REG(0x0110) /* CCK calibration */
+#define CR69  CTL_REG(0x0114)
+#define CR70  CTL_REG(0x0118)
+#define CR71  CTL_REG(0x011C)
+#define CR72  CTL_REG(0x0120)
+#define CR73  CTL_REG(0x0124)
+#define CR74  CTL_REG(0x0128)
+#define CR75  CTL_REG(0x012C)
+#define CR76  CTL_REG(0x0130)
+#define CR77  CTL_REG(0x0134)
+#define CR78  CTL_REG(0x0138)
+#define CR79  CTL_REG(0x013C)
+#define CR80  CTL_REG(0x0140)
+#define CR81  CTL_REG(0x0144)
+#define CR82  CTL_REG(0x0148)
+#define CR83  CTL_REG(0x014C)
+#define CR84  CTL_REG(0x0150)
+#define CR85  CTL_REG(0x0154)
+#define CR86  CTL_REG(0x0158)
+#define CR87  CTL_REG(0x015C)
+#define CR88  CTL_REG(0x0160)
+#define CR89  CTL_REG(0x0164)
+#define CR90  CTL_REG(0x0168)
+#define CR91  CTL_REG(0x016C)
+#define CR92  CTL_REG(0x0170)
+#define CR93  CTL_REG(0x0174)
+#define CR94  CTL_REG(0x0178)
+#define CR95  CTL_REG(0x017C)
+#define CR96  CTL_REG(0x0180)
+#define CR97  CTL_REG(0x0184)
+#define CR98  CTL_REG(0x0188)
+#define CR99  CTL_REG(0x018C)
+#define CR100 CTL_REG(0x0190)
+#define CR101 CTL_REG(0x0194)
+#define CR102 CTL_REG(0x0198)
+#define CR103 CTL_REG(0x019C)
+#define CR104 CTL_REG(0x01A0)
+#define CR105 CTL_REG(0x01A4)
+#define CR106 CTL_REG(0x01A8)
+#define CR107 CTL_REG(0x01AC)
+#define CR108 CTL_REG(0x01B0)
+#define CR109 CTL_REG(0x01B4)
+#define CR110 CTL_REG(0x01B8)
+#define CR111 CTL_REG(0x01BC)
+#define CR112 CTL_REG(0x01C0)
+#define CR113 CTL_REG(0x01C4)
+#define CR114 CTL_REG(0x01C8)
+#define CR115 CTL_REG(0x01CC)
+#define CR116 CTL_REG(0x01D0)
+#define CR117 CTL_REG(0x01D4)
+#define CR118 CTL_REG(0x01D8)
+#define CR119 CTL_REG(0x01DC)
+#define CR120 CTL_REG(0x01E0)
+#define CR121 CTL_REG(0x01E4)
+#define CR122 CTL_REG(0x01E8)
+#define CR123 CTL_REG(0x01EC)
+#define CR124 CTL_REG(0x01F0)
+#define CR125 CTL_REG(0x01F4)
+#define CR126 CTL_REG(0x01F8)
+#define CR127 CTL_REG(0x01FC)
+#define CR128 CTL_REG(0x0200)
+#define CR129 CTL_REG(0x0204)
+#define CR130 CTL_REG(0x0208)
+#define CR131 CTL_REG(0x020C)
+#define CR132 CTL_REG(0x0210)
+#define CR133 CTL_REG(0x0214)
+#define CR134 CTL_REG(0x0218)
+#define CR135 CTL_REG(0x021C)
+#define CR136 CTL_REG(0x0220)
+#define CR137 CTL_REG(0x0224)
+#define CR138 CTL_REG(0x0228)
+#define CR139 CTL_REG(0x022C)
+#define CR140 CTL_REG(0x0230)
+#define CR141 CTL_REG(0x0234)
+#define CR142 CTL_REG(0x0238)
+#define CR143 CTL_REG(0x023C)
+#define CR144 CTL_REG(0x0240)
+#define CR145 CTL_REG(0x0244)
+#define CR146 CTL_REG(0x0248)
+#define CR147 CTL_REG(0x024C)
+#define CR148 CTL_REG(0x0250)
+#define CR149 CTL_REG(0x0254)
+#define CR150 CTL_REG(0x0258)
+#define CR151 CTL_REG(0x025C)
+#define CR152 CTL_REG(0x0260)
+#define CR153 CTL_REG(0x0264)
+#define CR154 CTL_REG(0x0268)
+#define CR155 CTL_REG(0x026C)
+#define CR156 CTL_REG(0x0270)
+#define CR157 CTL_REG(0x0274)
+#define CR158 CTL_REG(0x0278)
+#define CR159 CTL_REG(0x027C)
+#define CR160 CTL_REG(0x0280)
+#define CR161 CTL_REG(0x0284)
+#define CR162 CTL_REG(0x0288)
+#define CR163 CTL_REG(0x028C)
+#define CR164 CTL_REG(0x0290)
+#define CR165 CTL_REG(0x0294)
+#define CR166 CTL_REG(0x0298)
+#define CR167 CTL_REG(0x029C)
+#define CR168 CTL_REG(0x02A0)
+#define CR169 CTL_REG(0x02A4)
+#define CR170 CTL_REG(0x02A8)
+#define CR171 CTL_REG(0x02AC)
+#define CR172 CTL_REG(0x02B0)
+#define CR173 CTL_REG(0x02B4)
+#define CR174 CTL_REG(0x02B8)
+#define CR175 CTL_REG(0x02BC)
+#define CR176 CTL_REG(0x02C0)
+#define CR177 CTL_REG(0x02C4)
+#define CR178 CTL_REG(0x02C8)
+#define CR179 CTL_REG(0x02CC)
+#define CR180 CTL_REG(0x02D0)
+#define CR181 CTL_REG(0x02D4)
+#define CR182 CTL_REG(0x02D8)
+#define CR183 CTL_REG(0x02DC)
+#define CR184 CTL_REG(0x02E0)
+#define CR185 CTL_REG(0x02E4)
+#define CR186 CTL_REG(0x02E8)
+#define CR187 CTL_REG(0x02EC)
+#define CR188 CTL_REG(0x02F0)
+#define CR189 CTL_REG(0x02F4)
+#define CR190 CTL_REG(0x02F8)
+#define CR191 CTL_REG(0x02FC)
+#define CR192 CTL_REG(0x0300)
+#define CR193 CTL_REG(0x0304)
+#define CR194 CTL_REG(0x0308)
+#define CR195 CTL_REG(0x030C)
+#define CR196 CTL_REG(0x0310)
+#define CR197 CTL_REG(0x0314)
+#define CR198 CTL_REG(0x0318)
+#define CR199 CTL_REG(0x031C)
+#define CR200 CTL_REG(0x0320)
+#define CR201 CTL_REG(0x0324)
+#define CR202 CTL_REG(0x0328)
+#define CR203 CTL_REG(0x032C)   /* I2C bus template value & flash control */
+#define CR204 CTL_REG(0x0330)
+#define CR205 CTL_REG(0x0334)
+#define CR206 CTL_REG(0x0338)
+#define CR207 CTL_REG(0x033C)
+#define CR208 CTL_REG(0x0340)
+#define CR209 CTL_REG(0x0344)
+#define CR210 CTL_REG(0x0348)
+#define CR211 CTL_REG(0x034C)
+#define CR212 CTL_REG(0x0350)
+#define CR213 CTL_REG(0x0354)
+#define CR214 CTL_REG(0x0358)
+#define CR215 CTL_REG(0x035C)
+#define CR216 CTL_REG(0x0360)
+#define CR217 CTL_REG(0x0364)
+#define CR218 CTL_REG(0x0368)
+#define CR219 CTL_REG(0x036C)
+#define CR220 CTL_REG(0x0370)
+#define CR221 CTL_REG(0x0374)
+#define CR222 CTL_REG(0x0378)
+#define CR223 CTL_REG(0x037C)
+#define CR224 CTL_REG(0x0380)
+#define CR225 CTL_REG(0x0384)
+#define CR226 CTL_REG(0x0388)
+#define CR227 CTL_REG(0x038C)
+#define CR228 CTL_REG(0x0390)
+#define CR229 CTL_REG(0x0394)
+#define CR230 CTL_REG(0x0398)
+#define CR231 CTL_REG(0x039C)
+#define CR232 CTL_REG(0x03A0)
+#define CR233 CTL_REG(0x03A4)
+#define CR234 CTL_REG(0x03A8)
+#define CR235 CTL_REG(0x03AC)
+#define CR236 CTL_REG(0x03B0)
+
+#define CR240 CTL_REG(0x03C0)
+/*      bit 7:  host-controlled RF register writes
+ * CR241-CR245: for hardware controlled writing of RF bits, not needed for
+ *              USB
+ */
+#define CR241 CTL_REG(0x03C4)
+#define CR242 CTL_REG(0x03C8)
+#define CR243 CTL_REG(0x03CC)
+#define CR244 CTL_REG(0x03D0)
+#define CR245 CTL_REG(0x03D4)
+
+#define CR251 CTL_REG(0x03EC)   /* only used for activation and deactivation of
+                                 * Airoha RFs AL2230 and AL7230B
+                                 */
+#define CR252 CTL_REG(0x03F0)
+#define CR253 CTL_REG(0x03F4)
+#define CR254 CTL_REG(0x03F8)
+#define CR255 CTL_REG(0x03FC)
+
+#define CR_MAX_PHY_REG 255
+
+/* Taken from the ZYDAS driver, not all of them are relevant for the ZSD1211
+ * driver.
+ */
+
+#define CR_RF_IF_CLK                    CTL_REG(0x0400)
+#define CR_RF_IF_DATA                   CTL_REG(0x0404)
+#define CR_PE1_PE2                      CTL_REG(0x0408)
+#define CR_PE2_DLY                      CTL_REG(0x040C)
+#define CR_LE1                          CTL_REG(0x0410)
+#define CR_LE2                          CTL_REG(0x0414)
+/* Seems to enable/disable GPI (General Purpose IO?) */
+#define CR_GPI_EN                       CTL_REG(0x0418)
+#define CR_RADIO_PD                     CTL_REG(0x042C)
+#define CR_RF2948_PD                    CTL_REG(0x042C)
+#define CR_ENABLE_PS_MANUAL_AGC         CTL_REG(0x043C)
+#define CR_CONFIG_PHILIPS               CTL_REG(0x0440)
+#define CR_SA2400_SER_AP                CTL_REG(0x0444)
+#define CR_I2C_WRITE                    CTL_REG(0x0444)
+#define CR_SA2400_SER_RP                CTL_REG(0x0448)
+#define CR_RADIO_PE                     CTL_REG(0x0458)
+#define CR_RST_BUS_MASTER               CTL_REG(0x045C)
+#define CR_RFCFG                        CTL_REG(0x0464)
+#define CR_HSTSCHG                      CTL_REG(0x046C)
+#define CR_PHY_ON                       CTL_REG(0x0474)
+#define CR_RX_DELAY                     CTL_REG(0x0478)
+#define CR_RX_PE_DELAY                  CTL_REG(0x047C)
+#define CR_GPIO_1                       CTL_REG(0x0490)
+#define CR_GPIO_2                       CTL_REG(0x0494)
+#define CR_EncryBufMux                  CTL_REG(0x04A8)
+#define CR_PS_CTRL                      CTL_REG(0x0500)
+#define CR_ADDA_PWR_DWN                 CTL_REG(0x0504)
+#define CR_ADDA_MBIAS_WARMTIME          CTL_REG(0x0508)
+#define CR_MAC_PS_STATE                 CTL_REG(0x050C)
+
+#define CR_INTERRUPT                    CTL_REG(0x0510)
+#define INT_TX_COMPLETE                 0x00000001
+#define INT_RX_COMPLETE                 0x00000002
+#define INT_RETRY_FAIL                  0x00000004
+#define INT_WAKEUP                      0x00000008
+#define INT_DTIM_NOTIFY                 0x00000020
+#define INT_CFG_NEXT_BCN                0x00000040
+#define INT_BUS_ABORT                   0x00000080
+#define INT_TX_FIFO_READY               0x00000100
+#define INT_UART                        0x00000200
+#define INT_TX_COMPLETE_EN              0x00010000
+#define INT_RX_COMPLETE_EN              0x00020000
+#define INT_RETRY_FAIL_EN               0x00040000
+#define INT_WAKEUP_EN                   0x00080000
+#define INT_DTIM_NOTIFY_EN              0x00200000
+#define INT_CFG_NEXT_BCN_EN             0x00400000
+#define INT_BUS_ABORT_EN                0x00800000
+#define INT_TX_FIFO_READY_EN            0x01000000
+#define INT_UART_EN                     0x02000000
+
+#define CR_TSF_LOW_PART                 CTL_REG(0x0514)
+#define CR_TSF_HIGH_PART                CTL_REG(0x0518)
+
+/* Following three values are in time units (1024us)
+ * Following condition must be met:
+ * atim < tbtt < bcn
+ */
+#define CR_ATIM_WND_PERIOD              CTL_REG(0x051C)
+#define CR_BCN_INTERVAL                 CTL_REG(0x0520)
+#define CR_PRE_TBTT                     CTL_REG(0x0524)
+/* in units of TU(1024us) */
+
+/* for UART support */
+#define CR_UART_RBR_THR_DLL             CTL_REG(0x0540)
+#define CR_UART_DLM_IER                 CTL_REG(0x0544)
+#define CR_UART_IIR_FCR                 CTL_REG(0x0548)
+#define CR_UART_LCR                     CTL_REG(0x054c)
+#define CR_UART_MCR                     CTL_REG(0x0550)
+#define CR_UART_LSR                     CTL_REG(0x0554)
+#define CR_UART_MSR                     CTL_REG(0x0558)
+#define CR_UART_ECR                     CTL_REG(0x055c)
+#define CR_UART_STATUS                  CTL_REG(0x0560)
+
+#define CR_PCI_TX_ADDR_P1               CTL_REG(0x0600)
+#define CR_PCI_TX_AddR_P2               CTL_REG(0x0604)
+#define CR_PCI_RX_AddR_P1               CTL_REG(0x0608)
+#define CR_PCI_RX_AddR_P2               CTL_REG(0x060C)
+
+/* must be overwritten if custom MAC address will be used */
+#define CR_MAC_ADDR_P1                  CTL_REG(0x0610)
+#define CR_MAC_ADDR_P2                  CTL_REG(0x0614)
+#define CR_BSSID_P1                     CTL_REG(0x0618)
+#define CR_BSSID_P2                     CTL_REG(0x061C)
+#define CR_BCN_PLCP_CFG                 CTL_REG(0x0620)
+#define CR_GROUP_HASH_P1                CTL_REG(0x0624)
+#define CR_GROUP_HASH_P2                CTL_REG(0x0628)
+#define CR_RX_TIMEOUT                   CTL_REG(0x062C)
+
+/* Basic rates supported by the BSS. When producing ACK or CTS messages, the
+ * device will use a rate in this table that is less than or equal to the rate
+ * of the incoming frame which prompted the response */
+#define CR_BASIC_RATE_TBL               CTL_REG(0x0630)
+#define CR_RATE_1M      0x0001  /* 802.11b */
+#define CR_RATE_2M      0x0002  /* 802.11b */
+#define CR_RATE_5_5M    0x0004  /* 802.11b */
+#define CR_RATE_11M     0x0008  /* 802.11b */
+#define CR_RATE_6M      0x0100  /* 802.11g */
+#define CR_RATE_9M      0x0200  /* 802.11g */
+#define CR_RATE_12M     0x0400  /* 802.11g */
+#define CR_RATE_18M     0x0800  /* 802.11g */
+#define CR_RATE_24M     0x1000  /* 802.11g */
+#define CR_RATE_36M     0x2000  /* 802.11g */
+#define CR_RATE_48M     0x4000  /* 802.11g */
+#define CR_RATE_54M     0x8000  /* 802.11g */
+#define CR_RATES_80211G 0xff00
+#define CR_RATES_80211B 0x000f
+
+/* Mandatory rates required in the BSS. When producing ACK or CTS messages, if
+ * the device could not find an appropriate rate in CR_BASIC_RATE_TBL, it will
+ * look for a rate in this table that is less than or equal to the rate of
+ * the incoming frame. */
+#define CR_MANDATORY_RATE_TBL           CTL_REG(0x0634)
+#define CR_RTS_CTS_RATE                 CTL_REG(0x0638)
+
+#define CR_WEP_PROTECT                  CTL_REG(0x063C)
+#define CR_RX_THRESHOLD                 CTL_REG(0x0640)
+
+/* register for controlling the LEDS */
+#define CR_LED                          CTL_REG(0x0644)
+/* masks for controlling LEDs */
+#define LED1                            0x0100
+#define LED2                            0x0200
+
+/* Seems to indicate that the configuration is over.
+ */
+#define CR_AFTER_PNP                    CTL_REG(0x0648)
+#define CR_ACK_TIME_80211               CTL_REG(0x0658)
+
+#define CR_RX_OFFSET                    CTL_REG(0x065c)
+
+#define CR_PHY_DELAY                    CTL_REG(0x066C)
+#define CR_BCN_FIFO                     CTL_REG(0x0670)
+#define CR_SNIFFER_ON                   CTL_REG(0x0674)
+
+#define CR_ENCRYPTION_TYPE              CTL_REG(0x0678)
+#define NO_WEP                          0
+#define WEP64                           1
+#define WEP128                          5
+#define WEP256                          6
+#define ENC_SNIFFER                     8
+
+#define CR_ZD1211_RETRY_MAX             CTL_REG(0x067C)
+
+#define CR_REG1                         CTL_REG(0x0680)
+/* Setting the bit UNLOCK_PHY_REGS disallows the write access to physical
+ * registers, so one could argue it is a LOCK bit. But calling it
+ * LOCK_PHY_REGS makes it confusing.
+ */
+#define UNLOCK_PHY_REGS                 0x0080
+
+#define CR_DEVICE_STATE                 CTL_REG(0x0684)
+#define CR_UNDERRUN_CNT                 CTL_REG(0x0688)
+
+#define CR_RX_FILTER                    CTL_REG(0x068c)
+#define RX_FILTER_ASSOC_RESPONSE        0x0002
+#define RX_FILTER_REASSOC_RESPONSE      0x0008
+#define RX_FILTER_PROBE_RESPONSE        0x0020
+#define RX_FILTER_BEACON                0x0100
+#define RX_FILTER_DISASSOC              0x0400
+#define RX_FILTER_AUTH                  0x0800
+#define AP_RX_FILTER                    0x0400feff
+#define STA_RX_FILTER                   0x0000ffff
+
+/* Monitor mode sets filter to 0xfffff */
+
+#define CR_ACK_TIMEOUT_EXT              CTL_REG(0x0690)
+#define CR_BCN_FIFO_SEMAPHORE           CTL_REG(0x0694)
+#define CR_IFS_VALUE                    CTL_REG(0x0698)
+#define CR_RX_TIME_OUT                  CTL_REG(0x069C)
+#define CR_TOTAL_RX_FRM                 CTL_REG(0x06A0)
+#define CR_CRC32_CNT                    CTL_REG(0x06A4)
+#define CR_CRC16_CNT                    CTL_REG(0x06A8)
+#define CR_DECRYPTION_ERR_UNI           CTL_REG(0x06AC)
+#define CR_RX_FIFO_OVERRUN              CTL_REG(0x06B0)
+
+#define CR_DECRYPTION_ERR_MUL           CTL_REG(0x06BC)
+
+#define CR_NAV_CNT                      CTL_REG(0x06C4)
+#define CR_NAV_CCA                      CTL_REG(0x06C8)
+#define CR_RETRY_CNT                    CTL_REG(0x06CC)
+
+#define CR_READ_TCB_ADDR                CTL_REG(0x06E8)
+#define CR_READ_RFD_ADDR                CTL_REG(0x06EC)
+#define CR_CWMIN_CWMAX                  CTL_REG(0x06F0)
+#define CR_TOTAL_TX_FRM                 CTL_REG(0x06F4)
+
+/* CAM: Continuous Access Mode (power management) */
+#define CR_CAM_MODE                     CTL_REG(0x0700)
+#define CR_CAM_ROLL_TB_LOW              CTL_REG(0x0704)
+#define CR_CAM_ROLL_TB_HIGH             CTL_REG(0x0708)
+#define CR_CAM_ADDRESS                  CTL_REG(0x070C)
+#define CR_CAM_DATA                     CTL_REG(0x0710)
+
+#define CR_ROMDIR                       CTL_REG(0x0714)
+
+#define CR_DECRY_ERR_FLG_LOW            CTL_REG(0x0714)
+#define CR_DECRY_ERR_FLG_HIGH           CTL_REG(0x0718)
+
+#define CR_WEPKEY0                      CTL_REG(0x0720)
+#define CR_WEPKEY1                      CTL_REG(0x0724)
+#define CR_WEPKEY2                      CTL_REG(0x0728)
+#define CR_WEPKEY3                      CTL_REG(0x072C)
+#define CR_WEPKEY4                      CTL_REG(0x0730)
+#define CR_WEPKEY5                      CTL_REG(0x0734)
+#define CR_WEPKEY6                      CTL_REG(0x0738)
+#define CR_WEPKEY7                      CTL_REG(0x073C)
+#define CR_WEPKEY8                      CTL_REG(0x0740)
+#define CR_WEPKEY9                      CTL_REG(0x0744)
+#define CR_WEPKEY10                     CTL_REG(0x0748)
+#define CR_WEPKEY11                     CTL_REG(0x074C)
+#define CR_WEPKEY12                     CTL_REG(0x0750)
+#define CR_WEPKEY13                     CTL_REG(0x0754)
+#define CR_WEPKEY14                     CTL_REG(0x0758)
+#define CR_WEPKEY15                     CTL_REG(0x075c)
+#define CR_TKIP_MODE                    CTL_REG(0x0760)
+
+#define CR_EEPROM_PROTECT0              CTL_REG(0x0758)
+#define CR_EEPROM_PROTECT1              CTL_REG(0x075C)
+
+#define CR_DBG_FIFO_RD                  CTL_REG(0x0800)
+#define CR_DBG_SELECT                   CTL_REG(0x0804)
+#define CR_FIFO_Length                  CTL_REG(0x0808)
+
+
+#define CR_RSSI_MGC                     CTL_REG(0x0810)
+
+#define CR_PON                          CTL_REG(0x0818)
+#define CR_RX_ON                        CTL_REG(0x081C)
+#define CR_TX_ON                        CTL_REG(0x0820)
+#define CR_CHIP_EN                      CTL_REG(0x0824)
+#define CR_LO_SW                        CTL_REG(0x0828)
+#define CR_TXRX_SW                      CTL_REG(0x082C)
+#define CR_S_MD                         CTL_REG(0x0830)
+
+#define CR_USB_DEBUG_PORT               CTL_REG(0x0888)
+
+#define CR_ZD1211B_TX_PWR_CTL1          CTL_REG(0x0b00)
+#define CR_ZD1211B_TX_PWR_CTL2          CTL_REG(0x0b04)
+#define CR_ZD1211B_TX_PWR_CTL3          CTL_REG(0x0b08)
+#define CR_ZD1211B_TX_PWR_CTL4          CTL_REG(0x0b0c)
+#define CR_ZD1211B_AIFS_CTL1            CTL_REG(0x0b10)
+#define CR_ZD1211B_AIFS_CTL2            CTL_REG(0x0b14)
+#define CR_ZD1211B_TXOP                 CTL_REG(0x0b20)
+#define CR_ZD1211B_RETRY_MAX            CTL_REG(0x0b28)
+
+#define CWIN_SIZE                       0x007f043f
+
+
+#define HWINT_ENABLED                   0x004f0000
+#define HWINT_DISABLED                  0
+
+#define E2P_PWR_INT_GUARD               8
+#define E2P_CHANNEL_COUNT               14
+
+/* If you compare this addresses with the ZYDAS orignal driver, please notify
+ * that we use word mapping for the EEPROM.
+ */
+
+/*
+ * Upper 16 bit contains the regulatory domain.
+ */
+#define E2P_SUBID               E2P_REG(0x00)
+#define E2P_POD                 E2P_REG(0x02)
+#define E2P_MAC_ADDR_P1         E2P_REG(0x04)
+#define E2P_MAC_ADDR_P2         E2P_REG(0x06)
+#define E2P_PWR_CAL_VALUE1      E2P_REG(0x08)
+#define E2P_PWR_CAL_VALUE2      E2P_REG(0x0a)
+#define E2P_PWR_CAL_VALUE3      E2P_REG(0x0c)
+#define E2P_PWR_CAL_VALUE4      E2P_REG(0x0e)
+#define E2P_PWR_INT_VALUE1      E2P_REG(0x10)
+#define E2P_PWR_INT_VALUE2      E2P_REG(0x12)
+#define E2P_PWR_INT_VALUE3      E2P_REG(0x14)
+#define E2P_PWR_INT_VALUE4      E2P_REG(0x16)
+
+/* Contains a bit for each allowed channel. It gives for Europe (ETSI 0x30)
+ * also only 11 channels. */
+#define E2P_ALLOWED_CHANNEL     E2P_REG(0x18)
+
+#define E2P_PHY_REG             E2P_REG(0x1a)
+#define E2P_DEVICE_VER          E2P_REG(0x20)
+#define E2P_36M_CAL_VALUE1      E2P_REG(0x28)
+#define E2P_36M_CAL_VALUE2      E2P_REG(0x2a)
+#define E2P_36M_CAL_VALUE3      E2P_REG(0x2c)
+#define E2P_36M_CAL_VALUE4      E2P_REG(0x2e)
+#define E2P_11A_INT_VALUE1      E2P_REG(0x30)
+#define E2P_11A_INT_VALUE2      E2P_REG(0x32)
+#define E2P_11A_INT_VALUE3      E2P_REG(0x34)
+#define E2P_11A_INT_VALUE4      E2P_REG(0x36)
+#define E2P_48M_CAL_VALUE1      E2P_REG(0x38)
+#define E2P_48M_CAL_VALUE2      E2P_REG(0x3a)
+#define E2P_48M_CAL_VALUE3      E2P_REG(0x3c)
+#define E2P_48M_CAL_VALUE4      E2P_REG(0x3e)
+#define E2P_48M_INT_VALUE1      E2P_REG(0x40)
+#define E2P_48M_INT_VALUE2      E2P_REG(0x42)
+#define E2P_48M_INT_VALUE3      E2P_REG(0x44)
+#define E2P_48M_INT_VALUE4      E2P_REG(0x46)
+#define E2P_54M_CAL_VALUE1      E2P_REG(0x48)   /* ??? */
+#define E2P_54M_CAL_VALUE2      E2P_REG(0x4a)
+#define E2P_54M_CAL_VALUE3      E2P_REG(0x4c)
+#define E2P_54M_CAL_VALUE4      E2P_REG(0x4e)
+#define E2P_54M_INT_VALUE1      E2P_REG(0x50)
+#define E2P_54M_INT_VALUE2      E2P_REG(0x52)
+#define E2P_54M_INT_VALUE3      E2P_REG(0x54)
+#define E2P_54M_INT_VALUE4      E2P_REG(0x56)
+
+/* All 16 bit values */
+#define FW_FIRMWARE_VER         FW_REG(0)
+/* non-zero if USB high speed connection */
+#define FW_USB_SPEED            FW_REG(1)
+#define FW_FIX_TX_RATE          FW_REG(2)
+/* Seems to be able to control LEDs over the firmware */
+#define FW_LINK_STATUS          FW_REG(3)
+#define FW_SOFT_RESET           FW_REG(4)
+#define FW_FLASH_CHK            FW_REG(5)
+
+enum {
+        CR_BASE_OFFSET                  = 0x9000,
+        FW_START_OFFSET                 = 0xee00,
+        FW_BASE_ADDR_OFFSET             = FW_START_OFFSET + 0x1d,
+        EEPROM_START_OFFSET             = 0xf800,
+        EEPROM_SIZE                     = 0x800, /* words */
+        LOAD_CODE_SIZE                  = 0xe, /* words */
+        LOAD_VECT_SIZE                  = 0x10000 - 0xfff7, /* words */
+        EEPROM_REGS_OFFSET              = LOAD_CODE_SIZE + LOAD_VECT_SIZE,
+        E2P_BASE_OFFSET                 = EEPROM_START_OFFSET +
+                                          EEPROM_REGS_OFFSET,
+};
+
+#define FW_REG_TABLE_ADDR       USB_ADDR(FW_START_OFFSET + 0x1d)
+
+enum {
+        /* indices for ofdm_cal_values */
+        OFDM_36M_INDEX = 0,
+        OFDM_48M_INDEX = 1,
+        OFDM_54M_INDEX = 2,
+};
+
+struct zd_chip {
+        struct zd_usb usb;
+        struct zd_rf rf;
+        struct mutex mutex;
+        u8 e2p_mac[ETH_ALEN];
+        /* EepSetPoint in the vendor driver */
+        u8 pwr_cal_values[E2P_CHANNEL_COUNT];
+        /* integration values in the vendor driver */
+        u8 pwr_int_values[E2P_CHANNEL_COUNT];
+        /* SetPointOFDM in the vendor driver */
+        u8 ofdm_cal_values[3][E2P_CHANNEL_COUNT];
+        u8 pa_type:4, patch_cck_gain:1, patch_cr157:1, patch_6m_band_edge:1,
+           is_zd1211b:1;
+};
+
+static inline struct zd_chip *zd_usb_to_chip(struct zd_usb *usb)
+{
+        return container_of(usb, struct zd_chip, usb);
+}
+
+static inline struct zd_chip *zd_rf_to_chip(struct zd_rf *rf)
+{
+        return container_of(rf, struct zd_chip, rf);
+}
+
+#define zd_chip_dev(chip) (&(chip)->usb.intf->dev)
+
+void zd_chip_init(struct zd_chip *chip,
+                 struct net_device *netdev,
+                 struct usb_interface *intf);
+void zd_chip_clear(struct zd_chip *chip);
+int zd_chip_init_hw(struct zd_chip *chip, u8 device_type);
+int zd_chip_reset(struct zd_chip *chip);
+
+static inline int zd_ioread16v_locked(struct zd_chip *chip, u16 *values,
+                                      const zd_addr_t *addresses,
+                                      unsigned int count)
+{
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        return zd_usb_ioread16v(&chip->usb, values, addresses, count);
+}
+
+static inline int zd_ioread16_locked(struct zd_chip *chip, u16 *value,
+                                     const zd_addr_t addr)
+{
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        return zd_usb_ioread16(&chip->usb, value, addr);
+}
+
+int zd_ioread32v_locked(struct zd_chip *chip, u32 *values,
+                        const zd_addr_t *addresses, unsigned int count);
+
+static inline int zd_ioread32_locked(struct zd_chip *chip, u32 *value,
+                                     const zd_addr_t addr)
+{
+        return zd_ioread32v_locked(chip, value, (const zd_addr_t *)&addr, 1);
+}
+
+static inline int zd_iowrite16_locked(struct zd_chip *chip, u16 value,
+                                      zd_addr_t addr)
+{
+        struct zd_ioreq16 ioreq;
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        ioreq.addr = addr;
+        ioreq.value = value;
+
+        return zd_usb_iowrite16v(&chip->usb, &ioreq, 1);
+}
+
+int zd_iowrite16a_locked(struct zd_chip *chip,
+                         const struct zd_ioreq16 *ioreqs, unsigned int count);
+
+int _zd_iowrite32v_locked(struct zd_chip *chip, const struct zd_ioreq32 *ioreqs,
+                          unsigned int count);
+
+static inline int zd_iowrite32_locked(struct zd_chip *chip, u32 value,
+                                      zd_addr_t addr)
+{
+        struct zd_ioreq32 ioreq;
+
+        ioreq.addr = addr;
+        ioreq.value = value;
+
+        return _zd_iowrite32v_locked(chip, &ioreq, 1);
+}
+
+int zd_iowrite32a_locked(struct zd_chip *chip,
+                         const struct zd_ioreq32 *ioreqs, unsigned int count);
+
+static inline int zd_rfwrite_locked(struct zd_chip *chip, u32 value, u8 bits)
+{
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        return zd_usb_rfwrite(&chip->usb, value, bits);
+}
+
+int zd_rfwritev_locked(struct zd_chip *chip,
+                       const u32* values, unsigned int count, u8 bits);
+
+/* Locking functions for reading and writing registers.
+ * The different parameters are intentional.
+ */
+int zd_ioread16(struct zd_chip *chip, zd_addr_t addr, u16 *value);
+int zd_iowrite16(struct zd_chip *chip, zd_addr_t addr, u16 value);
+int zd_ioread32(struct zd_chip *chip, zd_addr_t addr, u32 *value);
+int zd_iowrite32(struct zd_chip *chip, zd_addr_t addr, u32 value);
+int zd_ioread32v(struct zd_chip *chip, const zd_addr_t *addresses,
+                  u32 *values, unsigned int count);
+int zd_iowrite32a(struct zd_chip *chip, const struct zd_ioreq32 *ioreqs,
+                   unsigned int count);
+
+int zd_chip_set_channel(struct zd_chip *chip, u8 channel);
+static inline u8 _zd_chip_get_channel(struct zd_chip *chip)
+{
+        return chip->rf.channel;
+}
+u8  zd_chip_get_channel(struct zd_chip *chip);
+int zd_read_regdomain(struct zd_chip *chip, u8 *regdomain);
+void zd_get_e2p_mac_addr(struct zd_chip *chip, u8 *mac_addr);
+int zd_read_mac_addr(struct zd_chip *chip, u8 *mac_addr);
+int zd_write_mac_addr(struct zd_chip *chip, const u8 *mac_addr);
+int zd_chip_switch_radio_on(struct zd_chip *chip);
+int zd_chip_switch_radio_off(struct zd_chip *chip);
+int zd_chip_enable_int(struct zd_chip *chip);
+void zd_chip_disable_int(struct zd_chip *chip);
+int zd_chip_enable_rx(struct zd_chip *chip);
+void zd_chip_disable_rx(struct zd_chip *chip);
+int zd_chip_enable_hwint(struct zd_chip *chip);
+int zd_chip_disable_hwint(struct zd_chip *chip);
+
+static inline int zd_get_encryption_type(struct zd_chip *chip, u32 *type)
+{
+        return zd_ioread32(chip, CR_ENCRYPTION_TYPE, type);
+}
+
+static inline int zd_set_encryption_type(struct zd_chip *chip, u32 type)
+{
+        return zd_iowrite32(chip, CR_ENCRYPTION_TYPE, type);
+}
+
+static inline int zd_chip_get_basic_rates(struct zd_chip *chip, u16 *cr_rates)
+{
+        return zd_ioread16(chip, CR_BASIC_RATE_TBL, cr_rates);
+}
+
+int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates);
+
+static inline int zd_chip_set_rx_filter(struct zd_chip *chip, u32 filter)
+{
+        return zd_iowrite32(chip, CR_RX_FILTER, filter);
+}
+
+int zd_chip_lock_phy_regs(struct zd_chip *chip);
+int zd_chip_unlock_phy_regs(struct zd_chip *chip);
+
+enum led_status {
+        LED_OFF    = 0,
+        LED_ON     = 1,
+        LED_FLIP   = 2,
+        LED_STATUS = 3,
+};
+
+int zd_chip_led_status(struct zd_chip *chip, int led, enum led_status status);
+int zd_chip_led_flip(struct zd_chip *chip, int led,
+                     const unsigned int *phases_msecs, unsigned int count);
+
+int zd_set_beacon_interval(struct zd_chip *chip, u32 interval);
+
+static inline int zd_get_beacon_interval(struct zd_chip *chip, u32 *interval)
+{
+        return zd_ioread32(chip, CR_BCN_INTERVAL, interval);
+}
+
+struct rx_status;
+
+u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
+                       const struct rx_status *status);
+u8 zd_rx_strength_percent(u8 rssi);
+
+u16 zd_rx_rate(const void *rx_frame, const struct rx_status *status);
+
+#endif /* _ZD_CHIP_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_def.h b/drivers/net/wireless/zd1211rw/zd_def.h
new file mode 100644
index 000000000000..465906812fc4
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_def.h
@@ -0,0 +1,48 @@
+/* zd_def.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_DEF_H
+#define _ZD_DEF_H
+
+#include <linux/kernel.h>
+#include <linux/stringify.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+
+#define dev_printk_f(level, dev, fmt, args...) \
+        dev_printk(level, dev, "%s() " fmt, __func__, ##args)
+
+#ifdef DEBUG
+#  define dev_dbg_f(dev, fmt, args...) \
+          dev_printk_f(KERN_DEBUG, dev, fmt, ## args)
+#else
+#  define dev_dbg_f(dev, fmt, args...) do { (void)(dev); } while (0)
+#endif /* DEBUG */
+
+#ifdef DEBUG
+#  define ZD_ASSERT(x) \
+do { \
+        if (!(x)) { \
+                pr_debug("%s:%d ASSERT %s VIOLATED!\n", \
+                        __FILE__, __LINE__, __stringify(x)); \
+        } \
+} while (0)
+#else
+#  define ZD_ASSERT(x) do { } while (0)
+#endif
+
+#endif /* _ZD_DEF_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_ieee80211.c b/drivers/net/wireless/zd1211rw/zd_ieee80211.c
new file mode 100644
index 000000000000..66905f7b61ff
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_ieee80211.c
@@ -0,0 +1,191 @@
+/* zd_ieee80211.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+/*
+ * A lot of this code is generic and should be moved into the upper layers
+ * at some point.
+ */
+
+#include <linux/errno.h>
+#include <linux/wireless.h>
+#include <linux/kernel.h>
+#include <net/ieee80211.h>
+
+#include "zd_def.h"
+#include "zd_ieee80211.h"
+#include "zd_mac.h"
+
+static const struct channel_range channel_ranges[] = {
+        [0]                      = { 0,  0},
+        [ZD_REGDOMAIN_FCC]       = { 1, 12},
+        [ZD_REGDOMAIN_IC]        = { 1, 12},
+        [ZD_REGDOMAIN_ETSI]      = { 1, 14},
+        [ZD_REGDOMAIN_JAPAN]     = { 1, 14},
+        [ZD_REGDOMAIN_SPAIN]     = { 1, 14},
+        [ZD_REGDOMAIN_FRANCE]    = { 1, 14},
+        [ZD_REGDOMAIN_JAPAN_ADD] = {14, 15},
+};
+
+const struct channel_range *zd_channel_range(u8 regdomain)
+{
+        if (regdomain >= ARRAY_SIZE(channel_ranges))
+                regdomain = 0;
+        return &channel_ranges[regdomain];
+}
+
+int zd_regdomain_supports_channel(u8 regdomain, u8 channel)
+{
+        const struct channel_range *range = zd_channel_range(regdomain);
+        return range->start <= channel && channel < range->end;
+}
+
+int zd_regdomain_supported(u8 regdomain)
+{
+        const struct channel_range *range = zd_channel_range(regdomain);
+        return range->start != 0;
+}
+
+/* Stores channel frequencies in MHz. */
+static const u16 channel_frequencies[] = {
+        2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447,
+        2452, 2457, 2462, 2467, 2472, 2484,
+};
+
+#define NUM_CHANNELS ARRAY_SIZE(channel_frequencies)
+
+static int compute_freq(struct iw_freq *freq, u32 mhz, u32 hz)
+{
+        u32 factor;
+
+        freq->e = 0;
+        if (mhz >= 1000000000U) {
+                pr_debug("zd1211 mhz %u to large\n", mhz);
+                freq->m = 0;
+                return -EINVAL;
+        }
+
+        factor = 1000;
+        while (mhz >= factor) {
+
+                freq->e += 1;
+                factor *= 10;
+        }
+
+        factor /= 1000U;
+        freq->m = mhz * (1000000U/factor) + hz/factor;
+
+        return 0;
+}
+
+int zd_channel_to_freq(struct iw_freq *freq, u8 channel)
+{
+        if (channel > NUM_CHANNELS) {
+                freq->m = 0;
+                freq->e = 0;
+                return -EINVAL;
+        }
+        if (!channel) {
+                freq->m = 0;
+                freq->e = 0;
+                return -EINVAL;
+        }
+        return compute_freq(freq, channel_frequencies[channel-1], 0);
+}
+
+static int freq_to_mhz(const struct iw_freq *freq)
+{
+        u32 factor;
+        int e;
+
+        /* Such high frequencies are not supported. */
+        if (freq->e > 6)
+                return -EINVAL;
+
+        factor = 1;
+        for (e = freq->e; e > 0; --e) {
+                factor *= 10;
+        }
+        factor = 1000000U / factor;
+
+        if (freq->m % factor) {
+                return -EINVAL;
+        }
+
+        return freq->m / factor;
+}
+
+int zd_find_channel(u8 *channel, const struct iw_freq *freq)
+{
+        int i, r;
+        u32 mhz;
+
+        if (!(freq->flags & IW_FREQ_FIXED))
+                return 0;
+
+        if (freq->m < 1000) {
+                if (freq->m  > NUM_CHANNELS || freq->m == 0)
+                        return -EINVAL;
+                *channel = freq->m;
+                return 1;
+        }
+
+        r = freq_to_mhz(freq);
+        if (r < 0)
+                return r;
+        mhz = r;
+
+        for (i = 0; i < NUM_CHANNELS; i++) {
+                if (mhz == channel_frequencies[i]) {
+                        *channel = i+1;
+                        return 1;
+                }
+        }
+
+        return -EINVAL;
+}
+
+int zd_geo_init(struct ieee80211_device *ieee, u8 regdomain)
+{
+        struct ieee80211_geo geo;
+        const struct channel_range *range;
+        int i;
+        u8 channel;
+
+        dev_dbg(zd_mac_dev(zd_netdev_mac(ieee->dev)),
+                "regdomain %#04x\n", regdomain);
+
+        range = zd_channel_range(regdomain);
+        if (range->start == 0) {
+                dev_err(zd_mac_dev(zd_netdev_mac(ieee->dev)),
+                        "zd1211 regdomain %#04x not supported\n",
+                        regdomain);
+                return -EINVAL;
+        }
+
+        memset(&geo, 0, sizeof(geo));
+
+        for (i = 0, channel = range->start; channel < range->end; channel++) {
+                struct ieee80211_channel *chan = &geo.bg[i++];
+                chan->freq = channel_frequencies[channel - 1];
+                chan->channel = channel;
+        }
+
+        geo.bg_channels = i;
+        memcpy(geo.name, "XX ", 4);
+        ieee80211_set_geo(ieee, &geo);
+        return 0;
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_ieee80211.h b/drivers/net/wireless/zd1211rw/zd_ieee80211.h
new file mode 100644
index 000000000000..36329890dfec
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_ieee80211.h
@@ -0,0 +1,85 @@
+#ifndef _ZD_IEEE80211_H
+#define _ZD_IEEE80211_H
+
+#include <net/ieee80211.h>
+#include "zd_types.h"
+
+/* Additional definitions from the standards.
+ */
+
+#define ZD_REGDOMAIN_FCC        0x10
+#define ZD_REGDOMAIN_IC         0x20
+#define ZD_REGDOMAIN_ETSI       0x30
+#define ZD_REGDOMAIN_SPAIN      0x31
+#define ZD_REGDOMAIN_FRANCE     0x32
+#define ZD_REGDOMAIN_JAPAN_ADD  0x40
+#define ZD_REGDOMAIN_JAPAN      0x41
+
+enum {
+        MIN_CHANNEL24 = 1,
+        MAX_CHANNEL24 = 14,
+};
+
+struct channel_range {
+        u8 start;
+        u8 end; /* exclusive (channel must be less than end) */
+};
+
+struct iw_freq;
+
+int zd_geo_init(struct ieee80211_device *ieee, u8 regdomain);
+
+const struct channel_range *zd_channel_range(u8 regdomain);
+int zd_regdomain_supports_channel(u8 regdomain, u8 channel);
+int zd_regdomain_supported(u8 regdomain);
+
+/* for 2.4 GHz band */
+int zd_channel_to_freq(struct iw_freq *freq, u8 channel);
+int zd_find_channel(u8 *channel, const struct iw_freq *freq);
+
+#define ZD_PLCP_SERVICE_LENGTH_EXTENSION 0x80
+
+struct ofdm_plcp_header {
+        u8 prefix[3];
+        __le16 service;
+} __attribute__((packed));
+
+static inline u8 zd_ofdm_plcp_header_rate(
+        const struct ofdm_plcp_header *header)
+{
+        return header->prefix[0] & 0xf;
+}
+
+#define ZD_OFDM_RATE_6M         0xb
+#define ZD_OFDM_RATE_9M         0xf
+#define ZD_OFDM_RATE_12M        0xa
+#define ZD_OFDM_RATE_18M        0xe
+#define ZD_OFDM_RATE_24M        0x9
+#define ZD_OFDM_RATE_36M        0xd
+#define ZD_OFDM_RATE_48M        0x8
+#define ZD_OFDM_RATE_54M        0xc
+
+struct cck_plcp_header {
+        u8 signal;
+        u8 service;
+        __le16 length;
+        __le16 crc16;
+} __attribute__((packed));
+
+static inline u8 zd_cck_plcp_header_rate(const struct cck_plcp_header *header)
+{
+        return header->signal;
+}
+
+#define ZD_CCK_SIGNAL_1M        0x0a
+#define ZD_CCK_SIGNAL_2M        0x14
+#define ZD_CCK_SIGNAL_5M5       0x37
+#define ZD_CCK_SIGNAL_11M       0x6e
+
+enum ieee80211_std {
+        IEEE80211B = 0x01,
+        IEEE80211A = 0x02,
+        IEEE80211G = 0x04,
+};
+
+#endif /* _ZD_IEEE80211_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
new file mode 100644
index 000000000000..a9bd80a08613
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -0,0 +1,1084 @@
+/* zd_mac.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/usb.h>
+#include <linux/jiffies.h>
+#include <net/ieee80211_radiotap.h>
+
+#include "zd_def.h"
+#include "zd_chip.h"
+#include "zd_mac.h"
+#include "zd_ieee80211.h"
+#include "zd_netdev.h"
+#include "zd_rf.h"
+#include "zd_util.h"
+
+static void ieee_init(struct ieee80211_device *ieee);
+static void softmac_init(struct ieee80211softmac_device *sm);
+
+int zd_mac_init(struct zd_mac *mac,
+                struct net_device *netdev,
+                struct usb_interface *intf)
+{
+        struct ieee80211_device *ieee = zd_netdev_ieee80211(netdev);
+
+        memset(mac, 0, sizeof(*mac));
+        spin_lock_init(&mac->lock);
+        mac->netdev = netdev;
+
+        ieee_init(ieee);
+        softmac_init(ieee80211_priv(netdev));
+        zd_chip_init(&mac->chip, netdev, intf);
+        return 0;
+}
+
+static int reset_channel(struct zd_mac *mac)
+{
+        int r;
+        unsigned long flags;
+        const struct channel_range *range;
+
+        spin_lock_irqsave(&mac->lock, flags);
+        range = zd_channel_range(mac->regdomain);
+        if (!range->start) {
+                r = -EINVAL;
+                goto out;
+        }
+        mac->requested_channel = range->start;
+        r = 0;
+out:
+        spin_unlock_irqrestore(&mac->lock, flags);
+        return r;
+}
+
+int zd_mac_init_hw(struct zd_mac *mac, u8 device_type)
+{
+        int r;
+        struct zd_chip *chip = &mac->chip;
+        u8 addr[ETH_ALEN];
+        u8 default_regdomain;
+
+        r = zd_chip_enable_int(chip);
+        if (r)
+                goto out;
+        r = zd_chip_init_hw(chip, device_type);
+        if (r)
+                goto disable_int;
+
+        zd_get_e2p_mac_addr(chip, addr);
+        r = zd_write_mac_addr(chip, addr);
+        if (r)
+                goto disable_int;
+        ZD_ASSERT(!irqs_disabled());
+        spin_lock_irq(&mac->lock);
+        memcpy(mac->netdev->dev_addr, addr, ETH_ALEN);
+        spin_unlock_irq(&mac->lock);
+
+        r = zd_read_regdomain(chip, &default_regdomain);
+        if (r)
+                goto disable_int;
+        if (!zd_regdomain_supported(default_regdomain)) {
+                dev_dbg_f(zd_mac_dev(mac),
+                          "Regulatory Domain %#04x is not supported.\n",
+                          default_regdomain);
+                r = -EINVAL;
+                goto disable_int;
+        }
+        spin_lock_irq(&mac->lock);
+        mac->regdomain = mac->default_regdomain = default_regdomain;
+        spin_unlock_irq(&mac->lock);
+        r = reset_channel(mac);
+        if (r)
+                goto disable_int;
+
+        /* We must inform the device that we are doing encryption/decryption in
+         * software at the moment. */
+        r = zd_set_encryption_type(chip, ENC_SNIFFER);
+        if (r)
+                goto disable_int;
+
+        r = zd_geo_init(zd_mac_to_ieee80211(mac), mac->regdomain);
+        if (r)
+                goto disable_int;
+
+        r = 0;
+disable_int:
+        zd_chip_disable_int(chip);
+out:
+        return r;
+}
+
+void zd_mac_clear(struct zd_mac *mac)
+{
+        /* Aquire the lock. */
+        spin_lock(&mac->lock);
+        spin_unlock(&mac->lock);
+        zd_chip_clear(&mac->chip);
+        memset(mac, 0, sizeof(*mac));
+}
+
+static int reset_mode(struct zd_mac *mac)
+{
+        struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
+        struct zd_ioreq32 ioreqs[3] = {
+                { CR_RX_FILTER, STA_RX_FILTER },
+                { CR_SNIFFER_ON, 0U },
+        };
+
+        if (ieee->iw_mode == IW_MODE_MONITOR) {
+                ioreqs[0].value = 0xffffffff;
+                ioreqs[1].value = 0x1;
+                ioreqs[2].value = ENC_SNIFFER;
+        }
+
+        return zd_iowrite32a(&mac->chip, ioreqs, 3);
+}
+
+int zd_mac_open(struct net_device *netdev)
+{
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct zd_chip *chip = &mac->chip;
+        int r;
+
+        r = zd_chip_enable_int(chip);
+        if (r < 0)
+                goto out;
+
+        r = zd_chip_set_basic_rates(chip, CR_RATES_80211B | CR_RATES_80211G);
+        if (r < 0)
+                goto disable_int;
+        r = reset_mode(mac);
+        if (r)
+                goto disable_int;
+        r = zd_chip_switch_radio_on(chip);
+        if (r < 0)
+                goto disable_int;
+        r = zd_chip_set_channel(chip, mac->requested_channel);
+        if (r < 0)
+                goto disable_radio;
+        r = zd_chip_enable_rx(chip);
+        if (r < 0)
+                goto disable_radio;
+        r = zd_chip_enable_hwint(chip);
+        if (r < 0)
+                goto disable_rx;
+
+        ieee80211softmac_start(netdev);
+        return 0;
+disable_rx:
+        zd_chip_disable_rx(chip);
+disable_radio:
+        zd_chip_switch_radio_off(chip);
+disable_int:
+        zd_chip_disable_int(chip);
+out:
+        return r;
+}
+
+int zd_mac_stop(struct net_device *netdev)
+{
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct zd_chip *chip = &mac->chip;
+
+        netif_stop_queue(netdev);
+
+        /*
+         * The order here deliberately is a little different from the open()
+         * method, since we need to make sure there is no opportunity for RX
+         * frames to be processed by softmac after we have stopped it.
+         */
+
+        zd_chip_disable_rx(chip);
+        ieee80211softmac_stop(netdev);
+
+        zd_chip_disable_hwint(chip);
+        zd_chip_switch_radio_off(chip);
+        zd_chip_disable_int(chip);
+
+        return 0;
+}
+
+int zd_mac_set_mac_address(struct net_device *netdev, void *p)
+{
+        int r;
+        unsigned long flags;
+        struct sockaddr *addr = p;
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct zd_chip *chip = &mac->chip;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        dev_dbg_f(zd_mac_dev(mac),
+                  "Setting MAC to " MAC_FMT "\n", MAC_ARG(addr->sa_data));
+
+        r = zd_write_mac_addr(chip, addr->sa_data);
+        if (r)
+                return r;
+
+        spin_lock_irqsave(&mac->lock, flags);
+        memcpy(netdev->dev_addr, addr->sa_data, ETH_ALEN);
+        spin_unlock_irqrestore(&mac->lock, flags);
+
+        return 0;
+}
+
+int zd_mac_set_regdomain(struct zd_mac *mac, u8 regdomain)
+{
+        int r;
+        u8 channel;
+
+        ZD_ASSERT(!irqs_disabled());
+        spin_lock_irq(&mac->lock);
+        if (regdomain == 0) {
+                regdomain = mac->default_regdomain;
+        }
+        if (!zd_regdomain_supported(regdomain)) {
+                spin_unlock_irq(&mac->lock);
+                return -EINVAL;
+        }
+        mac->regdomain = regdomain;
+        channel = mac->requested_channel;
+        spin_unlock_irq(&mac->lock);
+
+        r = zd_geo_init(zd_mac_to_ieee80211(mac), regdomain);
+        if (r)
+                return r;
+        if (!zd_regdomain_supports_channel(regdomain, channel)) {
+                r = reset_channel(mac);
+                if (r)
+                        return r;
+        }
+
+        return 0;
+}
+
+u8 zd_mac_get_regdomain(struct zd_mac *mac)
+{
+        unsigned long flags;
+        u8 regdomain;
+
+        spin_lock_irqsave(&mac->lock, flags);
+        regdomain = mac->regdomain;
+        spin_unlock_irqrestore(&mac->lock, flags);
+        return regdomain;
+}
+
+static void set_channel(struct net_device *netdev, u8 channel)
+{
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+
+        dev_dbg_f(zd_mac_dev(mac), "channel %d\n", channel);
+
+        zd_chip_set_channel(&mac->chip, channel);
+}
+
+/* TODO: Should not work in Managed mode. */
+int zd_mac_request_channel(struct zd_mac *mac, u8 channel)
+{
+        unsigned long lock_flags;
+        struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
+
+        if (ieee->iw_mode == IW_MODE_INFRA)
+                return -EPERM;
+
+        spin_lock_irqsave(&mac->lock, lock_flags);
+        if (!zd_regdomain_supports_channel(mac->regdomain, channel)) {
+                spin_unlock_irqrestore(&mac->lock, lock_flags);
+                return -EINVAL;
+        }
+        mac->requested_channel = channel;
+        spin_unlock_irqrestore(&mac->lock, lock_flags);
+        if (netif_running(mac->netdev))
+                return zd_chip_set_channel(&mac->chip, channel);
+        else
+                return 0;
+}
+
+int zd_mac_get_channel(struct zd_mac *mac, u8 *channel, u8 *flags)
+{
+        struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
+
+        *channel = zd_chip_get_channel(&mac->chip);
+        if (ieee->iw_mode != IW_MODE_INFRA) {
+                spin_lock_irq(&mac->lock);
+                *flags = *channel == mac->requested_channel ?
+                        MAC_FIXED_CHANNEL : 0;
+                spin_unlock(&mac->lock);
+        } else {
+                *flags = 0;
+        }
+        dev_dbg_f(zd_mac_dev(mac), "channel %u flags %u\n", *channel, *flags);
+        return 0;
+}
+
+/* If wrong rate is given, we are falling back to the slowest rate: 1MBit/s */
+static u8 cs_typed_rate(u8 cs_rate)
+{
+        static const u8 typed_rates[16] = {
+                [ZD_CS_CCK_RATE_1M]     = ZD_CS_CCK|ZD_CS_CCK_RATE_1M,
+                [ZD_CS_CCK_RATE_2M]     = ZD_CS_CCK|ZD_CS_CCK_RATE_2M,
+                [ZD_CS_CCK_RATE_5_5M]   = ZD_CS_CCK|ZD_CS_CCK_RATE_5_5M,
+                [ZD_CS_CCK_RATE_11M]    = ZD_CS_CCK|ZD_CS_CCK_RATE_11M,
+                [ZD_OFDM_RATE_6M]       = ZD_CS_OFDM|ZD_OFDM_RATE_6M,
+                [ZD_OFDM_RATE_9M]       = ZD_CS_OFDM|ZD_OFDM_RATE_9M,
+                [ZD_OFDM_RATE_12M]      = ZD_CS_OFDM|ZD_OFDM_RATE_12M,
+                [ZD_OFDM_RATE_18M]      = ZD_CS_OFDM|ZD_OFDM_RATE_18M,
+                [ZD_OFDM_RATE_24M]      = ZD_CS_OFDM|ZD_OFDM_RATE_24M,
+                [ZD_OFDM_RATE_36M]      = ZD_CS_OFDM|ZD_OFDM_RATE_36M,
+                [ZD_OFDM_RATE_48M]      = ZD_CS_OFDM|ZD_OFDM_RATE_48M,
+                [ZD_OFDM_RATE_54M]      = ZD_CS_OFDM|ZD_OFDM_RATE_54M,
+        };
+
+        ZD_ASSERT(ZD_CS_RATE_MASK == 0x0f);
+        return typed_rates[cs_rate & ZD_CS_RATE_MASK];
+}
+
+/* Fallback to lowest rate, if rate is unknown. */
+static u8 rate_to_cs_rate(u8 rate)
+{
+        switch (rate) {
+        case IEEE80211_CCK_RATE_2MB:
+                return ZD_CS_CCK_RATE_2M;
+        case IEEE80211_CCK_RATE_5MB:
+                return ZD_CS_CCK_RATE_5_5M;
+        case IEEE80211_CCK_RATE_11MB:
+                return ZD_CS_CCK_RATE_11M;
+        case IEEE80211_OFDM_RATE_6MB:
+                return ZD_OFDM_RATE_6M;
+        case IEEE80211_OFDM_RATE_9MB:
+                return ZD_OFDM_RATE_9M;
+        case IEEE80211_OFDM_RATE_12MB:
+                return ZD_OFDM_RATE_12M;
+        case IEEE80211_OFDM_RATE_18MB:
+                return ZD_OFDM_RATE_18M;
+        case IEEE80211_OFDM_RATE_24MB:
+                return ZD_OFDM_RATE_24M;
+        case IEEE80211_OFDM_RATE_36MB:
+                return ZD_OFDM_RATE_36M;
+        case IEEE80211_OFDM_RATE_48MB:
+                return ZD_OFDM_RATE_48M;
+        case IEEE80211_OFDM_RATE_54MB:
+                return ZD_OFDM_RATE_54M;
+        }
+        return ZD_CS_CCK_RATE_1M;
+}
+
+int zd_mac_set_mode(struct zd_mac *mac, u32 mode)
+{
+        struct ieee80211_device *ieee;
+
+        switch (mode) {
+        case IW_MODE_AUTO:
+        case IW_MODE_ADHOC:
+        case IW_MODE_INFRA:
+                mac->netdev->type = ARPHRD_ETHER;
+                break;
+        case IW_MODE_MONITOR:
+                mac->netdev->type = ARPHRD_IEEE80211_RADIOTAP;
+                break;
+        default:
+                dev_dbg_f(zd_mac_dev(mac), "wrong mode %u\n", mode);
+                return -EINVAL;
+        }
+
+        ieee = zd_mac_to_ieee80211(mac);
+        ZD_ASSERT(!irqs_disabled());
+        spin_lock_irq(&ieee->lock);
+        ieee->iw_mode = mode;
+        spin_unlock_irq(&ieee->lock);
+
+        if (netif_running(mac->netdev))
+                return reset_mode(mac);
+
+        return 0;
+}
+
+int zd_mac_get_mode(struct zd_mac *mac, u32 *mode)
+{
+        unsigned long flags;
+        struct ieee80211_device *ieee;
+
+        ieee = zd_mac_to_ieee80211(mac);
+        spin_lock_irqsave(&ieee->lock, flags);
+        *mode = ieee->iw_mode;
+        spin_unlock_irqrestore(&ieee->lock, flags);
+        return 0;
+}
+
+int zd_mac_get_range(struct zd_mac *mac, struct iw_range *range)
+{
+        int i;
+        const struct channel_range *channel_range;
+        u8 regdomain;
+
+        memset(range, 0, sizeof(*range));
+
+        /* FIXME: Not so important and depends on the mode. For 802.11g
+         * usually this value is used. It seems to be that Bit/s number is
+         * given here.
+         */
+        range->throughput = 27 * 1000 * 1000;
+
+        range->max_qual.qual = 100;
+        range->max_qual.level = 100;
+
+        /* FIXME: Needs still to be tuned. */
+        range->avg_qual.qual = 71;
+        range->avg_qual.level = 80;
+
+        /* FIXME: depends on standard? */
+        range->min_rts = 256;
+        range->max_rts = 2346;
+
+        range->min_frag = MIN_FRAG_THRESHOLD;
+        range->max_frag = MAX_FRAG_THRESHOLD;
+
+        range->max_encoding_tokens = WEP_KEYS;
+        range->num_encoding_sizes = 2;
+        range->encoding_size[0] = 5;
+        range->encoding_size[1] = WEP_KEY_LEN;
+
+        range->we_version_compiled = WIRELESS_EXT;
+        range->we_version_source = 20;
+
+        ZD_ASSERT(!irqs_disabled());
+        spin_lock_irq(&mac->lock);
+        regdomain = mac->regdomain;
+        spin_unlock_irq(&mac->lock);
+        channel_range = zd_channel_range(regdomain);
+
+        range->num_channels = channel_range->end - channel_range->start;
+        range->old_num_channels = range->num_channels;
+        range->num_frequency = range->num_channels;
+        range->old_num_frequency = range->num_frequency;
+
+        for (i = 0; i < range->num_frequency; i++) {
+                struct iw_freq *freq = &range->freq[i];
+                freq->i = channel_range->start + i;
+                zd_channel_to_freq(freq, freq->i);
+        }
+
+        return 0;
+}
+
+static int zd_calc_tx_length_us(u8 *service, u8 cs_rate, u16 tx_length)
+{
+        static const u8 rate_divisor[] = {
+                [ZD_CS_CCK_RATE_1M]     =  1,
+                [ZD_CS_CCK_RATE_2M]     =  2,
+                [ZD_CS_CCK_RATE_5_5M]   = 11, /* bits must be doubled */
+                [ZD_CS_CCK_RATE_11M]    = 11,
+                [ZD_OFDM_RATE_6M]       =  6,
+                [ZD_OFDM_RATE_9M]       =  9,
+                [ZD_OFDM_RATE_12M]      = 12,
+                [ZD_OFDM_RATE_18M]      = 18,
+                [ZD_OFDM_RATE_24M]      = 24,
+                [ZD_OFDM_RATE_36M]      = 36,
+                [ZD_OFDM_RATE_48M]      = 48,
+                [ZD_OFDM_RATE_54M]      = 54,
+        };
+
+        u32 bits = (u32)tx_length * 8;
+        u32 divisor;
+
+        divisor = rate_divisor[cs_rate];
+        if (divisor == 0)
+                return -EINVAL;
+
+        switch (cs_rate) {
+        case ZD_CS_CCK_RATE_5_5M:
+                bits = (2*bits) + 10; /* round up to the next integer */
+                break;
+        case ZD_CS_CCK_RATE_11M:
+                if (service) {
+                        u32 t = bits % 11;
+                        *service &= ~ZD_PLCP_SERVICE_LENGTH_EXTENSION;
+                        if (0 < t && t <= 3) {
+                                *service |= ZD_PLCP_SERVICE_LENGTH_EXTENSION;
+                        }
+                }
+                bits += 10; /* round up to the next integer */
+                break;
+        }
+
+        return bits/divisor;
+}
+
+enum {
+        R2M_SHORT_PREAMBLE = 0x01,
+        R2M_11A            = 0x02,
+};
+
+static u8 cs_rate_to_modulation(u8 cs_rate, int flags)
+{
+        u8 modulation;
+
+        modulation = cs_typed_rate(cs_rate);
+        if (flags & R2M_SHORT_PREAMBLE) {
+                switch (ZD_CS_RATE(modulation)) {
+                case ZD_CS_CCK_RATE_2M:
+                case ZD_CS_CCK_RATE_5_5M:
+                case ZD_CS_CCK_RATE_11M:
+                        modulation |= ZD_CS_CCK_PREA_SHORT;
+                        return modulation;
+                }
+        }
+        if (flags & R2M_11A) {
+                if (ZD_CS_TYPE(modulation) == ZD_CS_OFDM)
+                        modulation |= ZD_CS_OFDM_MODE_11A;
+        }
+        return modulation;
+}
+
+static void cs_set_modulation(struct zd_mac *mac, struct zd_ctrlset *cs,
+                              struct ieee80211_hdr_4addr *hdr)
+{
+        struct ieee80211softmac_device *softmac = ieee80211_priv(mac->netdev);
+        u16 ftype = WLAN_FC_GET_TYPE(le16_to_cpu(hdr->frame_ctl));
+        u8 rate, cs_rate;
+        int is_mgt = (ftype == IEEE80211_FTYPE_MGMT) != 0;
+
+        /* FIXME: 802.11a? short preamble? */
+        rate = ieee80211softmac_suggest_txrate(softmac,
+                is_multicast_ether_addr(hdr->addr1), is_mgt);
+
+        cs_rate = rate_to_cs_rate(rate);
+        cs->modulation = cs_rate_to_modulation(cs_rate, 0);
+}
+
+static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
+                           struct ieee80211_hdr_4addr *header)
+{
+        unsigned int tx_length = le16_to_cpu(cs->tx_length);
+        u16 fctl = le16_to_cpu(header->frame_ctl);
+        u16 ftype = WLAN_FC_GET_TYPE(fctl);
+        u16 stype = WLAN_FC_GET_STYPE(fctl);
+
+        /*
+         * CONTROL:
+         * - start at 0x00
+         * - if fragment 0, enable bit 0
+         * - if backoff needed, enable bit 0
+         * - if burst (backoff not needed) disable bit 0
+         * - if multicast, enable bit 1
+         * - if PS-POLL frame, enable bit 2
+         * - if in INDEPENDENT_BSS mode and zd1205_DestPowerSave, then enable
+         *   bit 4 (FIXME: wtf)
+         * - if frag_len > RTS threshold, set bit 5 as long if it isnt
+         *   multicast or mgt
+         * - if bit 5 is set, and we are in OFDM mode, unset bit 5 and set bit
+         *   7
+         */
+
+        cs->control = 0;
+
+        /* First fragment */
+        if (WLAN_GET_SEQ_FRAG(le16_to_cpu(header->seq_ctl)) == 0)
+                cs->control |= ZD_CS_NEED_RANDOM_BACKOFF;
+
+        /* Multicast */
+        if (is_multicast_ether_addr(header->addr1))
+                cs->control |= ZD_CS_MULTICAST;
+
+        /* PS-POLL */
+        if (stype == IEEE80211_STYPE_PSPOLL)
+                cs->control |= ZD_CS_PS_POLL_FRAME;
+
+        if (!is_multicast_ether_addr(header->addr1) &&
+            ftype != IEEE80211_FTYPE_MGMT &&
+            tx_length > zd_netdev_ieee80211(mac->netdev)->rts)
+        {
+                /* FIXME: check the logic */
+                if (ZD_CS_TYPE(cs->modulation) == ZD_CS_OFDM) {
+                        /* 802.11g */
+                        cs->control |= ZD_CS_SELF_CTS;
+                } else { /* 802.11b */
+                        cs->control |= ZD_CS_RTS;
+                }
+        }
+
+        /* FIXME: Management frame? */
+}
+
+static int fill_ctrlset(struct zd_mac *mac,
+                        struct ieee80211_txb *txb,
+                        int frag_num)
+{
+        int r;
+        struct sk_buff *skb = txb->fragments[frag_num];
+        struct ieee80211_hdr_4addr *hdr =
+                (struct ieee80211_hdr_4addr *) skb->data;
+        unsigned int frag_len = skb->len + IEEE80211_FCS_LEN;
+        unsigned int next_frag_len;
+        unsigned int packet_length;
+        struct zd_ctrlset *cs = (struct zd_ctrlset *)
+                skb_push(skb, sizeof(struct zd_ctrlset));
+
+        if (frag_num+1  < txb->nr_frags) {
+                next_frag_len = txb->fragments[frag_num+1]->len +
+                                IEEE80211_FCS_LEN;
+        } else {
+                next_frag_len = 0;
+        }
+        ZD_ASSERT(frag_len <= 0xffff);
+        ZD_ASSERT(next_frag_len <= 0xffff);
+
+        cs_set_modulation(mac, cs, hdr);
+
+        cs->tx_length = cpu_to_le16(frag_len);
+
+        cs_set_control(mac, cs, hdr);
+
+        packet_length = frag_len + sizeof(struct zd_ctrlset) + 10;
+        ZD_ASSERT(packet_length <= 0xffff);
+        /* ZD1211B: Computing the length difference this way, gives us
+         * flexibility to compute the packet length.
+         */
+        cs->packet_length = cpu_to_le16(mac->chip.is_zd1211b ?
+                        packet_length - frag_len : packet_length);
+
+        /*
+         * CURRENT LENGTH:
+         * - transmit frame length in microseconds
+         * - seems to be derived from frame length
+         * - see Cal_Us_Service() in zdinlinef.h
+         * - if macp->bTxBurstEnable is enabled, then multiply by 4
+         *  - bTxBurstEnable is never set in the vendor driver
+         *
+         * SERVICE:
+         * - "for PLCP configuration"
+         * - always 0 except in some situations at 802.11b 11M
+         * - see line 53 of zdinlinef.h
+         */
+        cs->service = 0;
+        r = zd_calc_tx_length_us(&cs->service, ZD_CS_RATE(cs->modulation),
+                                 le16_to_cpu(cs->tx_length));
+        if (r < 0)
+                return r;
+        cs->current_length = cpu_to_le16(r);
+
+        if (next_frag_len == 0) {
+                cs->next_frame_length = 0;
+        } else {
+                r = zd_calc_tx_length_us(NULL, ZD_CS_RATE(cs->modulation),
+                                         next_frag_len);
+                if (r < 0)
+                        return r;
+                cs->next_frame_length = cpu_to_le16(r);
+        }
+
+        return 0;
+}
+
+static int zd_mac_tx(struct zd_mac *mac, struct ieee80211_txb *txb, int pri)
+{
+        int i, r;
+
+        for (i = 0; i < txb->nr_frags; i++) {
+                struct sk_buff *skb = txb->fragments[i];
+
+                r = fill_ctrlset(mac, txb, i);
+                if (r)
+                        return r;
+                r = zd_usb_tx(&mac->chip.usb, skb->data, skb->len);
+                if (r)
+                        return r;
+        }
+
+        /* FIXME: shouldn't this be handled by the upper layers? */
+        mac->netdev->trans_start = jiffies;
+
+        ieee80211_txb_free(txb);
+        return 0;
+}
+
+struct zd_rt_hdr {
+        struct ieee80211_radiotap_header rt_hdr;
+        u8  rt_flags;
+        u8  rt_rate;
+        u16 rt_channel;
+        u16 rt_chbitmask;
+} __attribute__((packed));
+
+static void fill_rt_header(void *buffer, struct zd_mac *mac,
+                           const struct ieee80211_rx_stats *stats,
+                           const struct rx_status *status)
+{
+        struct zd_rt_hdr *hdr = buffer;
+
+        hdr->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
+        hdr->rt_hdr.it_pad = 0;
+        hdr->rt_hdr.it_len = cpu_to_le16(sizeof(struct zd_rt_hdr));
+        hdr->rt_hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
+                                 (1 << IEEE80211_RADIOTAP_CHANNEL) |
+                                 (1 << IEEE80211_RADIOTAP_RATE));
+
+        hdr->rt_flags = 0;
+        if (status->decryption_type & (ZD_RX_WEP64|ZD_RX_WEP128|ZD_RX_WEP256))
+                hdr->rt_flags |= IEEE80211_RADIOTAP_F_WEP;
+
+        hdr->rt_rate = stats->rate / 5;
+
+        /* FIXME: 802.11a */
+        hdr->rt_channel = cpu_to_le16(ieee80211chan2mhz(
+                                             _zd_chip_get_channel(&mac->chip)));
+        hdr->rt_chbitmask = cpu_to_le16(IEEE80211_CHAN_2GHZ |
+                ((status->frame_status & ZD_RX_FRAME_MODULATION_MASK) ==
+                ZD_RX_OFDM ? IEEE80211_CHAN_OFDM : IEEE80211_CHAN_CCK));
+}
+
+/* Returns 1 if the data packet is for us and 0 otherwise. */
+static int is_data_packet_for_us(struct ieee80211_device *ieee,
+                                 struct ieee80211_hdr_4addr *hdr)
+{
+        struct net_device *netdev = ieee->dev;
+        u16 fc = le16_to_cpu(hdr->frame_ctl);
+
+        ZD_ASSERT(WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA);
+
+        switch (ieee->iw_mode) {
+        case IW_MODE_ADHOC:
+                if ((fc & (IEEE80211_FCTL_TODS|IEEE80211_FCTL_FROMDS)) != 0 ||
+                    memcmp(hdr->addr3, ieee->bssid, ETH_ALEN) != 0)
+                        return 0;
+                break;
+        case IW_MODE_AUTO:
+        case IW_MODE_INFRA:
+                if ((fc & (IEEE80211_FCTL_TODS|IEEE80211_FCTL_FROMDS)) !=
+                    IEEE80211_FCTL_FROMDS ||
+                    memcmp(hdr->addr2, ieee->bssid, ETH_ALEN) != 0)
+                        return 0;
+                break;
+        default:
+                ZD_ASSERT(ieee->iw_mode != IW_MODE_MONITOR);
+                return 0;
+        }
+
+        return memcmp(hdr->addr1, netdev->dev_addr, ETH_ALEN) == 0 ||
+               is_multicast_ether_addr(hdr->addr1) ||
+               (netdev->flags & IFF_PROMISC);
+}
+
+/* Filters receiving packets. If it returns 1 send it to ieee80211_rx, if 0
+ * return. If an error is detected -EINVAL is returned. ieee80211_rx_mgt() is
+ * called here.
+ *
+ * It has been based on ieee80211_rx_any.
+ */
+static int filter_rx(struct ieee80211_device *ieee,
+                     const u8 *buffer, unsigned int length,
+                     struct ieee80211_rx_stats *stats)
+{
+        struct ieee80211_hdr_4addr *hdr;
+        u16 fc;
+
+        if (ieee->iw_mode == IW_MODE_MONITOR)
+                return 1;
+
+        hdr = (struct ieee80211_hdr_4addr *)buffer;
+        fc = le16_to_cpu(hdr->frame_ctl);
+        if ((fc & IEEE80211_FCTL_VERS) != 0)
+                return -EINVAL;
+
+        switch (WLAN_FC_GET_TYPE(fc)) {
+        case IEEE80211_FTYPE_MGMT:
+                if (length < sizeof(struct ieee80211_hdr_3addr))
+                        return -EINVAL;
+                ieee80211_rx_mgt(ieee, hdr, stats);
+                return 0;
+        case IEEE80211_FTYPE_CTL:
+                /* Ignore invalid short buffers */
+                return 0;
+        case IEEE80211_FTYPE_DATA:
+                if (length < sizeof(struct ieee80211_hdr_3addr))
+                        return -EINVAL;
+                return is_data_packet_for_us(ieee, hdr);
+        }
+
+        return -EINVAL;
+}
+
+static void update_qual_rssi(struct zd_mac *mac,
+                             const u8 *buffer, unsigned int length,
+                             u8 qual_percent, u8 rssi_percent)
+{
+        unsigned long flags;
+        struct ieee80211_hdr_3addr *hdr;
+        int i;
+
+        hdr = (struct ieee80211_hdr_3addr *)buffer;
+        if (length < offsetof(struct ieee80211_hdr_3addr, addr3))
+                return;
+        if (memcmp(hdr->addr2, zd_mac_to_ieee80211(mac)->bssid, ETH_ALEN) != 0)
+                return;
+
+        spin_lock_irqsave(&mac->lock, flags);
+        i = mac->stats_count % ZD_MAC_STATS_BUFFER_SIZE;
+        mac->qual_buffer[i] = qual_percent;
+        mac->rssi_buffer[i] = rssi_percent;
+        mac->stats_count++;
+        spin_unlock_irqrestore(&mac->lock, flags);
+}
+
+static int fill_rx_stats(struct ieee80211_rx_stats *stats,
+                         const struct rx_status **pstatus,
+                         struct zd_mac *mac,
+                         const u8 *buffer, unsigned int length)
+{
+        const struct rx_status *status;
+
+        *pstatus = status = zd_tail(buffer, length, sizeof(struct rx_status));
+        if (status->frame_status & ZD_RX_ERROR) {
+                /* FIXME: update? */
+                return -EINVAL;
+        }
+        memset(stats, 0, sizeof(struct ieee80211_rx_stats));
+        stats->len = length - (ZD_PLCP_HEADER_SIZE + IEEE80211_FCS_LEN +
+                               + sizeof(struct rx_status));
+        /* FIXME: 802.11a */
+        stats->freq = IEEE80211_24GHZ_BAND;
+        stats->received_channel = _zd_chip_get_channel(&mac->chip);
+        stats->rssi = zd_rx_strength_percent(status->signal_strength);
+        stats->signal = zd_rx_qual_percent(buffer,
+                                          length - sizeof(struct rx_status),
+                                          status);
+        stats->mask = IEEE80211_STATMASK_RSSI | IEEE80211_STATMASK_SIGNAL;
+        stats->rate = zd_rx_rate(buffer, status);
+        if (stats->rate)
+                stats->mask |= IEEE80211_STATMASK_RATE;
+
+        return 0;
+}
+
+int zd_mac_rx(struct zd_mac *mac, const u8 *buffer, unsigned int length)
+{
+        int r;
+        struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
+        struct ieee80211_rx_stats stats;
+        const struct rx_status *status;
+        struct sk_buff *skb;
+
+        if (length < ZD_PLCP_HEADER_SIZE + IEEE80211_1ADDR_LEN +
+                     IEEE80211_FCS_LEN + sizeof(struct rx_status))
+                return -EINVAL;
+
+        r = fill_rx_stats(&stats, &status, mac, buffer, length);
+        if (r)
+                return r;
+
+        length -= ZD_PLCP_HEADER_SIZE+IEEE80211_FCS_LEN+
+                  sizeof(struct rx_status);
+        buffer += ZD_PLCP_HEADER_SIZE;
+
+        update_qual_rssi(mac, buffer, length, stats.signal, stats.rssi);
+
+        r = filter_rx(ieee, buffer, length, &stats);
+        if (r <= 0)
+                return r;
+
+        skb = dev_alloc_skb(sizeof(struct zd_rt_hdr) + length);
+        if (!skb)
+                return -ENOMEM;
+        if (ieee->iw_mode == IW_MODE_MONITOR)
+                fill_rt_header(skb_put(skb, sizeof(struct zd_rt_hdr)), mac,
+                               &stats, status);
+        memcpy(skb_put(skb, length), buffer, length);
+
+        r = ieee80211_rx(ieee, skb, &stats);
+        if (!r) {
+                ZD_ASSERT(in_irq());
+                dev_kfree_skb_irq(skb);
+        }
+        return 0;
+}
+
+static int netdev_tx(struct ieee80211_txb *txb, struct net_device *netdev,
+                     int pri)
+{
+        return zd_mac_tx(zd_netdev_mac(netdev), txb, pri);
+}
+
+static void set_security(struct net_device *netdev,
+                         struct ieee80211_security *sec)
+{
+        struct ieee80211_device *ieee = zd_netdev_ieee80211(netdev);
+        struct ieee80211_security *secinfo = &ieee->sec;
+        int keyidx;
+
+        dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)), "\n");
+
+        for (keyidx = 0; keyidx<WEP_KEYS; keyidx++)
+                if (sec->flags & (1<<keyidx)) {
+                        secinfo->encode_alg[keyidx] = sec->encode_alg[keyidx];
+                        secinfo->key_sizes[keyidx] = sec->key_sizes[keyidx];
+                        memcpy(secinfo->keys[keyidx], sec->keys[keyidx],
+                               SCM_KEY_LEN);
+                }
+
+        if (sec->flags & SEC_ACTIVE_KEY) {
+                secinfo->active_key = sec->active_key;
+                dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)),
+                        "   .active_key = %d\n", sec->active_key);
+        }
+        if (sec->flags & SEC_UNICAST_GROUP) {
+                secinfo->unicast_uses_group = sec->unicast_uses_group;
+                dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)),
+                        "   .unicast_uses_group = %d\n",
+                        sec->unicast_uses_group);
+        }
+        if (sec->flags & SEC_LEVEL) {
+                secinfo->level = sec->level;
+                dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)),
+                        "   .level = %d\n", sec->level);
+        }
+        if (sec->flags & SEC_ENABLED) {
+                secinfo->enabled = sec->enabled;
+                dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)),
+                        "   .enabled = %d\n", sec->enabled);
+        }
+        if (sec->flags & SEC_ENCRYPT) {
+                secinfo->encrypt = sec->encrypt;
+                dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)),
+                        "   .encrypt = %d\n", sec->encrypt);
+        }
+        if (sec->flags & SEC_AUTH_MODE) {
+                secinfo->auth_mode = sec->auth_mode;
+                dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)),
+                        "   .auth_mode = %d\n", sec->auth_mode);
+        }
+}
+
+static void ieee_init(struct ieee80211_device *ieee)
+{
+        ieee->mode = IEEE_B | IEEE_G;
+        ieee->freq_band = IEEE80211_24GHZ_BAND;
+        ieee->modulation = IEEE80211_OFDM_MODULATION | IEEE80211_CCK_MODULATION;
+        ieee->tx_headroom = sizeof(struct zd_ctrlset);
+        ieee->set_security = set_security;
+        ieee->hard_start_xmit = netdev_tx;
+
+        /* Software encryption/decryption for now */
+        ieee->host_build_iv = 0;
+        ieee->host_encrypt = 1;
+        ieee->host_decrypt = 1;
+
+        /* FIXME: default to managed mode, until ieee80211 and zd1211rw can
+         * correctly support AUTO */
+        ieee->iw_mode = IW_MODE_INFRA;
+}
+
+static void softmac_init(struct ieee80211softmac_device *sm)
+{
+        sm->set_channel = set_channel;
+}
+
+struct iw_statistics *zd_mac_get_wireless_stats(struct net_device *ndev)
+{
+        struct zd_mac *mac = zd_netdev_mac(ndev);
+        struct iw_statistics *iw_stats = &mac->iw_stats;
+        unsigned int i, count, qual_total, rssi_total;
+
+        memset(iw_stats, 0, sizeof(struct iw_statistics));
+        /* We are not setting the status, because ieee->state is not updated
+         * at all and this driver doesn't track authentication state.
+         */
+        spin_lock_irq(&mac->lock);
+        count = mac->stats_count < ZD_MAC_STATS_BUFFER_SIZE ?
+                mac->stats_count : ZD_MAC_STATS_BUFFER_SIZE;
+        qual_total = rssi_total = 0;
+        for (i = 0; i < count; i++) {
+                qual_total += mac->qual_buffer[i];
+                rssi_total += mac->rssi_buffer[i];
+        }
+        spin_unlock_irq(&mac->lock);
+        iw_stats->qual.updated = IW_QUAL_NOISE_INVALID;
+        if (count > 0) {
+                iw_stats->qual.qual = qual_total / count;
+                iw_stats->qual.level = rssi_total / count;
+                iw_stats->qual.updated |=
+                        IW_QUAL_QUAL_UPDATED|IW_QUAL_LEVEL_UPDATED;
+        } else {
+                iw_stats->qual.updated |=
+                        IW_QUAL_QUAL_INVALID|IW_QUAL_LEVEL_INVALID;
+        }
+        /* TODO: update counter */
+        return iw_stats;
+}
+
+#ifdef DEBUG
+static const char* decryption_types[] = {
+        [ZD_RX_NO_WEP] = "none",
+        [ZD_RX_WEP64] = "WEP64",
+        [ZD_RX_TKIP] = "TKIP",
+        [ZD_RX_AES] = "AES",
+        [ZD_RX_WEP128] = "WEP128",
+        [ZD_RX_WEP256] = "WEP256",
+};
+
+static const char *decryption_type_string(u8 type)
+{
+        const char *s;
+
+        if (type < ARRAY_SIZE(decryption_types)) {
+                s = decryption_types[type];
+        } else {
+                s = NULL;
+        }
+        return s ? s : "unknown";
+}
+
+static int is_ofdm(u8 frame_status)
+{
+        return (frame_status & ZD_RX_OFDM);
+}
+
+void zd_dump_rx_status(const struct rx_status *status)
+{
+        const char* modulation;
+        u8 quality;
+
+        if (is_ofdm(status->frame_status)) {
+                modulation = "ofdm";
+                quality = status->signal_quality_ofdm;
+        } else {
+                modulation = "cck";
+                quality = status->signal_quality_cck;
+        }
+        pr_debug("rx status %s strength %#04x qual %#04x decryption %s\n",
+                modulation, status->signal_strength, quality,
+                decryption_type_string(status->decryption_type));
+        if (status->frame_status & ZD_RX_ERROR) {
+                pr_debug("rx error %s%s%s%s%s%s\n",
+                        (status->frame_status & ZD_RX_TIMEOUT_ERROR) ?
+                                "timeout " : "",
+                        (status->frame_status & ZD_RX_FIFO_OVERRUN_ERROR) ?
+                                "fifo " : "",
+                        (status->frame_status & ZD_RX_DECRYPTION_ERROR) ?
+                                "decryption " : "",
+                        (status->frame_status & ZD_RX_CRC32_ERROR) ?
+                                "crc32 " : "",
+                        (status->frame_status & ZD_RX_NO_ADDR1_MATCH_ERROR) ?
+                                "addr1 " : "",
+                        (status->frame_status & ZD_RX_CRC16_ERROR) ?
+                                "crc16" : "");
+        }
+}
+#endif /* DEBUG */
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
new file mode 100644
index 000000000000..b3ba49b84634
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -0,0 +1,193 @@
+/* zd_mac.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_MAC_H
+#define _ZD_MAC_H
+
+#include <linux/wireless.h>
+#include <linux/kernel.h>
+#include <net/ieee80211.h>
+#include <net/ieee80211softmac.h>
+
+#include "zd_chip.h"
+#include "zd_netdev.h"
+
+struct zd_ctrlset {
+        u8     modulation;
+        __le16 tx_length;
+        u8     control;
+        /* stores only the difference to tx_length on ZD1211B */
+        __le16 packet_length;
+        __le16 current_length;
+        u8     service;
+        __le16  next_frame_length;
+} __attribute__((packed));
+
+#define ZD_CS_RESERVED_SIZE     25
+
+/* zd_crtlset field modulation */
+#define ZD_CS_RATE_MASK         0x0f
+#define ZD_CS_TYPE_MASK         0x10
+#define ZD_CS_RATE(modulation) ((modulation) & ZD_CS_RATE_MASK)
+#define ZD_CS_TYPE(modulation) ((modulation) & ZD_CS_TYPE_MASK)
+
+#define ZD_CS_CCK               0x00
+#define ZD_CS_OFDM              0x10
+
+#define ZD_CS_CCK_RATE_1M       0x00
+#define ZD_CS_CCK_RATE_2M       0x01
+#define ZD_CS_CCK_RATE_5_5M     0x02
+#define ZD_CS_CCK_RATE_11M      0x03
+/* The rates for OFDM are encoded as in the PLCP header. Use ZD_OFDM_RATE_*.
+ */
+
+/* bit 5 is preamble (when in CCK mode), or a/g selection (when in OFDM mode) */
+#define ZD_CS_CCK_PREA_LONG     0x00
+#define ZD_CS_CCK_PREA_SHORT    0x20
+#define ZD_CS_OFDM_MODE_11G     0x00
+#define ZD_CS_OFDM_MODE_11A     0x20
+
+/* zd_ctrlset control field */
+#define ZD_CS_NEED_RANDOM_BACKOFF       0x01
+#define ZD_CS_MULTICAST                 0x02
+
+#define ZD_CS_FRAME_TYPE_MASK           0x0c
+#define ZD_CS_DATA_FRAME                0x00
+#define ZD_CS_PS_POLL_FRAME             0x04
+#define ZD_CS_MANAGEMENT_FRAME          0x08
+#define ZD_CS_NO_SEQUENCE_CTL_FRAME     0x0c
+
+#define ZD_CS_WAKE_DESTINATION          0x10
+#define ZD_CS_RTS                       0x20
+#define ZD_CS_ENCRYPT                   0x40
+#define ZD_CS_SELF_CTS                  0x80
+
+/* Incoming frames are prepended by a PLCP header */
+#define ZD_PLCP_HEADER_SIZE             5
+
+struct rx_length_info {
+        __le16 length[3];
+        __le16 tag;
+} __attribute__((packed));
+
+#define RX_LENGTH_INFO_TAG              0x697e
+
+struct rx_status {
+        u8 signal_quality_cck;
+        /* rssi */
+        u8 signal_strength;
+        u8 signal_quality_ofdm;
+        u8 decryption_type;
+        u8 frame_status;
+} __attribute__((packed));
+
+/* rx_status field decryption_type */
+#define ZD_RX_NO_WEP    0
+#define ZD_RX_WEP64     1
+#define ZD_RX_TKIP      2
+#define ZD_RX_AES       4
+#define ZD_RX_WEP128    5
+#define ZD_RX_WEP256    6
+
+/* rx_status field frame_status */
+#define ZD_RX_FRAME_MODULATION_MASK     0x01
+#define ZD_RX_CCK                       0x00
+#define ZD_RX_OFDM                      0x01
+
+#define ZD_RX_TIMEOUT_ERROR             0x02
+#define ZD_RX_FIFO_OVERRUN_ERROR        0x04
+#define ZD_RX_DECRYPTION_ERROR          0x08
+#define ZD_RX_CRC32_ERROR               0x10
+#define ZD_RX_NO_ADDR1_MATCH_ERROR      0x20
+#define ZD_RX_CRC16_ERROR               0x40
+#define ZD_RX_ERROR                     0x80
+
+enum mac_flags {
+        MAC_FIXED_CHANNEL = 0x01,
+};
+
+#define ZD_MAC_STATS_BUFFER_SIZE 16
+
+struct zd_mac {
+        struct net_device *netdev;
+        struct zd_chip chip;
+        spinlock_t lock;
+        /* Unlocked reading possible */
+        struct iw_statistics iw_stats;
+        unsigned int stats_count;
+        u8 qual_buffer[ZD_MAC_STATS_BUFFER_SIZE];
+        u8 rssi_buffer[ZD_MAC_STATS_BUFFER_SIZE];
+        u8 regdomain;
+        u8 default_regdomain;
+        u8 requested_channel;
+};
+
+static inline struct ieee80211_device *zd_mac_to_ieee80211(struct zd_mac *mac)
+{
+        return zd_netdev_ieee80211(mac->netdev);
+}
+
+static inline struct zd_mac *zd_netdev_mac(struct net_device *netdev)
+{
+        return ieee80211softmac_priv(netdev);
+}
+
+static inline struct zd_mac *zd_chip_to_mac(struct zd_chip *chip)
+{
+        return container_of(chip, struct zd_mac, chip);
+}
+
+static inline struct zd_mac *zd_usb_to_mac(struct zd_usb *usb)
+{
+        return zd_chip_to_mac(zd_usb_to_chip(usb));
+}
+
+#define zd_mac_dev(mac) (zd_chip_dev(&(mac)->chip))
+
+int zd_mac_init(struct zd_mac *mac,
+                struct net_device *netdev,
+                struct usb_interface *intf);
+void zd_mac_clear(struct zd_mac *mac);
+
+int zd_mac_init_hw(struct zd_mac *mac, u8 device_type);
+
+int zd_mac_open(struct net_device *netdev);
+int zd_mac_stop(struct net_device *netdev);
+int zd_mac_set_mac_address(struct net_device *dev, void *p);
+
+int zd_mac_rx(struct zd_mac *mac, const u8 *buffer, unsigned int length);
+
+int zd_mac_set_regdomain(struct zd_mac *zd_mac, u8 regdomain);
+u8 zd_mac_get_regdomain(struct zd_mac *zd_mac);
+
+int zd_mac_request_channel(struct zd_mac *mac, u8 channel);
+int zd_mac_get_channel(struct zd_mac *mac, u8 *channel, u8 *flags);
+
+int zd_mac_set_mode(struct zd_mac *mac, u32 mode);
+int zd_mac_get_mode(struct zd_mac *mac, u32 *mode);
+
+int zd_mac_get_range(struct zd_mac *mac, struct iw_range *range);
+
+struct iw_statistics *zd_mac_get_wireless_stats(struct net_device *ndev);
+
+#ifdef DEBUG
+void zd_dump_rx_status(const struct rx_status *status);
+#else
+#define zd_dump_rx_status(status)
+#endif /* DEBUG */
+
+#endif /* _ZD_MAC_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_netdev.c b/drivers/net/wireless/zd1211rw/zd_netdev.c
new file mode 100644
index 000000000000..9df232c2c863
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_netdev.c
@@ -0,0 +1,267 @@
+/* zd_netdev.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <net/ieee80211.h>
+#include <net/ieee80211softmac.h>
+#include <net/ieee80211softmac_wx.h>
+#include <net/iw_handler.h>
+
+#include "zd_def.h"
+#include "zd_netdev.h"
+#include "zd_mac.h"
+#include "zd_ieee80211.h"
+
+/* Region 0 means reset regdomain to default. */
+static int zd_set_regdomain(struct net_device *netdev,
+                            struct iw_request_info *info,
+                            union iwreq_data *req, char *extra)
+{
+        const u8 *regdomain = (u8 *)req;
+        return zd_mac_set_regdomain(zd_netdev_mac(netdev), *regdomain);
+}
+
+static int zd_get_regdomain(struct net_device *netdev,
+                            struct iw_request_info *info,
+                            union iwreq_data *req, char *extra)
+{
+        u8 *regdomain = (u8 *)req;
+        if (!regdomain)
+                return -EINVAL;
+        *regdomain = zd_mac_get_regdomain(zd_netdev_mac(netdev));
+        return 0;
+}
+
+static const struct iw_priv_args zd_priv_args[] = {
+        {
+                .cmd = ZD_PRIV_SET_REGDOMAIN,
+                .set_args = IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1,
+                .name = "set_regdomain",
+        },
+        {
+                .cmd = ZD_PRIV_GET_REGDOMAIN,
+                .get_args = IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1,
+                .name = "get_regdomain",
+        },
+};
+
+#define PRIV_OFFSET(x) [(x)-SIOCIWFIRSTPRIV]
+
+static const iw_handler zd_priv_handler[] = {
+        PRIV_OFFSET(ZD_PRIV_SET_REGDOMAIN) = zd_set_regdomain,
+        PRIV_OFFSET(ZD_PRIV_GET_REGDOMAIN) = zd_get_regdomain,
+};
+
+static int iw_get_name(struct net_device *netdev,
+                       struct iw_request_info *info,
+                       union iwreq_data *req, char *extra)
+{
+        /* FIXME: check whether 802.11a will also supported, add also
+         *        zd1211B, if we support it.
+         */
+        strlcpy(req->name, "802.11g zd1211", IFNAMSIZ);
+        return 0;
+}
+
+static int iw_set_freq(struct net_device *netdev,
+                       struct iw_request_info *info,
+                       union iwreq_data *req, char *extra)
+{
+        int r;
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct iw_freq *freq = &req->freq;
+        u8 channel;
+
+        r = zd_find_channel(&channel, freq);
+        if (r < 0)
+                return r;
+        r = zd_mac_request_channel(mac, channel);
+        return r;
+}
+
+static int iw_get_freq(struct net_device *netdev,
+                   struct iw_request_info *info,
+                   union iwreq_data *req, char *extra)
+{
+        int r;
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct iw_freq *freq = &req->freq;
+        u8 channel;
+        u8 flags;
+
+        r = zd_mac_get_channel(mac, &channel, &flags);
+        if (r)
+                return r;
+
+        freq->flags = (flags & MAC_FIXED_CHANNEL) ?
+                      IW_FREQ_FIXED : IW_FREQ_AUTO;
+        dev_dbg_f(zd_mac_dev(mac), "channel %s\n",
+                  (flags & MAC_FIXED_CHANNEL) ? "fixed" : "auto");
+        return zd_channel_to_freq(freq, channel);
+}
+
+static int iw_set_mode(struct net_device *netdev,
+                       struct iw_request_info *info,
+                       union iwreq_data *req, char *extra)
+{
+        return zd_mac_set_mode(zd_netdev_mac(netdev), req->mode);
+}
+
+static int iw_get_mode(struct net_device *netdev,
+                       struct iw_request_info *info,
+                       union iwreq_data *req, char *extra)
+{
+        return zd_mac_get_mode(zd_netdev_mac(netdev), &req->mode);
+}
+
+static int iw_get_range(struct net_device *netdev,
+                       struct iw_request_info *info,
+                       union iwreq_data *req, char *extra)
+{
+        struct iw_range *range = (struct iw_range *)extra;
+
+        dev_dbg_f(zd_mac_dev(zd_netdev_mac(netdev)), "\n");
+        req->data.length = sizeof(*range);
+        return zd_mac_get_range(zd_netdev_mac(netdev), range);
+}
+
+static int iw_set_encode(struct net_device *netdev,
+                         struct iw_request_info *info,
+                         union iwreq_data *data,
+                         char *extra)
+{
+        return ieee80211_wx_set_encode(zd_netdev_ieee80211(netdev), info,
+                data, extra);
+}
+
+static int iw_get_encode(struct net_device *netdev,
+                         struct iw_request_info *info,
+                         union iwreq_data *data,
+                         char *extra)
+{
+        return ieee80211_wx_get_encode(zd_netdev_ieee80211(netdev), info,
+                data, extra);
+}
+
+static int iw_set_encodeext(struct net_device *netdev,
+                         struct iw_request_info *info,
+                         union iwreq_data *data,
+                         char *extra)
+{
+        return ieee80211_wx_set_encodeext(zd_netdev_ieee80211(netdev), info,
+                data, extra);
+}
+
+static int iw_get_encodeext(struct net_device *netdev,
+                         struct iw_request_info *info,
+                         union iwreq_data *data,
+                         char *extra)
+{
+        return ieee80211_wx_get_encodeext(zd_netdev_ieee80211(netdev), info,
+                data, extra);
+}
+
+#define WX(x) [(x)-SIOCIWFIRST]
+
+static const iw_handler zd_standard_iw_handlers[] = {
+        WX(SIOCGIWNAME)         = iw_get_name,
+        WX(SIOCSIWFREQ)         = iw_set_freq,
+        WX(SIOCGIWFREQ)         = iw_get_freq,
+        WX(SIOCSIWMODE)         = iw_set_mode,
+        WX(SIOCGIWMODE)         = iw_get_mode,
+        WX(SIOCGIWRANGE)        = iw_get_range,
+        WX(SIOCSIWENCODE)       = iw_set_encode,
+        WX(SIOCGIWENCODE)       = iw_get_encode,
+        WX(SIOCSIWENCODEEXT)    = iw_set_encodeext,
+        WX(SIOCGIWENCODEEXT)    = iw_get_encodeext,
+        WX(SIOCSIWAUTH)         = ieee80211_wx_set_auth,
+        WX(SIOCGIWAUTH)         = ieee80211_wx_get_auth,
+        WX(SIOCSIWSCAN)         = ieee80211softmac_wx_trigger_scan,
+        WX(SIOCGIWSCAN)         = ieee80211softmac_wx_get_scan_results,
+        WX(SIOCSIWESSID)        = ieee80211softmac_wx_set_essid,
+        WX(SIOCGIWESSID)        = ieee80211softmac_wx_get_essid,
+        WX(SIOCSIWAP)           = ieee80211softmac_wx_set_wap,
+        WX(SIOCGIWAP)           = ieee80211softmac_wx_get_wap,
+        WX(SIOCSIWRATE)         = ieee80211softmac_wx_set_rate,
+        WX(SIOCGIWRATE)         = ieee80211softmac_wx_get_rate,
+        WX(SIOCSIWGENIE)        = ieee80211softmac_wx_set_genie,
+        WX(SIOCGIWGENIE)        = ieee80211softmac_wx_get_genie,
+        WX(SIOCSIWMLME)         = ieee80211softmac_wx_set_mlme,
+};
+
+static const struct iw_handler_def iw_handler_def = {
+        .standard               = zd_standard_iw_handlers,
+        .num_standard           = ARRAY_SIZE(zd_standard_iw_handlers),
+        .private                = zd_priv_handler,
+        .num_private            = ARRAY_SIZE(zd_priv_handler),
+        .private_args           = zd_priv_args,
+        .num_private_args       = ARRAY_SIZE(zd_priv_args),
+        .get_wireless_stats     = zd_mac_get_wireless_stats,
+};
+
+struct net_device *zd_netdev_alloc(struct usb_interface *intf)
+{
+        int r;
+        struct net_device *netdev;
+        struct zd_mac *mac;
+
+        netdev = alloc_ieee80211softmac(sizeof(struct zd_mac));
+        if (!netdev) {
+                dev_dbg_f(&intf->dev, "out of memory\n");
+                return NULL;
+        }
+
+        mac = zd_netdev_mac(netdev);
+        r = zd_mac_init(mac, netdev, intf);
+        if (r) {
+                usb_set_intfdata(intf, NULL);
+                free_ieee80211(netdev);
+                return NULL;
+        }
+
+        SET_MODULE_OWNER(netdev);
+        SET_NETDEV_DEV(netdev, &intf->dev);
+
+        dev_dbg_f(&intf->dev, "netdev->flags %#06hx\n", netdev->flags);
+        dev_dbg_f(&intf->dev, "netdev->features %#010lx\n", netdev->features);
+
+        netdev->open = zd_mac_open;
+        netdev->stop = zd_mac_stop;
+        /* netdev->get_stats = */
+        /* netdev->set_multicast_list = */
+        netdev->set_mac_address = zd_mac_set_mac_address;
+        netdev->wireless_handlers = &iw_handler_def;
+        /* netdev->ethtool_ops = */
+
+        return netdev;
+}
+
+void zd_netdev_free(struct net_device *netdev)
+{
+        if (!netdev)
+                return;
+
+        zd_mac_clear(zd_netdev_mac(netdev));
+        free_ieee80211(netdev);
+}
+
+void zd_netdev_disconnect(struct net_device *netdev)
+{
+        unregister_netdev(netdev);
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_netdev.h b/drivers/net/wireless/zd1211rw/zd_netdev.h
new file mode 100644
index 000000000000..374a957073c1
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_netdev.h
@@ -0,0 +1,45 @@
+/* zd_netdev.h: Header for net device related functions.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_NETDEV_H
+#define _ZD_NETDEV_H
+
+#include <linux/usb.h>
+#include <linux/netdevice.h>
+#include <net/ieee80211.h>
+
+#define ZD_PRIV_SET_REGDOMAIN (SIOCIWFIRSTPRIV)
+#define ZD_PRIV_GET_REGDOMAIN (SIOCIWFIRSTPRIV+1)
+
+static inline struct ieee80211_device *zd_netdev_ieee80211(
+        struct net_device *ndev)
+{
+        return netdev_priv(ndev);
+}
+
+static inline struct net_device *zd_ieee80211_to_netdev(
+        struct ieee80211_device *ieee)
+{
+        return ieee->dev;
+}
+
+struct net_device *zd_netdev_alloc(struct usb_interface *intf);
+void zd_netdev_free(struct net_device *netdev);
+
+void zd_netdev_disconnect(struct net_device *netdev);
+
+#endif /* _ZD_NETDEV_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_rf.c b/drivers/net/wireless/zd1211rw/zd_rf.c
new file mode 100644
index 000000000000..d3770d2c61bc
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_rf.c
@@ -0,0 +1,151 @@
+/* zd_rf.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/errno.h>
+#include <linux/string.h>
+
+#include "zd_def.h"
+#include "zd_rf.h"
+#include "zd_ieee80211.h"
+#include "zd_chip.h"
+
+static const char *rfs[] = {
+        [0]             = "unknown RF0",
+        [1]             = "unknown RF1",
+        [UW2451_RF]     = "UW2451_RF",
+        [UCHIP_RF]      = "UCHIP_RF",
+        [AL2230_RF]     = "AL2230_RF",
+        [AL7230B_RF]    = "AL7230B_RF",
+        [THETA_RF]      = "THETA_RF",
+        [AL2210_RF]     = "AL2210_RF",
+        [MAXIM_NEW_RF]  = "MAXIM_NEW_RF",
+        [UW2453_RF]     = "UW2453_RF",
+        [AL2230S_RF]    = "AL2230S_RF",
+        [RALINK_RF]     = "RALINK_RF",
+        [INTERSIL_RF]   = "INTERSIL_RF",
+        [RF2959_RF]     = "RF2959_RF",
+        [MAXIM_NEW2_RF] = "MAXIM_NEW2_RF",
+        [PHILIPS_RF]    = "PHILIPS_RF",
+};
+
+const char *zd_rf_name(u8 type)
+{
+        if (type & 0xf0)
+                type = 0;
+        return rfs[type];
+}
+
+void zd_rf_init(struct zd_rf *rf)
+{
+        memset(rf, 0, sizeof(*rf));
+}
+
+void zd_rf_clear(struct zd_rf *rf)
+{
+        memset(rf, 0, sizeof(*rf));
+}
+
+int zd_rf_init_hw(struct zd_rf *rf, u8 type)
+{
+        int r, t;
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        switch (type) {
+        case RF2959_RF:
+                r = zd_rf_init_rf2959(rf);
+                if (r)
+                        return r;
+                break;
+        case AL2230_RF:
+                r = zd_rf_init_al2230(rf);
+                if (r)
+                        return r;
+                break;
+        default:
+                dev_err(zd_chip_dev(chip),
+                        "RF %s %#x is not supported\n", zd_rf_name(type), type);
+                rf->type = 0;
+                return -ENODEV;
+        }
+
+        rf->type = type;
+
+        r = zd_chip_lock_phy_regs(chip);
+        if (r)
+                return r;
+        t = rf->init_hw(rf);
+        r = zd_chip_unlock_phy_regs(chip);
+        if (t)
+                r = t;
+        return r;
+}
+
+int zd_rf_scnprint_id(struct zd_rf *rf, char *buffer, size_t size)
+{
+        return scnprintf(buffer, size, "%s", zd_rf_name(rf->type));
+}
+
+int zd_rf_set_channel(struct zd_rf *rf, u8 channel)
+{
+        int r;
+
+        ZD_ASSERT(mutex_is_locked(&zd_rf_to_chip(rf)->mutex));
+        if (channel < MIN_CHANNEL24)
+                return -EINVAL;
+        if (channel > MAX_CHANNEL24)
+                return -EINVAL;
+        dev_dbg_f(zd_chip_dev(zd_rf_to_chip(rf)), "channel: %d\n", channel);
+
+        r = rf->set_channel(rf, channel);
+        if (r >= 0)
+                rf->channel = channel;
+        return r;
+}
+
+int zd_switch_radio_on(struct zd_rf *rf)
+{
+        int r, t;
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_chip_lock_phy_regs(chip);
+        if (r)
+                return r;
+        t = rf->switch_radio_on(rf);
+        r = zd_chip_unlock_phy_regs(chip);
+        if (t)
+                r = t;
+        return r;
+}
+
+int zd_switch_radio_off(struct zd_rf *rf)
+{
+        int r, t;
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        /* TODO: move phy regs handling to zd_chip */
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_chip_lock_phy_regs(chip);
+        if (r)
+                return r;
+        t = rf->switch_radio_off(rf);
+        r = zd_chip_unlock_phy_regs(chip);
+        if (t)
+                r = t;
+        return r;
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_rf.h b/drivers/net/wireless/zd1211rw/zd_rf.h
new file mode 100644
index 000000000000..ea30f693fcc8
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_rf.h
@@ -0,0 +1,82 @@
+/* zd_rf.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_RF_H
+#define _ZD_RF_H
+
+#include "zd_types.h"
+
+#define UW2451_RF                       0x2
+#define UCHIP_RF                        0x3
+#define AL2230_RF                       0x4
+#define AL7230B_RF                      0x5     /* a,b,g */
+#define THETA_RF                        0x6
+#define AL2210_RF                       0x7
+#define MAXIM_NEW_RF                    0x8
+#define UW2453_RF                       0x9
+#define AL2230S_RF                      0xa
+#define RALINK_RF                       0xb
+#define INTERSIL_RF                     0xc
+#define RF2959_RF                       0xd
+#define MAXIM_NEW2_RF                   0xe
+#define PHILIPS_RF                      0xf
+
+#define RF_CHANNEL(ch) [(ch)-1]
+
+/* Provides functions of the RF transceiver. */
+
+enum {
+        RF_REG_BITS = 6,
+        RF_VALUE_BITS = 18,
+        RF_RV_BITS = RF_REG_BITS + RF_VALUE_BITS,
+};
+
+struct zd_rf {
+        u8 type;
+
+        u8 channel;
+        /*
+         * Whether this RF should patch the 6M band edge
+         * (assuming E2P_POD agrees)
+         */
+        u8 patch_6m_band_edge:1;
+
+        /* RF-specific functions */
+        int (*init_hw)(struct zd_rf *rf);
+        int (*set_channel)(struct zd_rf *rf, u8 channel);
+        int (*switch_radio_on)(struct zd_rf *rf);
+        int (*switch_radio_off)(struct zd_rf *rf);
+};
+
+const char *zd_rf_name(u8 type);
+void zd_rf_init(struct zd_rf *rf);
+void zd_rf_clear(struct zd_rf *rf);
+int zd_rf_init_hw(struct zd_rf *rf, u8 type);
+
+int zd_rf_scnprint_id(struct zd_rf *rf, char *buffer, size_t size);
+
+int zd_rf_set_channel(struct zd_rf *rf, u8 channel);
+
+int zd_switch_radio_on(struct zd_rf *rf);
+int zd_switch_radio_off(struct zd_rf *rf);
+
+/* Functions for individual RF chips */
+
+int zd_rf_init_rf2959(struct zd_rf *rf);
+int zd_rf_init_al2230(struct zd_rf *rf);
+
+#endif /* _ZD_RF_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_al2230.c b/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
new file mode 100644
index 000000000000..0948b25f660d
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
@@ -0,0 +1,308 @@
+/* zd_rf_al2230.c: Functions for the AL2230 RF controller
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/kernel.h>
+
+#include "zd_rf.h"
+#include "zd_usb.h"
+#include "zd_chip.h"
+
+static const u32 al2230_table[][3] = {
+        RF_CHANNEL( 1) = { 0x03f790, 0x033331, 0x00000d, },
+        RF_CHANNEL( 2) = { 0x03f790, 0x0b3331, 0x00000d, },
+        RF_CHANNEL( 3) = { 0x03e790, 0x033331, 0x00000d, },
+        RF_CHANNEL( 4) = { 0x03e790, 0x0b3331, 0x00000d, },
+        RF_CHANNEL( 5) = { 0x03f7a0, 0x033331, 0x00000d, },
+        RF_CHANNEL( 6) = { 0x03f7a0, 0x0b3331, 0x00000d, },
+        RF_CHANNEL( 7) = { 0x03e7a0, 0x033331, 0x00000d, },
+        RF_CHANNEL( 8) = { 0x03e7a0, 0x0b3331, 0x00000d, },
+        RF_CHANNEL( 9) = { 0x03f7b0, 0x033331, 0x00000d, },
+        RF_CHANNEL(10) = { 0x03f7b0, 0x0b3331, 0x00000d, },
+        RF_CHANNEL(11) = { 0x03e7b0, 0x033331, 0x00000d, },
+        RF_CHANNEL(12) = { 0x03e7b0, 0x0b3331, 0x00000d, },
+        RF_CHANNEL(13) = { 0x03f7c0, 0x033331, 0x00000d, },
+        RF_CHANNEL(14) = { 0x03e7c0, 0x066661, 0x00000d, },
+};
+
+static int zd1211_al2230_init_hw(struct zd_rf *rf)
+{
+        int r;
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR15,   0x20 }, { CR23,   0x40 }, { CR24,  0x20 },
+                { CR26,   0x11 }, { CR28,   0x3e }, { CR29,  0x00 },
+                { CR44,   0x33 }, { CR106,  0x2a }, { CR107, 0x1a },
+                { CR109,  0x09 }, { CR110,  0x27 }, { CR111, 0x2b },
+                { CR112,  0x2b }, { CR119,  0x0a }, { CR10,  0x89 },
+                /* for newest (3rd cut) AL2300 */
+                { CR17,   0x28 },
+                { CR26,   0x93 }, { CR34,   0x30 },
+                /* for newest (3rd cut) AL2300 */
+                { CR35,   0x3e },
+                { CR41,   0x24 }, { CR44,   0x32 },
+                /* for newest (3rd cut) AL2300 */
+                { CR46,   0x96 },
+                { CR47,   0x1e }, { CR79,   0x58 }, { CR80,  0x30 },
+                { CR81,   0x30 }, { CR87,   0x0a }, { CR89,  0x04 },
+                { CR92,   0x0a }, { CR99,   0x28 }, { CR100, 0x00 },
+                { CR101,  0x13 }, { CR102,  0x27 }, { CR106, 0x24 },
+                { CR107,  0x2a }, { CR109,  0x09 }, { CR110, 0x13 },
+                { CR111,  0x1f }, { CR112,  0x1f }, { CR113, 0x27 },
+                { CR114,  0x27 },
+                /* for newest (3rd cut) AL2300 */
+                { CR115,  0x24 },
+                { CR116,  0x24 }, { CR117,  0xf4 }, { CR118, 0xfc },
+                { CR119,  0x10 }, { CR120,  0x4f }, { CR121, 0x77 },
+                { CR122,  0xe0 }, { CR137,  0x88 }, { CR252, 0xff },
+                { CR253,  0xff },
+
+                /* These following happen separately in the vendor driver */
+                { },
+
+                /* shdnb(PLL_ON)=0 */
+                { CR251,  0x2f },
+                /* shdnb(PLL_ON)=1 */
+                { CR251,  0x3f },
+                { CR138,  0x28 }, { CR203,  0x06 },
+        };
+
+        static const u32 rv[] = {
+                /* Channel 1 */
+                0x03f790,
+                0x033331,
+                0x00000d,
+
+                0x0b3331,
+                0x03b812,
+                0x00fff3,
+                0x000da4,
+                0x0f4dc5, /* fix freq shift, 0x04edc5 */
+                0x0805b6,
+                0x011687,
+                0x000688,
+                0x0403b9, /* external control TX power (CR31) */
+                0x00dbba,
+                0x00099b,
+                0x0bdffc,
+                0x00000d,
+                0x00500f,
+
+                /* These writes happen separately in the vendor driver */
+                0x00d00f,
+                0x004c0f,
+                0x00540f,
+                0x00700f,
+                0x00500f,
+        };
+
+        r = zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+        if (r)
+                return r;
+
+        r = zd_rfwritev_locked(chip, rv, ARRAY_SIZE(rv), RF_RV_BITS);
+        if (r)
+                return r;
+
+        return 0;
+}
+
+static int zd1211b_al2230_init_hw(struct zd_rf *rf)
+{
+        int r;
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        static const struct zd_ioreq16 ioreqs1[] = {
+                { CR10,  0x89 }, { CR15,  0x20 },
+                { CR17,  0x2B }, /* for newest(3rd cut) AL2230 */
+                { CR23,  0x40 }, { CR24,  0x20 }, { CR26,  0x93 },
+                { CR28,  0x3e }, { CR29,  0x00 },
+                { CR33,  0x28 }, /* 5621 */
+                { CR34,  0x30 },
+                { CR35,  0x3e }, /* for newest(3rd cut) AL2230 */
+                { CR41,  0x24 }, { CR44,  0x32 },
+                { CR46,  0x99 }, /* for newest(3rd cut) AL2230 */
+                { CR47,  0x1e },
+
+                /* ZD1211B 05.06.10 */
+                { CR48,  0x00 }, { CR49,  0x00 }, { CR51,  0x01 },
+                { CR52,  0x80 }, { CR53,  0x7e }, { CR65,  0x00 },
+                { CR66,  0x00 }, { CR67,  0x00 }, { CR68,  0x00 },
+                { CR69,  0x28 },
+
+                { CR79,  0x58 }, { CR80,  0x30 }, { CR81,  0x30 },
+                { CR87,  0x0a }, { CR89,  0x04 },
+                { CR91,  0x00 }, /* 5621 */
+                { CR92,  0x0a },
+                { CR98,  0x8d }, /* 4804,  for 1212 new algorithm */
+                { CR99,  0x00 }, /* 5621 */
+                { CR101, 0x13 }, { CR102, 0x27 },
+                { CR106, 0x24 }, /* for newest(3rd cut) AL2230 */
+                { CR107, 0x2a },
+                { CR109, 0x13 }, /* 4804, for 1212 new algorithm */
+                { CR110, 0x1f }, /* 4804, for 1212 new algorithm */
+                { CR111, 0x1f }, { CR112, 0x1f }, { CR113, 0x27 },
+                { CR114, 0x27 },
+                { CR115, 0x26 }, /* 24->26 at 4902 for newest(3rd cut) AL2230 */
+                { CR116, 0x24 },
+                { CR117, 0xfa }, /* for 1211b */
+                { CR118, 0xfa }, /* for 1211b */
+                { CR119, 0x10 },
+                { CR120, 0x4f },
+                { CR121, 0x6c }, /* for 1211b */
+                { CR122, 0xfc }, /* E0->FC at 4902 */
+                { CR123, 0x57 }, /* 5623 */
+                { CR125, 0xad }, /* 4804, for 1212 new algorithm */
+                { CR126, 0x6c }, /* 5614 */
+                { CR127, 0x03 }, /* 4804, for 1212 new algorithm */
+                { CR137, 0x50 }, /* 5614 */
+                { CR138, 0xa8 },
+                { CR144, 0xac }, /* 5621 */
+                { CR150, 0x0d }, { CR252, 0x00 }, { CR253, 0x00 },
+        };
+
+        static const u32 rv1[] = {
+                /* channel 1 */
+                0x03f790,
+                0x033331,
+                0x00000d,
+
+                0x0b3331,
+                0x03b812,
+                0x00fff3,
+                0x0005a4,
+                0x0f4dc5, /* fix freq shift 0x044dc5 */
+                0x0805b6,
+                0x0146c7,
+                0x000688,
+                0x0403b9, /* External control TX power (CR31) */
+                0x00dbba,
+                0x00099b,
+                0x0bdffc,
+                0x00000d,
+                0x00580f,
+        };
+
+        static const struct zd_ioreq16 ioreqs2[] = {
+                { CR47,  0x1e }, { CR_RFCFG, 0x03 },
+        };
+
+        static const u32 rv2[] = {
+                0x00880f,
+                0x00080f,
+        };
+
+        static const struct zd_ioreq16 ioreqs3[] = {
+                { CR_RFCFG, 0x00 }, { CR47, 0x1e }, { CR251, 0x7f },
+        };
+
+        static const u32 rv3[] = {
+                0x00d80f,
+                0x00780f,
+                0x00580f,
+        };
+
+        static const struct zd_ioreq16 ioreqs4[] = {
+                { CR138, 0x28 }, { CR203, 0x06 },
+        };
+
+        r = zd_iowrite16a_locked(chip, ioreqs1, ARRAY_SIZE(ioreqs1));
+        if (r)
+                return r;
+        r = zd_rfwritev_locked(chip, rv1, ARRAY_SIZE(rv1), RF_RV_BITS);
+        if (r)
+                return r;
+        r = zd_iowrite16a_locked(chip, ioreqs2, ARRAY_SIZE(ioreqs2));
+        if (r)
+                return r;
+        r = zd_rfwritev_locked(chip, rv2, ARRAY_SIZE(rv2), RF_RV_BITS);
+        if (r)
+                return r;
+        r = zd_iowrite16a_locked(chip, ioreqs3, ARRAY_SIZE(ioreqs3));
+        if (r)
+                return r;
+        r = zd_rfwritev_locked(chip, rv3, ARRAY_SIZE(rv3), RF_RV_BITS);
+        if (r)
+                return r;
+        return zd_iowrite16a_locked(chip, ioreqs4, ARRAY_SIZE(ioreqs4));
+}
+
+static int al2230_set_channel(struct zd_rf *rf, u8 channel)
+{
+        int r;
+        const u32 *rv = al2230_table[channel-1];
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR138, 0x28 },
+                { CR203, 0x06 },
+        };
+
+        r = zd_rfwritev_locked(chip, rv, 3, RF_RV_BITS);
+        if (r)
+                return r;
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+static int zd1211_al2230_switch_radio_on(struct zd_rf *rf)
+{
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR11,  0x00 },
+                { CR251, 0x3f },
+        };
+
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+static int zd1211b_al2230_switch_radio_on(struct zd_rf *rf)
+{
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR11,  0x00 },
+                { CR251, 0x7f },
+        };
+
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+static int al2230_switch_radio_off(struct zd_rf *rf)
+{
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR11,  0x04 },
+                { CR251, 0x2f },
+        };
+
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+int zd_rf_init_al2230(struct zd_rf *rf)
+{
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        rf->set_channel = al2230_set_channel;
+        rf->switch_radio_off = al2230_switch_radio_off;
+        if (chip->is_zd1211b) {
+                rf->init_hw = zd1211b_al2230_init_hw;
+                rf->switch_radio_on = zd1211b_al2230_switch_radio_on;
+        } else {
+                rf->init_hw = zd1211_al2230_init_hw;
+                rf->switch_radio_on = zd1211_al2230_switch_radio_on;
+        }
+        rf->patch_6m_band_edge = 1;
+        return 0;
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c b/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c
new file mode 100644
index 000000000000..58247271cc24
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c
@@ -0,0 +1,279 @@
+/* zd_rf_rfmd.c: Functions for the RFMD RF controller
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/kernel.h>
+
+#include "zd_rf.h"
+#include "zd_usb.h"
+#include "zd_chip.h"
+
+static u32 rf2959_table[][2] = {
+        RF_CHANNEL( 1) = { 0x181979, 0x1e6666 },
+        RF_CHANNEL( 2) = { 0x181989, 0x1e6666 },
+        RF_CHANNEL( 3) = { 0x181999, 0x1e6666 },
+        RF_CHANNEL( 4) = { 0x1819a9, 0x1e6666 },
+        RF_CHANNEL( 5) = { 0x1819b9, 0x1e6666 },
+        RF_CHANNEL( 6) = { 0x1819c9, 0x1e6666 },
+        RF_CHANNEL( 7) = { 0x1819d9, 0x1e6666 },
+        RF_CHANNEL( 8) = { 0x1819e9, 0x1e6666 },
+        RF_CHANNEL( 9) = { 0x1819f9, 0x1e6666 },
+        RF_CHANNEL(10) = { 0x181a09, 0x1e6666 },
+        RF_CHANNEL(11) = { 0x181a19, 0x1e6666 },
+        RF_CHANNEL(12) = { 0x181a29, 0x1e6666 },
+        RF_CHANNEL(13) = { 0x181a39, 0x1e6666 },
+        RF_CHANNEL(14) = { 0x181a60, 0x1c0000 },
+};
+
+#if 0
+static int bits(u32 rw, int from, int to)
+{
+        rw &= ~(0xffffffffU << (to+1));
+        rw >>= from;
+        return rw;
+}
+
+static int bit(u32 rw, int bit)
+{
+        return bits(rw, bit, bit);
+}
+
+static void dump_regwrite(u32 rw)
+{
+        int reg = bits(rw, 18, 22);
+        int rw_flag = bits(rw, 23, 23);
+        PDEBUG("rf2959 %#010x reg %d rw %d", rw, reg, rw_flag);
+
+        switch (reg) {
+        case 0:
+                PDEBUG("reg0 CFG1 ref_sel %d hybernate %d rf_vco_reg_en %d"
+                       " if_vco_reg_en %d if_vga_en %d",
+                       bits(rw, 14, 15), bit(rw, 3), bit(rw, 2), bit(rw, 1),
+                       bit(rw, 0));
+                break;
+        case 1:
+                PDEBUG("reg1 IFPLL1 pll_en1 %d kv_en1 %d vtc_en1 %d lpf1 %d"
+                       " cpl1 %d pdp1 %d autocal_en1 %d ld_en1 %d ifloopr %d"
+                       " ifloopc %d dac1 %d",
+                       bit(rw, 17), bit(rw, 16), bit(rw, 15), bit(rw, 14),
+                       bit(rw, 13), bit(rw, 12), bit(rw, 11), bit(rw, 10),
+                       bits(rw, 7, 9), bits(rw, 4, 6), bits(rw, 0, 3));
+                break;
+        case 2:
+                PDEBUG("reg2 IFPLL2 n1 %d num1 %d",
+                       bits(rw, 6, 17), bits(rw, 0, 5));
+                break;
+        case 3:
+                PDEBUG("reg3 IFPLL3 num %d", bits(rw, 0, 17));
+                break;
+        case 4:
+                PDEBUG("reg4 IFPLL4 dn1 %#04x ct_def1 %d kv_def1 %d",
+                       bits(rw, 8, 16), bits(rw, 4, 7), bits(rw, 0, 3));
+                break;
+        case 5:
+                PDEBUG("reg5 RFPLL1 pll_en %d kv_en %d vtc_en %d lpf %d cpl %d"
+                       " pdp %d autocal_en %d ld_en %d rfloopr %d rfloopc %d"
+                       " dac %d",
+                       bit(rw, 17), bit(rw, 16), bit(rw, 15), bit(rw, 14),
+                       bit(rw, 13), bit(rw, 12), bit(rw, 11), bit(rw, 10),
+                       bits(rw, 7, 9), bits(rw, 4, 6), bits(rw, 0,3));
+                break;
+        case 6:
+                PDEBUG("reg6 RFPLL2 n %d num %d",
+                       bits(rw, 6, 17), bits(rw, 0, 5));
+                break;
+        case 7:
+                PDEBUG("reg7 RFPLL3 num2 %d", bits(rw, 0, 17));
+                break;
+        case 8:
+                PDEBUG("reg8 RFPLL4 dn %#06x ct_def %d kv_def %d",
+                       bits(rw, 8, 16), bits(rw, 4, 7), bits(rw, 0, 3));
+                break;
+        case 9:
+                PDEBUG("reg9 CAL1 tvco %d tlock %d m_ct_value %d ld_window %d",
+                       bits(rw, 13, 17), bits(rw, 8, 12), bits(rw, 3, 7),
+                       bits(rw, 0, 2));
+                break;
+        case 10:
+                PDEBUG("reg10 TXRX1 rxdcfbbyps %d pcontrol %d txvgc %d"
+                       " rxlpfbw %d txlpfbw %d txdiffmode %d txenmode %d"
+                       " intbiasen %d tybypass %d",
+                       bit(rw, 17), bits(rw, 15, 16), bits(rw, 10, 14),
+                       bits(rw, 7, 9), bits(rw, 4, 6), bit(rw, 3), bit(rw, 2),
+                       bit(rw, 1), bit(rw, 0));
+                break;
+        case 11:
+                PDEBUG("reg11 PCNT1 mid_bias %d p_desired %d pc_offset %d"
+                        " tx_delay %d",
+                        bits(rw, 15, 17), bits(rw, 9, 14), bits(rw, 3, 8),
+                        bits(rw, 0, 2));
+                break;
+        case 12:
+                PDEBUG("reg12 PCNT2 max_power %d mid_power %d min_power %d",
+                       bits(rw, 12, 17), bits(rw, 6, 11), bits(rw, 0, 5));
+                break;
+        case 13:
+                PDEBUG("reg13 VCOT1 rfpll vco comp %d ifpll vco comp %d"
+                       " lobias %d if_biasbuf %d if_biasvco %d rf_biasbuf %d"
+                       " rf_biasvco %d",
+                       bit(rw, 17), bit(rw, 16), bit(rw, 15),
+                       bits(rw, 8, 9), bits(rw, 5, 7), bits(rw, 3, 4),
+                       bits(rw, 0, 2));
+                break;
+        case 14:
+                PDEBUG("reg14 IQCAL rx_acal %d rx_pcal %d"
+                       " tx_acal %d tx_pcal %d",
+                       bits(rw, 13, 17), bits(rw, 9, 12), bits(rw, 4, 8),
+                       bits(rw, 0, 3));
+                break;
+        }
+}
+#endif /* 0 */
+
+static int rf2959_init_hw(struct zd_rf *rf)
+{
+        int r;
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR2,   0x1E }, { CR9,   0x20 }, { CR10,  0x89 },
+                { CR11,  0x00 }, { CR15,  0xD0 }, { CR17,  0x68 },
+                { CR19,  0x4a }, { CR20,  0x0c }, { CR21,  0x0E },
+                { CR23,  0x48 },
+                /* normal size for cca threshold */
+                { CR24,  0x14 },
+                /* { CR24,  0x20 }, */
+                { CR26,  0x90 }, { CR27,  0x30 }, { CR29,  0x20 },
+                { CR31,  0xb2 }, { CR32,  0x43 }, { CR33,  0x28 },
+                { CR38,  0x30 }, { CR34,  0x0f }, { CR35,  0xF0 },
+                { CR41,  0x2a }, { CR46,  0x7F }, { CR47,  0x1E },
+                { CR51,  0xc5 }, { CR52,  0xc5 }, { CR53,  0xc5 },
+                { CR79,  0x58 }, { CR80,  0x30 }, { CR81,  0x30 },
+                { CR82,  0x00 }, { CR83,  0x24 }, { CR84,  0x04 },
+                { CR85,  0x00 }, { CR86,  0x10 }, { CR87,  0x2A },
+                { CR88,  0x10 }, { CR89,  0x24 }, { CR90,  0x18 },
+                /* { CR91,  0x18 }, */
+                /* should solve continous CTS frame problems */
+                { CR91,  0x00 },
+                { CR92,  0x0a }, { CR93,  0x00 }, { CR94,  0x01 },
+                { CR95,  0x00 }, { CR96,  0x40 }, { CR97,  0x37 },
+                { CR98,  0x05 }, { CR99,  0x28 }, { CR100, 0x00 },
+                { CR101, 0x13 }, { CR102, 0x27 }, { CR103, 0x27 },
+                { CR104, 0x18 }, { CR105, 0x12 },
+                /* normal size */
+                { CR106, 0x1a },
+                /* { CR106, 0x22 }, */
+                { CR107, 0x24 }, { CR108, 0x0a }, { CR109, 0x13 },
+                { CR110, 0x2F }, { CR111, 0x27 }, { CR112, 0x27 },
+                { CR113, 0x27 }, { CR114, 0x27 }, { CR115, 0x40 },
+                { CR116, 0x40 }, { CR117, 0xF0 }, { CR118, 0xF0 },
+                { CR119, 0x16 },
+                /* no TX continuation */
+                { CR122, 0x00 },
+                /* { CR122, 0xff }, */
+                { CR127, 0x03 }, { CR131, 0x08 }, { CR138, 0x28 },
+                { CR148, 0x44 }, { CR150, 0x10 }, { CR169, 0xBB },
+                { CR170, 0xBB },
+        };
+
+        static const u32 rv[] = {
+                0x000007,  /* REG0(CFG1) */
+                0x07dd43,  /* REG1(IFPLL1) */
+                0x080959,  /* REG2(IFPLL2) */
+                0x0e6666,
+                0x116a57,  /* REG4 */
+                0x17dd43,  /* REG5 */
+                0x1819f9,  /* REG6 */
+                0x1e6666,
+                0x214554,
+                0x25e7fa,
+                0x27fffa,
+                /* The Zydas driver somehow forgets to set this value. It's
+                 * only set for Japan. We are using internal power control
+                 * for now.
+                 */
+                0x294128, /* internal power */
+                /* 0x28252c, */ /* External control TX power */
+                /* CR31_CCK, CR51_6-36M, CR52_48M, CR53_54M */
+                0x2c0000,
+                0x300000,
+                0x340000,  /* REG13(0xD) */
+                0x381e0f,  /* REG14(0xE) */
+                /* Bogus, RF2959's data sheet doesn't know register 27, which is
+                 * actually referenced here. The commented 0x11 is 17.
+                 */
+                0x6c180f,  /* REG27(0x11) */
+        };
+
+        r = zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+        if (r)
+                return r;
+
+        return zd_rfwritev_locked(chip, rv, ARRAY_SIZE(rv), RF_RV_BITS);
+}
+
+static int rf2959_set_channel(struct zd_rf *rf, u8 channel)
+{
+        int i, r;
+        u32 *rv = rf2959_table[channel-1];
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        for (i = 0; i < 2; i++) {
+                r = zd_rfwrite_locked(chip, rv[i], RF_RV_BITS);
+                if (r)
+                        return r;
+        }
+        return 0;
+}
+
+static int rf2959_switch_radio_on(struct zd_rf *rf)
+{
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR10, 0x89 },
+                { CR11, 0x00 },
+        };
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+static int rf2959_switch_radio_off(struct zd_rf *rf)
+{
+        static const struct zd_ioreq16 ioreqs[] = {
+                { CR10, 0x15 },
+                { CR11, 0x81 },
+        };
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        return zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
+}
+
+int zd_rf_init_rf2959(struct zd_rf *rf)
+{
+        struct zd_chip *chip = zd_rf_to_chip(rf);
+
+        if (chip->is_zd1211b) {
+                dev_err(zd_chip_dev(chip),
+                       "RF2959 is currently not supported for ZD1211B"
+                       " devices\n");
+                return -ENODEV;
+        }
+        rf->init_hw = rf2959_init_hw;
+        rf->set_channel = rf2959_set_channel;
+        rf->switch_radio_on = rf2959_switch_radio_on;
+        rf->switch_radio_off = rf2959_switch_radio_off;
+        return 0;
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_types.h b/drivers/net/wireless/zd1211rw/zd_types.h
new file mode 100644
index 000000000000..0155a1584ed3
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_types.h
@@ -0,0 +1,71 @@
+/* zd_types.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_TYPES_H
+#define _ZD_TYPES_H
+
+#include <linux/types.h>
+
+/* We have three register spaces mapped into the overall USB address space of
+ * 64K words (16-bit values). There is the control register space of
+ * double-word registers, the eeprom register space and the firmware register
+ * space. The control register space is byte mapped, the others are word
+ * mapped.
+ *
+ * For that reason, we are using byte offsets for control registers and word
+ * offsets for everything else.
+ */
+
+typedef u32 __nocast zd_addr_t;
+
+enum {
+        ADDR_BASE_MASK          = 0xff000000,
+        ADDR_OFFSET_MASK        = 0x0000ffff,
+        ADDR_ZERO_MASK          = 0x00ff0000,
+        NULL_BASE               = 0x00000000,
+        USB_BASE                = 0x01000000,
+        CR_BASE                 = 0x02000000,
+        CR_MAX_OFFSET           = 0x0b30,
+        E2P_BASE                = 0x03000000,
+        E2P_MAX_OFFSET          = 0x007e,
+        FW_BASE                 = 0x04000000,
+        FW_MAX_OFFSET           = 0x0005,
+};
+
+#define ZD_ADDR_BASE(addr) ((u32)(addr) & ADDR_BASE_MASK)
+#define ZD_OFFSET(addr) ((u32)(addr) & ADDR_OFFSET_MASK)
+
+#define ZD_ADDR(base, offset) \
+        ((zd_addr_t)(((base) & ADDR_BASE_MASK) | ((offset) & ADDR_OFFSET_MASK)))
+
+#define ZD_NULL_ADDR    ((zd_addr_t)0)
+#define USB_REG(offset)  ZD_ADDR(USB_BASE, offset)      /* word addressing */
+#define CTL_REG(offset)  ZD_ADDR(CR_BASE, offset)       /* byte addressing */
+#define E2P_REG(offset)  ZD_ADDR(E2P_BASE, offset)      /* word addressing */
+#define FW_REG(offset)   ZD_ADDR(FW_BASE, offset)       /* word addressing */
+
+static inline zd_addr_t zd_inc_word(zd_addr_t addr)
+{
+        u32 base = ZD_ADDR_BASE(addr);
+        u32 offset = ZD_OFFSET(addr);
+
+        offset += base == CR_BASE ? 2 : 1;
+
+        return base | offset;
+}
+
+#endif /* _ZD_TYPES_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
new file mode 100644
index 000000000000..6320984126c7
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -0,0 +1,1309 @@
+/* zd_usb.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <asm/unaligned.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/firmware.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+#include <linux/usb.h>
+#include <net/ieee80211.h>
+
+#include "zd_def.h"
+#include "zd_netdev.h"
+#include "zd_mac.h"
+#include "zd_usb.h"
+#include "zd_util.h"
+
+static struct usb_device_id usb_ids[] = {
+        /* ZD1211 */
+        { USB_DEVICE(0x0ace, 0x1211), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x07b8, 0x6001), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x126f, 0xa006), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x0df6, 0x9071), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x157e, 0x300b), .driver_info = DEVICE_ZD1211 },
+        /* ZD1211B */
+        { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
+        {}
+};
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("USB driver for devices with the ZD1211 chip.");
+MODULE_AUTHOR("Ulrich Kunitz");
+MODULE_AUTHOR("Daniel Drake");
+MODULE_VERSION("1.0");
+MODULE_DEVICE_TABLE(usb, usb_ids);
+
+#define FW_ZD1211_PREFIX        "zd1211/zd1211_"
+#define FW_ZD1211B_PREFIX       "zd1211/zd1211b_"
+
+/* register address handling */
+
+#ifdef DEBUG
+static int check_addr(struct zd_usb *usb, zd_addr_t addr)
+{
+        u32 base = ZD_ADDR_BASE(addr);
+        u32 offset = ZD_OFFSET(addr);
+
+        if ((u32)addr & ADDR_ZERO_MASK)
+                goto invalid_address;
+        switch (base) {
+        case USB_BASE:
+                break;
+        case CR_BASE:
+                if (offset > CR_MAX_OFFSET) {
+                        dev_dbg(zd_usb_dev(usb),
+                                "CR offset %#010x larger than"
+                                " CR_MAX_OFFSET %#10x\n",
+                                offset, CR_MAX_OFFSET);
+                        goto invalid_address;
+                }
+                if (offset & 1) {
+                        dev_dbg(zd_usb_dev(usb),
+                                "CR offset %#010x is not a multiple of 2\n",
+                                offset);
+                        goto invalid_address;
+                }
+                break;
+        case E2P_BASE:
+                if (offset > E2P_MAX_OFFSET) {
+                        dev_dbg(zd_usb_dev(usb),
+                                "E2P offset %#010x larger than"
+                                " E2P_MAX_OFFSET %#010x\n",
+                                offset, E2P_MAX_OFFSET);
+                        goto invalid_address;
+                }
+                break;
+        case FW_BASE:
+                if (!usb->fw_base_offset) {
+                        dev_dbg(zd_usb_dev(usb),
+                               "ERROR: fw base offset has not been set\n");
+                        return -EAGAIN;
+                }
+                if (offset > FW_MAX_OFFSET) {
+                        dev_dbg(zd_usb_dev(usb),
+                                "FW offset %#10x is larger than"
+                                " FW_MAX_OFFSET %#010x\n",
+                                offset, FW_MAX_OFFSET);
+                        goto invalid_address;
+                }
+                break;
+        default:
+                dev_dbg(zd_usb_dev(usb),
+                        "address has unsupported base %#010x\n", addr);
+                goto invalid_address;
+        }
+
+        return 0;
+invalid_address:
+        dev_dbg(zd_usb_dev(usb),
+                "ERROR: invalid address: %#010x\n", addr);
+        return -EINVAL;
+}
+#endif /* DEBUG */
+
+static u16 usb_addr(struct zd_usb *usb, zd_addr_t addr)
+{
+        u32 base;
+        u16 offset;
+
+        base = ZD_ADDR_BASE(addr);
+        offset = ZD_OFFSET(addr);
+
+        ZD_ASSERT(check_addr(usb, addr) == 0);
+
+        switch (base) {
+        case CR_BASE:
+                offset += CR_BASE_OFFSET;
+                break;
+        case E2P_BASE:
+                offset += E2P_BASE_OFFSET;
+                break;
+        case FW_BASE:
+                offset += usb->fw_base_offset;
+                break;
+        }
+
+        return offset;
+}
+
+/* USB device initialization */
+
+static int request_fw_file(
+        const struct firmware **fw, const char *name, struct device *device)
+{
+        int r;
+
+        dev_dbg_f(device, "fw name %s\n", name);
+
+        r = request_firmware(fw, name, device);
+        if (r)
+                dev_err(device,
+                       "Could not load firmware file %s. Error number %d\n",
+                       name, r);
+        return r;
+}
+
+static inline u16 get_bcdDevice(const struct usb_device *udev)
+{
+        return le16_to_cpu(udev->descriptor.bcdDevice);
+}
+
+enum upload_code_flags {
+        REBOOT = 1,
+};
+
+/* Ensures that MAX_TRANSFER_SIZE is even. */
+#define MAX_TRANSFER_SIZE (USB_MAX_TRANSFER_SIZE & ~1)
+
+static int upload_code(struct usb_device *udev,
+        const u8 *data, size_t size, u16 code_offset, int flags)
+{
+        u8 *p;
+        int r;
+
+        /* USB request blocks need "kmalloced" buffers.
+         */
+        p = kmalloc(MAX_TRANSFER_SIZE, GFP_KERNEL);
+        if (!p) {
+                dev_err(&udev->dev, "out of memory\n");
+                r = -ENOMEM;
+                goto error;
+        }
+
+        size &= ~1;
+        while (size > 0) {
+                size_t transfer_size = size <= MAX_TRANSFER_SIZE ?
+                        size : MAX_TRANSFER_SIZE;
+
+                dev_dbg_f(&udev->dev, "transfer size %zu\n", transfer_size);
+
+                memcpy(p, data, transfer_size);
+                r = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                        USB_REQ_FIRMWARE_DOWNLOAD,
+                        USB_DIR_OUT | USB_TYPE_VENDOR,
+                        code_offset, 0, p, transfer_size, 1000 /* ms */);
+                if (r < 0) {
+                        dev_err(&udev->dev,
+                               "USB control request for firmware upload"
+                               " failed. Error number %d\n", r);
+                        goto error;
+                }
+                transfer_size = r & ~1;
+
+                size -= transfer_size;
+                data += transfer_size;
+                code_offset += transfer_size/sizeof(u16);
+        }
+
+        if (flags & REBOOT) {
+                u8 ret;
+
+                r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+                        USB_REQ_FIRMWARE_CONFIRM,
+                        USB_DIR_IN | USB_TYPE_VENDOR,
+                        0, 0, &ret, sizeof(ret), 5000 /* ms */);
+                if (r != sizeof(ret)) {
+                        dev_err(&udev->dev,
+                                "control request firmeware confirmation failed."
+                                " Return value %d\n", r);
+                        if (r >= 0)
+                                r = -ENODEV;
+                        goto error;
+                }
+                if (ret & 0x80) {
+                        dev_err(&udev->dev,
+                                "Internal error while downloading."
+                                " Firmware confirm return value %#04x\n",
+                                (unsigned int)ret);
+                        r = -ENODEV;
+                        goto error;
+                }
+                dev_dbg_f(&udev->dev, "firmware confirm return value %#04x\n",
+                        (unsigned int)ret);
+        }
+
+        r = 0;
+error:
+        kfree(p);
+        return r;
+}
+
+static u16 get_word(const void *data, u16 offset)
+{
+        const __le16 *p = data;
+        return le16_to_cpu(p[offset]);
+}
+
+static char *get_fw_name(char *buffer, size_t size, u8 device_type,
+                       const char* postfix)
+{
+        scnprintf(buffer, size, "%s%s",
+                device_type == DEVICE_ZD1211B ?
+                        FW_ZD1211B_PREFIX : FW_ZD1211_PREFIX,
+                postfix);
+        return buffer;
+}
+
+static int upload_firmware(struct usb_device *udev, u8 device_type)
+{
+        int r;
+        u16 fw_bcdDevice;
+        u16 bcdDevice;
+        const struct firmware *ub_fw = NULL;
+        const struct firmware *uph_fw = NULL;
+        char fw_name[128];
+
+        bcdDevice = get_bcdDevice(udev);
+
+        r = request_fw_file(&ub_fw,
+                get_fw_name(fw_name, sizeof(fw_name), device_type,  "ub"),
+                &udev->dev);
+        if (r)
+                goto error;
+
+        fw_bcdDevice = get_word(ub_fw->data, EEPROM_REGS_OFFSET);
+
+        /* FIXME: do we have any reason to perform the kludge that the vendor
+         * driver does when there is a version mismatch? (their driver uploads
+         * different firmwares and stuff)
+         */
+        if (fw_bcdDevice != bcdDevice) {
+                dev_info(&udev->dev,
+                        "firmware device id %#06x and actual device id "
+                        "%#06x differ, continuing anyway\n",
+                        fw_bcdDevice, bcdDevice);
+        } else {
+                dev_dbg_f(&udev->dev,
+                        "firmware device id %#06x is equal to the "
+                        "actual device id\n", fw_bcdDevice);
+        }
+
+
+        r = request_fw_file(&uph_fw,
+                get_fw_name(fw_name, sizeof(fw_name), device_type, "uphr"),
+                &udev->dev);
+        if (r)
+                goto error;
+
+        r = upload_code(udev, uph_fw->data, uph_fw->size, FW_START_OFFSET,
+                        REBOOT);
+        if (r) {
+                dev_err(&udev->dev,
+                        "Could not upload firmware code uph. Error number %d\n",
+                        r);
+        }
+
+        /* FALL-THROUGH */
+error:
+        release_firmware(ub_fw);
+        release_firmware(uph_fw);
+        return r;
+}
+
+static void disable_read_regs_int(struct zd_usb *usb)
+{
+        struct zd_usb_interrupt *intr = &usb->intr;
+
+        spin_lock(&intr->lock);
+        intr->read_regs_enabled = 0;
+        spin_unlock(&intr->lock);
+}
+
+#define urb_dev(urb) (&(urb)->dev->dev)
+
+static inline void handle_regs_int(struct urb *urb)
+{
+        struct zd_usb *usb = urb->context;
+        struct zd_usb_interrupt *intr = &usb->intr;
+        int len;
+
+        ZD_ASSERT(in_interrupt());
+        spin_lock(&intr->lock);
+
+        if (intr->read_regs_enabled) {
+                intr->read_regs.length = len = urb->actual_length;
+
+                if (len > sizeof(intr->read_regs.buffer))
+                        len = sizeof(intr->read_regs.buffer);
+                memcpy(intr->read_regs.buffer, urb->transfer_buffer, len);
+                intr->read_regs_enabled = 0;
+                complete(&intr->read_regs.completion);
+                goto out;
+        }
+
+        dev_dbg_f(urb_dev(urb), "regs interrupt ignored\n");
+out:
+        spin_unlock(&intr->lock);
+}
+
+static inline void handle_retry_failed_int(struct urb *urb)
+{
+        dev_dbg_f(urb_dev(urb), "retry failed interrupt\n");
+}
+
+
+static void int_urb_complete(struct urb *urb, struct pt_regs *pt_regs)
+{
+        int r;
+        struct usb_int_header *hdr;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ESHUTDOWN:
+        case -EINVAL:
+        case -ENODEV:
+        case -ENOENT:
+        case -ECONNRESET:
+        case -EPIPE:
+                goto kfree;
+        default:
+                goto resubmit;
+        }
+
+        if (urb->actual_length < sizeof(hdr)) {
+                dev_dbg_f(urb_dev(urb), "error: urb %p to small\n", urb);
+                goto resubmit;
+        }
+
+        hdr = urb->transfer_buffer;
+        if (hdr->type != USB_INT_TYPE) {
+                dev_dbg_f(urb_dev(urb), "error: urb %p wrong type\n", urb);
+                goto resubmit;
+        }
+
+        switch (hdr->id) {
+        case USB_INT_ID_REGS:
+                handle_regs_int(urb);
+                break;
+        case USB_INT_ID_RETRY_FAILED:
+                handle_retry_failed_int(urb);
+                break;
+        default:
+                dev_dbg_f(urb_dev(urb), "error: urb %p unknown id %x\n", urb,
+                        (unsigned int)hdr->id);
+                goto resubmit;
+        }
+
+resubmit:
+        r = usb_submit_urb(urb, GFP_ATOMIC);
+        if (r) {
+                dev_dbg_f(urb_dev(urb), "resubmit urb %p\n", urb);
+                goto kfree;
+        }
+        return;
+kfree:
+        kfree(urb->transfer_buffer);
+}
+
+static inline int int_urb_interval(struct usb_device *udev)
+{
+        switch (udev->speed) {
+        case USB_SPEED_HIGH:
+                return 4;
+        case USB_SPEED_LOW:
+                return 10;
+        case USB_SPEED_FULL:
+        default:
+                return 1;
+        }
+}
+
+static inline int usb_int_enabled(struct zd_usb *usb)
+{
+        unsigned long flags;
+        struct zd_usb_interrupt *intr = &usb->intr;
+        struct urb *urb;
+
+        spin_lock_irqsave(&intr->lock, flags);
+        urb = intr->urb;
+        spin_unlock_irqrestore(&intr->lock, flags);
+        return urb != NULL;
+}
+
+int zd_usb_enable_int(struct zd_usb *usb)
+{
+        int r;
+        struct usb_device *udev;
+        struct zd_usb_interrupt *intr = &usb->intr;
+        void *transfer_buffer = NULL;
+        struct urb *urb;
+
+        dev_dbg_f(zd_usb_dev(usb), "\n");
+
+        urb = usb_alloc_urb(0, GFP_NOFS);
+        if (!urb) {
+                r = -ENOMEM;
+                goto out;
+        }
+
+        ZD_ASSERT(!irqs_disabled());
+        spin_lock_irq(&intr->lock);
+        if (intr->urb) {
+                spin_unlock_irq(&intr->lock);
+                r = 0;
+                goto error_free_urb;
+        }
+        intr->urb = urb;
+        spin_unlock_irq(&intr->lock);
+
+        /* TODO: make it a DMA buffer */
+        r = -ENOMEM;
+        transfer_buffer = kmalloc(USB_MAX_EP_INT_BUFFER, GFP_NOFS);
+        if (!transfer_buffer) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "couldn't allocate transfer_buffer\n");
+                goto error_set_urb_null;
+        }
+
+        udev = zd_usb_to_usbdev(usb);
+        usb_fill_int_urb(urb, udev, usb_rcvintpipe(udev, EP_INT_IN),
+                         transfer_buffer, USB_MAX_EP_INT_BUFFER,
+                         int_urb_complete, usb,
+                         intr->interval);
+
+        dev_dbg_f(zd_usb_dev(usb), "submit urb %p\n", intr->urb);
+        r = usb_submit_urb(urb, GFP_NOFS);
+        if (r) {
+                dev_dbg_f(zd_usb_dev(usb),
+                         "Couldn't submit urb. Error number %d\n", r);
+                goto error;
+        }
+
+        return 0;
+error:
+        kfree(transfer_buffer);
+error_set_urb_null:
+        spin_lock_irq(&intr->lock);
+        intr->urb = NULL;
+        spin_unlock_irq(&intr->lock);
+error_free_urb:
+        usb_free_urb(urb);
+out:
+        return r;
+}
+
+void zd_usb_disable_int(struct zd_usb *usb)
+{
+        unsigned long flags;
+        struct zd_usb_interrupt *intr = &usb->intr;
+        struct urb *urb;
+
+        spin_lock_irqsave(&intr->lock, flags);
+        urb = intr->urb;
+        if (!urb) {
+                spin_unlock_irqrestore(&intr->lock, flags);
+                return;
+        }
+        intr->urb = NULL;
+        spin_unlock_irqrestore(&intr->lock, flags);
+
+        usb_kill_urb(urb);
+        dev_dbg_f(zd_usb_dev(usb), "urb %p killed\n", urb);
+        usb_free_urb(urb);
+}
+
+static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
+                             unsigned int length)
+{
+        int i;
+        struct zd_mac *mac = zd_usb_to_mac(usb);
+        const struct rx_length_info *length_info;
+
+        if (length < sizeof(struct rx_length_info)) {
+                /* It's not a complete packet anyhow. */
+                return;
+        }
+        length_info = (struct rx_length_info *)
+                (buffer + length - sizeof(struct rx_length_info));
+
+        /* It might be that three frames are merged into a single URB
+         * transaction. We have to check for the length info tag.
+         *
+         * While testing we discovered that length_info might be unaligned,
+         * because if USB transactions are merged, the last packet will not
+         * be padded. Unaligned access might also happen if the length_info
+         * structure is not present.
+         */
+        if (get_unaligned(&length_info->tag) == cpu_to_le16(RX_LENGTH_INFO_TAG))
+        {
+                unsigned int l, k, n;
+                for (i = 0, l = 0;; i++) {
+                        k = le16_to_cpu(get_unaligned(&length_info->length[i]));
+                        n = l+k;
+                        if (n > length)
+                                return;
+                        zd_mac_rx(mac, buffer+l, k);
+                        if (i >= 2)
+                                return;
+                        l = (n+3) & ~3;
+                }
+        } else {
+                zd_mac_rx(mac, buffer, length);
+        }
+}
+
+static void rx_urb_complete(struct urb *urb, struct pt_regs *pt_regs)
+{
+        struct zd_usb *usb;
+        struct zd_usb_rx *rx;
+        const u8 *buffer;
+        unsigned int length;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ESHUTDOWN:
+        case -EINVAL:
+        case -ENODEV:
+        case -ENOENT:
+        case -ECONNRESET:
+        case -EPIPE:
+                return;
+        default:
+                dev_dbg_f(urb_dev(urb), "urb %p error %d\n", urb, urb->status);
+                goto resubmit;
+        }
+
+        buffer = urb->transfer_buffer;
+        length = urb->actual_length;
+        usb = urb->context;
+        rx = &usb->rx;
+
+        if (length%rx->usb_packet_size > rx->usb_packet_size-4) {
+                /* If there is an old first fragment, we don't care. */
+                dev_dbg_f(urb_dev(urb), "*** first fragment ***\n");
+                ZD_ASSERT(length <= ARRAY_SIZE(rx->fragment));
+                spin_lock(&rx->lock);
+                memcpy(rx->fragment, buffer, length);
+                rx->fragment_length = length;
+                spin_unlock(&rx->lock);
+                goto resubmit;
+        }
+
+        spin_lock(&rx->lock);
+        if (rx->fragment_length > 0) {
+                /* We are on a second fragment, we believe */
+                ZD_ASSERT(length + rx->fragment_length <=
+                          ARRAY_SIZE(rx->fragment));
+                dev_dbg_f(urb_dev(urb), "*** second fragment ***\n");
+                memcpy(rx->fragment+rx->fragment_length, buffer, length);
+                handle_rx_packet(usb, rx->fragment,
+                                 rx->fragment_length + length);
+                rx->fragment_length = 0;
+                spin_unlock(&rx->lock);
+        } else {
+                spin_unlock(&rx->lock);
+                handle_rx_packet(usb, buffer, length);
+        }
+
+resubmit:
+        usb_submit_urb(urb, GFP_ATOMIC);
+}
+
+struct urb *alloc_urb(struct zd_usb *usb)
+{
+        struct usb_device *udev = zd_usb_to_usbdev(usb);
+        struct urb *urb;
+        void *buffer;
+
+        urb = usb_alloc_urb(0, GFP_NOFS);
+        if (!urb)
+                return NULL;
+        buffer = usb_buffer_alloc(udev, USB_MAX_RX_SIZE, GFP_NOFS,
+                                  &urb->transfer_dma);
+        if (!buffer) {
+                usb_free_urb(urb);
+                return NULL;
+        }
+
+        usb_fill_bulk_urb(urb, udev, usb_rcvbulkpipe(udev, EP_DATA_IN),
+                          buffer, USB_MAX_RX_SIZE,
+                          rx_urb_complete, usb);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        return urb;
+}
+
+void free_urb(struct urb *urb)
+{
+        if (!urb)
+                return;
+        usb_buffer_free(urb->dev, urb->transfer_buffer_length,
+                        urb->transfer_buffer, urb->transfer_dma);
+        usb_free_urb(urb);
+}
+
+int zd_usb_enable_rx(struct zd_usb *usb)
+{
+        int i, r;
+        struct zd_usb_rx *rx = &usb->rx;
+        struct urb **urbs;
+
+        dev_dbg_f(zd_usb_dev(usb), "\n");
+
+        r = -ENOMEM;
+        urbs = kcalloc(URBS_COUNT, sizeof(struct urb *), GFP_NOFS);
+        if (!urbs)
+                goto error;
+        for (i = 0; i < URBS_COUNT; i++) {
+                urbs[i] = alloc_urb(usb);
+                if (!urbs[i])
+                        goto error;
+        }
+
+        ZD_ASSERT(!irqs_disabled());
+        spin_lock_irq(&rx->lock);
+        if (rx->urbs) {
+                spin_unlock_irq(&rx->lock);
+                r = 0;
+                goto error;
+        }
+        rx->urbs = urbs;
+        rx->urbs_count = URBS_COUNT;
+        spin_unlock_irq(&rx->lock);
+
+        for (i = 0; i < URBS_COUNT; i++) {
+                r = usb_submit_urb(urbs[i], GFP_NOFS);
+                if (r)
+                        goto error_submit;
+        }
+
+        return 0;
+error_submit:
+        for (i = 0; i < URBS_COUNT; i++) {
+                usb_kill_urb(urbs[i]);
+        }
+        spin_lock_irq(&rx->lock);
+        rx->urbs = NULL;
+        rx->urbs_count = 0;
+        spin_unlock_irq(&rx->lock);
+error:
+        if (urbs) {
+                for (i = 0; i < URBS_COUNT; i++)
+                        free_urb(urbs[i]);
+        }
+        return r;
+}
+
+void zd_usb_disable_rx(struct zd_usb *usb)
+{
+        int i;
+        unsigned long flags;
+        struct urb **urbs;
+        unsigned int count;
+        struct zd_usb_rx *rx = &usb->rx;
+
+        spin_lock_irqsave(&rx->lock, flags);
+        urbs = rx->urbs;
+        count = rx->urbs_count;
+        spin_unlock_irqrestore(&rx->lock, flags);
+        if (!urbs)
+                return;
+
+        for (i = 0; i < count; i++) {
+                usb_kill_urb(urbs[i]);
+                free_urb(urbs[i]);
+        }
+        kfree(urbs);
+
+        spin_lock_irqsave(&rx->lock, flags);
+        rx->urbs = NULL;
+        rx->urbs_count = 0;
+        spin_unlock_irqrestore(&rx->lock, flags);
+}
+
+static void tx_urb_complete(struct urb *urb, struct pt_regs *pt_regs)
+{
+        int r;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ESHUTDOWN:
+        case -EINVAL:
+        case -ENODEV:
+        case -ENOENT:
+        case -ECONNRESET:
+        case -EPIPE:
+                dev_dbg_f(urb_dev(urb), "urb %p error %d\n", urb, urb->status);
+                break;
+        default:
+                dev_dbg_f(urb_dev(urb), "urb %p error %d\n", urb, urb->status);
+                goto resubmit;
+        }
+free_urb:
+        usb_buffer_free(urb->dev, urb->transfer_buffer_length,
+                        urb->transfer_buffer, urb->transfer_dma);
+        usb_free_urb(urb);
+        return;
+resubmit:
+        r = usb_submit_urb(urb, GFP_ATOMIC);
+        if (r) {
+                dev_dbg_f(urb_dev(urb), "error resubmit urb %p %d\n", urb, r);
+                goto free_urb;
+        }
+}
+
+/* Puts the frame on the USB endpoint. It doesn't wait for
+ * completion. The frame must contain the control set.
+ */
+int zd_usb_tx(struct zd_usb *usb, const u8 *frame, unsigned int length)
+{
+        int r;
+        struct usb_device *udev = zd_usb_to_usbdev(usb);
+        struct urb *urb;
+        void *buffer;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb) {
+                r = -ENOMEM;
+                goto out;
+        }
+
+        buffer = usb_buffer_alloc(zd_usb_to_usbdev(usb), length, GFP_ATOMIC,
+                                  &urb->transfer_dma);
+        if (!buffer) {
+                r = -ENOMEM;
+                goto error_free_urb;
+        }
+        memcpy(buffer, frame, length);
+
+        usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_DATA_OUT),
+                          buffer, length, tx_urb_complete, NULL);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        r = usb_submit_urb(urb, GFP_ATOMIC);
+        if (r)
+                goto error;
+        return 0;
+error:
+        usb_buffer_free(zd_usb_to_usbdev(usb), length, buffer,
+                        urb->transfer_dma);
+error_free_urb:
+        usb_free_urb(urb);
+out:
+        return r;
+}
+
+static inline void init_usb_interrupt(struct zd_usb *usb)
+{
+        struct zd_usb_interrupt *intr = &usb->intr;
+
+        spin_lock_init(&intr->lock);
+        intr->interval = int_urb_interval(zd_usb_to_usbdev(usb));
+        init_completion(&intr->read_regs.completion);
+        intr->read_regs.cr_int_addr = cpu_to_le16(usb_addr(usb, CR_INTERRUPT));
+}
+
+static inline void init_usb_rx(struct zd_usb *usb)
+{
+        struct zd_usb_rx *rx = &usb->rx;
+        spin_lock_init(&rx->lock);
+        if (interface_to_usbdev(usb->intf)->speed == USB_SPEED_HIGH) {
+                rx->usb_packet_size = 512;
+        } else {
+                rx->usb_packet_size = 64;
+        }
+        ZD_ASSERT(rx->fragment_length == 0);
+}
+
+static inline void init_usb_tx(struct zd_usb *usb)
+{
+        /* FIXME: at this point we will allocate a fixed number of urb's for
+         * use in a cyclic scheme */
+}
+
+void zd_usb_init(struct zd_usb *usb, struct net_device *netdev,
+                 struct usb_interface *intf)
+{
+        memset(usb, 0, sizeof(*usb));
+        usb->intf = usb_get_intf(intf);
+        usb_set_intfdata(usb->intf, netdev);
+        init_usb_interrupt(usb);
+        init_usb_tx(usb);
+        init_usb_rx(usb);
+}
+
+int zd_usb_init_hw(struct zd_usb *usb)
+{
+        int r;
+        struct zd_chip *chip = zd_usb_to_chip(usb);
+
+        ZD_ASSERT(mutex_is_locked(&chip->mutex));
+        r = zd_ioread16_locked(chip, &usb->fw_base_offset,
+                        USB_REG((u16)FW_BASE_ADDR_OFFSET));
+        if (r)
+                return r;
+        dev_dbg_f(zd_usb_dev(usb), "fw_base_offset: %#06hx\n",
+                 usb->fw_base_offset);
+
+        return 0;
+}
+
+void zd_usb_clear(struct zd_usb *usb)
+{
+        usb_set_intfdata(usb->intf, NULL);
+        usb_put_intf(usb->intf);
+        memset(usb, 0, sizeof(*usb));
+        /* FIXME: usb_interrupt, usb_tx, usb_rx? */
+}
+
+static const char *speed(enum usb_device_speed speed)
+{
+        switch (speed) {
+        case USB_SPEED_LOW:
+                return "low";
+        case USB_SPEED_FULL:
+                return "full";
+        case USB_SPEED_HIGH:
+                return "high";
+        default:
+                return "unknown speed";
+        }
+}
+
+static int scnprint_id(struct usb_device *udev, char *buffer, size_t size)
+{
+        return scnprintf(buffer, size, "%04hx:%04hx v%04hx %s",
+                le16_to_cpu(udev->descriptor.idVendor),
+                le16_to_cpu(udev->descriptor.idProduct),
+                get_bcdDevice(udev),
+                speed(udev->speed));
+}
+
+int zd_usb_scnprint_id(struct zd_usb *usb, char *buffer, size_t size)
+{
+        struct usb_device *udev = interface_to_usbdev(usb->intf);
+        return scnprint_id(udev, buffer, size);
+}
+
+#ifdef DEBUG
+static void print_id(struct usb_device *udev)
+{
+        char buffer[40];
+
+        scnprint_id(udev, buffer, sizeof(buffer));
+        buffer[sizeof(buffer)-1] = 0;
+        dev_dbg_f(&udev->dev, "%s\n", buffer);
+}
+#else
+#define print_id(udev) do { } while (0)
+#endif
+
+static int probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+        int r;
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct net_device *netdev = NULL;
+
+        print_id(udev);
+
+        switch (udev->speed) {
+        case USB_SPEED_LOW:
+        case USB_SPEED_FULL:
+        case USB_SPEED_HIGH:
+                break;
+        default:
+                dev_dbg_f(&intf->dev, "Unknown USB speed\n");
+                r = -ENODEV;
+                goto error;
+        }
+
+        netdev = zd_netdev_alloc(intf);
+        if (netdev == NULL) {
+                r = -ENOMEM;
+                goto error;
+        }
+
+        r = upload_firmware(udev, id->driver_info);
+        if (r) {
+                dev_err(&intf->dev,
+                       "couldn't load firmware. Error number %d\n", r);
+                goto error;
+        }
+
+        r = usb_reset_configuration(udev);
+        if (r) {
+                dev_dbg_f(&intf->dev,
+                        "couldn't reset configuration. Error number %d\n", r);
+                goto error;
+        }
+
+        /* At this point the interrupt endpoint is not generally enabled. We
+         * save the USB bandwidth until the network device is opened. But
+         * notify that the initialization of the MAC will require the
+         * interrupts to be temporary enabled.
+         */
+        r = zd_mac_init_hw(zd_netdev_mac(netdev), id->driver_info);
+        if (r) {
+                dev_dbg_f(&intf->dev,
+                         "couldn't initialize mac. Error number %d\n", r);
+                goto error;
+        }
+
+        r = register_netdev(netdev);
+        if (r) {
+                dev_dbg_f(&intf->dev,
+                         "couldn't register netdev. Error number %d\n", r);
+                goto error;
+        }
+
+        dev_dbg_f(&intf->dev, "successful\n");
+        dev_info(&intf->dev,"%s\n", netdev->name);
+        return 0;
+error:
+        usb_reset_device(interface_to_usbdev(intf));
+        zd_netdev_free(netdev);
+        return r;
+}
+
+static void disconnect(struct usb_interface *intf)
+{
+        struct net_device *netdev = zd_intf_to_netdev(intf);
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct zd_usb *usb = &mac->chip.usb;
+
+        dev_dbg_f(zd_usb_dev(usb), "\n");
+
+        zd_netdev_disconnect(netdev);
+
+        /* Just in case something has gone wrong! */
+        zd_usb_disable_rx(usb);
+        zd_usb_disable_int(usb);
+
+        /* If the disconnect has been caused by a removal of the
+         * driver module, the reset allows reloading of the driver. If the
+         * reset will not be executed here, the upload of the firmware in the
+         * probe function caused by the reloading of the driver will fail.
+         */
+        usb_reset_device(interface_to_usbdev(intf));
+
+        /* If somebody still waits on this lock now, this is an error. */
+        zd_netdev_free(netdev);
+        dev_dbg(&intf->dev, "disconnected\n");
+}
+
+static struct usb_driver driver = {
+        .name           = "zd1211rw",
+        .id_table       = usb_ids,
+        .probe          = probe,
+        .disconnect     = disconnect,
+};
+
+static int __init usb_init(void)
+{
+        int r;
+
+        pr_debug("usb_init()\n");
+
+        r = usb_register(&driver);
+        if (r) {
+                printk(KERN_ERR "usb_register() failed. Error number %d\n", r);
+                return r;
+        }
+
+        pr_debug("zd1211rw initialized\n");
+        return 0;
+}
+
+static void __exit usb_exit(void)
+{
+        pr_debug("usb_exit()\n");
+        usb_deregister(&driver);
+}
+
+module_init(usb_init);
+module_exit(usb_exit);
+
+static int usb_int_regs_length(unsigned int count)
+{
+        return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data);
+}
+
+static void prepare_read_regs_int(struct zd_usb *usb)
+{
+        struct zd_usb_interrupt *intr = &usb->intr;
+
+        spin_lock(&intr->lock);
+        intr->read_regs_enabled = 1;
+        INIT_COMPLETION(intr->read_regs.completion);
+        spin_unlock(&intr->lock);
+}
+
+static int get_results(struct zd_usb *usb, u16 *values,
+                       struct usb_req_read_regs *req, unsigned int count)
+{
+        int r;
+        int i;
+        struct zd_usb_interrupt *intr = &usb->intr;
+        struct read_regs_int *rr = &intr->read_regs;
+        struct usb_int_regs *regs = (struct usb_int_regs *)rr->buffer;
+
+        spin_lock(&intr->lock);
+
+        r = -EIO;
+        /* The created block size seems to be larger than expected.
+         * However results appear to be correct.
+         */
+        if (rr->length < usb_int_regs_length(count)) {
+                dev_dbg_f(zd_usb_dev(usb),
+                         "error: actual length %d less than expected %d\n",
+                         rr->length, usb_int_regs_length(count));
+                goto error_unlock;
+        }
+        if (rr->length > sizeof(rr->buffer)) {
+                dev_dbg_f(zd_usb_dev(usb),
+                         "error: actual length %d exceeds buffer size %zu\n",
+                         rr->length, sizeof(rr->buffer));
+                goto error_unlock;
+        }
+
+        for (i = 0; i < count; i++) {
+                struct reg_data *rd = &regs->regs[i];
+                if (rd->addr != req->addr[i]) {
+                        dev_dbg_f(zd_usb_dev(usb),
+                                 "rd[%d] addr %#06hx expected %#06hx\n", i,
+                                 le16_to_cpu(rd->addr),
+                                 le16_to_cpu(req->addr[i]));
+                        goto error_unlock;
+                }
+                values[i] = le16_to_cpu(rd->value);
+        }
+
+        r = 0;
+error_unlock:
+        spin_unlock(&intr->lock);
+        return r;
+}
+
+int zd_usb_ioread16v(struct zd_usb *usb, u16 *values,
+                     const zd_addr_t *addresses, unsigned int count)
+{
+        int r;
+        int i, req_len, actual_req_len;
+        struct usb_device *udev;
+        struct usb_req_read_regs *req = NULL;
+        unsigned long timeout;
+
+        if (count < 1) {
+                dev_dbg_f(zd_usb_dev(usb), "error: count is zero\n");
+                return -EINVAL;
+        }
+        if (count > USB_MAX_IOREAD16_COUNT) {
+                dev_dbg_f(zd_usb_dev(usb),
+                         "error: count %u exceeds possible max %u\n",
+                         count, USB_MAX_IOREAD16_COUNT);
+                return -EINVAL;
+        }
+        if (in_atomic()) {
+                dev_dbg_f(zd_usb_dev(usb),
+                         "error: io in atomic context not supported\n");
+                return -EWOULDBLOCK;
+        }
+        if (!usb_int_enabled(usb)) {
+                 dev_dbg_f(zd_usb_dev(usb),
+                          "error: usb interrupt not enabled\n");
+                return -EWOULDBLOCK;
+        }
+
+        req_len = sizeof(struct usb_req_read_regs) + count * sizeof(__le16);
+        req = kmalloc(req_len, GFP_NOFS);
+        if (!req)
+                return -ENOMEM;
+        req->id = cpu_to_le16(USB_REQ_READ_REGS);
+        for (i = 0; i < count; i++)
+                req->addr[i] = cpu_to_le16(usb_addr(usb, addresses[i]));
+
+        udev = zd_usb_to_usbdev(usb);
+        prepare_read_regs_int(usb);
+        r = usb_bulk_msg(udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
+                         req, req_len, &actual_req_len, 1000 /* ms */);
+        if (r) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error in usb_bulk_msg(). Error number %d\n", r);
+                goto error;
+        }
+        if (req_len != actual_req_len) {
+                dev_dbg_f(zd_usb_dev(usb), "error in usb_bulk_msg()\n"
+                        " req_len %d != actual_req_len %d\n",
+                        req_len, actual_req_len);
+                r = -EIO;
+                goto error;
+        }
+
+        timeout = wait_for_completion_timeout(&usb->intr.read_regs.completion,
+                                              msecs_to_jiffies(1000));
+        if (!timeout) {
+                disable_read_regs_int(usb);
+                dev_dbg_f(zd_usb_dev(usb), "read timed out\n");
+                r = -ETIMEDOUT;
+                goto error;
+        }
+
+        r = get_results(usb, values, req, count);
+error:
+        kfree(req);
+        return r;
+}
+
+int zd_usb_iowrite16v(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
+                      unsigned int count)
+{
+        int r;
+        struct usb_device *udev;
+        struct usb_req_write_regs *req = NULL;
+        int i, req_len, actual_req_len;
+
+        if (count == 0)
+                return 0;
+        if (count > USB_MAX_IOWRITE16_COUNT) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error: count %u exceeds possible max %u\n",
+                        count, USB_MAX_IOWRITE16_COUNT);
+                return -EINVAL;
+        }
+        if (in_atomic()) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error: io in atomic context not supported\n");
+                return -EWOULDBLOCK;
+        }
+
+        req_len = sizeof(struct usb_req_write_regs) +
+                  count * sizeof(struct reg_data);
+        req = kmalloc(req_len, GFP_NOFS);
+        if (!req)
+                return -ENOMEM;
+
+        req->id = cpu_to_le16(USB_REQ_WRITE_REGS);
+        for (i = 0; i < count; i++) {
+                struct reg_data *rw  = &req->reg_writes[i];
+                rw->addr = cpu_to_le16(usb_addr(usb, ioreqs[i].addr));
+                rw->value = cpu_to_le16(ioreqs[i].value);
+        }
+
+        udev = zd_usb_to_usbdev(usb);
+        r = usb_bulk_msg(udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
+                         req, req_len, &actual_req_len, 1000 /* ms */);
+        if (r) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error in usb_bulk_msg(). Error number %d\n", r);
+                goto error;
+        }
+        if (req_len != actual_req_len) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error in usb_bulk_msg()"
+                        " req_len %d != actual_req_len %d\n",
+                        req_len, actual_req_len);
+                r = -EIO;
+                goto error;
+        }
+
+        /* FALL-THROUGH with r == 0 */
+error:
+        kfree(req);
+        return r;
+}
+
+int zd_usb_rfwrite(struct zd_usb *usb, u32 value, u8 bits)
+{
+        int r;
+        struct usb_device *udev;
+        struct usb_req_rfwrite *req = NULL;
+        int i, req_len, actual_req_len;
+        u16 bit_value_template;
+
+        if (in_atomic()) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error: io in atomic context not supported\n");
+                return -EWOULDBLOCK;
+        }
+        if (bits < USB_MIN_RFWRITE_BIT_COUNT) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error: bits %d are smaller than"
+                        " USB_MIN_RFWRITE_BIT_COUNT %d\n",
+                        bits, USB_MIN_RFWRITE_BIT_COUNT);
+                return -EINVAL;
+        }
+        if (bits > USB_MAX_RFWRITE_BIT_COUNT) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error: bits %d exceed USB_MAX_RFWRITE_BIT_COUNT %d\n",
+                        bits, USB_MAX_RFWRITE_BIT_COUNT);
+                return -EINVAL;
+        }
+#ifdef DEBUG
+        if (value & (~0UL << bits)) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error: value %#09x has bits >= %d set\n",
+                        value, bits);
+                return -EINVAL;
+        }
+#endif /* DEBUG */
+
+        dev_dbg_f(zd_usb_dev(usb), "value %#09x bits %d\n", value, bits);
+
+        r = zd_usb_ioread16(usb, &bit_value_template, CR203);
+        if (r) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error %d: Couldn't read CR203\n", r);
+                goto out;
+        }
+        bit_value_template &= ~(RF_IF_LE|RF_CLK|RF_DATA);
+
+        req_len = sizeof(struct usb_req_rfwrite) + bits * sizeof(__le16);
+        req = kmalloc(req_len, GFP_NOFS);
+        if (!req)
+                return -ENOMEM;
+
+        req->id = cpu_to_le16(USB_REQ_WRITE_RF);
+        /* 1: 3683a, but not used in ZYDAS driver */
+        req->value = cpu_to_le16(2);
+        req->bits = cpu_to_le16(bits);
+
+        for (i = 0; i < bits; i++) {
+                u16 bv = bit_value_template;
+                if (value & (1 << (bits-1-i)))
+                        bv |= RF_DATA;
+                req->bit_values[i] = cpu_to_le16(bv);
+        }
+
+        udev = zd_usb_to_usbdev(usb);
+        r = usb_bulk_msg(udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
+                         req, req_len, &actual_req_len, 1000 /* ms */);
+        if (r) {
+                dev_dbg_f(zd_usb_dev(usb),
+                        "error in usb_bulk_msg(). Error number %d\n", r);
+                goto out;
+        }
+        if (req_len != actual_req_len) {
+                dev_dbg_f(zd_usb_dev(usb), "error in usb_bulk_msg()"
+                        " req_len %d != actual_req_len %d\n",
+                        req_len, actual_req_len);
+                r = -EIO;
+                goto out;
+        }
+
+        /* FALL-THROUGH with r == 0 */
+out:
+        kfree(req);
+        return r;
+}
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
new file mode 100644
index 000000000000..d6420283bd5a
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_usb.h
@@ -0,0 +1,240 @@
+/* zd_usb.h: Header for USB interface implemented by ZD1211 chip
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _ZD_USB_H
+#define _ZD_USB_H
+
+#include <linux/completion.h>
+#include <linux/netdevice.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#include <linux/usb.h>
+
+#include "zd_def.h"
+#include "zd_types.h"
+
+enum devicetype {
+        DEVICE_ZD1211  = 0,
+        DEVICE_ZD1211B = 1,
+};
+
+enum endpoints {
+        EP_CTRL     = 0,
+        EP_DATA_OUT = 1,
+        EP_DATA_IN  = 2,
+        EP_INT_IN   = 3,
+        EP_REGS_OUT = 4,
+};
+
+enum {
+        USB_MAX_TRANSFER_SIZE           = 4096, /* bytes */
+        /* FIXME: The original driver uses this value. We have to check,
+         * whether the MAX_TRANSFER_SIZE is sufficient and this needs only be
+         * used if one combined frame is split over two USB transactions.
+         */
+        USB_MAX_RX_SIZE                 = 4800, /* bytes */
+        USB_MAX_IOWRITE16_COUNT         = 15,
+        USB_MAX_IOWRITE32_COUNT         = USB_MAX_IOWRITE16_COUNT/2,
+        USB_MAX_IOREAD16_COUNT          = 15,
+        USB_MAX_IOREAD32_COUNT          = USB_MAX_IOREAD16_COUNT/2,
+        USB_MIN_RFWRITE_BIT_COUNT       = 16,
+        USB_MAX_RFWRITE_BIT_COUNT       = 28,
+        USB_MAX_EP_INT_BUFFER           = 64,
+        USB_ZD1211B_BCD_DEVICE          = 0x4810,
+};
+
+enum control_requests {
+        USB_REQ_WRITE_REGS              = 0x21,
+        USB_REQ_READ_REGS               = 0x22,
+        USB_REQ_WRITE_RF                = 0x23,
+        USB_REQ_PROG_FLASH              = 0x24,
+        USB_REQ_EEPROM_START            = 0x0128, /* ? request is a byte */
+        USB_REQ_EEPROM_MID              = 0x28,
+        USB_REQ_EEPROM_END              = 0x0228, /* ? request is a byte */
+        USB_REQ_FIRMWARE_DOWNLOAD       = 0x30,
+        USB_REQ_FIRMWARE_CONFIRM        = 0x31,
+        USB_REQ_FIRMWARE_READ_DATA      = 0x32,
+};
+
+struct usb_req_read_regs {
+        __le16 id;
+        __le16 addr[0];
+} __attribute__((packed));
+
+struct reg_data {
+        __le16 addr;
+        __le16 value;
+} __attribute__((packed));
+
+struct usb_req_write_regs {
+        __le16 id;
+        struct reg_data reg_writes[0];
+} __attribute__((packed));
+
+enum {
+        RF_IF_LE = 0x02,
+        RF_CLK   = 0x04,
+        RF_DATA  = 0x08,
+};
+
+struct usb_req_rfwrite {
+        __le16 id;
+        __le16 value;
+        /* 1: 3683a */
+        /* 2: other (default) */
+        __le16 bits;
+        /* RF2595: 24 */
+        __le16 bit_values[0];
+        /* (CR203 & ~(RF_IF_LE | RF_CLK | RF_DATA)) | (bit ? RF_DATA : 0) */
+} __attribute__((packed));
+
+/* USB interrupt */
+
+enum usb_int_id {
+        USB_INT_TYPE                    = 0x01,
+        USB_INT_ID_REGS                 = 0x90,
+        USB_INT_ID_RETRY_FAILED         = 0xa0,
+};
+
+enum usb_int_flags {
+        USB_INT_READ_REGS_EN            = 0x01,
+};
+
+struct usb_int_header {
+        u8 type;        /* must always be 1 */
+        u8 id;
+} __attribute__((packed));
+
+struct usb_int_regs {
+        struct usb_int_header hdr;
+        struct reg_data regs[0];
+} __attribute__((packed));
+
+struct usb_int_retry_fail {
+        struct usb_int_header hdr;
+        u8 new_rate;
+        u8 _dummy;
+        u8 addr[ETH_ALEN];
+        u8 ibss_wakeup_dest;
+} __attribute__((packed));
+
+struct read_regs_int {
+        struct completion completion;
+        /* Stores the USB int structure and contains the USB address of the
+         * first requested register before request.
+         */
+        u8 buffer[USB_MAX_EP_INT_BUFFER];
+        int length;
+        __le16 cr_int_addr;
+};
+
+struct zd_ioreq16 {
+        zd_addr_t addr;
+        u16 value;
+};
+
+struct zd_ioreq32 {
+        zd_addr_t addr;
+        u32 value;
+};
+
+struct zd_usb_interrupt {
+        struct read_regs_int read_regs;
+        spinlock_t lock;
+        struct urb *urb;
+        int interval;
+        u8 read_regs_enabled:1;
+};
+
+static inline struct usb_int_regs *get_read_regs(struct zd_usb_interrupt *intr)
+{
+        return (struct usb_int_regs *)intr->read_regs.buffer;
+}
+
+#define URBS_COUNT 5
+
+struct zd_usb_rx {
+        spinlock_t lock;
+        u8 fragment[2*USB_MAX_RX_SIZE];
+        unsigned int fragment_length;
+        unsigned int usb_packet_size;
+        struct urb **urbs;
+        int urbs_count;
+};
+
+struct zd_usb_tx {
+        spinlock_t lock;
+};
+
+/* Contains the usb parts. The structure doesn't require a lock, because intf
+ * and fw_base_offset, will not be changed after initialization.
+ */
+struct zd_usb {
+        struct zd_usb_interrupt intr;
+        struct zd_usb_rx rx;
+        struct zd_usb_tx tx;
+        struct usb_interface *intf;
+        u16 fw_base_offset;
+};
+
+#define zd_usb_dev(usb) (&usb->intf->dev)
+
+static inline struct usb_device *zd_usb_to_usbdev(struct zd_usb *usb)
+{
+        return interface_to_usbdev(usb->intf);
+}
+
+static inline struct net_device *zd_intf_to_netdev(struct usb_interface *intf)
+{
+        return usb_get_intfdata(intf);
+}
+
+static inline struct net_device *zd_usb_to_netdev(struct zd_usb *usb)
+{
+        return zd_intf_to_netdev(usb->intf);
+}
+
+void zd_usb_init(struct zd_usb *usb, struct net_device *netdev,
+                 struct usb_interface *intf);
+int zd_usb_init_hw(struct zd_usb *usb);
+void zd_usb_clear(struct zd_usb *usb);
+
+int zd_usb_scnprint_id(struct zd_usb *usb, char *buffer, size_t size);
+
+int zd_usb_enable_int(struct zd_usb *usb);
+void zd_usb_disable_int(struct zd_usb *usb);
+
+int zd_usb_enable_rx(struct zd_usb *usb);
+void zd_usb_disable_rx(struct zd_usb *usb);
+
+int zd_usb_tx(struct zd_usb *usb, const u8 *frame, unsigned int length);
+
+int zd_usb_ioread16v(struct zd_usb *usb, u16 *values,
+                 const zd_addr_t *addresses, unsigned int count);
+
+static inline int zd_usb_ioread16(struct zd_usb *usb, u16 *value,
+                              const zd_addr_t addr)
+{
+        return zd_usb_ioread16v(usb, value, (const zd_addr_t *)&addr, 1);
+}
+
+int zd_usb_iowrite16v(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
+                      unsigned int count);
+
+int zd_usb_rfwrite(struct zd_usb *usb, u32 value, u8 bits);
+
+#endif /* _ZD_USB_H */
diff --git a/drivers/net/wireless/zd1211rw/zd_util.c b/drivers/net/wireless/zd1211rw/zd_util.c
new file mode 100644
index 000000000000..d20036c15d11
--- /dev/null
+++ b/drivers/net/wireless/zd1211rw/zd_util.c
@@ -0,0 +1,82 @@
+/* zd_util.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Utility program
+ */
+
+#include "zd_def.h"
+#include "zd_util.h"
+
+#ifdef DEBUG
+static char hex(u8 v)
+{
+        v &= 0xf;
+        return (v < 10 ? '0' : 'a' - 10) + v;
+}
+
+static char hex_print(u8 c)
+{
+        return (0x20 <= c && c < 0x7f) ? c : '.';
+}
+
+static void dump_line(const u8 *bytes, size_t size)
+{
+        char c;
+        size_t i;
+
+        size = size <= 8 ? size : 8;
+        printk(KERN_DEBUG "zd1211 %p ", bytes);
+        for (i = 0; i < 8; i++) {
+                switch (i) {
+                case 1:
+                case 5:
+                        c = '.';
+                        break;
+                case 3:
+                        c = ':';
+                        break;
+                default:
+                        c = ' ';
+                }
+                if (i < size) {
+                        printk("%c%c%c", hex(bytes[i] >> 4), hex(bytes[i]), c);
+                } else {
+                        printk("  %c", c);
+                }
+        }
+
+        for (i = 0; i < size; i++)
+                printk("%c", hex_print(bytes[i]));
+        printk("\n");
+}
+
+void zd_hexdump(const void *bytes, size_t size)
+{
+        size_t i = 0;
+
+        do {
+                dump_line((u8 *)bytes + i, size-i);
+                i += 8;
+        } while (i < size);
+}
+#endif /* DEBUG */
+
+void *zd_tail(const void *buffer, size_t buffer_size, size_t tail_size)
+{
+        if (buffer_size < tail_size)
+                return NULL;
+        return (u8 *)buffer + (buffer_size - tail_size);
+}
diff --git a/drivers/w1/w1_io.h b/drivers/net/wireless/zd1211rw/zd_util.h
index 9a76d2ad69c5..ce26f7adea92 100644
--- a/drivers/w1/w1_io.h
+++ b/drivers/net/wireless/zd1211rw/zd_util.h
@@ -1,8 +1,4 @@
-/*
- *      w1_io.h
- *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
- *
+/* zd_util.h
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -19,18 +15,15 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
-#ifndef __W1_IO_H
-#define __W1_IO_H
+#ifndef _ZD_UTIL_H
+#define _ZD_UTIL_H
 
-#include "w1.h"
+void *zd_tail(const void *buffer, size_t buffer_size, size_t tail_size);
 
-u8 w1_triplet(struct w1_master *dev, int bdir);
-void w1_write_8(struct w1_master *, u8);
-int w1_reset_bus(struct w1_master *);
-u8 w1_calc_crc8(u8 *, int);
-void w1_write_block(struct w1_master *, const u8 *, int);
-u8 w1_read_block(struct w1_master *, u8 *, int);
-void w1_search_devices(struct w1_master *dev, w1_slave_found_callback cb);
-int w1_reset_select_slave(struct w1_slave *sl);
+#ifdef DEBUG
+void zd_hexdump(const void *bytes, size_t size);
+#else
+#define zd_hexdump(bytes, size)
+#endif /* DEBUG */
 
-#endif /* __W1_IO_H */
+#endif /* _ZD_UTIL_H */
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index bbbf7e274a2a..8459a18254a4 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -19,37 +19,13 @@
 
         Support and updates available at
         http://www.scyld.com/network/yellowfin.html
+        [link no longer provides useful info -jgarzik]
 
-
-        Linux kernel changelog:
-        -----------------------
-
-        LK1.1.1 (jgarzik): Port to 2.4 kernel
-
-        LK1.1.2 (jgarzik):
-        * Merge in becker version 1.05
-
-        LK1.1.3 (jgarzik):
-        * Various cleanups
-        * Update yellowfin_timer to correctly calculate duplex.
-        (suggested by Manfred Spraul)
-
-        LK1.1.4 (val@nmt.edu):
-        * Fix three endian-ness bugs
-        * Support dual function SYM53C885E ethernet chip
-        
-        LK1.1.5 (val@nmt.edu):
-        * Fix forced full-duplex bug I introduced
-
-        LK1.1.6 (val@nmt.edu):
-        * Only print warning on truly "oversized" packets
-        * Fix theoretical bug on gigabit cards - return to 1.1.3 behavior
-        
 */
 
 #define DRV_NAME        "yellowfin"
-#define DRV_VERSION     "1.05+LK1.1.6"
-#define DRV_RELDATE     "Feb 11, 2002"
+#define DRV_VERSION     "2.0"
+#define DRV_RELDATE     "Jun 27, 2006"
 
 #define PFX DRV_NAME ": "
 
@@ -239,8 +215,11 @@ enum capability_flags {
         HasMACAddrBug=32, /* Only on early revs.  */
         DontUseEeprom=64, /* Don't read the MAC from the EEPROm. */
 };
+
 /* The PCI I/O space extent. */
-#define YELLOWFIN_SIZE 0x100
+enum {
+        YELLOWFIN_SIZE  = 0x100,
+};
 
 struct pci_id_info {
         const char *name;
@@ -248,16 +227,14 @@ struct pci_id_info {
                 int     pci, pci_mask, subsystem, subsystem_mask;
                 int revision, revision_mask;                            /* Only 8 bits. */
         } id;
-        int io_size;                            /* Needed for I/O region check or ioremap(). */
         int drv_flags;                          /* Driver use, intended as capability flags. */
 };
 
 static const struct pci_id_info pci_id_tbl[] = {
         {"Yellowfin G-NIC Gigabit Ethernet", { 0x07021000, 0xffffffff},
-         YELLOWFIN_SIZE,
          FullTxStatus | IsGigabit | HasMulticastBug | HasMACAddrBug | DontUseEeprom},
         {"Symbios SYM83C885", { 0x07011000, 0xffffffff},
-         YELLOWFIN_SIZE, HasMII | DontUseEeprom },
+          HasMII | DontUseEeprom },
         { }
 };
 
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index 222a1cc4aa28..8a60f391ffcf 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -6,8 +6,7 @@ menu "PCI Hotplug Support"
 
 config HOTPLUG_PCI
         tristate "Support for PCI Hotplug (EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
-        select HOTPLUG
+        depends on PCI && EXPERIMENTAL && HOTPLUG
         ---help---
           Say Y here if you have a motherboard with a PCI Hotplug controller.
           This allows you to add and remove PCI cards while the machine is
@@ -77,7 +76,7 @@ config HOTPLUG_PCI_IBM
 
 config HOTPLUG_PCI_ACPI
         tristate "ACPI PCI Hotplug driver"
-        depends on ACPI && HOTPLUG_PCI
+        depends on (!ACPI_DOCK && ACPI && HOTPLUG_PCI) || (ACPI_DOCK && HOTPLUG_PCI)
         help
           Say Y here if you have a system that supports PCI Hotplug using
           ACPI.
@@ -154,13 +153,6 @@ config HOTPLUG_PCI_SHPC_POLL_EVENT_MODE
 
           When in doubt, say N.
 
-config HOTPLUG_PCI_SHPC_PHPRM_LEGACY
-        bool "For AMD SHPC only: Use $HRT for resource/configuration"
-        depends on HOTPLUG_PCI_SHPC && !ACPI 
-        help
-          Say Y here for AMD SHPC. You have to select this option if you are 
-          using this driver on platform with AMD SHPC.
-
 config HOTPLUG_PCI_RPA
         tristate "RPA PCI Hotplug driver"
         depends on HOTPLUG_PCI && PPC_PSERIES && PPC64 && !HOTPLUG_PCI_FAKE
diff --git a/drivers/pci/hotplug/acpiphp_core.c b/drivers/pci/hotplug/acpiphp_core.c
index 34de5697983d..e2fef60c2d06 100644
--- a/drivers/pci/hotplug/acpiphp_core.c
+++ b/drivers/pci/hotplug/acpiphp_core.c
@@ -27,8 +27,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <gregkh@us.ibm.com>,
- *                  <t-kochi@bq.jp.nec.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index ef95d12fb32c..ae67a8f55ba1 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -26,7 +26,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <t-kochi@bq.jp.nec.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
index 02be74caa89f..4afcaffd031c 100644
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -254,8 +254,8 @@ int cpci_led_off(struct slot* slot)
 
 int cpci_configure_slot(struct slot* slot)
 {
-        unsigned char busnr;
-        struct pci_bus *child;
+        struct pci_bus *parent;
+        int fn;
 
         dbg("%s - enter", __FUNCTION__);
 
@@ -276,23 +276,53 @@ int cpci_configure_slot(struct slot* slot)
                  */
                 n = pci_scan_slot(slot->bus, slot->devfn);
                 dbg("%s: pci_scan_slot returned %d", __FUNCTION__, n);
-                if (n > 0)
-                        pci_bus_add_devices(slot->bus);
                 slot->dev = pci_get_slot(slot->bus, slot->devfn);
                 if (slot->dev == NULL) {
                         err("Could not find PCI device for slot %02x", slot->number);
-                        return 1;
+                        return -ENODEV;
                 }
         }
-
-        if (slot->dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
-                pci_read_config_byte(slot->dev, PCI_SECONDARY_BUS, &busnr);
-                child = pci_add_new_bus(slot->dev->bus, slot->dev, busnr);
-                pci_do_scan_bus(child);
-                pci_bus_size_bridges(child);
+        parent = slot->dev->bus;
+
+        for (fn = 0; fn < 8; fn++) {
+                struct pci_dev *dev;
+
+                dev = pci_get_slot(parent, PCI_DEVFN(PCI_SLOT(slot->devfn), fn));
+                if (!dev)
+                        continue;
+                if ((dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) ||
+                    (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS)) {
+                        /* Find an unused bus number for the new bridge */
+                        struct pci_bus *child;
+                        unsigned char busnr, start = parent->secondary;
+                        unsigned char end = parent->subordinate;
+
+                        for (busnr = start; busnr <= end; busnr++) {
+                                if (!pci_find_bus(pci_domain_nr(parent),
+                                                  busnr))
+                                        break;
+                        }
+                        if (busnr >= end) {
+                                err("No free bus for hot-added bridge\n");
+                                pci_dev_put(dev);
+                                continue;
+                        }
+                        child = pci_add_new_bus(parent, dev, busnr);
+                        if (!child) {
+                                err("Cannot add new bus for %s\n",
+                                    pci_name(dev));
+                                pci_dev_put(dev);
+                                continue;
+                        }
+                        child->subordinate = pci_do_scan_bus(child);
+                        pci_bus_size_bridges(child);
+                }
+                pci_dev_put(dev);
         }
 
-        pci_bus_assign_resources(slot->dev->bus);
+        pci_bus_assign_resources(parent);
+        pci_bus_add_devices(parent);
+        pci_enable_bridges(parent);
 
         dbg("%s - exit", __FUNCTION__);
         return 0;
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index ce89f5815861..eaea9d36a1bb 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -279,6 +279,11 @@ struct hpc_ops {
 
 
 #ifdef CONFIG_ACPI
+#include <acpi/acpi.h>
+#include <acpi/acpi_bus.h>
+#include <acpi/actypes.h>
+#include <linux/pci-acpi.h>
+
 #define pciehp_get_hp_hw_control_from_firmware(dev) \
         pciehp_acpi_get_hp_hw_control_from_firmware(dev)
 static inline int pciehp_get_hp_params_from_firmware(struct pci_dev *dev,
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 0d8fb6e607a1..6ab3b6cd2b54 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -38,10 +38,6 @@
 
 #include "../pci.h"
 #include "pciehp.h"
-#include <acpi/acpi.h>
-#include <acpi/acpi_bus.h>
-#include <acpi/actypes.h>
-#include <linux/pci-acpi.h>
 #ifdef DEBUG
 #define DBG_K_TRACE_ENTRY      ((unsigned int)0x00000001)       /* On function entry */
 #define DBG_K_TRACE_EXIT       ((unsigned int)0x00000002)       /* On function exit */
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 36bc7c415af7..a83c1f5735d6 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -47,13 +47,13 @@ msi_register(struct msi_ops *ops)
 
 static void msi_cache_ctor(void *p, kmem_cache_t *cache, unsigned long flags)
 {
-        memset(p, 0, NR_IRQS * sizeof(struct msi_desc));
+        memset(p, 0, sizeof(struct msi_desc));
 }
 
 static int msi_cache_init(void)
 {
         msi_cachep = kmem_cache_create("msi_cache",
-                        NR_IRQS * sizeof(struct msi_desc),
+                        sizeof(struct msi_desc),
                         0, SLAB_HWCACHE_ALIGN, msi_cache_ctor, NULL);
         if (!msi_cachep)
                 return -ENOMEM;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 10e1a905c144..474e9cd0e9e4 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -139,9 +139,8 @@ const struct pci_device_id *pci_match_id(const struct pci_device_id *ids,
 /**
  * pci_match_device - Tell if a PCI device structure has a matching
  *                    PCI device id structure
- * @ids: array of PCI device id structures to search in
- * @dev: the PCI device structure to match against
  * @drv: the PCI driver to match against
+ * @dev: the PCI device structure to match against
  *
  * Used by a driver to check whether a PCI device present in the
  * system is in its list of supported devices.  Returns the matching
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index cf57d7de3765..9f79dd6d51ab 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -19,6 +19,7 @@
 #include <asm/dma.h>    /* isa_dma_bridge_buggy */
 #include "pci.h"
 
+unsigned int pci_pm_d3_delay = 10;
 
 /**
  * pci_bus_max_busnr - returns maximum PCI bus number of given bus' children
@@ -313,6 +314,14 @@ pci_set_power_state(struct pci_dev *dev, pci_power_t state)
         } else if (dev->current_state == state)
                 return 0;        /* we're already there */
 
+        /*
+         * If the device or the parent bridge can't support PCI PM, ignore
+         * the request if we're doing anything besides putting it into D0
+         * (which would only happen on boot).
+         */
+        if ((state == PCI_D1 || state == PCI_D2) && pci_no_d1d2(dev))
+                return 0;
+
         /* find PCI PM capability in list */
         pm = pci_find_capability(dev, PCI_CAP_ID_PM);
         
@@ -363,7 +372,7 @@ pci_set_power_state(struct pci_dev *dev, pci_power_t state)
         /* Mandatory power management transition delays */
         /* see PCI PM 1.1 5.6.1 table 18 */
         if (state == PCI_D3hot || dev->current_state == PCI_D3hot)
-                msleep(10);
+                msleep(pci_pm_d3_delay);
         else if (state == PCI_D2 || dev->current_state == PCI_D2)
                 udelay(200);
 
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 9cc842b666eb..08d58fc78ee1 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -47,7 +47,7 @@ extern int pci_msi_quirk;
 #else
 #define pci_msi_quirk 0
 #endif
-
+extern unsigned int pci_pm_d3_delay;
 #ifdef CONFIG_PCI_MSI
 void disable_msi_mode(struct pci_dev *dev, int pos, int type);
 void pci_no_msi(void);
@@ -66,7 +66,15 @@ static inline int pci_save_msix_state(struct pci_dev *dev) { return 0; }
 static inline void pci_restore_msi_state(struct pci_dev *dev) {}
 static inline void pci_restore_msix_state(struct pci_dev *dev) {}
 #endif
+static inline int pci_no_d1d2(struct pci_dev *dev)
+{
+        unsigned int parent_dstates = 0;
 
+        if (dev->bus->self)
+                parent_dstates = dev->bus->self->no_d1d2;
+        return (dev->no_d1d2 || parent_dstates);
+
+}
 extern int pcie_mch_quirk;
 extern struct device_attribute pci_dev_attrs[];
 extern struct class_device_attribute class_device_attr_cpuaffinity;
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 50bfc1b2f3bf..478d0d28f7ad 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -30,23 +30,6 @@ MODULE_LICENSE("GPL");
 /* global data */
 static const char device_name[] = "pcieport-driver";
 
-static int pcie_portdrv_save_config(struct pci_dev *dev)
-{
-        return pci_save_state(dev);
-}
-
-static int pcie_portdrv_restore_config(struct pci_dev *dev)
-{
-        int retval;
-
-        pci_restore_state(dev);
-        retval = pci_enable_device(dev);
-        if (retval)
-                return retval;
-        pci_set_master(dev);
-        return 0;
-}
-
 /*
  * pcie_portdrv_probe - Probe PCI-Express port devices
  * @dev: PCI-Express port device being probed
@@ -73,8 +56,10 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
                 "%s->Dev[%04x:%04x] has invalid IRQ. Check vendor BIOS\n", 
                 __FUNCTION__, dev->device, dev->vendor);
         }
-        if (pcie_port_device_register(dev)) 
+        if (pcie_port_device_register(dev)) {
+                pci_disable_device(dev);
                 return -ENOMEM;
+        }
 
         return 0;
 }
@@ -86,6 +71,23 @@ static void pcie_portdrv_remove (struct pci_dev *dev)
 }
 
 #ifdef CONFIG_PM
+static int pcie_portdrv_save_config(struct pci_dev *dev)
+{
+        return pci_save_state(dev);
+}
+
+static int pcie_portdrv_restore_config(struct pci_dev *dev)
+{
+        int retval;
+
+        pci_restore_state(dev);
+        retval = pci_enable_device(dev);
+        if (retval)
+                return retval;
+        pci_set_master(dev);
+        return 0;
+}
+
 static int pcie_portdrv_suspend (struct pci_dev *dev, pm_message_t state)
 {
         int ret = pcie_port_device_suspend(dev, state);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index f89dbc3738b7..c5a58d1c6c1c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -815,6 +815,7 @@ pci_scan_device(struct pci_bus *bus, int devfn)
         dev->vendor = l & 0xffff;
         dev->device = (l >> 16) & 0xffff;
         dev->cfg_size = pci_cfg_space_size(dev);
+        dev->error_state = pci_channel_io_normal;
 
         /* Assume 32-bit PCI; let 64-bit PCI cards (which are far rarer)
            set this higher, assuming the system even supports it.  */
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index d1d7333bb71b..17e709e7d72a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -400,6 +400,7 @@ static void __devinit quirk_piix4_acpi(struct pci_dev *dev)
         piix4_io_quirk(dev, "PIIX4 devres J", 0x7c, 1 << 20);
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82371AB_3,  quirk_piix4_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82443MX_3,  quirk_piix4_acpi );
 
 /*
  * ICH4, ICH4-M, ICH5, ICH5-M ACPI: Three IO regions pointed to by longwords at
@@ -437,6 +438,7 @@ static void __devinit quirk_ich6_lpc_acpi(struct pci_dev *dev)
         pci_read_config_dword(dev, 0x48, &region);
         quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH6 GPIO");
 }
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH6_0, quirk_ich6_lpc_acpi );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH6_1, quirk_ich6_lpc_acpi );
 
 /*
@@ -665,6 +667,7 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_0, quirk_vi
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_1, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_2, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_3, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235_USB_2, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_5, quirk_via_irq);
@@ -682,6 +685,33 @@ static void __devinit quirk_vt82c598_id(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_82C597_0,     quirk_vt82c598_id );
 
+#ifdef CONFIG_ACPI_SLEEP
+
+/*
+ * Some VIA systems boot with the abnormal status flag set. This can cause
+ * the BIOS to re-POST the system on resume rather than passing control
+ * back to the OS.  Clear the flag on boot
+ */
+static void __devinit quirk_via_abnormal_poweroff(struct pci_dev *dev)
+{
+        u32 reg;
+
+        acpi_hw_register_read(ACPI_MTX_DO_NOT_LOCK, ACPI_REGISTER_PM1_STATUS,
+                                &reg);
+
+        if (reg & 0x800) {
+                printk("Clearing abnormal poweroff flag\n");
+                acpi_hw_register_write(ACPI_MTX_DO_NOT_LOCK,
+                                        ACPI_REGISTER_PM1_STATUS,
+                                        (u16)0x800);
+        }
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235, quirk_via_abnormal_poweroff);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, quirk_via_abnormal_poweroff);
+
+#endif
+
 /*
  * CardBus controllers have a legacy base address that enables them
  * to respond as i82365 pcmcia controllers.  We don't want them to
@@ -962,6 +992,11 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
                         case 0x8070: /* P4G8X Deluxe */
                                 asus_hides_smbus = 1;
                         }
+                if (dev->device == PCI_DEVICE_ID_INTEL_E7501_MCH)
+                        switch (dev->subsystem_device) {
+                        case 0x80c9: /* PU-DLS */
+                                asus_hides_smbus = 1;
+                        }
                 if (dev->device == PCI_DEVICE_ID_INTEL_82855GM_HB)
                         switch (dev->subsystem_device) {
                         case 0x1751: /* M2N notebook */
@@ -1030,6 +1065,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82845G_HB,	asu
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82850_HB,   asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82865_HB,   asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_7205_0,     asus_hides_smbus_hostbridge );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_E7501_MCH,  asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82855PM_HB, asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82855GM_HB, asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82915GM_HB, asus_hides_smbus_hostbridge );
@@ -1053,10 +1089,10 @@ static void __init asus_hides_smbus_lpc(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801BA_0,  asus_hides_smbus_lpc );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_12, asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_12, asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801EB_0,  asus_hides_smbus_lpc );
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH6_1,     asus_hides_smbus_lpc );
 
 static void __init asus_hides_smbus_lpc_ich6(struct pci_dev *dev)
 {
@@ -1174,6 +1210,55 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SI,	PCI_DEVICE_ID_SI_962,		quirk_sis_96x_
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SI,      PCI_DEVICE_ID_SI_963,           quirk_sis_96x_smbus );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SI,      PCI_DEVICE_ID_SI_LPC,           quirk_sis_96x_smbus );
 
+#if defined(CONFIG_SCSI_SATA) || defined(CONFIG_SCSI_SATA_MODULE)
+
+/*
+ *      If we are using libata we can drive this chip properly but must
+ *      do this early on to make the additional device appear during
+ *      the PCI scanning.
+ */
+
+static void __devinit quirk_jmicron_dualfn(struct pci_dev *pdev)
+{
+        u32 conf;
+        u8 hdr;
+
+        /* Only poke fn 0 */
+        if (PCI_FUNC(pdev->devfn))
+                return;
+
+        switch(pdev->device) {
+                case PCI_DEVICE_ID_JMICRON_JMB365:
+                case PCI_DEVICE_ID_JMICRON_JMB366:
+                        /* Redirect IDE second PATA port to the right spot */
+                        pci_read_config_dword(pdev, 0x80, &conf);
+                        conf |= (1 << 24);
+                        /* Fall through */
+                        pci_write_config_dword(pdev, 0x80, conf);
+                case PCI_DEVICE_ID_JMICRON_JMB361:
+                case PCI_DEVICE_ID_JMICRON_JMB363:
+                        pci_read_config_dword(pdev, 0x40, &conf);
+                        /* Enable dual function mode, AHCI on fn 0, IDE fn1 */
+                        /* Set the class codes correctly and then direct IDE 0 */
+                        conf &= ~0x000F0200;    /* Clear bit 9 and 16-19 */
+                        conf |=  0x00C20002;    /* Set bit 1, 17, 22, 23 */
+                        pci_write_config_dword(pdev, 0x40, conf);
+
+                        /* Reconfigure so that the PCI scanner discovers the
+                           device is now multifunction */
+
+                        pci_read_config_byte(pdev, PCI_HEADER_TYPE, &hdr);
+                        pdev->hdr_type = hdr & 0x7f;
+                        pdev->multifunction = !!(hdr & 0x80);
+
+                        break;
+        }
+}
+
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, quirk_jmicron_dualfn);
+
+#endif
+
 #ifdef CONFIG_X86_IO_APIC
 static void __init quirk_alder_ioapic(struct pci_dev *pdev)
 {
@@ -1341,6 +1426,37 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_PXH_0,	quirk_pc
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXH_1,      quirk_pcie_pxh);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHV,       quirk_pcie_pxh);
 
+/*
+ * Some Intel PCI Express chipsets have trouble with downstream
+ * device power management.
+ */
+static void quirk_intel_pcie_pm(struct pci_dev * dev)
+{
+        pci_pm_d3_delay = 120;
+        dev->no_d1d2 = 1;
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25e2, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25e3, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25e4, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25e5, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25e6, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25e7, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25f7, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25f8, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25f9, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x25fa, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2601, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2602, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2603, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2604, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2605, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2606, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2607, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2608, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x2609, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x260a, quirk_intel_pcie_pm);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x260b, quirk_intel_pcie_pm);
 
 /*
  * Fixup the cardbus bridges on the IBM Dock II docking station
@@ -1403,6 +1519,63 @@ static void __devinit quirk_netmos(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID, quirk_netmos);
 
+static void __devinit quirk_e100_interrupt(struct pci_dev *dev)
+{
+        u16 command;
+        u32 bar;
+        u8 __iomem *csr;
+        u8 cmd_hi;
+
+        switch (dev->device) {
+        /* PCI IDs taken from drivers/net/e100.c */
+        case 0x1029:
+        case 0x1030 ... 0x1034:
+        case 0x1038 ... 0x103E:
+        case 0x1050 ... 0x1057:
+        case 0x1059:
+        case 0x1064 ... 0x106B:
+        case 0x1091 ... 0x1095:
+        case 0x1209:
+        case 0x1229:
+        case 0x2449:
+        case 0x2459:
+        case 0x245D:
+        case 0x27DC:
+                break;
+        default:
+                return;
+        }
+
+        /*
+         * Some firmware hands off the e100 with interrupts enabled,
+         * which can cause a flood of interrupts if packets are
+         * received before the driver attaches to the device.  So
+         * disable all e100 interrupts here.  The driver will
+         * re-enable them when it's ready.
+         */
+        pci_read_config_word(dev, PCI_COMMAND, &command);
+        pci_read_config_dword(dev, PCI_BASE_ADDRESS_0, &bar);
+
+        if (!(command & PCI_COMMAND_MEMORY) || !bar)
+                return;
+
+        csr = ioremap(bar, 8);
+        if (!csr) {
+                printk(KERN_WARNING "PCI: Can't map %s e100 registers\n",
+                        pci_name(dev));
+                return;
+        }
+
+        cmd_hi = readb(csr + 3);
+        if (cmd_hi == 0) {
+                printk(KERN_WARNING "PCI: Firmware left %s e100 interrupts "
+                        "enabled, disabling\n", pci_name(dev));
+                writeb(1, csr + 3);
+        }
+
+        iounmap(csr);
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_e100_interrupt);
 
 static void __devinit fixup_rev1_53c810(struct pci_dev* dev)
 {
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index 622b3f8ba820..d529462d1b53 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -41,7 +41,7 @@ pci_do_find_bus(struct pci_bus* bus, unsigned char busnr)
  * in the global list of PCI buses.  If the bus is found, a pointer to its
  * data structure is returned.  If no bus is found, %NULL is returned.
  */
-struct pci_bus * __devinit pci_find_bus(int domain, int busnr)
+struct pci_bus * pci_find_bus(int domain, int busnr)
 {
         struct pci_bus *bus = NULL;
         struct pci_bus *tmp_bus;
@@ -61,7 +61,7 @@ struct pci_bus * __devinit pci_find_bus(int domain, int busnr)
  * @from: Previous PCI bus found, or %NULL for new search.
  *
  * Iterates through the list of known PCI busses.  A new search is
- * initiated by passing %NULL to the @from argument.  Otherwise if
+ * initiated by passing %NULL as the @from argument.  Otherwise if
  * @from is not %NULL, searches continue from next device on the
  * global list.
  */
@@ -148,13 +148,14 @@ struct pci_dev * pci_get_slot(struct pci_bus *bus, unsigned int devfn)
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
  * Iterates through the list of known PCI devices.  If a PCI device is
- * found with a matching @vendor, @device, @ss_vendor and @ss_device, a pointer to its
- * device structure is returned.  Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
- * Otherwise if @from is not %NULL, searches continue from next device on the global list.
+ * found with a matching @vendor, @device, @ss_vendor and @ss_device, a
+ * pointer to its device structure is returned.  Otherwise, %NULL is returned.
+ * A new search is initiated by passing %NULL as the @from argument.
+ * Otherwise if @from is not %NULL, searches continue from next device
+ * on the global list.
  *
- * NOTE: Do not use this function anymore, use pci_get_subsys() instead, as
- * the pci device returned by this function can disappear at any moment in
+ * NOTE: Do not use this function any more; use pci_get_subsys() instead, as
+ * the PCI device returned by this function can disappear at any moment in
  * time.
  */
 static struct pci_dev * pci_find_subsys(unsigned int vendor,
@@ -191,14 +192,15 @@ exit:
  * @device: PCI device id to match, or %PCI_ANY_ID to match all device ids
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
- * Iterates through the list of known PCI devices.  If a PCI device is
- * found with a matching @vendor and @device, a pointer to its device structure is
+ * Iterates through the list of known PCI devices.  If a PCI device is found
+ * with a matching @vendor and @device, a pointer to its device structure is
  * returned.  Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
- * Otherwise if @from is not %NULL, searches continue from next device on the global list.
+ * A new search is initiated by passing %NULL as the @from argument.
+ * Otherwise if @from is not %NULL, searches continue from next device
+ * on the global list.
  * 
- * NOTE: Do not use this function anymore, use pci_get_device() instead, as
- * the pci device returned by this function can disappear at any moment in
+ * NOTE: Do not use this function any more; use pci_get_device() instead, as
+ * the PCI device returned by this function can disappear at any moment in
  * time.
  */
 struct pci_dev *
@@ -215,11 +217,11 @@ pci_find_device(unsigned int vendor, unsigned int device, const struct pci_dev *
  * @ss_device: PCI subsystem device id to match, or %PCI_ANY_ID to match all device ids
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
- * Iterates through the list of known PCI devices.  If a PCI device is
- * found with a matching @vendor, @device, @ss_vendor and @ss_device, a pointer to its
+ * Iterates through the list of known PCI devices.  If a PCI device is found
+ * with a matching @vendor, @device, @ss_vendor and @ss_device, a pointer to its
  * device structure is returned, and the reference count to the device is
  * incremented.  Otherwise, %NULL is returned.  A new search is initiated by
- * passing %NULL to the @from argument.  Otherwise if @from is not %NULL,
+ * passing %NULL as the @from argument.  Otherwise if @from is not %NULL,
  * searches continue from next device on the global list.
  * The reference count for @from is always decremented if it is not %NULL.
  */
@@ -262,7 +264,7 @@ exit:
  * found with a matching @vendor and @device, the reference count to the
  * device is incremented and a pointer to its device structure is returned.
  * Otherwise, %NULL is returned.  A new search is initiated by passing %NULL
- * to the @from argument.  Otherwise if @from is not %NULL, searches continue
+ * as the @from argument.  Otherwise if @from is not %NULL, searches continue
  * from next device on the global list.  The reference count for @from is
  * always decremented if it is not %NULL.
  */
@@ -279,11 +281,13 @@ pci_get_device(unsigned int vendor, unsigned int device, struct pci_dev *from)
  * @device: PCI device id to match, or %PCI_ANY_ID to match all device ids
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
- * Iterates through the list of known PCI devices in the reverse order of pci_find_device().
+ * Iterates through the list of known PCI devices in the reverse order of
+ * pci_find_device().
  * If a PCI device is found with a matching @vendor and @device, a pointer to
  * its device structure is returned.  Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
- * Otherwise if @from is not %NULL, searches continue from previous device on the global list.
+ * A new search is initiated by passing %NULL as the @from argument.
+ * Otherwise if @from is not %NULL, searches continue from previous device
+ * on the global list.
  */
 struct pci_dev *
 pci_find_device_reverse(unsigned int vendor, unsigned int device, const struct pci_dev *from)
@@ -317,7 +321,7 @@ exit:
  * found with a matching @class, the reference count to the device is
  * incremented and a pointer to its device structure is returned.
  * Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
+ * A new search is initiated by passing %NULL as the @from argument.
  * Otherwise if @from is not %NULL, searches continue from next device
  * on the global list.  The reference count for @from is always decremented
  * if it is not %NULL.
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index 61cb4b29f55c..35f88649d3b7 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -6,7 +6,7 @@ menu "PCCARD (PCMCIA/CardBus) support"
 
 config PCCARD
         tristate "PCCard (PCMCIA/CardBus) support"
-        select HOTPLUG
+        depends on HOTPLUG
         ---help---
           Say Y here if you want to attach PCMCIA- or PC-cards to your Linux
           computer.  These are credit-card size devices such as network cards,
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 738b1ef595a3..9ad18e62658d 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -601,12 +601,8 @@ static int ds_ioctl(struct inode * inode, struct file * file,
             ret = CS_BAD_ARGS;
         else {
             struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->config.Function);
-            if (p_dev == NULL)
-                    ret = CS_BAD_ARGS;
-            else {
-                    ret = pccard_get_configuration_info(s, p_dev, &buf->config);
-                    pcmcia_put_dev(p_dev);
-            }
+            ret = pccard_get_configuration_info(s, p_dev, &buf->config);
+            pcmcia_put_dev(p_dev);
         }
         break;
     case DS_GET_FIRST_TUPLE:
@@ -636,12 +632,8 @@ static int ds_ioctl(struct inode * inode, struct file * file,
                     ret = CS_BAD_ARGS;
             else {
                     struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->status.Function);
-                    if (p_dev == NULL)
-                            ret = CS_BAD_ARGS;
-                    else {
-                            ret = pccard_get_status(s, p_dev, &buf->status);
-                            pcmcia_put_dev(p_dev);
-                    }
+                    ret = pccard_get_status(s, p_dev, &buf->status);
+                    pcmcia_put_dev(p_dev);
             }
             break;
     case DS_VALIDATE_CIS:
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 7bf25b88ea31..c8323399e9e4 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -245,10 +245,17 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
                 return CS_SUCCESS;
         }
 
-        /* !!! This is a hack !!! */
-        memcpy(&config->Attributes, &c->Attributes, sizeof(config_t));
-        config->Attributes |= CONF_VALID_CLIENT;
-        config->CardValues = c->CardValues;
+        config->Attributes = c->Attributes | CONF_VALID_CLIENT;
+        config->Vcc = s->socket.Vcc;
+        config->Vpp1 = config->Vpp2 = s->socket.Vpp;
+        config->IntType = c->IntType;
+        config->ConfigBase = c->ConfigBase;
+        config->Status = c->Status;
+        config->Pin = c->Pin;
+        config->Copy = c->Copy;
+        config->Option = c->Option;
+        config->ExtStatus = c->ExtStatus;
+        config->Present = config->CardValues = c->CardValues;
         config->IRQAttributes = c->irq.Attributes;
         config->AssignedIRQ = s->irq.AssignedIRQ;
         config->BasePort1 = c->io.BasePort1;
diff --git a/drivers/pnp/interface.c b/drivers/pnp/interface.c
index 3163e3d73da1..9d8b415eca79 100644
--- a/drivers/pnp/interface.c
+++ b/drivers/pnp/interface.c
@@ -265,8 +265,8 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," 0x%llx-0x%llx\n",
-                                                pnp_port_start(dev, i),
-                                                pnp_port_end(dev, i));
+                                        (unsigned long long)pnp_port_start(dev, i),
+                                        (unsigned long long)pnp_port_end(dev, i));
                 }
         }
         for (i = 0; i < PNP_MAX_MEM; i++) {
@@ -276,8 +276,8 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," 0x%llx-0x%llx\n",
-                                                pnp_mem_start(dev, i),
-                                                pnp_mem_end(dev, i));
+                                        (unsigned long long)pnp_mem_start(dev, i),
+                                        (unsigned long long)pnp_mem_end(dev, i));
                 }
         }
         for (i = 0; i < PNP_MAX_IRQ; i++) {
@@ -287,7 +287,7 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," %lld\n",
-                                                pnp_irq(dev, i));
+                                        (unsigned long long)pnp_irq(dev, i));
                 }
         }
         for (i = 0; i < PNP_MAX_DMA; i++) {
@@ -297,7 +297,7 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," %lld\n",
-                                                pnp_dma(dev, i));
+                                        (unsigned long long)pnp_dma(dev, i));
                 }
         }
         ret = (buffer->curr - buf);
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 3a4a644c2686..dc79b0a0059f 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -74,7 +74,7 @@ static void decode_irq_flags(int flag, int *triggering, int *polarity)
 
 static void
 pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, u32 gsi,
-        int triggering, int polarity)
+        int triggering, int polarity, int shareable)
 {
         int i = 0;
         int irq;
@@ -95,6 +95,9 @@ pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, u32 gsi,
                 return;
         }
 
+        if (shareable)
+                res->irq_resource[i].flags |= IORESOURCE_IRQ_SHAREABLE;
+
         res->irq_resource[i].start = irq;
         res->irq_resource[i].end = irq;
         pcibios_penalize_isa_irq(irq, 1);
@@ -170,6 +173,9 @@ pnpacpi_parse_allocated_address_space(struct pnp_resource_table *res_table,
                 return;
         }
 
+        if (p->producer_consumer == ACPI_PRODUCER)
+                return;
+
         if (p->resource_type == ACPI_MEMORY_RANGE)
                 pnpacpi_parse_allocated_memresource(res_table,
                                 p->minimum, p->address_length);
@@ -194,7 +200,8 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
                         pnpacpi_parse_allocated_irqresource(res_table,
                                 res->data.irq.interrupts[i],
                                 res->data.irq.triggering,
-                                res->data.irq.polarity);
+                                res->data.irq.polarity,
+                                res->data.irq.sharable);
                 }
                 break;
 
@@ -248,14 +255,20 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_ADDRESS64:
+                if (res->data.ext_address64.producer_consumer == ACPI_PRODUCER)
+                        return AE_OK;
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
+                if (res->data.extended_irq.producer_consumer == ACPI_PRODUCER)
+                        return AE_OK;
+
                 for (i = 0; i < res->data.extended_irq.interrupt_count; i++) {
                         pnpacpi_parse_allocated_irqresource(res_table,
                                 res->data.extended_irq.interrupts[i],
                                 res->data.extended_irq.triggering,
-                                res->data.extended_irq.polarity);
+                                res->data.extended_irq.polarity,
+                                res->data.extended_irq.sharable);
                 }
                 break;
 
diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c
index b154b3f52cbe..551f58e29810 100644
--- a/drivers/pnp/pnpbios/core.c
+++ b/drivers/pnp/pnpbios/core.c
@@ -346,7 +346,7 @@ static int insert_device(struct pnp_dev *dev, struct pnp_bios_node * node)
         dev->flags = node->flags;
         if (!(dev->flags & PNPBIOS_NO_CONFIG))
                 dev->capabilities |= PNP_CONFIGURABLE;
-        if (!(dev->flags & PNPBIOS_NO_DISABLE))
+        if (!(dev->flags & PNPBIOS_NO_DISABLE) && pnpbios_is_dynamic(dev))
                 dev->capabilities |= PNP_DISABLE;
         dev->capabilities |= PNP_READ;
         if (pnpbios_is_dynamic(dev))
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index f5b9f187a930..7ff1d88094b6 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -121,6 +121,16 @@ config RTC_DRV_DS1553
           This driver can also be built as a module. If so, the module
           will be called rtc-ds1553.
 
+config RTC_DRV_ISL1208
+        tristate "Intersil 1208"
+        depends on RTC_CLASS && I2C
+        help
+          If you say yes here you get support for the
+          Intersil 1208 RTC chip.
+
+          This driver can also be built as a module. If so, the module
+          will be called rtc-isl1208.
+
 config RTC_DRV_DS1672
         tristate "Dallas/Maxim DS1672"
         depends on RTC_CLASS && I2C
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 54220714ff49..bbcfb09d81d9 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_RTC_INTF_PROC)	+= rtc-proc.o
 obj-$(CONFIG_RTC_INTF_DEV)      += rtc-dev.o
 
 obj-$(CONFIG_RTC_DRV_X1205)     += rtc-x1205.o
+obj-$(CONFIG_RTC_DRV_ISL1208)   += rtc-isl1208.o
 obj-$(CONFIG_RTC_DRV_TEST)      += rtc-test.o
 obj-$(CONFIG_RTC_DRV_DS1307)    += rtc-ds1307.o
 obj-$(CONFIG_RTC_DRV_DS1672)    += rtc-ds1672.o
diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
new file mode 100644
index 000000000000..f324d0a635d4
--- /dev/null
+++ b/drivers/rtc/rtc-isl1208.c
@@ -0,0 +1,591 @@
+/*
+ * Intersil ISL1208 rtc class driver
+ *
+ * Copyright 2005,2006 Hebert Valerio Riedel <hvr@gnu.org>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/bcd.h>
+#include <linux/rtc.h>
+
+#define DRV_NAME "isl1208"
+#define DRV_VERSION "0.2"
+
+/* Register map */
+/* rtc section */
+#define ISL1208_REG_SC  0x00
+#define ISL1208_REG_MN  0x01
+#define ISL1208_REG_HR  0x02
+#define ISL1208_REG_HR_MIL     (1<<7) /* 24h/12h mode */
+#define ISL1208_REG_HR_PM      (1<<5) /* PM/AM bit in 12h mode */
+#define ISL1208_REG_DT  0x03
+#define ISL1208_REG_MO  0x04
+#define ISL1208_REG_YR  0x05
+#define ISL1208_REG_DW  0x06
+#define ISL1208_RTC_SECTION_LEN 7
+
+/* control/status section */
+#define ISL1208_REG_SR  0x07
+#define ISL1208_REG_SR_ARST    (1<<7) /* auto reset */
+#define ISL1208_REG_SR_XTOSCB  (1<<6) /* crystal oscillator */
+#define ISL1208_REG_SR_WRTC    (1<<4) /* write rtc */
+#define ISL1208_REG_SR_ALM     (1<<2) /* alarm */
+#define ISL1208_REG_SR_BAT     (1<<1) /* battery */
+#define ISL1208_REG_SR_RTCF    (1<<0) /* rtc fail */
+#define ISL1208_REG_INT 0x08
+#define ISL1208_REG_09  0x09 /* reserved */
+#define ISL1208_REG_ATR 0x0a
+#define ISL1208_REG_DTR 0x0b
+
+/* alarm section */
+#define ISL1208_REG_SCA 0x0c
+#define ISL1208_REG_MNA 0x0d
+#define ISL1208_REG_HRA 0x0e
+#define ISL1208_REG_DTA 0x0f
+#define ISL1208_REG_MOA 0x10
+#define ISL1208_REG_DWA 0x11
+#define ISL1208_ALARM_SECTION_LEN 6
+
+/* user section */
+#define ISL1208_REG_USR1 0x12
+#define ISL1208_REG_USR2 0x13
+#define ISL1208_USR_SECTION_LEN 2
+
+/* i2c configuration */
+#define ISL1208_I2C_ADDR 0xde
+
+static unsigned short normal_i2c[] = {
+        ISL1208_I2C_ADDR>>1, I2C_CLIENT_END
+};
+I2C_CLIENT_INSMOD; /* defines addr_data */
+
+static int isl1208_attach_adapter(struct i2c_adapter *adapter);
+static int isl1208_detach_client(struct i2c_client *client);
+
+static struct i2c_driver isl1208_driver = {
+        .driver         = {
+                .name   = DRV_NAME,
+        },
+        .id             = I2C_DRIVERID_ISL1208,
+        .attach_adapter = &isl1208_attach_adapter,
+        .detach_client  = &isl1208_detach_client,
+};
+
+/* block read */
+static int
+isl1208_i2c_read_regs(struct i2c_client *client, u8 reg, u8 buf[],
+                       unsigned len)
+{
+        u8 reg_addr[1] = { reg };
+        struct i2c_msg msgs[2] = {
+                { client->addr, client->flags, sizeof(reg_addr), reg_addr },
+                { client->addr, client->flags | I2C_M_RD, len, buf }
+        };
+        int ret;
+
+        BUG_ON(len == 0);
+        BUG_ON(reg > ISL1208_REG_USR2);
+        BUG_ON(reg + len > ISL1208_REG_USR2 + 1);
+
+        ret = i2c_transfer(client->adapter, msgs, 2);
+        if (ret > 0)
+                ret = 0;
+        return ret;
+}
+
+/* block write */
+static int
+isl1208_i2c_set_regs(struct i2c_client *client, u8 reg, u8 const buf[],
+                       unsigned len)
+{
+        u8 i2c_buf[ISL1208_REG_USR2 + 2];
+        struct i2c_msg msgs[1] = {
+                { client->addr, client->flags, len + 1, i2c_buf }
+        };
+        int ret;
+
+        BUG_ON(len == 0);
+        BUG_ON(reg > ISL1208_REG_USR2);
+        BUG_ON(reg + len > ISL1208_REG_USR2 + 1);
+
+        i2c_buf[0] = reg;
+        memcpy(&i2c_buf[1], &buf[0], len);
+
+        ret = i2c_transfer(client->adapter, msgs, 1);
+        if (ret > 0)
+                ret = 0;
+        return ret;
+}
+
+/* simple check to see wether we have a isl1208 */
+static int isl1208_i2c_validate_client(struct i2c_client *client)
+{
+        u8 regs[ISL1208_RTC_SECTION_LEN] = { 0, };
+        u8 zero_mask[ISL1208_RTC_SECTION_LEN] = {
+                0x80, 0x80, 0x40, 0xc0, 0xe0, 0x00, 0xf8
+        };
+        int i;
+        int ret;
+
+        ret = isl1208_i2c_read_regs(client, 0, regs, ISL1208_RTC_SECTION_LEN);
+        if (ret < 0)
+                return ret;
+
+        for (i = 0; i < ISL1208_RTC_SECTION_LEN; ++i) {
+                if (regs[i] & zero_mask[i]) /* check if bits are cleared */
+                        return -ENODEV;
+        }
+
+        return 0;
+}
+
+static int isl1208_i2c_get_sr(struct i2c_client *client)
+{
+        return i2c_smbus_read_byte_data(client, ISL1208_REG_SR) == -1 ? -EIO:0;
+}
+
+static int isl1208_i2c_get_atr(struct i2c_client *client)
+{
+        int atr = i2c_smbus_read_byte_data(client, ISL1208_REG_ATR);
+
+        if (atr < 0)
+                return -EIO;
+
+        /* The 6bit value in the ATR register controls the load
+         * capacitance C_load * in steps of 0.25pF
+         *
+         * bit (1<<5) of the ATR register is inverted
+         *
+         * C_load(ATR=0x20) =  4.50pF
+         * C_load(ATR=0x00) = 12.50pF
+         * C_load(ATR=0x1f) = 20.25pF
+         *
+         */
+
+        atr &= 0x3f; /* mask out lsb */
+        atr ^= 1<<5; /* invert 6th bit */
+        atr += 2*9; /* add offset of 4.5pF; unit[atr] = 0.25pF */
+
+        return atr;
+}
+
+static int isl1208_i2c_get_dtr(struct i2c_client *client)
+{
+        int dtr = i2c_smbus_read_byte_data(client, ISL1208_REG_DTR);
+
+        if (dtr < 0)
+                return -EIO;
+
+        /* dtr encodes adjustments of {-60,-40,-20,0,20,40,60} ppm */
+        dtr = ((dtr & 0x3) * 20) * (dtr & (1<<2) ? -1 : 1);
+
+        return dtr;
+}
+
+static int isl1208_i2c_get_usr(struct i2c_client *client)
+{
+        u8 buf[ISL1208_USR_SECTION_LEN] = { 0, };
+        int ret;
+
+        ret = isl1208_i2c_read_regs (client, ISL1208_REG_USR1, buf,
+                                   ISL1208_USR_SECTION_LEN);
+        if (ret < 0)
+                return ret;
+
+        return (buf[1] << 8) | buf[0];
+}
+
+static int isl1208_i2c_set_usr(struct i2c_client *client, u16 usr)
+{
+        u8 buf[ISL1208_USR_SECTION_LEN];
+
+        buf[0] = usr & 0xff;
+        buf[1] = (usr >> 8) & 0xff;
+
+        return isl1208_i2c_set_regs (client, ISL1208_REG_USR1, buf,
+                                     ISL1208_USR_SECTION_LEN);
+}
+
+static int isl1208_rtc_proc(struct device *dev, struct seq_file *seq)
+{
+        struct i2c_client *const client = to_i2c_client(dev);
+        int sr, dtr, atr, usr;
+
+        sr = isl1208_i2c_get_sr(client);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: reading SR failed\n", __func__);
+                return sr;
+        }
+
+        seq_printf(seq, "status_reg\t:%s%s%s%s%s%s (0x%.2x)\n",
+                   (sr & ISL1208_REG_SR_RTCF) ? " RTCF" : "",
+                   (sr & ISL1208_REG_SR_BAT) ? " BAT" : "",
+                   (sr & ISL1208_REG_SR_ALM) ? " ALM" : "",
+                   (sr & ISL1208_REG_SR_WRTC) ? " WRTC" : "",
+                   (sr & ISL1208_REG_SR_XTOSCB) ? " XTOSCB" : "",
+                   (sr & ISL1208_REG_SR_ARST) ? " ARST" : "",
+                   sr);
+
+        seq_printf(seq, "batt_status\t: %s\n",
+                   (sr & ISL1208_REG_SR_RTCF) ? "bad" : "okay");
+
+        dtr = isl1208_i2c_get_dtr(client);
+        if (dtr >= 0 -1)
+                seq_printf(seq, "digital_trim\t: %d ppm\n", dtr);
+
+        atr = isl1208_i2c_get_atr(client);
+        if (atr >= 0)
+                seq_printf(seq, "analog_trim\t: %d.%.2d pF\n",
+                           atr>>2, (atr&0x3)*25);
+
+        usr = isl1208_i2c_get_usr(client);
+        if (usr >= 0)
+                seq_printf(seq, "user_data\t: 0x%.4x\n", usr);
+
+        return 0;
+}
+
+
+static int isl1208_i2c_read_time(struct i2c_client *client,
+                                 struct rtc_time *tm)
+{
+        int sr;
+        u8 regs[ISL1208_RTC_SECTION_LEN] = { 0, };
+
+        sr = isl1208_i2c_get_sr(client);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: reading SR failed\n", __func__);
+                return -EIO;
+        }
+
+        sr = isl1208_i2c_read_regs(client, 0, regs, ISL1208_RTC_SECTION_LEN);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: reading RTC section failed\n",
+                        __func__);
+                return sr;
+        }
+
+        tm->tm_sec = BCD2BIN(regs[ISL1208_REG_SC]);
+        tm->tm_min = BCD2BIN(regs[ISL1208_REG_MN]);
+        { /* HR field has a more complex interpretation */
+                const u8 _hr = regs[ISL1208_REG_HR];
+                if (_hr & ISL1208_REG_HR_MIL) /* 24h format */
+                        tm->tm_hour = BCD2BIN(_hr & 0x3f);
+                else { // 12h format
+                        tm->tm_hour = BCD2BIN(_hr & 0x1f);
+                        if (_hr & ISL1208_REG_HR_PM) /* PM flag set */
+                                tm->tm_hour += 12;
+                }
+        }
+
+        tm->tm_mday = BCD2BIN(regs[ISL1208_REG_DT]);
+        tm->tm_mon = BCD2BIN(regs[ISL1208_REG_MO]) - 1; /* rtc starts at 1 */
+        tm->tm_year = BCD2BIN(regs[ISL1208_REG_YR]) + 100;
+        tm->tm_wday = BCD2BIN(regs[ISL1208_REG_DW]);
+
+        return 0;
+}
+
+static int isl1208_i2c_read_alarm(struct i2c_client *client,
+                                  struct rtc_wkalrm *alarm)
+{
+        struct rtc_time *const tm = &alarm->time;
+        u8 regs[ISL1208_ALARM_SECTION_LEN] = { 0, };
+        int sr;
+
+        sr = isl1208_i2c_get_sr(client);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: reading SR failed\n", __func__);
+                return sr;
+        }
+
+        sr = isl1208_i2c_read_regs(client, ISL1208_REG_SCA, regs,
+                                  ISL1208_ALARM_SECTION_LEN);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: reading alarm section failed\n",
+                        __func__);
+                return sr;
+        }
+
+        /* MSB of each alarm register is an enable bit */
+        tm->tm_sec  = BCD2BIN(regs[ISL1208_REG_SCA-ISL1208_REG_SCA] & 0x7f);
+        tm->tm_min  = BCD2BIN(regs[ISL1208_REG_MNA-ISL1208_REG_SCA] & 0x7f);
+        tm->tm_hour = BCD2BIN(regs[ISL1208_REG_HRA-ISL1208_REG_SCA] & 0x3f);
+        tm->tm_mday = BCD2BIN(regs[ISL1208_REG_DTA-ISL1208_REG_SCA] & 0x3f);
+        tm->tm_mon  = BCD2BIN(regs[ISL1208_REG_MOA-ISL1208_REG_SCA] & 0x1f)-1;
+        tm->tm_wday = BCD2BIN(regs[ISL1208_REG_DWA-ISL1208_REG_SCA] & 0x03);
+
+        return 0;
+}
+
+static int isl1208_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        return isl1208_i2c_read_time(to_i2c_client(dev), tm);
+}
+
+static int isl1208_i2c_set_time(struct i2c_client *client,
+                                struct rtc_time const *tm)
+{
+        int sr;
+        u8 regs[ISL1208_RTC_SECTION_LEN] = { 0, };
+
+        regs[ISL1208_REG_SC] = BIN2BCD(tm->tm_sec);
+        regs[ISL1208_REG_MN] = BIN2BCD(tm->tm_min);
+        regs[ISL1208_REG_HR] = BIN2BCD(tm->tm_hour) | ISL1208_REG_HR_MIL;
+
+        regs[ISL1208_REG_DT] = BIN2BCD(tm->tm_mday);
+        regs[ISL1208_REG_MO] = BIN2BCD(tm->tm_mon + 1);
+        regs[ISL1208_REG_YR] = BIN2BCD(tm->tm_year - 100);
+
+        regs[ISL1208_REG_DW] = BIN2BCD(tm->tm_wday & 7);
+
+        sr = isl1208_i2c_get_sr(client);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: reading SR failed\n", __func__);
+                return sr;
+        }
+
+        /* set WRTC */
+        sr = i2c_smbus_write_byte_data (client, ISL1208_REG_SR,
+                                       sr | ISL1208_REG_SR_WRTC);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: writing SR failed\n", __func__);
+                return sr;
+        }
+
+        /* write RTC registers */
+        sr = isl1208_i2c_set_regs(client, 0, regs, ISL1208_RTC_SECTION_LEN);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: writing RTC section failed\n",
+                        __func__);
+                return sr;
+        }
+
+        /* clear WRTC again */
+        sr = i2c_smbus_write_byte_data (client, ISL1208_REG_SR,
+                                       sr & ~ISL1208_REG_SR_WRTC);
+        if (sr < 0) {
+                dev_err(&client->dev, "%s: writing SR failed\n", __func__);
+                return sr;
+        }
+
+        return 0;
+}
+
+
+static int isl1208_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        return isl1208_i2c_set_time(to_i2c_client(dev), tm);
+}
+
+static int isl1208_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+{
+        return isl1208_i2c_read_alarm(to_i2c_client(dev), alarm);
+}
+
+static struct rtc_class_ops isl1208_rtc_ops = {
+        .proc           = isl1208_rtc_proc,
+        .read_time      = isl1208_rtc_read_time,
+        .set_time       = isl1208_rtc_set_time,
+        .read_alarm     = isl1208_rtc_read_alarm,
+        //.set_alarm    = isl1208_rtc_set_alarm,
+};
+
+/* sysfs interface */
+
+static ssize_t isl1208_sysfs_show_atrim(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        int atr;
+
+        atr = isl1208_i2c_get_atr(to_i2c_client(dev));
+        if (atr < 0)
+                return atr;
+
+        return sprintf(buf, "%d.%.2d pF\n", atr>>2, (atr&0x3)*25);
+}
+static DEVICE_ATTR(atrim, S_IRUGO, isl1208_sysfs_show_atrim, NULL);
+
+static ssize_t isl1208_sysfs_show_dtrim(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        int dtr;
+
+        dtr = isl1208_i2c_get_dtr(to_i2c_client(dev));
+        if (dtr < 0)
+                return dtr;
+
+        return sprintf(buf, "%d ppm\n", dtr);
+}
+static DEVICE_ATTR(dtrim, S_IRUGO, isl1208_sysfs_show_dtrim, NULL);
+
+static ssize_t isl1208_sysfs_show_usr(struct device *dev,
+                                       struct device_attribute *attr,
+                                       char *buf)
+{
+        int usr;
+
+        usr = isl1208_i2c_get_usr(to_i2c_client(dev));
+        if (usr < 0)
+                return usr;
+
+        return sprintf(buf, "0x%.4x\n", usr);
+}
+
+static ssize_t isl1208_sysfs_store_usr(struct device *dev,
+                                       struct device_attribute *attr,
+                                       const char *buf, size_t count)
+{
+        int usr = -1;
+
+        if (buf[0] == '0' && (buf[1] == 'x' || buf[1] == 'X')) {
+                if (sscanf(buf, "%x", &usr) != 1)
+                        return -EINVAL;
+        } else {
+                if (sscanf(buf, "%d", &usr) != 1)
+                        return -EINVAL;
+        }
+
+        if (usr < 0 || usr > 0xffff)
+                return -EINVAL;
+
+        return isl1208_i2c_set_usr(to_i2c_client(dev), usr) ? -EIO : count;
+}
+static DEVICE_ATTR(usr, S_IRUGO | S_IWUSR, isl1208_sysfs_show_usr,
+                   isl1208_sysfs_store_usr);
+
+static int
+isl1208_probe(struct i2c_adapter *adapter, int addr, int kind)
+{
+        int rc = 0;
+        struct i2c_client *new_client = NULL;
+        struct rtc_device *rtc = NULL;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
+                rc = -ENODEV;
+                goto failout;
+        }
+
+        new_client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
+        if (new_client == NULL) {
+                rc = -ENOMEM;
+                goto failout;
+        }
+
+        new_client->addr = addr;
+        new_client->adapter = adapter;
+        new_client->driver = &isl1208_driver;
+        new_client->flags = 0;
+        strcpy(new_client->name, DRV_NAME);
+
+        if (kind < 0) {
+                rc = isl1208_i2c_validate_client(new_client);
+                if (rc < 0)
+                        goto failout;
+        }
+
+        rc = i2c_attach_client(new_client);
+        if (rc < 0)
+                goto failout;
+
+        dev_info(&new_client->dev,
+                 "chip found, driver version " DRV_VERSION "\n");
+
+        rtc = rtc_device_register(isl1208_driver.driver.name,
+                                  &new_client->dev,
+                                  &isl1208_rtc_ops, THIS_MODULE);
+
+        if (IS_ERR(rtc)) {
+                rc = PTR_ERR(rtc);
+                goto failout_detach;
+        }
+
+        i2c_set_clientdata(new_client, rtc);
+
+        rc = isl1208_i2c_get_sr(new_client);
+        if (rc < 0) {
+                dev_err(&new_client->dev, "reading status failed\n");
+                goto failout_unregister;
+        }
+
+        if (rc & ISL1208_REG_SR_RTCF)
+                dev_warn(&new_client->dev, "rtc power failure detected, "
+                         "please set clock.\n");
+
+        rc = device_create_file(&new_client->dev, &dev_attr_atrim);
+        if (rc < 0)
+                goto failout_unregister;
+        rc = device_create_file(&new_client->dev, &dev_attr_dtrim);
+        if (rc < 0)
+                goto failout_atrim;
+        rc = device_create_file(&new_client->dev, &dev_attr_usr);
+        if (rc < 0)
+                goto failout_dtrim;
+
+        return 0;
+
+ failout_dtrim:
+        device_remove_file(&new_client->dev, &dev_attr_dtrim);
+ failout_atrim:
+        device_remove_file(&new_client->dev, &dev_attr_atrim);
+ failout_unregister:
+        rtc_device_unregister(rtc);
+ failout_detach:
+        i2c_detach_client(new_client);
+ failout:
+        kfree(new_client);
+        return rc;
+}
+
+static int
+isl1208_attach_adapter (struct i2c_adapter *adapter)
+{
+        return i2c_probe(adapter, &addr_data, isl1208_probe);
+}
+
+static int
+isl1208_detach_client(struct i2c_client *client)
+{
+        int rc;
+        struct rtc_device *const rtc = i2c_get_clientdata(client);
+
+        if (rtc)
+                rtc_device_unregister(rtc); /* do we need to kfree? */
+
+        rc = i2c_detach_client(client);
+        if (rc)
+                return rc;
+
+        kfree(client);
+
+        return 0;
+}
+
+/* module management */
+
+static int __init isl1208_init(void)
+{
+        return i2c_add_driver(&isl1208_driver);
+}
+
+static void __exit isl1208_exit(void)
+{
+        i2c_del_driver(&isl1208_driver);
+}
+
+MODULE_AUTHOR("Herbert Valerio Riedel <hvr@gnu.org>");
+MODULE_DESCRIPTION("Intersil ISL1208 RTC driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+
+module_init(isl1208_init);
+module_exit(isl1208_exit);
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index d6d1bff52b8e..2c7de79c83b9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -69,12 +69,12 @@ static void s3c_rtc_setaie(int to)
 
         pr_debug("%s: aie=%d\n", __FUNCTION__, to);
 
-        tmp = readb(S3C2410_RTCALM) & ~S3C2410_RTCALM_ALMEN;
+        tmp = readb(s3c_rtc_base + S3C2410_RTCALM) & ~S3C2410_RTCALM_ALMEN;
 
         if (to)
                 tmp |= S3C2410_RTCALM_ALMEN;
 
-        writeb(tmp, S3C2410_RTCALM);
+        writeb(tmp, s3c_rtc_base + S3C2410_RTCALM);
 }
 
 static void s3c_rtc_setpie(int to)
@@ -84,12 +84,12 @@ static void s3c_rtc_setpie(int to)
         pr_debug("%s: pie=%d\n", __FUNCTION__, to);
 
         spin_lock_irq(&s3c_rtc_pie_lock);
-        tmp = readb(S3C2410_TICNT) & ~S3C2410_TICNT_ENABLE;
+        tmp = readb(s3c_rtc_base + S3C2410_TICNT) & ~S3C2410_TICNT_ENABLE;
 
         if (to)
                 tmp |= S3C2410_TICNT_ENABLE;
 
-        writeb(tmp, S3C2410_TICNT);
+        writeb(tmp, s3c_rtc_base + S3C2410_TICNT);
         spin_unlock_irq(&s3c_rtc_pie_lock);
 }
 
@@ -98,13 +98,13 @@ static void s3c_rtc_setfreq(int freq)
         unsigned int tmp;
 
         spin_lock_irq(&s3c_rtc_pie_lock);
-        tmp = readb(S3C2410_TICNT) & S3C2410_TICNT_ENABLE;
+        tmp = readb(s3c_rtc_base + S3C2410_TICNT) & S3C2410_TICNT_ENABLE;
 
         s3c_rtc_freq = freq;
 
         tmp |= (128 / freq)-1;
 
-        writeb(tmp, S3C2410_TICNT);
+        writeb(tmp, s3c_rtc_base + S3C2410_TICNT);
         spin_unlock_irq(&s3c_rtc_pie_lock);
 }
 
@@ -113,14 +113,15 @@ static void s3c_rtc_setfreq(int freq)
 static int s3c_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
 {
         unsigned int have_retried = 0;
+        void __iomem *base = s3c_rtc_base;
 
  retry_get_time:
-        rtc_tm->tm_min  = readb(S3C2410_RTCMIN);
-        rtc_tm->tm_hour = readb(S3C2410_RTCHOUR);
-        rtc_tm->tm_mday = readb(S3C2410_RTCDATE);
-        rtc_tm->tm_mon  = readb(S3C2410_RTCMON);
-        rtc_tm->tm_year = readb(S3C2410_RTCYEAR);
-        rtc_tm->tm_sec  = readb(S3C2410_RTCSEC);
+        rtc_tm->tm_min  = readb(base + S3C2410_RTCMIN);
+        rtc_tm->tm_hour = readb(base + S3C2410_RTCHOUR);
+        rtc_tm->tm_mday = readb(base + S3C2410_RTCDATE);
+        rtc_tm->tm_mon  = readb(base + S3C2410_RTCMON);
+        rtc_tm->tm_year = readb(base + S3C2410_RTCYEAR);
+        rtc_tm->tm_sec  = readb(base + S3C2410_RTCSEC);
 
         /* the only way to work out wether the system was mid-update
          * when we read it is to check the second counter, and if it
@@ -151,17 +152,26 @@ static int s3c_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
 
 static int s3c_rtc_settime(struct device *dev, struct rtc_time *tm)
 {
-        /* the rtc gets round the y2k problem by just not supporting it */
+        void __iomem *base = s3c_rtc_base;
+        int year = tm->tm_year - 100;
 
-        if (tm->tm_year < 100)
+        pr_debug("set time %02d.%02d.%02d %02d/%02d/%02d\n",
+                 tm->tm_year, tm->tm_mon, tm->tm_mday,
+                 tm->tm_hour, tm->tm_min, tm->tm_sec);
+
+        /* we get around y2k by simply not supporting it */
+
+        if (year < 0 || year >= 100) {
+                dev_err(dev, "rtc only supports 100 years\n");
                 return -EINVAL;
+        }
 
-        writeb(BIN2BCD(tm->tm_sec),  S3C2410_RTCSEC);
-        writeb(BIN2BCD(tm->tm_min),  S3C2410_RTCMIN);
-        writeb(BIN2BCD(tm->tm_hour), S3C2410_RTCHOUR);
-        writeb(BIN2BCD(tm->tm_mday), S3C2410_RTCDATE);
-        writeb(BIN2BCD(tm->tm_mon + 1), S3C2410_RTCMON);
-        writeb(BIN2BCD(tm->tm_year - 100), S3C2410_RTCYEAR);
+        writeb(BIN2BCD(tm->tm_sec),  base + S3C2410_RTCSEC);
+        writeb(BIN2BCD(tm->tm_min),  base + S3C2410_RTCMIN);
+        writeb(BIN2BCD(tm->tm_hour), base + S3C2410_RTCHOUR);
+        writeb(BIN2BCD(tm->tm_mday), base + S3C2410_RTCDATE);
+        writeb(BIN2BCD(tm->tm_mon + 1), base + S3C2410_RTCMON);
+        writeb(BIN2BCD(year), base + S3C2410_RTCYEAR);
 
         return 0;
 }
@@ -169,16 +179,17 @@ static int s3c_rtc_settime(struct device *dev, struct rtc_time *tm)
 static int s3c_rtc_getalarm(struct device *dev, struct rtc_wkalrm *alrm)
 {
         struct rtc_time *alm_tm = &alrm->time;
+        void __iomem *base = s3c_rtc_base;
         unsigned int alm_en;
 
-        alm_tm->tm_sec  = readb(S3C2410_ALMSEC);
-        alm_tm->tm_min  = readb(S3C2410_ALMMIN);
-        alm_tm->tm_hour = readb(S3C2410_ALMHOUR);
-        alm_tm->tm_mon  = readb(S3C2410_ALMMON);
-        alm_tm->tm_mday = readb(S3C2410_ALMDATE);
-        alm_tm->tm_year = readb(S3C2410_ALMYEAR);
+        alm_tm->tm_sec  = readb(base + S3C2410_ALMSEC);
+        alm_tm->tm_min  = readb(base + S3C2410_ALMMIN);
+        alm_tm->tm_hour = readb(base + S3C2410_ALMHOUR);
+        alm_tm->tm_mon  = readb(base + S3C2410_ALMMON);
+        alm_tm->tm_mday = readb(base + S3C2410_ALMDATE);
+        alm_tm->tm_year = readb(base + S3C2410_ALMYEAR);
 
-        alm_en = readb(S3C2410_RTCALM);
+        alm_en = readb(base + S3C2410_RTCALM);
 
         pr_debug("read alarm %02x %02x.%02x.%02x %02x/%02x/%02x\n",
                  alm_en,
@@ -226,6 +237,7 @@ static int s3c_rtc_getalarm(struct device *dev, struct rtc_wkalrm *alrm)
 static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 {
         struct rtc_time *tm = &alrm->time;
+        void __iomem *base = s3c_rtc_base;
         unsigned int alrm_en;
 
         pr_debug("s3c_rtc_setalarm: %d, %02x/%02x/%02x %02x.%02x.%02x\n",
@@ -234,32 +246,32 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
                  tm->tm_hour & 0xff, tm->tm_min & 0xff, tm->tm_sec);
 
 
-        alrm_en = readb(S3C2410_RTCALM) & S3C2410_RTCALM_ALMEN;
-        writeb(0x00, S3C2410_RTCALM);
+        alrm_en = readb(base + S3C2410_RTCALM) & S3C2410_RTCALM_ALMEN;
+        writeb(0x00, base + S3C2410_RTCALM);
 
         if (tm->tm_sec < 60 && tm->tm_sec >= 0) {
                 alrm_en |= S3C2410_RTCALM_SECEN;
-                writeb(BIN2BCD(tm->tm_sec), S3C2410_ALMSEC);
+                writeb(BIN2BCD(tm->tm_sec), base + S3C2410_ALMSEC);
         }
 
         if (tm->tm_min < 60 && tm->tm_min >= 0) {
                 alrm_en |= S3C2410_RTCALM_MINEN;
-                writeb(BIN2BCD(tm->tm_min), S3C2410_ALMMIN);
+                writeb(BIN2BCD(tm->tm_min), base + S3C2410_ALMMIN);
         }
 
         if (tm->tm_hour < 24 && tm->tm_hour >= 0) {
                 alrm_en |= S3C2410_RTCALM_HOUREN;
-                writeb(BIN2BCD(tm->tm_hour), S3C2410_ALMHOUR);
+                writeb(BIN2BCD(tm->tm_hour), base + S3C2410_ALMHOUR);
         }
 
         pr_debug("setting S3C2410_RTCALM to %08x\n", alrm_en);
 
-        writeb(alrm_en, S3C2410_RTCALM);
+        writeb(alrm_en, base + S3C2410_RTCALM);
 
         if (0) {
-                alrm_en = readb(S3C2410_RTCALM);
+                alrm_en = readb(base + S3C2410_RTCALM);
                 alrm_en &= ~S3C2410_RTCALM_ALMEN;
-                writeb(alrm_en, S3C2410_RTCALM);
+                writeb(alrm_en, base + S3C2410_RTCALM);
                 disable_irq_wake(s3c_rtc_alarmno);
         }
 
@@ -319,8 +331,8 @@ static int s3c_rtc_ioctl(struct device *dev,
 
 static int s3c_rtc_proc(struct device *dev, struct seq_file *seq)
 {
-        unsigned int rtcalm = readb(S3C2410_RTCALM);
-        unsigned int ticnt = readb (S3C2410_TICNT);
+        unsigned int rtcalm = readb(s3c_rtc_base + S3C2410_RTCALM);
+        unsigned int ticnt = readb(s3c_rtc_base + S3C2410_TICNT);
 
         seq_printf(seq, "alarm_IRQ\t: %s\n",
                    (rtcalm & S3C2410_RTCALM_ALMEN) ? "yes" : "no" );
@@ -387,39 +399,40 @@ static struct rtc_class_ops s3c_rtcops = {
 
 static void s3c_rtc_enable(struct platform_device *pdev, int en)
 {
+        void __iomem *base = s3c_rtc_base;
         unsigned int tmp;
 
         if (s3c_rtc_base == NULL)
                 return;
 
         if (!en) {
-                tmp = readb(S3C2410_RTCCON);
-                writeb(tmp & ~S3C2410_RTCCON_RTCEN, S3C2410_RTCCON);
+                tmp = readb(base + S3C2410_RTCCON);
+                writeb(tmp & ~S3C2410_RTCCON_RTCEN, base + S3C2410_RTCCON);
 
-                tmp = readb(S3C2410_TICNT);
-                writeb(tmp & ~S3C2410_TICNT_ENABLE, S3C2410_TICNT);
+                tmp = readb(base + S3C2410_TICNT);
+                writeb(tmp & ~S3C2410_TICNT_ENABLE, base + S3C2410_TICNT);
         } else {
                 /* re-enable the device, and check it is ok */
 
-                if ((readb(S3C2410_RTCCON) & S3C2410_RTCCON_RTCEN) == 0){
+                if ((readb(base+S3C2410_RTCCON) & S3C2410_RTCCON_RTCEN) == 0){
                         dev_info(&pdev->dev, "rtc disabled, re-enabling\n");
 
-                        tmp = readb(S3C2410_RTCCON);
-                        writeb(tmp | S3C2410_RTCCON_RTCEN , S3C2410_RTCCON);
+                        tmp = readb(base + S3C2410_RTCCON);
+                        writeb(tmp|S3C2410_RTCCON_RTCEN, base+S3C2410_RTCCON);
                 }
 
-                if ((readb(S3C2410_RTCCON) & S3C2410_RTCCON_CNTSEL)){
+                if ((readb(base + S3C2410_RTCCON) & S3C2410_RTCCON_CNTSEL)){
                         dev_info(&pdev->dev, "removing RTCCON_CNTSEL\n");
 
-                        tmp = readb(S3C2410_RTCCON);
-                        writeb(tmp& ~S3C2410_RTCCON_CNTSEL , S3C2410_RTCCON);
+                        tmp = readb(base + S3C2410_RTCCON);
+                        writeb(tmp& ~S3C2410_RTCCON_CNTSEL, base+S3C2410_RTCCON);
                 }
 
-                if ((readb(S3C2410_RTCCON) & S3C2410_RTCCON_CLKRST)){
+                if ((readb(base + S3C2410_RTCCON) & S3C2410_RTCCON_CLKRST)){
                         dev_info(&pdev->dev, "removing RTCCON_CLKRST\n");
 
-                        tmp = readb(S3C2410_RTCCON);
-                        writeb(tmp & ~S3C2410_RTCCON_CLKRST, S3C2410_RTCCON);
+                        tmp = readb(base + S3C2410_RTCCON);
+                        writeb(tmp & ~S3C2410_RTCCON_CLKRST, base+S3C2410_RTCCON);
                 }
         }
 }
@@ -475,8 +488,8 @@ static int s3c_rtc_probe(struct platform_device *pdev)
         }
 
         s3c_rtc_mem = request_mem_region(res->start,
-                                             res->end-res->start+1,
-                                             pdev->name);
+                                         res->end-res->start+1,
+                                         pdev->name);
 
         if (s3c_rtc_mem == NULL) {
                 dev_err(&pdev->dev, "failed to reserve memory region\n");
@@ -495,7 +508,8 @@ static int s3c_rtc_probe(struct platform_device *pdev)
 
         s3c_rtc_enable(pdev, 1);
 
-        pr_debug("s3c2410_rtc: RTCCON=%02x\n", readb(S3C2410_RTCCON));
+        pr_debug("s3c2410_rtc: RTCCON=%02x\n",
+                 readb(s3c_rtc_base + S3C2410_RTCCON));
 
         s3c_rtc_setfreq(s3c_rtc_freq);
 
@@ -543,7 +557,7 @@ static int s3c_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 
         /* save TICNT for anyone using periodic interrupts */
 
-        ticnt_save = readb(S3C2410_TICNT);
+        ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
 
         /* calculate time delta for suspend */
 
@@ -567,7 +581,7 @@ static int s3c_rtc_resume(struct platform_device *pdev)
         rtc_tm_to_time(&tm, &time.tv_sec);
         restore_time_delta(&s3c_rtc_delta, &time);
 
-        writeb(ticnt_save, S3C2410_TICNT);
+        writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
         return 0;
 }
 #else
diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
index bb6d5ff24fd0..596764fd29f5 100644
--- a/drivers/rtc/rtc-vr41xx.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -30,7 +30,7 @@
 #include <asm/div64.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
-#include <asm/vr41xx/vr41xx.h>
+#include <asm/vr41xx/irq.h>
 
 MODULE_AUTHOR("Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>");
 MODULE_DESCRIPTION("NEC VR4100 series RTC driver");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4bf03fb67f8d..25c1ef6dfd44 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -52,7 +52,7 @@ static void dasd_setup_queue(struct dasd_device * device);
 static void dasd_free_queue(struct dasd_device * device);
 static void dasd_flush_request_queue(struct dasd_device *);
 static void dasd_int_handler(struct ccw_device *, unsigned long, struct irb *);
-static void dasd_flush_ccw_queue(struct dasd_device *, int);
+static int dasd_flush_ccw_queue(struct dasd_device *, int);
 static void dasd_tasklet(struct dasd_device *);
 static void do_kick_device(void *data);
 
@@ -60,6 +60,7 @@ static void do_kick_device(void *data);
  * SECTION: Operations on the device structure.
  */
 static wait_queue_head_t dasd_init_waitq;
+static wait_queue_head_t dasd_flush_wq;
 
 /*
  * Allocate memory for a new device structure.
@@ -121,7 +122,7 @@ dasd_free_device(struct dasd_device *device)
 /*
  * Make a new device known to the system.
  */
-static inline int
+static int
 dasd_state_new_to_known(struct dasd_device *device)
 {
         int rc;
@@ -145,7 +146,7 @@ dasd_state_new_to_known(struct dasd_device *device)
 /*
  * Let the system forget about a device.
  */
-static inline void
+static int
 dasd_state_known_to_new(struct dasd_device * device)
 {
         /* Disable extended error reporting for this device. */
@@ -163,12 +164,13 @@ dasd_state_known_to_new(struct dasd_device * device)
 
         /* Give up reference we took in dasd_state_new_to_known. */
         dasd_put_device(device);
+        return 0;
 }
 
 /*
  * Request the irq line for the device.
  */
-static inline int
+static int
 dasd_state_known_to_basic(struct dasd_device * device)
 {
         int rc;
@@ -192,17 +194,23 @@ dasd_state_known_to_basic(struct dasd_device * device)
 /*
  * Release the irq line for the device. Terminate any running i/o.
  */
-static inline void
+static int
 dasd_state_basic_to_known(struct dasd_device * device)
 {
+        int rc;
+
         dasd_gendisk_free(device);
-        dasd_flush_ccw_queue(device, 1);
+        rc = dasd_flush_ccw_queue(device, 1);
+        if (rc)
+                return rc;
+
         DBF_DEV_EVENT(DBF_EMERG, device, "%p debug area deleted", device);
         if (device->debug_area != NULL) {
                 debug_unregister(device->debug_area);
                 device->debug_area = NULL;
         }
         device->state = DASD_STATE_KNOWN;
+        return 0;
 }
 
 /*
@@ -219,7 +227,7 @@ dasd_state_basic_to_known(struct dasd_device * device)
  * In case the analysis returns an error, the device setup is stopped
  * (a fake disk was already added to allow formatting).
  */
-static inline int
+static int
 dasd_state_basic_to_ready(struct dasd_device * device)
 {
         int rc;
@@ -247,25 +255,31 @@ dasd_state_basic_to_ready(struct dasd_device * device)
  * Forget format information. Check if the target level is basic
  * and if it is create fake disk for formatting.
  */
-static inline void
+static int
 dasd_state_ready_to_basic(struct dasd_device * device)
 {
-        dasd_flush_ccw_queue(device, 0);
+        int rc;
+
+        rc = dasd_flush_ccw_queue(device, 0);
+        if (rc)
+                return rc;
         dasd_destroy_partitions(device);
         dasd_flush_request_queue(device);
         device->blocks = 0;
         device->bp_block = 0;
         device->s2b_shift = 0;
         device->state = DASD_STATE_BASIC;
+        return 0;
 }
 
 /*
  * Back to basic.
  */
-static inline void
+static int
 dasd_state_unfmt_to_basic(struct dasd_device * device)
 {
         device->state = DASD_STATE_BASIC;
+        return 0;
 }
 
 /*
@@ -273,7 +287,7 @@ dasd_state_unfmt_to_basic(struct dasd_device * device)
  * the requeueing of requests from the linux request queue to the
  * ccw queue.
  */
-static inline int
+static int
 dasd_state_ready_to_online(struct dasd_device * device)
 {
         device->state = DASD_STATE_ONLINE;
@@ -284,16 +298,17 @@ dasd_state_ready_to_online(struct dasd_device * device)
 /*
  * Stop the requeueing of requests again.
  */
-static inline void
+static int
 dasd_state_online_to_ready(struct dasd_device * device)
 {
         device->state = DASD_STATE_READY;
+        return 0;
 }
 
 /*
  * Device startup state changes.
  */
-static inline int
+static int
 dasd_increase_state(struct dasd_device *device)
 {
         int rc;
@@ -329,30 +344,37 @@ dasd_increase_state(struct dasd_device *device)
 /*
  * Device shutdown state changes.
  */
-static inline int
+static int
 dasd_decrease_state(struct dasd_device *device)
 {
+        int rc;
+
+        rc = 0;
         if (device->state == DASD_STATE_ONLINE &&
             device->target <= DASD_STATE_READY)
-                dasd_state_online_to_ready(device);
+                rc = dasd_state_online_to_ready(device);
 
-        if (device->state == DASD_STATE_READY &&
+        if (!rc &&
+            device->state == DASD_STATE_READY &&
             device->target <= DASD_STATE_BASIC)
-                dasd_state_ready_to_basic(device);
+                rc = dasd_state_ready_to_basic(device);
 
-        if (device->state == DASD_STATE_UNFMT &&
+        if (!rc &&
+            device->state == DASD_STATE_UNFMT &&
             device->target <= DASD_STATE_BASIC)
-                dasd_state_unfmt_to_basic(device);
+                rc = dasd_state_unfmt_to_basic(device);
 
-        if (device->state == DASD_STATE_BASIC &&
+        if (!rc &&
+            device->state == DASD_STATE_BASIC &&
             device->target <= DASD_STATE_KNOWN)
-                dasd_state_basic_to_known(device);
+                rc = dasd_state_basic_to_known(device);
 
-        if (device->state == DASD_STATE_KNOWN &&
+        if (!rc &&
+            device->state == DASD_STATE_KNOWN &&
             device->target <= DASD_STATE_NEW)
-                dasd_state_known_to_new(device);
+                rc = dasd_state_known_to_new(device);
 
-        return 0;
+        return rc;
 }
 
 /*
@@ -701,6 +723,7 @@ dasd_term_IO(struct dasd_ccw_req * cqr)
                         cqr->retries--;
                         cqr->status = DASD_CQR_CLEAR;
                         cqr->stopclk = get_clock();
+                        cqr->starttime = 0;
                         DBF_DEV_EVENT(DBF_DEBUG, device,
                                       "terminate cqr %p successful",
                                       cqr);
@@ -978,6 +1001,7 @@ dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
             irb->scsw.fctl & SCSW_FCTL_CLEAR_FUNC) {
                 cqr->status = DASD_CQR_QUEUED;
                 dasd_clear_timer(device);
+                wake_up(&dasd_flush_wq);
                 dasd_schedule_bh(device);
                 return;
         }
@@ -1241,6 +1265,10 @@ __dasd_check_expire(struct dasd_device * device)
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, list);
         if (cqr->status == DASD_CQR_IN_IO && cqr->expires != 0) {
                 if (time_after_eq(jiffies, cqr->expires + cqr->starttime)) {
+                        DEV_MESSAGE(KERN_ERR, device,
+                                    "internal error - timeout (%is) expired "
+                                    "for cqr %p (%i retries left)",
+                                    (cqr->expires/HZ), cqr, cqr->retries);
                         if (device->discipline->term_IO(cqr) != 0)
                                 /* Hmpf, try again in 1/10 sec */
                                 dasd_set_timer(device, 10);
@@ -1285,46 +1313,100 @@ __dasd_start_head(struct dasd_device * device)
                 dasd_set_timer(device, 50);
 }
 
+static inline int
+_wait_for_clear(struct dasd_ccw_req *cqr)
+{
+        return (cqr->status == DASD_CQR_QUEUED);
+}
+
 /*
- * Remove requests from the ccw queue.
+ * Remove all requests from the ccw queue (all = '1') or only block device
+ * requests in case all = '0'.
+ * Take care of the erp-chain (chained via cqr->refers) and remove either
+ * the whole erp-chain or none of the erp-requests.
+ * If a request is currently running, term_IO is called and the request
+ * is re-queued. Prior to removing the terminated request we need to wait
+ * for the clear-interrupt.
+ * In case termination is not possible we stop processing and just finishing
+ * the already moved requests.
  */
-static void
+static int
 dasd_flush_ccw_queue(struct dasd_device * device, int all)
 {
+        struct dasd_ccw_req *cqr, *orig, *n;
+        int rc, i;
+
         struct list_head flush_queue;
-        struct list_head *l, *n;
-        struct dasd_ccw_req *cqr;
 
         INIT_LIST_HEAD(&flush_queue);
         spin_lock_irq(get_ccwdev_lock(device->cdev));
-        list_for_each_safe(l, n, &device->ccw_queue) {
-                cqr = list_entry(l, struct dasd_ccw_req, list);
+        rc = 0;
+restart:
+        list_for_each_entry_safe(cqr, n, &device->ccw_queue, list) {
+                /* get original request of erp request-chain */
+                for (orig = cqr; orig->refers != NULL; orig = orig->refers);
+
                 /* Flush all request or only block device requests? */
-                if (all == 0 && cqr->callback == dasd_end_request_cb)
+                if (all == 0 && cqr->callback != dasd_end_request_cb &&
+                    orig->callback != dasd_end_request_cb) {
                         continue;
-                if (cqr->status == DASD_CQR_IN_IO)
-                        device->discipline->term_IO(cqr);
-                if (cqr->status != DASD_CQR_DONE ||
-                    cqr->status != DASD_CQR_FAILED) {
-                        cqr->status = DASD_CQR_FAILED;
+                }
+                /* Check status and move request to flush_queue */
+                switch (cqr->status) {
+                case DASD_CQR_IN_IO:
+                        rc = device->discipline->term_IO(cqr);
+                        if (rc) {
+                                /* unable to terminate requeust */
+                                DEV_MESSAGE(KERN_ERR, device,
+                                            "dasd flush ccw_queue is unable "
+                                            " to terminate request %p",
+                                            cqr);
+                                /* stop flush processing */
+                                goto finished;
+                        }
+                        break;
+                case DASD_CQR_QUEUED:
+                case DASD_CQR_ERROR:
+                        /* set request to FAILED */
                         cqr->stopclk = get_clock();
+                        cqr->status = DASD_CQR_FAILED;
+                        break;
+                default: /* do not touch the others */
+                        break;
+                }
+                /* Rechain request (including erp chain) */
+                for (i = 0; cqr != NULL; cqr = cqr->refers, i++) {
+                        cqr->endclk = get_clock();
+                        list_move_tail(&cqr->list, &flush_queue);
+                }
+                if (i > 1)
+                        /* moved more than one request - need to restart */
+                        goto restart;
+        }
+
+finished:
+        spin_unlock_irq(get_ccwdev_lock(device->cdev));
+        /* Now call the callback function of flushed requests */
+restart_cb:
+        list_for_each_entry_safe(cqr, n, &flush_queue, list) {
+                if (cqr->status == DASD_CQR_CLEAR) {
+                        /* wait for clear interrupt! */
+                        wait_event(dasd_flush_wq, _wait_for_clear(cqr));
+                        cqr->status = DASD_CQR_FAILED;
                 }
                 /* Process finished ERP request. */
                 if (cqr->refers) {
                         __dasd_process_erp(device, cqr);
-                        continue;
+                        /* restart list_for_xx loop since dasd_process_erp
+                         * might remove multiple elements */
+                        goto restart_cb;
                 }
-                /* Rechain request on device request queue */
+                /* call the callback function */
                 cqr->endclk = get_clock();
-                list_move_tail(&cqr->list, &flush_queue);
-        }
-        spin_unlock_irq(get_ccwdev_lock(device->cdev));
-        /* Now call the callback function of flushed requests */
-        list_for_each_safe(l, n, &flush_queue) {
-                cqr = list_entry(l, struct dasd_ccw_req, list);
                 if (cqr->callback != NULL)
                         (cqr->callback)(cqr, cqr->callback_data);
         }
+        return rc;
 }
 
 /*
@@ -1510,10 +1592,8 @@ dasd_sleep_on_interruptible(struct dasd_ccw_req * cqr)
                         if (device->discipline->term_IO) {
                                 cqr->retries = -1;
                                 device->discipline->term_IO(cqr);
-                                /*nished =
-                                 * wait (non-interruptible) for final status
-                                 * because signal ist still pending
-                                 */
+                                /* wait (non-interruptible) for final status
+                                 * because signal ist still pending */
                                 spin_unlock_irq(get_ccwdev_lock(device->cdev));
                                 wait_event(wait_q, _wait_for_wakeup(cqr));
                                 spin_lock_irq(get_ccwdev_lock(device->cdev));
@@ -1546,19 +1626,11 @@ static inline int
 _dasd_term_running_cqr(struct dasd_device *device)
 {
         struct dasd_ccw_req *cqr;
-        int rc;
 
         if (list_empty(&device->ccw_queue))
                 return 0;
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, list);
-        rc = device->discipline->term_IO(cqr);
-        if (rc == 0) {
-                /* termination successful */
-                cqr->status = DASD_CQR_QUEUED;
-                cqr->startclk = cqr->stopclk = 0;
-                cqr->starttime = 0;
-        }
-        return rc;
+        return device->discipline->term_IO(cqr);
 }
 
 int
@@ -1726,12 +1798,9 @@ dasd_flush_request_queue(struct dasd_device * device)
                 return;
 
         spin_lock_irq(&device->request_queue_lock);
-        while (!list_empty(&device->request_queue->queue_head)) {
-                req = elv_next_request(device->request_queue);
-                if (req == NULL)
-                        break;
-                dasd_end_request(req, 0);
+        while ((req = elv_next_request(device->request_queue))) {
                 blkdev_dequeue_request(req);
+                dasd_end_request(req, 0);
         }
         spin_unlock_irq(&device->request_queue_lock);
 }
@@ -2091,6 +2160,7 @@ dasd_init(void)
         int rc;
 
         init_waitqueue_head(&dasd_init_waitq);
+        init_waitqueue_head(&dasd_flush_wq);
 
         /* register 'common' DASD debug area, used for all DBF_XXX calls */
         dasd_debug_area = debug_register("dasd", 1, 2, 8 * sizeof (long));
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index d7295386821c..9af02c79ce8a 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -48,18 +48,20 @@ struct dasd_devmap {
 };
 
 /*
- * dasd_servermap is used to store the server_id of all storage servers
- * accessed by DASD device driver.
+ * dasd_server_ssid_map contains a globally unique storage server subsystem ID.
+ * dasd_server_ssid_list contains the list of all subsystem IDs accessed by
+ * the DASD device driver.
  */
-struct dasd_servermap {
+struct dasd_server_ssid_map {
         struct list_head list;
-        struct server_id {
+        struct system_id {
                 char vendor[4];
                 char serial[15];
+                __u16 ssid;
         } sid;
 };
 
-static struct list_head dasd_serverlist;
+static struct list_head dasd_server_ssid_list;
 
 /*
  * Parameter parsing functions for dasd= parameter. The syntax is:
@@ -89,7 +91,7 @@ static char *dasd[256];
 module_param_array(dasd, charp, NULL, 0);
 
 /*
- * Single spinlock to protect devmap structures and lists.
+ * Single spinlock to protect devmap and servermap structures and lists.
  */
 static DEFINE_SPINLOCK(dasd_devmap_lock);
 
@@ -264,8 +266,9 @@ dasd_parse_keyword( char *parsestring ) {
                 if (dasd_page_cache)
                         return residual_str;
                 dasd_page_cache =
-                        kmem_cache_create("dasd_page_cache", PAGE_SIZE, 0,
-                                          SLAB_CACHE_DMA, NULL, NULL );
+                        kmem_cache_create("dasd_page_cache", PAGE_SIZE,
+                                          PAGE_SIZE, SLAB_CACHE_DMA,
+                                          NULL, NULL );
                 if (!dasd_page_cache)
                         MESSAGE(KERN_WARNING, "%s", "Failed to create slab, "
                                 "fixed buffer mode disabled.");
@@ -394,7 +397,7 @@ dasd_add_busid(char *bus_id, int features)
         if (!new)
                 return ERR_PTR(-ENOMEM);
         spin_lock(&dasd_devmap_lock);
-        devmap = 0;
+        devmap = NULL;
         hash = dasd_hash_busid(bus_id);
         list_for_each_entry(tmp, &dasd_hashlists[hash], list)
                 if (strncmp(tmp->bus_id, bus_id, BUS_ID_SIZE) == 0) {
@@ -406,10 +409,10 @@ dasd_add_busid(char *bus_id, int features)
                 new->devindex = dasd_max_devindex++;
                 strncpy(new->bus_id, bus_id, BUS_ID_SIZE);
                 new->features = features;
-                new->device = 0;
+                new->device = NULL;
                 list_add(&new->list, &dasd_hashlists[hash]);
                 devmap = new;
-                new = 0;
+                new = NULL;
         }
         spin_unlock(&dasd_devmap_lock);
         kfree(new);
@@ -479,7 +482,7 @@ dasd_device_from_devindex(int devindex)
         int i;
 
         spin_lock(&dasd_devmap_lock);
-        devmap = 0;
+        devmap = NULL;
         for (i = 0; (i < 256) && !devmap; i++)
                 list_for_each_entry(tmp, &dasd_hashlists[i], list)
                         if (tmp->devindex == devindex) {
@@ -859,39 +862,6 @@ static struct attribute_group dasd_attr_group = {
 };
 
 /*
- * Check if the related storage server is already contained in the
- * dasd_serverlist. If server is not contained, create new entry.
- * Return 0 if server was already in serverlist,
- *        1 if the server was added successfully
- *       <0 in case of error.
- */
-static int
-dasd_add_server(struct dasd_uid *uid)
-{
-        struct dasd_servermap *new, *tmp;
-
-        /* check if server is already contained */
-        list_for_each_entry(tmp, &dasd_serverlist, list)
-          // normale cmp?
-                if (strncmp(tmp->sid.vendor, uid->vendor,
-                            sizeof(tmp->sid.vendor)) == 0
-                    && strncmp(tmp->sid.serial, uid->serial,
-                               sizeof(tmp->sid.serial)) == 0)
-                        return 0;
-
-        new = (struct dasd_servermap *)
-                kzalloc(sizeof(struct dasd_servermap), GFP_KERNEL);
-        if (!new)
-                return -ENOMEM;
-
-        strncpy(new->sid.vendor, uid->vendor, sizeof(new->sid.vendor));
-        strncpy(new->sid.serial, uid->serial, sizeof(new->sid.serial));
-        list_add(&new->list, &dasd_serverlist);
-        return 1;
-}
-
-
-/*
  * Return copy of the device unique identifier.
  */
 int
@@ -910,6 +880,9 @@ dasd_get_uid(struct ccw_device *cdev, struct dasd_uid *uid)
 
 /*
  * Register the given device unique identifier into devmap struct.
+ * In addition check if the related storage server subsystem ID is already
+ * contained in the dasd_server_ssid_list. If subsystem ID is not contained,
+ * create new entry.
  * Return 0 if server was already in serverlist,
  *        1 if the server was added successful
  *       <0 in case of error.
@@ -918,16 +891,39 @@ int
 dasd_set_uid(struct ccw_device *cdev, struct dasd_uid *uid)
 {
         struct dasd_devmap *devmap;
-        int rc;
+        struct dasd_server_ssid_map *srv, *tmp;
 
         devmap = dasd_find_busid(cdev->dev.bus_id);
         if (IS_ERR(devmap))
                 return PTR_ERR(devmap);
+
+        /* generate entry for server_ssid_map */
+        srv = (struct dasd_server_ssid_map *)
+                kzalloc(sizeof(struct dasd_server_ssid_map), GFP_KERNEL);
+        if (!srv)
+                return -ENOMEM;
+        strncpy(srv->sid.vendor, uid->vendor, sizeof(srv->sid.vendor) - 1);
+        strncpy(srv->sid.serial, uid->serial, sizeof(srv->sid.serial) - 1);
+        srv->sid.ssid = uid->ssid;
+
+        /* server is already contained ? */
         spin_lock(&dasd_devmap_lock);
         devmap->uid = *uid;
-        rc = dasd_add_server(uid);
+        list_for_each_entry(tmp, &dasd_server_ssid_list, list) {
+                if (!memcmp(&srv->sid, &tmp->sid,
+                            sizeof(struct system_id))) {
+                        kfree(srv);
+                        srv = NULL;
+                        break;
+                }
+        }
+
+        /* add servermap to serverlist */
+        if (srv)
+                list_add(&srv->list, &dasd_server_ssid_list);
         spin_unlock(&dasd_devmap_lock);
-        return rc;
+
+        return (srv ? 1 : 0);
 }
 EXPORT_SYMBOL_GPL(dasd_set_uid);
 
@@ -995,7 +991,7 @@ dasd_devmap_init(void)
                 INIT_LIST_HEAD(&dasd_hashlists[i]);
 
         /* Initialize servermap structure. */
-        INIT_LIST_HEAD(&dasd_serverlist);
+        INIT_LIST_HEAD(&dasd_server_ssid_list);
         return 0;
 }
 
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 2e655f466743..b7a7fac3f7c3 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -65,16 +65,16 @@ struct dasd_eckd_private {
 /* The ccw bus type uses this table to find devices that it sends to
  * dasd_eckd_probe */
 static struct ccw_device_id dasd_eckd_ids[] = {
-        { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3390, 0), driver_info: 0x1},
-        { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3390, 0), driver_info: 0x2},
-        { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3390, 0), driver_info: 0x3},
-        { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3380, 0), driver_info: 0x4},
-        { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3380, 0), driver_info: 0x5},
-        { CCW_DEVICE_DEVTYPE (0x9343, 0, 0x9345, 0), driver_info: 0x6},
-        { CCW_DEVICE_DEVTYPE (0x2107, 0, 0x3390, 0), driver_info: 0x7},
-        { CCW_DEVICE_DEVTYPE (0x2107, 0, 0x3380, 0), driver_info: 0x8},
-        { CCW_DEVICE_DEVTYPE (0x1750, 0, 0x3390, 0), driver_info: 0x9},
-        { CCW_DEVICE_DEVTYPE (0x1750, 0, 0x3380, 0), driver_info: 0xa},
+        { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3390, 0), .driver_info = 0x1},
+        { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3390, 0), .driver_info = 0x2},
+        { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3390, 0), .driver_info = 0x3},
+        { CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3380, 0), .driver_info = 0x4},
+        { CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3380, 0), .driver_info = 0x5},
+        { CCW_DEVICE_DEVTYPE (0x9343, 0, 0x9345, 0), .driver_info = 0x6},
+        { CCW_DEVICE_DEVTYPE (0x2107, 0, 0x3390, 0), .driver_info = 0x7},
+        { CCW_DEVICE_DEVTYPE (0x2107, 0, 0x3380, 0), .driver_info = 0x8},
+        { CCW_DEVICE_DEVTYPE (0x1750, 0, 0x3390, 0), .driver_info = 0x9},
+        { CCW_DEVICE_DEVTYPE (0x1750, 0, 0x3380, 0), .driver_info = 0xa},
         { /* end of list */ },
 };
 
@@ -468,11 +468,11 @@ dasd_eckd_generate_uid(struct dasd_device *device, struct dasd_uid *uid)
                 return -ENODEV;
 
         memset(uid, 0, sizeof(struct dasd_uid));
-        strncpy(uid->vendor, confdata->ned1.HDA_manufacturer,
-                sizeof(uid->vendor) - 1);
+        memcpy(uid->vendor, confdata->ned1.HDA_manufacturer,
+               sizeof(uid->vendor) - 1);
         EBCASC(uid->vendor, sizeof(uid->vendor) - 1);
-        strncpy(uid->serial, confdata->ned1.HDA_location,
-                sizeof(uid->serial) - 1);
+        memcpy(uid->serial, confdata->ned1.HDA_location,
+               sizeof(uid->serial) - 1);
         EBCASC(uid->serial, sizeof(uid->serial) - 1);
         uid->ssid = confdata->neq.subsystemID;
         if (confdata->ned2.sneq.flags == 0x40) {
@@ -607,7 +607,7 @@ dasd_eckd_psf_ssc(struct dasd_device *device)
  * Valide storage server of current device.
  */
 static int
-dasd_eckd_validate_server(struct dasd_device *device)
+dasd_eckd_validate_server(struct dasd_device *device, struct dasd_uid *uid)
 {
         int rc;
 
@@ -616,11 +616,11 @@ dasd_eckd_validate_server(struct dasd_device *device)
                 return 0;
 
         rc = dasd_eckd_psf_ssc(device);
-        if (rc)
-                /* may be requested feature is not available on server,
-                 * therefore just report error and go ahead */
-                DEV_MESSAGE(KERN_INFO, device,
-                            "Perform Subsystem Function returned rc=%d", rc);
+        /* may be requested feature is not available on server,
+         * therefore just report error and go ahead */
+        DEV_MESSAGE(KERN_INFO, device,
+                    "PSF-SSC on storage subsystem %s.%s.%04x returned rc=%d",
+                    uid->vendor, uid->serial, uid->ssid, rc);
         /* RE-Read Configuration Data */
         return dasd_eckd_read_conf(device);
 }
@@ -666,7 +666,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
                 return rc;
         rc = dasd_set_uid(device->cdev, &uid);
         if (rc == 1)    /* new server found */
-                rc = dasd_eckd_validate_server(device);
+                rc = dasd_eckd_validate_server(device, &uid);
         if (rc)
                 return rc;
 
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index 808434d38526..e85015be109b 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -44,8 +44,8 @@ struct dasd_fba_private {
 };
 
 static struct ccw_device_id dasd_fba_ids[] = {
-        { CCW_DEVICE_DEVTYPE (0x6310, 0, 0x9336, 0), driver_info: 0x1},
-        { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3370, 0), driver_info: 0x2},
+        { CCW_DEVICE_DEVTYPE (0x6310, 0, 0x9336, 0), .driver_info = 0x1},
+        { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3370, 0), .driver_info = 0x2},
         { /* end of list */ },
 };
 
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 12c7d296eaa8..d163632101d2 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -83,10 +83,12 @@ dasd_gendisk_alloc(struct dasd_device *device)
 void
 dasd_gendisk_free(struct dasd_device *device)
 {
-        del_gendisk(device->gdp);
-        device->gdp->queue = 0;
-        put_disk(device->gdp);
-        device->gdp = 0;
+        if (device->gdp) {
+                del_gendisk(device->gdp);
+                device->gdp->queue = NULL;
+                put_disk(device->gdp);
+                device->gdp = NULL;
+        }
 }
 
 /*
@@ -136,7 +138,7 @@ dasd_destroy_partitions(struct dasd_device * device)
          * device->bdev to lower the offline open_count limit again.
          */
         bdev = device->bdev;
-        device->bdev = 0;
+        device->bdev = NULL;
 
         /*
          * See fs/partition/check.c:delete_partition
@@ -145,7 +147,7 @@ dasd_destroy_partitions(struct dasd_device * device)
          */
         memset(&bpart, 0, sizeof(struct blkpg_partition));
         memset(&barg, 0, sizeof(struct blkpg_ioctl_arg));
-        barg.data = &bpart;
+        barg.data = (void __user *) &bpart;
         barg.op = BLKPG_DEL_PARTITION;
         for (bpart.pno = device->gdp->minors - 1; bpart.pno > 0; bpart.pno--)
                 ioctl_by_bdev(bdev, BLKPG, (unsigned long) &barg);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index e97f5316ad2d..8fed3603e9ea 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -345,7 +345,7 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
         if (bdev != bdev->bd_contains)
                 // ro setting is not allowed for partitions
                 return -EINVAL;
-        if (get_user(intval, (int *)argp))
+        if (get_user(intval, (int __user *)argp))
                 return -EFAULT;
 
         set_disk_ro(bdev->bd_disk, intval);
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index 4c1e56b9b98d..ca7d51f7eccc 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -48,15 +48,6 @@
 #define PRINT_ERR(x...)         printk(KERN_ERR XPRAM_NAME " error:" x)
 
 
-static struct sysdev_class xpram_sysclass = {
-        set_kset_name("xpram"),
-};
-
-static struct sys_device xpram_sys_device = {
-        .id     = 0,
-        .cls    = &xpram_sysclass,
-}; 
-
 typedef struct {
         unsigned int    size;           /* size of xpram segment in pages */
         unsigned int    offset;         /* start page of xpram segment */
@@ -71,11 +62,11 @@ static int xpram_devs;
 /*
  * Parameter parsing functions.
  */
-static int devs = XPRAM_DEVS;
-static unsigned int sizes[XPRAM_MAX_DEVS];
+static int __initdata devs = XPRAM_DEVS;
+static char __initdata *sizes[XPRAM_MAX_DEVS];
 
 module_param(devs, int, 0);
-module_param_array(sizes, int, NULL, 0);
+module_param_array(sizes, charp, NULL, 0);
 
 MODULE_PARM_DESC(devs, "number of devices (\"partitions\"), " \
                  "the default is " __MODULE_STRING(XPRAM_DEVS) "\n");
@@ -86,59 +77,6 @@ MODULE_PARM_DESC(sizes, "list of device (partition) sizes " \
                  "claimed by explicit sizes\n");
 MODULE_LICENSE("GPL");
 
-#ifndef MODULE
-/*
- * Parses the kernel parameters given in the kernel parameter line.
- * The expected format is
- *           <number_of_partitions>[","<partition_size>]*
- * where
- *           devices is a positive integer that initializes xpram_devs
- *           each size is a non-negative integer possibly followed by a
- *           magnitude (k,K,m,M,g,G), the list of sizes initialises
- *           xpram_sizes
- *
- * Arguments
- *           str: substring of kernel parameter line that contains xprams
- *                kernel parameters.
- *
- * Result    0 on success, -EINVAL else -- only for Version > 2.3
- *
- * Side effects
- *           the global variabls devs is set to the value of
- *           <number_of_partitions> and sizes[i] is set to the i-th
- *           partition size (if provided). A parsing error of a value
- *           results in this value being set to -EINVAL.
- */
-static int __init xpram_setup (char *str)
-{
-        char *cp;
-        int i;
-
-        devs = simple_strtoul(str, &cp, 10);
-        if (cp <= str || devs > XPRAM_MAX_DEVS)
-                return 0;
-        for (i = 0; (i < devs) && (*cp++ == ','); i++) {
-                sizes[i] = simple_strtoul(cp, &cp, 10);
-                if (*cp == 'g' || *cp == 'G') {
-                        sizes[i] <<= 20;
-                        cp++;
-                } else if (*cp == 'm' || *cp == 'M') {
-                        sizes[i] <<= 10;
-                        cp++;
-                } else if (*cp == 'k' || *cp == 'K')
-                        cp++;
-                while (isspace(*cp)) cp++;
-        }
-        if (*cp == ',' && i >= devs)
-                PRINT_WARN("partition sizes list has too many entries.\n");
-        else if (*cp != 0)
-                PRINT_WARN("ignored '%s' at end of parameter string.\n", cp);
-        return 1;
-}
-
-__setup("xpram_parts=", xpram_setup);
-#endif
-
 /*
  * Copy expanded memory page (4kB) into main memory                  
  * Arguments                                                         
@@ -357,6 +295,7 @@ static int __init xpram_setup_sizes(unsigned long pages)
 {
         unsigned long mem_needed;
         unsigned long mem_auto;
+        unsigned long long size;
         int mem_auto_no;
         int i;
 
@@ -374,7 +313,19 @@ static int __init xpram_setup_sizes(unsigned long pages)
         mem_needed = 0;
         mem_auto_no = 0;
         for (i = 0; i < xpram_devs; i++) {
-                xpram_sizes[i] = (sizes[i] + 3) & -4UL;
+                if (sizes[i]) {
+                        size = simple_strtoull(sizes[i], &sizes[i], 0);
+                        switch (sizes[i][0]) {
+                        case 'g':
+                        case 'G':
+                                size <<= 20;
+                                break;
+                        case 'm':
+                        case 'M':
+                                size <<= 10;
+                        }
+                        xpram_sizes[i] = (size + 3) & -4UL;
+                }
                 if (xpram_sizes[i])
                         mem_needed += xpram_sizes[i];
                 else
@@ -491,8 +442,6 @@ static void __exit xpram_exit(void)
         }
         unregister_blkdev(XPRAM_MAJOR, XPRAM_NAME);
         blk_cleanup_queue(xpram_queue);
-        sysdev_unregister(&xpram_sys_device);
-        sysdev_class_unregister(&xpram_sysclass);
 }
 
 static int __init xpram_init(void)
@@ -510,19 +459,7 @@ static int __init xpram_init(void)
         rc = xpram_setup_sizes(xpram_pages);
         if (rc)
                 return rc;
-        rc = sysdev_class_register(&xpram_sysclass);
-        if (rc)
-                return rc;
-
-        rc = sysdev_register(&xpram_sys_device);
-        if (rc) {
-                sysdev_class_unregister(&xpram_sysclass);
-                return rc;
-        }
-        rc = xpram_setup_blkdev();
-        if (rc)
-                sysdev_unregister(&xpram_sys_device);
-        return rc;
+        return xpram_setup_blkdev();
 }
 
 module_init(xpram_init);
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index f25c6d116f6f..2fa566fa6da4 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -693,7 +693,7 @@ raw3215_probe (struct ccw_device *cdev)
                                        GFP_KERNEL|GFP_DMA);
         if (raw->buffer == NULL) {
                 spin_lock(&raw3215_device_lock);
-                raw3215[line] = 0;
+                raw3215[line] = NULL;
                 spin_unlock(&raw3215_device_lock);
                 kfree(raw);
                 return -ENOMEM;
diff --git a/drivers/s390/char/ctrlchar.c b/drivers/s390/char/ctrlchar.c
index 0ea6f36a2527..d83eb6358bac 100644
--- a/drivers/s390/char/ctrlchar.c
+++ b/drivers/s390/char/ctrlchar.c
@@ -23,7 +23,7 @@ ctrlchar_handle_sysrq(void *tty)
         handle_sysrq(ctrlchar_sysrq_key, NULL, (struct tty_struct *) tty);
 }
 
-static DECLARE_WORK(ctrlchar_work, ctrlchar_handle_sysrq, 0);
+static DECLARE_WORK(ctrlchar_work, ctrlchar_handle_sysrq, NULL);
 #endif
 
 
diff --git a/drivers/s390/char/defkeymap.c b/drivers/s390/char/defkeymap.c
index ca15adb140d1..17027d918cf7 100644
--- a/drivers/s390/char/defkeymap.c
+++ b/drivers/s390/char/defkeymap.c
@@ -83,8 +83,8 @@ static u_short shift_ctrl_map[NR_KEYS] = {
 };
 
 ushort *key_maps[MAX_NR_KEYMAPS] = {
-        plain_map, shift_map, 0, 0,
-        ctrl_map, shift_ctrl_map,       0
+        plain_map, shift_map, NULL, NULL,
+        ctrl_map, shift_ctrl_map, NULL,
 };
 
 unsigned int keymap_count = 4;
@@ -145,7 +145,7 @@ char *func_table[MAX_NR_FUNC] = {
         func_buf + 97,
         func_buf + 103,
         func_buf + 109,
-        0,
+        NULL,
 };
 
 struct kbdiacr accent_table[MAX_DIACR] = {
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 6099c14de429..ef004d089712 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -236,7 +236,7 @@ fs3270_irq(struct fs3270 *fp, struct raw3270_request *rq, struct irb *irb)
  * Process reads from fullscreen 3270.
  */
 static ssize_t
-fs3270_read(struct file *filp, char *data, size_t count, loff_t *off)
+fs3270_read(struct file *filp, char __user *data, size_t count, loff_t *off)
 {
         struct fs3270 *fp;
         struct raw3270_request *rq;
@@ -281,7 +281,7 @@ fs3270_read(struct file *filp, char *data, size_t count, loff_t *off)
  * Process writes to fullscreen 3270.
  */
 static ssize_t
-fs3270_write(struct file *filp, const char *data, size_t count, loff_t *off)
+fs3270_write(struct file *filp, const char __user *data, size_t count, loff_t *off)
 {
         struct fs3270 *fp;
         struct raw3270_request *rq;
@@ -338,10 +338,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 fp->write_command = arg;
                 break;
         case TUBGETI:
-                rc = put_user(fp->read_command, (char *) arg);
+                rc = put_user(fp->read_command, (char __user *) arg);
                 break;
         case TUBGETO:
-                rc = put_user(fp->write_command,(char *) arg);
+                rc = put_user(fp->write_command,(char __user *) arg);
                 break;
         case TUBGETMOD:
                 iocb.model = fp->view.model;
@@ -350,7 +350,7 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 iocb.pf_cnt = 24;
                 iocb.re_cnt = 20;
                 iocb.map = 0;
-                if (copy_to_user((char *) arg, &iocb,
+                if (copy_to_user((char __user *) arg, &iocb,
                                  sizeof(struct raw3270_iocb)))
                         rc = -EFAULT;
                 break;
@@ -479,7 +479,7 @@ fs3270_close(struct inode *inode, struct file *filp)
         struct fs3270 *fp;
 
         fp = filp->private_data;
-        filp->private_data = 0;
+        filp->private_data = NULL;
         if (fp) {
                 fp->fs_pid = 0;
                 raw3270_reset(&fp->view);
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index 547ef906ae2c..3be06569180d 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -103,7 +103,7 @@ out_maps:
 out_kbd:
         kfree(kbd);
 out:
-        return 0;
+        return NULL;
 }
 
 void
@@ -304,7 +304,7 @@ kbd_keycode(struct kbd_data *kbd, unsigned int keycode)
                 if (kbd->sysrq) {
                         if (kbd->sysrq == K(KT_LATIN, '-')) {
                                 kbd->sysrq = 0;
-                                handle_sysrq(value, 0, kbd->tty);
+                                handle_sysrq(value, NULL, kbd->tty);
                                 return;
                         }
                         if (value == '-') {
@@ -363,7 +363,7 @@ do_kdsk_ioctl(struct kbd_data *kbd, struct kbentry __user *user_kbe,
                         /* disallocate map */
                         key_map = kbd->key_maps[tmp.kb_table];
                         if (key_map) {
-                            kbd->key_maps[tmp.kb_table] = 0;
+                            kbd->key_maps[tmp.kb_table] = NULL;
                             kfree(key_map);
                         }
                         break;
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index e95b56f810db..7a84014f2037 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -555,7 +555,7 @@ raw3270_start_init(struct raw3270 *rp, struct raw3270_view *view,
 #ifdef CONFIG_TN3270_CONSOLE
         if (raw3270_registered == 0) {
                 spin_lock_irqsave(get_ccwdev_lock(view->dev->cdev), flags);
-                rq->callback = 0;
+                rq->callback = NULL;
                 rc = __raw3270_start(rp, view, rq);
                 if (rc == 0)
                         while (!raw3270_request_final(rq)) {
@@ -719,8 +719,8 @@ raw3270_size_device(struct raw3270 *rp)
                 rc = __raw3270_size_device_vm(rp);
         else
                 rc = __raw3270_size_device(rp);
-        raw3270_init_view.dev = 0;
-        rp->view = 0;
+        raw3270_init_view.dev = NULL;
+        rp->view = NULL;
         up(&raw3270_init_sem);
         if (rc == 0) {  /* Found something. */
                 /* Try to find a model. */
@@ -761,8 +761,8 @@ raw3270_reset_device(struct raw3270 *rp)
         rp->view = &raw3270_init_view;
         raw3270_init_view.dev = rp;
         rc = raw3270_start_init(rp, &raw3270_init_view, &rp->init_request);
-        raw3270_init_view.dev = 0;
-        rp->view = 0;
+        raw3270_init_view.dev = NULL;
+        rp->view = NULL;
         up(&raw3270_init_sem);
         return rc;
 }
@@ -934,7 +934,7 @@ raw3270_activate_view(struct raw3270_view *view)
         else if (!test_bit(RAW3270_FLAGS_READY, &rp->flags))
                 rc = -ENODEV;
         else {
-                oldview = 0;
+                oldview = NULL;
                 if (rp->view) {
                         oldview = rp->view;
                         oldview->fn->deactivate(oldview);
@@ -951,7 +951,7 @@ raw3270_activate_view(struct raw3270_view *view)
                                                 rp->view = nv;
                                                 if (nv->fn->activate(nv) == 0)
                                                         break;
-                                                rp->view = 0;
+                                                rp->view = NULL;
                                         }
                         }
                 }
@@ -975,7 +975,7 @@ raw3270_deactivate_view(struct raw3270_view *view)
         spin_lock_irqsave(get_ccwdev_lock(rp->cdev), flags);
         if (rp->view == view) {
                 view->fn->deactivate(view);
-                rp->view = 0;
+                rp->view = NULL;
                 /* Move deactivated view to end of list. */
                 list_del_init(&view->list);
                 list_add_tail(&view->list, &rp->view_list);
@@ -985,7 +985,7 @@ raw3270_deactivate_view(struct raw3270_view *view)
                                 rp->view = view;
                                 if (view->fn->activate(view) == 0)
                                         break;
-                                rp->view = 0;
+                                rp->view = NULL;
                         }
                 }
         }
@@ -1076,7 +1076,7 @@ raw3270_del_view(struct raw3270_view *view)
         spin_lock_irqsave(get_ccwdev_lock(rp->cdev), flags);
         if (rp->view == view) {
                 view->fn->deactivate(view);
-                rp->view = 0;
+                rp->view = NULL;
         }
         list_del_init(&view->list);
         if (!rp->view && test_bit(RAW3270_FLAGS_READY, &rp->flags)) {
@@ -1106,10 +1106,10 @@ raw3270_delete_device(struct raw3270 *rp)
 
         /* Remove from device chain. */
         mutex_lock(&raw3270_mutex);
-        if (rp->clttydev)
+        if (rp->clttydev && !IS_ERR(rp->clttydev))
                 class_device_destroy(class3270,
                                      MKDEV(IBM_TTY3270_MAJOR, rp->minor));
-        if (rp->cltubdev)
+        if (rp->cltubdev && !IS_ERR(rp->cltubdev))
                 class_device_destroy(class3270,
                                      MKDEV(IBM_FS3270_MAJOR, rp->minor));
         list_del_init(&rp->list);
@@ -1117,9 +1117,9 @@ raw3270_delete_device(struct raw3270 *rp)
 
         /* Disconnect from ccw_device. */
         cdev = rp->cdev;
-        rp->cdev = 0;
-        cdev->dev.driver_data = 0;
-        cdev->handler = 0;
+        rp->cdev = NULL;
+        cdev->dev.driver_data = NULL;
+        cdev->handler = NULL;
 
         /* Put ccw_device structure. */
         put_device(&cdev->dev);
@@ -1144,7 +1144,7 @@ raw3270_model_show(struct device *dev, struct device_attribute *attr, char *buf)
         return snprintf(buf, PAGE_SIZE, "%i\n",
                         ((struct raw3270 *) dev->driver_data)->model);
 }
-static DEVICE_ATTR(model, 0444, raw3270_model_show, 0);
+static DEVICE_ATTR(model, 0444, raw3270_model_show, NULL);
 
 static ssize_t
 raw3270_rows_show(struct device *dev, struct device_attribute *attr, char *buf)
@@ -1152,7 +1152,7 @@ raw3270_rows_show(struct device *dev, struct device_attribute *attr, char *buf)
         return snprintf(buf, PAGE_SIZE, "%i\n",
                         ((struct raw3270 *) dev->driver_data)->rows);
 }
-static DEVICE_ATTR(rows, 0444, raw3270_rows_show, 0);
+static DEVICE_ATTR(rows, 0444, raw3270_rows_show, NULL);
 
 static ssize_t
 raw3270_columns_show(struct device *dev, struct device_attribute *attr, char *buf)
@@ -1160,7 +1160,7 @@ raw3270_columns_show(struct device *dev, struct device_attribute *attr, char *bu
         return snprintf(buf, PAGE_SIZE, "%i\n",
                         ((struct raw3270 *) dev->driver_data)->cols);
 }
-static DEVICE_ATTR(columns, 0444, raw3270_columns_show, 0);
+static DEVICE_ATTR(columns, 0444, raw3270_columns_show, NULL);
 
 static struct attribute * raw3270_attrs[] = {
         &dev_attr_model.attr,
@@ -1173,21 +1173,37 @@ static struct attribute_group raw3270_attr_group = {
         .attrs = raw3270_attrs,
 };
 
-static void
-raw3270_create_attributes(struct raw3270 *rp)
+static int raw3270_create_attributes(struct raw3270 *rp)
 {
-        //FIXME: check return code
-        sysfs_create_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
-        rp->clttydev =
-                class_device_create(class3270, NULL,
-                                    MKDEV(IBM_TTY3270_MAJOR, rp->minor),
-                                    &rp->cdev->dev, "tty%s",
-                                    rp->cdev->dev.bus_id);
-        rp->cltubdev =
-                class_device_create(class3270, NULL,
-                                    MKDEV(IBM_FS3270_MAJOR, rp->minor),
-                                    &rp->cdev->dev, "tub%s",
-                                    rp->cdev->dev.bus_id);
+        int rc;
+
+        rc = sysfs_create_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
+        if (rc)
+                goto out;
+
+        rp->clttydev = class_device_create(class3270, NULL,
+                                           MKDEV(IBM_TTY3270_MAJOR, rp->minor),
+                                           &rp->cdev->dev, "tty%s",
+                                           rp->cdev->dev.bus_id);
+        if (IS_ERR(rp->clttydev)) {
+                rc = PTR_ERR(rp->clttydev);
+                goto out_ttydev;
+        }
+
+        rp->cltubdev = class_device_create(class3270, NULL,
+                                           MKDEV(IBM_FS3270_MAJOR, rp->minor),
+                                           &rp->cdev->dev, "tub%s",
+                                           rp->cdev->dev.bus_id);
+        if (!IS_ERR(rp->cltubdev))
+                goto out;
+
+        rc = PTR_ERR(rp->cltubdev);
+        class_device_destroy(class3270, MKDEV(IBM_TTY3270_MAJOR, rp->minor));
+
+out_ttydev:
+        sysfs_remove_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
+out:
+        return rc;
 }
 
 /*
@@ -1255,7 +1271,9 @@ raw3270_set_online (struct ccw_device *cdev)
         rc = raw3270_reset_device(rp);
         if (rc)
                 goto failure;
-        raw3270_create_attributes(rp);
+        rc = raw3270_create_attributes(rp);
+        if (rc)
+                goto failure;
         set_bit(RAW3270_FLAGS_READY, &rp->flags);
         mutex_lock(&raw3270_mutex);
         list_for_each_entry(np, &raw3270_notifier, list)
@@ -1296,7 +1314,7 @@ raw3270_remove (struct ccw_device *cdev)
         spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
         if (rp->view) {
                 rp->view->fn->deactivate(rp->view);
-                rp->view = 0;
+                rp->view = NULL;
         }
         while (!list_empty(&rp->view_list)) {
                 v = list_entry(rp->view_list.next, struct raw3270_view, list);
diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h
index b635bf8e7775..90beaa80a782 100644
--- a/drivers/s390/char/raw3270.h
+++ b/drivers/s390/char/raw3270.h
@@ -231,7 +231,7 @@ alloc_string(struct list_head *free_list, unsigned long len)
                 INIT_LIST_HEAD(&cs->update);
                 return cs;
         }
-        return 0;
+        return NULL;
 }
 
 static inline unsigned long
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 4138564402b8..985d1613baaa 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -383,6 +383,7 @@ void
 sclp_sync_wait(void)
 {
         unsigned long psw_mask;
+        unsigned long flags;
         unsigned long cr0, cr0_sync;
         u64 timeout;
 
@@ -395,9 +396,11 @@ sclp_sync_wait(void)
                           sclp_tod_from_jiffies(sclp_request_timer.expires -
                                                 jiffies);
         }
+        local_irq_save(flags);
         /* Prevent bottom half from executing once we force interrupts open */
         local_bh_disable();
         /* Enable service-signal interruption, disable timer interrupts */
+        trace_hardirqs_on();
         __ctl_store(cr0, 0, 0);
         cr0_sync = cr0;
         cr0_sync |= 0x00000200;
@@ -415,11 +418,10 @@ sclp_sync_wait(void)
                 barrier();
                 cpu_relax();
         }
-        /* Restore interrupt settings */
-        asm volatile ("SSM 0(%0)"
-                      : : "a" (&psw_mask) : "memory");
+        local_irq_disable();
         __ctl_load(cr0, 0, 0);
-        __local_bh_enable();
+        _local_bh_enable();
+        local_irq_restore(flags);
 }
 
 EXPORT_SYMBOL(sclp_sync_wait);
diff --git a/drivers/s390/char/tape_34xx.c b/drivers/s390/char/tape_34xx.c
index 48b4d30a7256..7b95dab913d0 100644
--- a/drivers/s390/char/tape_34xx.c
+++ b/drivers/s390/char/tape_34xx.c
@@ -1309,9 +1309,9 @@ static struct tape_discipline tape_discipline_34xx = {
 };
 
 static struct ccw_device_id tape_34xx_ids[] = {
-        { CCW_DEVICE_DEVTYPE(0x3480, 0, 0x3480, 0), driver_info: tape_3480},
-        { CCW_DEVICE_DEVTYPE(0x3490, 0, 0x3490, 0), driver_info: tape_3490},
-        { /* end of list */ }
+        { CCW_DEVICE_DEVTYPE(0x3480, 0, 0x3480, 0), .driver_info = tape_3480},
+        { CCW_DEVICE_DEVTYPE(0x3490, 0, 0x3490, 0), .driver_info = tape_3490},
+        { /* end of list */ },
 };
 
 static int
diff --git a/drivers/s390/char/tape_class.c b/drivers/s390/char/tape_class.c
index a5c68e60fcf4..56b87618b100 100644
--- a/drivers/s390/char/tape_class.c
+++ b/drivers/s390/char/tape_class.c
@@ -76,14 +76,22 @@ struct tape_class_device *register_tape_dev(
                                 device,
                                 "%s", tcd->device_name
                         );
-        sysfs_create_link(
+        rc = IS_ERR(tcd->class_device) ? PTR_ERR(tcd->class_device) : 0;
+        if (rc)
+                goto fail_with_cdev;
+        rc = sysfs_create_link(
                 &device->kobj,
                 &tcd->class_device->kobj,
                 tcd->mode_name
         );
+        if (rc)
+                goto fail_with_class_device;
 
         return tcd;
 
+fail_with_class_device:
+        class_device_destroy(tape_class, tcd->char_device->dev);
+
 fail_with_cdev:
         cdev_del(tcd->char_device);
 
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 122b4d8965c3..2826aed91043 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -543,20 +543,24 @@ int
 tape_generic_probe(struct ccw_device *cdev)
 {
         struct tape_device *device;
+        int ret;
 
         device = tape_alloc_device();
         if (IS_ERR(device))
                 return -ENODEV;
-        PRINT_INFO("tape device %s found\n", cdev->dev.bus_id);
+        ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
+        ret = sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
+        if (ret) {
+                tape_put_device(device);
+                PRINT_ERR("probe failed for tape device %s\n", cdev->dev.bus_id);
+                return ret;
+        }
         cdev->dev.driver_data = device;
+        cdev->handler = __tape_do_irq;
         device->cdev = cdev;
         device->cdev_id = busid_to_int(cdev->dev.bus_id);
-        cdev->handler = __tape_do_irq;
-
-        ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
-        sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
-
-        return 0;
+        PRINT_INFO("tape device %s found\n", cdev->dev.bus_id);
+        return ret;
 }
 
 static inline void
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index f496f236b9c0..29718042c6c9 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -437,7 +437,7 @@ tty3270_rcl_add(struct tty3270 *tp, char *input, int len)
 {
         struct string *s;
 
-        tp->rcl_walk = 0;
+        tp->rcl_walk = NULL;
         if (len <= 0)
                 return;
         if (tp->rcl_nr >= tp->rcl_max) {
@@ -466,12 +466,12 @@ tty3270_rcl_backward(struct kbd_data *kbd)
                 else if (!list_empty(&tp->rcl_lines))
                         tp->rcl_walk = tp->rcl_lines.prev;
                 s = tp->rcl_walk ? 
-                        list_entry(tp->rcl_walk, struct string, list) : 0;
+                        list_entry(tp->rcl_walk, struct string, list) : NULL;
                 if (tp->rcl_walk) {
                         s = list_entry(tp->rcl_walk, struct string, list);
                         tty3270_update_prompt(tp, s->string, s->len);
                 } else
-                        tty3270_update_prompt(tp, 0, 0);
+                        tty3270_update_prompt(tp, NULL, 0);
                 tty3270_set_timer(tp, 1);
         }
         spin_unlock_bh(&tp->view.lock);
@@ -553,7 +553,7 @@ tty3270_read_tasklet(struct raw3270_request *rrq)
          * has to be emitted to the tty and for 0x6d the screen
          * needs to be redrawn.
          */
-        input = 0;
+        input = NULL;
         len = 0;
         if (tp->input->string[0] == 0x7d) {
                 /* Enter: write input to tty. */
@@ -567,7 +567,7 @@ tty3270_read_tasklet(struct raw3270_request *rrq)
                         tty3270_update_status(tp);
                 }
                 /* Clear input area. */
-                tty3270_update_prompt(tp, 0, 0);
+                tty3270_update_prompt(tp, NULL, 0);
                 tty3270_set_timer(tp, 1);
         } else if (tp->input->string[0] == 0x6d) {
                 /* Display has been cleared. Redraw. */
@@ -808,8 +808,8 @@ tty3270_release(struct raw3270_view *view)
         tp = (struct tty3270 *) view;
         tty = tp->tty;
         if (tty) {
-                tty->driver_data = 0;
-                tp->tty = tp->kbd->tty = 0;
+                tty->driver_data = NULL;
+                tp->tty = tp->kbd->tty = NULL;
                 tty_hangup(tty);
                 raw3270_put_view(&tp->view);
         }
@@ -948,8 +948,8 @@ tty3270_close(struct tty_struct *tty, struct file * filp)
                 return;
         tp = (struct tty3270 *) tty->driver_data;
         if (tp) {
-                tty->driver_data = 0;
-                tp->tty = tp->kbd->tty = 0;
+                tty->driver_data = NULL;
+                tp->tty = tp->kbd->tty = NULL;
                 raw3270_put_view(&tp->view);
         }
 }
@@ -1673,7 +1673,7 @@ tty3270_set_termios(struct tty_struct *tty, struct termios *old)
                 new = L_ECHO(tty) ? TF_INPUT: TF_INPUTN;
                 if (new != tp->inattr) {
                         tp->inattr = new;
-                        tty3270_update_prompt(tp, 0, 0);
+                        tty3270_update_prompt(tp, NULL, 0);
                         tty3270_set_timer(tp, 1);
                 }
         }
@@ -1759,7 +1759,7 @@ void
 tty3270_notifier(int index, int active)
 {
         if (active)
-                tty_register_device(tty3270_driver, index, 0);
+                tty_register_device(tty3270_driver, index, NULL);
         else
                 tty_unregister_device(tty3270_driver, index);
 }
@@ -1818,7 +1818,7 @@ tty3270_exit(void)
 
         raw3270_unregister_notifier(tty3270_notifier);
         driver = tty3270_driver;
-        tty3270_driver = 0;
+        tty3270_driver = NULL;
         tty_unregister_driver(driver);
         tty3270_del_views();
 }
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index c625b69ebd19..6cb23040954b 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -86,8 +86,8 @@ struct vmlogrdr_priv_t {
  */
 static int vmlogrdr_open(struct inode *, struct file *);
 static int vmlogrdr_release(struct inode *, struct file *);
-static ssize_t vmlogrdr_read (struct file *filp, char *data, size_t count,
-                               loff_t * ppos);
+static ssize_t vmlogrdr_read (struct file *filp, char __user *data,
+                              size_t count, loff_t * ppos);
 
 static struct file_operations vmlogrdr_fops = {
         .owner   = THIS_MODULE,
@@ -515,7 +515,7 @@ vmlogrdr_receive_data(struct vmlogrdr_priv_t *priv) {
 
 
 static ssize_t
-vmlogrdr_read (struct file *filp, char *data, size_t count, loff_t * ppos)
+vmlogrdr_read(struct file *filp, char __user *data, size_t count, loff_t * ppos)
 {
         int rc;
         struct vmlogrdr_priv_t * priv = filp->private_data;
diff --git a/drivers/s390/char/vmwatchdog.c b/drivers/s390/char/vmwatchdog.c
index 5acc0ace3d7d..807320a41fa4 100644
--- a/drivers/s390/char/vmwatchdog.c
+++ b/drivers/s390/char/vmwatchdog.c
@@ -193,7 +193,7 @@ static int vmwdt_ioctl(struct inode *i, struct file *f,
                 return 0;
         case WDIOC_GETSTATUS:
         case WDIOC_GETBOOTSTATUS:
-                return put_user(0, (int *)arg);
+                return put_user(0, (int __user *)arg);
         case WDIOC_GETTEMP:
                 return -EINVAL;
         case WDIOC_SETOPTIONS:
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index c7319a07ba35..38954f5cd14c 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -152,7 +152,6 @@ ccwgroup_create(struct device *root,
         struct ccwgroup_device *gdev;
         int i;
         int rc;
-        int del_drvdata;
 
         if (argc > 256) /* disallow dumb users */
                 return -EINVAL;
@@ -163,7 +162,6 @@ ccwgroup_create(struct device *root,
 
         atomic_set(&gdev->onoff, 0);
 
-        del_drvdata = 0;
         for (i = 0; i < argc; i++) {
                 gdev->cdev[i] = get_ccwdev_by_busid(cdrv, argv[i]);
 
@@ -180,18 +178,14 @@ ccwgroup_create(struct device *root,
                         rc = -EINVAL;
                         goto free_dev;
                 }
-        }
-        for (i = 0; i < argc; i++)
                 gdev->cdev[i]->dev.driver_data = gdev;
-        del_drvdata = 1;
+        }
 
         gdev->creator_id = creator_id;
         gdev->count = argc;
-        gdev->dev = (struct device ) {
-                .bus = &ccwgroup_bus_type,
-                .parent = root,
-                .release = ccwgroup_release,
-        };
+        gdev->dev.bus = &ccwgroup_bus_type;
+        gdev->dev.parent = root;
+        gdev->dev.release = ccwgroup_release;
 
         snprintf (gdev->dev.bus_id, BUS_ID_SIZE, "%s",
                         gdev->cdev[0]->dev.bus_id);
@@ -226,9 +220,9 @@ error:
 free_dev:
         for (i = 0; i < argc; i++)
                 if (gdev->cdev[i]) {
-                        put_device(&gdev->cdev[i]->dev);
-                        if (del_drvdata)
+                        if (gdev->cdev[i]->dev.driver_data == gdev)
                                 gdev->cdev[i]->dev.driver_data = NULL;
+                        put_device(&gdev->cdev[i]->dev);
                 }
         kfree(gdev);
         return rc;
@@ -319,7 +313,7 @@ ccwgroup_online_store (struct device *dev, struct device_attribute *attr, const
         if (!try_module_get(gdrv->owner))
                 return -EINVAL;
 
-        value = simple_strtoul(buf, 0, 0);
+        value = simple_strtoul(buf, NULL, 0);
         ret = count;
         if (value == 1)
                 ccwgroup_set_online(gdev);
@@ -395,10 +389,8 @@ int
 ccwgroup_driver_register (struct ccwgroup_driver *cdriver)
 {
         /* register our new driver with the core */
-        cdriver->driver = (struct device_driver) {
-                .bus = &ccwgroup_bus_type,
-                .name = cdriver->name,
-        };
+        cdriver->driver.bus = &ccwgroup_bus_type;
+        cdriver->driver.name = cdriver->name;
 
         return driver_register(&cdriver->driver);
 }
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index a01f3bba4a7b..c28444af0919 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -238,8 +238,6 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         /* Check for single path devices. */
         if (sch->schib.pmcw.pim == 0x80)
                 goto out_unreg;
-        if (sch->vpm == mask)
-                goto out_unreg;
 
         if ((sch->schib.scsw.actl & SCSW_ACTL_DEVACT) &&
             (sch->schib.scsw.actl & SCSW_ACTL_SCHACT) &&
@@ -258,6 +256,8 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         /* trigger path verification. */
         if (sch->driver && sch->driver->verify)
                 sch->driver->verify(&sch->dev);
+        else if (sch->vpm == mask)
+                goto out_unreg;
 out_unlock:
         spin_unlock_irq(&sch->lock);
         return 0;
@@ -1391,10 +1391,8 @@ new_channel_path(int chpid)
         /* fill in status, etc. */
         chp->id = chpid;
         chp->state = 1;
-        chp->dev = (struct device) {
-                .parent  = &css[0]->device,
-                .release = chp_release,
-        };
+        chp->dev.parent = &css[0]->device;
+        chp->dev.release = chp_release;
         snprintf(chp->dev.bus_id, BUS_ID_SIZE, "chp0.%x", chpid);
 
         /* Obtain channel path description and fill it in. */
@@ -1464,6 +1462,40 @@ chsc_get_chp_desc(struct subchannel *sch, int chp_no)
         return desc;
 }
 
+static int reset_channel_path(struct channel_path *chp)
+{
+        int cc;
+
+        cc = rchp(chp->id);
+        switch (cc) {
+        case 0:
+                return 0;
+        case 2:
+                return -EBUSY;
+        default:
+                return -ENODEV;
+        }
+}
+
+static void reset_channel_paths_css(struct channel_subsystem *css)
+{
+        int i;
+
+        for (i = 0; i <= __MAX_CHPID; i++) {
+                if (css->chps[i])
+                        reset_channel_path(css->chps[i]);
+        }
+}
+
+void cio_reset_channel_paths(void)
+{
+        int i;
+
+        for (i = 0; i <= __MAX_CSSID; i++) {
+                if (css[i] && css[i]->valid)
+                        reset_channel_paths_css(css[i]);
+        }
+}
 
 static int __init
 chsc_alloc_sei_area(void)
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index a3423267467f..89320c1ad825 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -147,7 +147,7 @@ cio_tpi(void)
                 sch->driver->irq(&sch->dev);
         spin_unlock(&sch->lock);
         irq_exit ();
-        __local_bh_enable();
+        _local_bh_enable();
         return 1;
 }
 
@@ -519,6 +519,7 @@ cio_validate_subchannel (struct subchannel *sch, struct subchannel_id schid)
         memset(sch, 0, sizeof(struct subchannel));
 
         spin_lock_init(&sch->lock);
+        mutex_init(&sch->reg_mutex);
 
         /* Set a name for the subchannel */
         snprintf (sch->dev.bus_id, BUS_ID_SIZE, "0.%x.%04x", schid.ssid,
@@ -797,7 +798,7 @@ struct subchannel *
 cio_get_console_subchannel(void)
 {
         if (!console_subchannel_in_use)
-                return 0;
+                return NULL;
         return &console_subchannel;
 }
 
@@ -875,5 +876,6 @@ void
 reipl(unsigned long devno)
 {
         clear_all_subchannels();
+        cio_reset_channel_paths();
         do_reipl(devno);
 }
diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
index 0ca987344e07..4541c1af4b66 100644
--- a/drivers/s390/cio/cio.h
+++ b/drivers/s390/cio/cio.h
@@ -2,6 +2,7 @@
 #define S390_CIO_H
 
 #include "schid.h"
+#include <linux/mutex.h>
 
 /*
  * where we put the ssd info
@@ -87,7 +88,7 @@ struct orb {
 struct subchannel {
         struct subchannel_id schid;
         spinlock_t lock;        /* subchannel lock */
-
+        struct mutex reg_mutex;
         enum {
                 SUBCHANNEL_TYPE_IO = 0,
                 SUBCHANNEL_TYPE_CHSC = 1,
diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
index 1c3e8e9012b0..828b2d334f0a 100644
--- a/drivers/s390/cio/cmf.c
+++ b/drivers/s390/cio/cmf.c
@@ -1068,6 +1068,7 @@ cmb_show_avg_sample_interval(struct device *dev, struct device_attribute *attr,
         if (count) {
                 interval = cmb_data->last_update -
                         cdev->private->cmb_start_time;
+                interval = (interval * 1000) >> 12;
                 interval /= count;
         } else
                 interval = -1;
@@ -1140,7 +1141,7 @@ static struct attribute *cmf_attributes[] = {
         &dev_attr_avg_device_disconnect_time.attr,
         &dev_attr_avg_control_unit_queuing_time.attr,
         &dev_attr_avg_device_active_only_time.attr,
-        0,
+        NULL,
 };
 
 static struct attribute_group cmf_attr_group = {
@@ -1160,7 +1161,7 @@ static struct attribute *cmf_attributes_ext[] = {
         &dev_attr_avg_device_active_only_time.attr,
         &dev_attr_avg_device_busy_time.attr,
         &dev_attr_avg_initial_command_response_time.attr,
-        0,
+        NULL,
 };
 
 static struct attribute_group cmf_attr_group_ext = {
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 1d3be80797f8..13eeea3d547f 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -108,6 +108,24 @@ css_subchannel_release(struct device *dev)
 
 extern int css_get_ssd_info(struct subchannel *sch);
 
+
+int css_sch_device_register(struct subchannel *sch)
+{
+        int ret;
+
+        mutex_lock(&sch->reg_mutex);
+        ret = device_register(&sch->dev);
+        mutex_unlock(&sch->reg_mutex);
+        return ret;
+}
+
+void css_sch_device_unregister(struct subchannel *sch)
+{
+        mutex_lock(&sch->reg_mutex);
+        device_unregister(&sch->dev);
+        mutex_unlock(&sch->reg_mutex);
+}
+
 static int
 css_register_subchannel(struct subchannel *sch)
 {
@@ -119,7 +137,7 @@ css_register_subchannel(struct subchannel *sch)
         sch->dev.release = &css_subchannel_release;
         
         /* make it known to the system */
-        ret = device_register(&sch->dev);
+        ret = css_sch_device_register(sch);
         if (ret)
                 printk (KERN_WARNING "%s: could not register %s\n",
                         __func__, sch->dev.bus_id);
@@ -250,7 +268,7 @@ css_evaluate_subchannel(struct subchannel_id schid, int slow)
                  * The device will be killed automatically.
                  */
                 cio_disable_subchannel(sch);
-                device_unregister(&sch->dev);
+                css_sch_device_unregister(sch);
                 /* Reset intparm to zeroes. */
                 sch->schib.pmcw.intparm = 0;
                 cio_modify(sch);
@@ -264,7 +282,7 @@ css_evaluate_subchannel(struct subchannel_id schid, int slow)
                  * away in any case.
                  */
                 if (!disc) {
-                        device_unregister(&sch->dev);
+                        css_sch_device_unregister(sch);
                         /* Reset intparm to zeroes. */
                         sch->schib.pmcw.intparm = 0;
                         cio_modify(sch);
@@ -605,9 +623,13 @@ init_channel_subsystem (void)
                 ret = device_register(&css[i]->device);
                 if (ret)
                         goto out_free;
-                if (css_characteristics_avail && css_chsc_characteristics.secm)
-                        device_create_file(&css[i]->device,
-                                           &dev_attr_cm_enable);
+                if (css_characteristics_avail &&
+                    css_chsc_characteristics.secm) {
+                        ret = device_create_file(&css[i]->device,
+                                                 &dev_attr_cm_enable);
+                        if (ret)
+                                goto out_device;
+                }
         }
         css_init_done = 1;
 
@@ -615,6 +637,8 @@ init_channel_subsystem (void)
 
         for_each_subchannel(__init_channel_subsystem, NULL);
         return 0;
+out_device:
+        device_unregister(&css[i]->device);
 out_free:
         kfree(css[i]);
 out_unregister:
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index e210f89a2449..8aabb4adeb5f 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -100,7 +100,7 @@ struct ccw_device_private {
         struct qdio_irq *qdio_data;
         struct irb irb;         /* device status */
         struct senseid senseid; /* SenseID info */
-        struct pgid pgid;       /* path group ID */
+        struct pgid pgid[8];    /* path group IDs per chpid*/
         struct ccw1 iccws[2];   /* ccws for SNID/SID/SPGID commands */
         struct work_struct kick_work;
         wait_queue_head_t wait_q;
@@ -136,6 +136,8 @@ extern struct bus_type css_bus_type;
 extern struct css_driver io_subchannel_driver;
 
 extern int css_probe_device(struct subchannel_id);
+extern int css_sch_device_register(struct subchannel *);
+extern void css_sch_device_unregister(struct subchannel *);
 extern struct subchannel * get_subchannel_by_schid(struct subchannel_id);
 extern int css_init_done;
 extern int for_each_subchannel(int(*fn)(struct subchannel_id, void *), void *);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 67f0de6aed33..646da5640401 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -100,7 +100,7 @@ ccw_uevent (struct device *dev, char **envp, int num_envp,
         if ((buffer_size - length <= 0) || (i >= num_envp))
                 return -ENOMEM;
 
-        envp[i] = 0;
+        envp[i] = NULL;
 
         return 0;
 }
@@ -280,7 +280,7 @@ ccw_device_remove_disconnected(struct ccw_device *cdev)
          * 'throw away device'.
          */
         sch = to_subchannel(cdev->dev.parent);
-        device_unregister(&sch->dev);
+        css_sch_device_unregister(sch);
         /* Reset intparm to zeroes. */
         sch->schib.pmcw.intparm = 0;
         cio_modify(sch);
@@ -556,12 +556,11 @@ get_disc_ccwdev_by_devno(unsigned int devno, unsigned int ssid,
                          struct ccw_device *sibling)
 {
         struct device *dev;
-        struct match_data data = {
-                .devno   = devno,
-                .ssid    = ssid,
-                .sibling = sibling,
-        };
+        struct match_data data;
 
+        data.devno = devno;
+        data.ssid = ssid;
+        data.sibling = sibling;
         dev = bus_find_device(&ccw_bus_type, NULL, &data, match_devno);
 
         return dev ? to_ccwdev(dev) : NULL;
@@ -625,7 +624,7 @@ ccw_device_do_unreg_rereg(void *data)
                                         other_sch->schib.pmcw.intparm = 0;
                                         cio_modify(other_sch);
                                 }
-                                device_unregister(&other_sch->dev);
+                                css_sch_device_unregister(other_sch);
                         }
                 }
                 /* Update ssd info here. */
@@ -709,7 +708,7 @@ ccw_device_call_sch_unregister(void *data)
         struct subchannel *sch;
 
         sch = to_subchannel(cdev->dev.parent);
-        device_unregister(&sch->dev);
+        css_sch_device_unregister(sch);
         /* Reset intparm to zeroes. */
         sch->schib.pmcw.intparm = 0;
         cio_modify(sch);
@@ -835,10 +834,8 @@ io_subchannel_probe (struct subchannel *sch)
                 return -ENOMEM;
         }
         atomic_set(&cdev->private->onoff, 0);
-        cdev->dev = (struct device) {
-                .parent = &sch->dev,
-                .release = ccw_device_release,
-        };
+        cdev->dev.parent = &sch->dev;
+        cdev->dev.release = ccw_device_release;
         INIT_LIST_HEAD(&cdev->private->kick_work.entry);
         /* Do first half of device_register. */
         device_initialize(&cdev->dev);
@@ -977,9 +974,7 @@ ccw_device_console_enable (struct ccw_device *cdev, struct subchannel *sch)
         int rc;
 
         /* Initialize the ccw_device structure. */
-        cdev->dev = (struct device) {
-                .parent = &sch->dev,
-        };
+        cdev->dev.parent= &sch->dev;
         rc = io_subchannel_recog(cdev, sch);
         if (rc)
                 return rc;
@@ -1057,7 +1052,7 @@ get_ccwdev_by_busid(struct ccw_driver *cdrv, const char *bus_id)
                                  __ccwdev_check_busid);
         put_driver(drv);
 
-        return dev ? to_ccwdev(dev) : 0;
+        return dev ? to_ccwdev(dev) : NULL;
 }
 
 /************************** device driver handling ************************/
@@ -1082,7 +1077,7 @@ ccw_device_probe (struct device *dev)
         ret = cdrv->probe ? cdrv->probe(cdev) : -ENODEV;
 
         if (ret) {
-                cdev->drv = 0;
+                cdev->drv = NULL;
                 return ret;
         }
 
@@ -1113,7 +1108,7 @@ ccw_device_remove (struct device *dev)
                                  ret, cdev->dev.bus_id);
         }
         ccw_device_set_timeout(cdev, 0);
-        cdev->drv = 0;
+        cdev->drv = NULL;
         return 0;
 }
 
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index cb1af0b6f033..35e162ba6d54 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -152,7 +152,8 @@ ccw_device_cancel_halt_clear(struct ccw_device *cdev)
                 if (cdev->private->iretry) {
                         cdev->private->iretry--;
                         ret = cio_halt(sch);
-                        return (ret == 0) ? -EBUSY : ret;
+                        if (ret != -EBUSY)
+                                return (ret == 0) ? -EBUSY : ret;
                 }
                 /* halt io unsuccessful. */
                 cdev->private->iretry = 255;    /* 255 clear retries. */
@@ -266,12 +267,10 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
                         notify = 1;
                 }
                 /* fill out sense information */
-                cdev->id = (struct ccw_device_id) {
-                        .cu_type   = cdev->private->senseid.cu_type,
-                        .cu_model  = cdev->private->senseid.cu_model,
-                        .dev_type  = cdev->private->senseid.dev_type,
-                        .dev_model = cdev->private->senseid.dev_model,
-                };
+                cdev->id.cu_type   = cdev->private->senseid.cu_type;
+                cdev->id.cu_model  = cdev->private->senseid.cu_model;
+                cdev->id.dev_type  = cdev->private->senseid.dev_type;
+                cdev->id.dev_model = cdev->private->senseid.dev_model;
                 if (notify) {
                         cdev->private->state = DEV_STATE_OFFLINE;
                         if (same_dev) {
@@ -378,6 +377,56 @@ ccw_device_done(struct ccw_device *cdev, int state)
                 put_device (&cdev->dev);
 }
 
+static inline int cmp_pgid(struct pgid *p1, struct pgid *p2)
+{
+        char *c1;
+        char *c2;
+
+        c1 = (char *)p1;
+        c2 = (char *)p2;
+
+        return memcmp(c1 + 1, c2 + 1, sizeof(struct pgid) - 1);
+}
+
+static void __ccw_device_get_common_pgid(struct ccw_device *cdev)
+{
+        int i;
+        int last;
+
+        last = 0;
+        for (i = 0; i < 8; i++) {
+                if (cdev->private->pgid[i].inf.ps.state1 == SNID_STATE1_RESET)
+                        /* No PGID yet */
+                        continue;
+                if (cdev->private->pgid[last].inf.ps.state1 ==
+                    SNID_STATE1_RESET) {
+                        /* First non-zero PGID */
+                        last = i;
+                        continue;
+                }
+                if (cmp_pgid(&cdev->private->pgid[i],
+                             &cdev->private->pgid[last]) == 0)
+                        /* Non-conflicting PGIDs */
+                        continue;
+
+                /* PGID mismatch, can't pathgroup. */
+                CIO_MSG_EVENT(0, "SNID - pgid mismatch for device "
+                              "0.%x.%04x, can't pathgroup\n",
+                              cdev->private->ssid, cdev->private->devno);
+                cdev->private->options.pgroup = 0;
+                return;
+        }
+        if (cdev->private->pgid[last].inf.ps.state1 ==
+            SNID_STATE1_RESET)
+                /* No previous pgid found */
+                memcpy(&cdev->private->pgid[0], &css[0]->global_pgid,
+                       sizeof(struct pgid));
+        else
+                /* Use existing pgid */
+                memcpy(&cdev->private->pgid[0], &cdev->private->pgid[last],
+                       sizeof(struct pgid));
+}
+
 /*
  * Function called from device_pgid.c after sense path ground has completed.
  */
@@ -388,24 +437,26 @@ ccw_device_sense_pgid_done(struct ccw_device *cdev, int err)
 
         sch = to_subchannel(cdev->dev.parent);
         switch (err) {
-        case 0:
-                /* Start Path Group verification. */
-                sch->vpm = 0;   /* Start with no path groups set. */
-                cdev->private->state = DEV_STATE_VERIFY;
-                ccw_device_verify_start(cdev);
+        case -EOPNOTSUPP: /* path grouping not supported, use nop instead. */
+                cdev->private->options.pgroup = 0;
+                break;
+        case 0: /* success */
+        case -EACCES: /* partial success, some paths not operational */
+                /* Check if all pgids are equal or 0. */
+                __ccw_device_get_common_pgid(cdev);
                 break;
         case -ETIME:            /* Sense path group id stopped by timeout. */
         case -EUSERS:           /* device is reserved for someone else. */
                 ccw_device_done(cdev, DEV_STATE_BOXED);
-                break;
-        case -EOPNOTSUPP: /* path grouping not supported, just set online. */
-                cdev->private->options.pgroup = 0;
-                ccw_device_done(cdev, DEV_STATE_ONLINE);
-                break;
+                return;
         default:
                 ccw_device_done(cdev, DEV_STATE_NOT_OPER);
-                break;
+                return;
         }
+        /* Start Path Group verification. */
+        sch->vpm = 0;   /* Start with no path groups set. */
+        cdev->private->state = DEV_STATE_VERIFY;
+        ccw_device_verify_start(cdev);
 }
 
 /*
@@ -513,12 +564,10 @@ ccw_device_verify_done(struct ccw_device *cdev, int err)
                 /* Deliver fake irb to device driver, if needed. */
                 if (cdev->private->flags.fake_irb) {
                         memset(&cdev->private->irb, 0, sizeof(struct irb));
-                        cdev->private->irb.scsw = (struct scsw) {
-                                .cc = 1,
-                                .fctl = SCSW_FCTL_START_FUNC,
-                                .actl = SCSW_ACTL_START_PEND,
-                                .stctl = SCSW_STCTL_STATUS_PEND,
-                        };
+                        cdev->private->irb.scsw.cc = 1;
+                        cdev->private->irb.scsw.fctl = SCSW_FCTL_START_FUNC;
+                        cdev->private->irb.scsw.actl = SCSW_ACTL_START_PEND;
+                        cdev->private->irb.scsw.stctl = SCSW_STCTL_STATUS_PEND;
                         cdev->private->flags.fake_irb = 0;
                         if (cdev->handler)
                                 cdev->handler(cdev, cdev->private->intparm,
@@ -562,8 +611,9 @@ ccw_device_online(struct ccw_device *cdev)
         }
         /* Do we want to do path grouping? */
         if (!cdev->private->options.pgroup) {
-                /* No, set state online immediately. */
-                ccw_device_done(cdev, DEV_STATE_ONLINE);
+                /* Start initial path verification. */
+                cdev->private->state = DEV_STATE_VERIFY;
+                ccw_device_verify_start(cdev);
                 return 0;
         }
         /* Do a SensePGID first. */
@@ -609,6 +659,7 @@ ccw_device_offline(struct ccw_device *cdev)
         /* Are we doing path grouping? */
         if (!cdev->private->options.pgroup) {
                 /* No, set state offline immediately. */
+                sch->vpm = 0;
                 ccw_device_done(cdev, DEV_STATE_OFFLINE);
                 return 0;
         }
@@ -705,8 +756,6 @@ ccw_device_online_verify(struct ccw_device *cdev, enum dev_event dev_event)
 {
         struct subchannel *sch;
 
-        if (!cdev->private->options.pgroup)
-                return;
         if (cdev->private->state == DEV_STATE_W4SENSE) {
                 cdev->private->flags.doverify = 1;
                 return;
@@ -719,6 +768,7 @@ ccw_device_online_verify(struct ccw_device *cdev, enum dev_event dev_event)
         stsch(sch->schid, &sch->schib);
 
         if (sch->schib.scsw.actl != 0 ||
+            (sch->schib.scsw.stctl & SCSW_STCTL_STATUS_PEND) ||
             (cdev->private->irb.scsw.stctl & SCSW_STCTL_STATUS_PEND)) {
                 /*
                  * No final status yet or final status not yet delivered
@@ -995,8 +1045,7 @@ static void
 ccw_device_wait4io_verify(struct ccw_device *cdev, enum dev_event dev_event)
 {
         /* When the I/O has terminated, we have to start verification. */
-        if (cdev->private->options.pgroup)
-                cdev->private->flags.doverify = 1;
+        cdev->private->flags.doverify = 1;
 }
 
 static void
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index a60124264bee..9e3de0bd59b5 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -263,6 +263,9 @@ ccw_device_wake_up(struct ccw_device *cdev, unsigned long ip, struct irb *irb)
         /* Abuse intparm for error reporting. */
         if (IS_ERR(irb))
                 cdev->private->intparm = -EIO;
+        else if (irb->scsw.cc == 1)
+                /* Retry for deferred condition code. */
+                cdev->private->intparm = -EAGAIN;
         else if ((irb->scsw.dstat !=
                   (DEV_STAT_CHN_END|DEV_STAT_DEV_END)) ||
                  (irb->scsw.cstat != 0)) {
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index 54cb64ed0786..1693a102dcfe 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -24,6 +24,21 @@
 #include "ioasm.h"
 
 /*
+ * Helper function called from interrupt context to decide whether an
+ * operation should be tried again.
+ */
+static int __ccw_device_should_retry(struct scsw *scsw)
+{
+        /* CC is only valid if start function bit is set. */
+        if ((scsw->fctl & SCSW_FCTL_START_FUNC) && scsw->cc == 1)
+                return 1;
+        /* No more activity. For sense and set PGID we stubbornly try again. */
+        if (!scsw->actl)
+                return 1;
+        return 0;
+}
+
+/*
  * Start Sense Path Group ID helper function. Used in ccw_device_recog
  * and ccw_device_sense_pgid.
  */
@@ -33,12 +48,17 @@ __ccw_device_sense_pgid_start(struct ccw_device *cdev)
         struct subchannel *sch;
         struct ccw1 *ccw;
         int ret;
+        int i;
 
         sch = to_subchannel(cdev->dev.parent);
+        /* Return if we already checked on all paths. */
+        if (cdev->private->imask == 0)
+                return (sch->lpm == 0) ? -ENODEV : -EACCES;
+        i = 8 - ffs(cdev->private->imask);
+
         /* Setup sense path group id channel program. */
         ccw = cdev->private->iccws;
         ccw->cmd_code = CCW_CMD_SENSE_PGID;
-        ccw->cda = (__u32) __pa (&cdev->private->pgid);
         ccw->count = sizeof (struct pgid);
         ccw->flags = CCW_FLAG_SLI;
 
@@ -48,6 +68,7 @@ __ccw_device_sense_pgid_start(struct ccw_device *cdev)
         ret = -ENODEV;
         while (cdev->private->imask != 0) {
                 /* Try every path multiple times. */
+                ccw->cda = (__u32) __pa (&cdev->private->pgid[i]);
                 if (cdev->private->iretry > 0) {
                         cdev->private->iretry--;
                         ret = cio_start (sch, cdev->private->iccws, 
@@ -64,7 +85,9 @@ __ccw_device_sense_pgid_start(struct ccw_device *cdev)
                 }
                 cdev->private->imask >>= 1;
                 cdev->private->iretry = 5;
+                i++;
         }
+
         return ret;
 }
 
@@ -76,7 +99,7 @@ ccw_device_sense_pgid_start(struct ccw_device *cdev)
         cdev->private->state = DEV_STATE_SENSE_PGID;
         cdev->private->imask = 0x80;
         cdev->private->iretry = 5;
-        memset (&cdev->private->pgid, 0, sizeof (struct pgid));
+        memset (&cdev->private->pgid, 0, sizeof (cdev->private->pgid));
         ret = __ccw_device_sense_pgid_start(cdev);
         if (ret && ret != -EBUSY)
                 ccw_device_sense_pgid_done(cdev, ret);
@@ -91,6 +114,7 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
 {
         struct subchannel *sch;
         struct irb *irb;
+        int i;
 
         sch = to_subchannel(cdev->dev.parent);
         irb = &cdev->private->irb;
@@ -124,7 +148,8 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
                               sch->schid.sch_no, sch->orb.lpm);
                 return -EACCES;
         }
-        if (cdev->private->pgid.inf.ps.state2 == SNID_STATE2_RESVD_ELSE) {
+        i = 8 - ffs(cdev->private->imask);
+        if (cdev->private->pgid[i].inf.ps.state2 == SNID_STATE2_RESVD_ELSE) {
                 CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x "
                               "is reserved by someone else\n",
                               cdev->private->devno, sch->schid.ssid,
@@ -145,10 +170,10 @@ ccw_device_sense_pgid_irq(struct ccw_device *cdev, enum dev_event dev_event)
         int ret;
 
         irb = (struct irb *) __LC_IRB;
-        /* Retry sense pgid for cc=1. */
+
         if (irb->scsw.stctl ==
             (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-                if (irb->scsw.cc == 1) {
+                if (__ccw_device_should_retry(&irb->scsw)) {
                         ret = __ccw_device_sense_pgid_start(cdev);
                         if (ret && ret != -EBUSY)
                                 ccw_device_sense_pgid_done(cdev, ret);
@@ -162,12 +187,6 @@ ccw_device_sense_pgid_irq(struct ccw_device *cdev, enum dev_event dev_event)
         memset(&cdev->private->irb, 0, sizeof(struct irb));
         switch (ret) {
         /* 0, -ETIME, -EOPNOTSUPP, -EAGAIN, -EACCES or -EUSERS */
-        case 0:                 /* Sense Path Group ID successful. */
-                if (cdev->private->pgid.inf.ps.state1 == SNID_STATE1_RESET)
-                        memcpy(&cdev->private->pgid, &css[0]->global_pgid,
-                               sizeof(struct pgid));
-                ccw_device_sense_pgid_done(cdev, 0);
-                break;
         case -EOPNOTSUPP:       /* Sense Path Group ID not supported */
                 ccw_device_sense_pgid_done(cdev, -EOPNOTSUPP);
                 break;
@@ -176,13 +195,15 @@ ccw_device_sense_pgid_irq(struct ccw_device *cdev, enum dev_event dev_event)
                 break;
         case -EACCES:           /* channel is not operational. */
                 sch->lpm &= ~cdev->private->imask;
+                /* Fall through. */
+        case 0:                 /* Sense Path Group ID successful. */
                 cdev->private->imask >>= 1;
                 cdev->private->iretry = 5;
                 /* Fall through. */
         case -EAGAIN:           /* Try again. */
                 ret = __ccw_device_sense_pgid_start(cdev);
                 if (ret != 0 && ret != -EBUSY)
-                        ccw_device_sense_pgid_done(cdev, -ENODEV);
+                        ccw_device_sense_pgid_done(cdev, ret);
                 break;
         case -EUSERS:           /* device is reserved for someone else. */
                 ccw_device_sense_pgid_done(cdev, -EUSERS);
@@ -203,20 +224,20 @@ __ccw_device_do_pgid(struct ccw_device *cdev, __u8 func)
         sch = to_subchannel(cdev->dev.parent);
 
         /* Setup sense path group id channel program. */
-        cdev->private->pgid.inf.fc = func;
+        cdev->private->pgid[0].inf.fc = func;
         ccw = cdev->private->iccws;
         if (!cdev->private->flags.pgid_single) {
-                cdev->private->pgid.inf.fc |= SPID_FUNC_MULTI_PATH;
+                cdev->private->pgid[0].inf.fc |= SPID_FUNC_MULTI_PATH;
                 ccw->cmd_code = CCW_CMD_SUSPEND_RECONN;
                 ccw->cda = 0;
                 ccw->count = 0;
                 ccw->flags = CCW_FLAG_SLI | CCW_FLAG_CC;
                 ccw++;
         } else
-                cdev->private->pgid.inf.fc |= SPID_FUNC_SINGLE_PATH;
+                cdev->private->pgid[0].inf.fc |= SPID_FUNC_SINGLE_PATH;
 
         ccw->cmd_code = CCW_CMD_SET_PGID;
-        ccw->cda = (__u32) __pa (&cdev->private->pgid);
+        ccw->cda = (__u32) __pa (&cdev->private->pgid[0]);
         ccw->count = sizeof (struct pgid);
         ccw->flags = CCW_FLAG_SLI;
 
@@ -244,6 +265,48 @@ __ccw_device_do_pgid(struct ccw_device *cdev, __u8 func)
 }
 
 /*
+ * Helper function to send a nop ccw down a path.
+ */
+static int __ccw_device_do_nop(struct ccw_device *cdev)
+{
+        struct subchannel *sch;
+        struct ccw1 *ccw;
+        int ret;
+
+        sch = to_subchannel(cdev->dev.parent);
+
+        /* Setup nop channel program. */
+        ccw = cdev->private->iccws;
+        ccw->cmd_code = CCW_CMD_NOOP;
+        ccw->cda = 0;
+        ccw->count = 0;
+        ccw->flags = CCW_FLAG_SLI;
+
+        /* Reset device status. */
+        memset(&cdev->private->irb, 0, sizeof(struct irb));
+
+        /* Try multiple times. */
+        ret = -ENODEV;
+        if (cdev->private->iretry > 0) {
+                cdev->private->iretry--;
+                ret = cio_start (sch, cdev->private->iccws,
+                                 cdev->private->imask);
+                /* ret is 0, -EBUSY, -EACCES or -ENODEV */
+                if ((ret != -EACCES) && (ret != -ENODEV))
+                        return ret;
+        }
+        /* nop command failed on this path. Switch it off. */
+        sch->lpm &= ~cdev->private->imask;
+        sch->vpm &= ~cdev->private->imask;
+        CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel "
+                      "0.%x.%04x, lpm %02X, became 'not operational'\n",
+                      cdev->private->devno, sch->schid.ssid,
+                      sch->schid.sch_no, cdev->private->imask);
+        return ret;
+}
+
+
+/*
  * Called from interrupt context to check if a valid answer
  * to Set Path Group ID was received.
  */
@@ -282,6 +345,29 @@ __ccw_device_check_pgid(struct ccw_device *cdev)
         return 0;
 }
 
+/*
+ * Called from interrupt context to check the path status after a nop has
+ * been send.
+ */
+static int __ccw_device_check_nop(struct ccw_device *cdev)
+{
+        struct subchannel *sch;
+        struct irb *irb;
+
+        sch = to_subchannel(cdev->dev.parent);
+        irb = &cdev->private->irb;
+        if (irb->scsw.fctl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC))
+                return -ETIME;
+        if (irb->scsw.cc == 3) {
+                CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel 0.%x.%04x,"
+                              " lpm %02X, became 'not operational'\n",
+                              cdev->private->devno, sch->schid.ssid,
+                              sch->schid.sch_no, cdev->private->imask);
+                return -EACCES;
+        }
+        return 0;
+}
+
 static void
 __ccw_device_verify_start(struct ccw_device *cdev)
 {
@@ -296,9 +382,12 @@ __ccw_device_verify_start(struct ccw_device *cdev)
                         if ((sch->vpm & imask) != (sch->lpm & imask))
                                 break;
                 cdev->private->imask = imask;
-                func = (sch->vpm & imask) ?
-                        SPID_FUNC_RESIGN : SPID_FUNC_ESTABLISH;
-                ret = __ccw_device_do_pgid(cdev, func);
+                if (cdev->private->options.pgroup) {
+                        func = (sch->vpm & imask) ?
+                                SPID_FUNC_RESIGN : SPID_FUNC_ESTABLISH;
+                        ret = __ccw_device_do_pgid(cdev, func);
+                } else
+                        ret = __ccw_device_do_nop(cdev);
                 if (ret == 0 || ret == -EBUSY)
                         return;
                 cdev->private->iretry = 5;
@@ -317,17 +406,20 @@ ccw_device_verify_irq(struct ccw_device *cdev, enum dev_event dev_event)
         int ret;
 
         irb = (struct irb *) __LC_IRB;
-        /* Retry set pgid for cc=1. */
+
         if (irb->scsw.stctl ==
             (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-                if (irb->scsw.cc == 1)
+                if (__ccw_device_should_retry(&irb->scsw))
                         __ccw_device_verify_start(cdev);
                 return;
         }
         if (ccw_device_accumulate_and_sense(cdev, irb) != 0)
                 return;
         sch = to_subchannel(cdev->dev.parent);
-        ret = __ccw_device_check_pgid(cdev);
+        if (cdev->private->options.pgroup)
+                ret = __ccw_device_check_pgid(cdev);
+        else
+                ret = __ccw_device_check_nop(cdev);
         memset(&cdev->private->irb, 0, sizeof(struct irb));
         switch (ret) {
         /* 0, -ETIME, -EAGAIN, -EOPNOTSUPP or -EACCES */
@@ -345,11 +437,10 @@ ccw_device_verify_irq(struct ccw_device *cdev, enum dev_event dev_event)
                  * One of those strange devices which claim to be able
                  * to do multipathing but not for Set Path Group ID.
                  */
-                if (cdev->private->flags.pgid_single) {
-                        ccw_device_verify_done(cdev, -EOPNOTSUPP);
-                        break;
-                }
-                cdev->private->flags.pgid_single = 1;
+                if (cdev->private->flags.pgid_single)
+                        cdev->private->options.pgroup = 0;
+                else
+                        cdev->private->flags.pgid_single = 1;
                 /* fall through. */
         case -EAGAIN:           /* Try again. */
                 __ccw_device_verify_start(cdev);
@@ -418,10 +509,10 @@ ccw_device_disband_irq(struct ccw_device *cdev, enum dev_event dev_event)
         int ret;
 
         irb = (struct irb *) __LC_IRB;
-        /* Retry set pgid for cc=1. */
+
         if (irb->scsw.stctl ==
             (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-                if (irb->scsw.cc == 1)
+                if (__ccw_device_should_retry(&irb->scsw))
                         __ccw_device_disband_start(cdev);
                 return;
         }
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 14bef2c179bf..caf148d5caad 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -67,8 +67,7 @@ ccw_device_path_notoper(struct ccw_device *cdev)
                       sch->schib.pmcw.pnom);
 
         sch->lpm &= ~sch->schib.pmcw.pnom;
-        if (cdev->private->options.pgroup)
-                cdev->private->flags.doverify = 1;
+        cdev->private->flags.doverify = 1;
 }
 
 /*
@@ -180,7 +179,7 @@ ccw_device_accumulate_esw(struct ccw_device *cdev, struct irb *irb)
         cdev_irb->esw.esw0.erw.auth = irb->esw.esw0.erw.auth;
         /* Copy path verification required flag. */
         cdev_irb->esw.esw0.erw.pvrf = irb->esw.esw0.erw.pvrf;
-        if (irb->esw.esw0.erw.pvrf && cdev->private->options.pgroup)
+        if (irb->esw.esw0.erw.pvrf)
                 cdev->private->flags.doverify = 1;
         /* Copy concurrent sense bit. */
         cdev_irb->esw.esw0.erw.cons = irb->esw.esw0.erw.cons;
@@ -354,7 +353,7 @@ ccw_device_accumulate_basic_sense(struct ccw_device *cdev, struct irb *irb)
         }
         /* Check if path verification is required. */
         if (ccw_device_accumulate_esw_valid(irb) &&
-            irb->esw.esw0.erw.pvrf && cdev->private->options.pgroup) 
+            irb->esw.esw0.erw.pvrf)
                 cdev->private->flags.doverify = 1;
 }
 
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index b70039af70d6..7c93a8798d23 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -2735,7 +2735,7 @@ qdio_free(struct ccw_device *cdev)
         QDIO_DBF_TEXT1(0,trace,dbf_text);
         QDIO_DBF_TEXT0(0,setup,dbf_text);
 
-        cdev->private->qdio_data = 0;
+        cdev->private->qdio_data = NULL;
 
         up(&irq_ptr->setting_up_sema);
 
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 548854754921..1a93fa684e9f 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -92,15 +92,6 @@ config QETH_VLAN
           If CONFIG_QETH is switched on, this option will include IEEE
           802.1q VLAN support in the qeth device driver.
 
-config QETH_PERF_STATS
-        bool "Performance statistics in /proc"
-        depends on QETH
-        help
-          When switched on, this option will add a file in the proc-fs
-          (/proc/qeth_perf_stats) containing performance statistics. It
-          may slightly impact performance, so this is only recommended for
-          internal tuning of the device driver.
-
 config CCWGROUP
         tristate
         default (LCS || CTC || QETH)
diff --git a/drivers/s390/net/Makefile b/drivers/s390/net/Makefile
index 6775a837d646..4777e36a922f 100644
--- a/drivers/s390/net/Makefile
+++ b/drivers/s390/net/Makefile
@@ -10,7 +10,6 @@ obj-$(CONFIG_SMSGIUCV) += smsgiucv.o
 obj-$(CONFIG_CTC) += ctc.o fsm.o cu3088.o
 obj-$(CONFIG_LCS) += lcs.o cu3088.o
 obj-$(CONFIG_CLAW) += claw.o cu3088.o
-obj-$(CONFIG_MPC) += ctcmpc.o fsm.o cu3088.o
 qeth-y := qeth_main.o qeth_mpc.o qeth_sys.o qeth_eddp.o 
 qeth-$(CONFIG_PROC_FS) += qeth_proc.o
 obj-$(CONFIG_QETH) += qeth.o
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index 23d53bf9daf1..95f4e105cb96 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -529,7 +529,7 @@ claw_open(struct net_device *dev)
         printk(KERN_INFO "%s:%s Enter  \n",dev->name,__FUNCTION__);
 #endif
         CLAW_DBF_TEXT(4,trace,"open");
-        if (!dev | (dev->name[0] == 0x00)) {
+        if (!dev || (dev->name[0] == 0x00)) {
                 CLAW_DBF_TEXT(2,trace,"BadDev");
                 printk(KERN_WARNING "claw: Bad device at open failing \n");
                 return -ENODEV;
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 20c8eb16f464..3257c22dd79c 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -1714,6 +1714,9 @@ add_channel(struct ccw_device *cdev, enum channel_types type)
                 kfree(ch);
                 return 0;
         }
+
+        spin_lock_init(&ch->collect_lock);
+
         fsm_settimer(ch->fsm, &ch->timer);
         skb_queue_head_init(&ch->io_queue);
         skb_queue_head_init(&ch->collect_queue);
@@ -2686,9 +2689,17 @@ static struct attribute_group ctc_attr_group = {
 static int
 ctc_add_attributes(struct device *dev)
 {
-        device_create_file(dev, &dev_attr_loglevel);
-        device_create_file(dev, &dev_attr_stats);
-        return 0;
+        int rc;
+
+        rc = device_create_file(dev, &dev_attr_loglevel);
+        if (rc)
+                goto out;
+        rc = device_create_file(dev, &dev_attr_stats);
+        if (!rc)
+                goto out;
+        device_remove_file(dev, &dev_attr_loglevel);
+out:
+        return rc;
 }
 
 static void
@@ -2901,7 +2912,12 @@ ctc_new_device(struct ccwgroup_device *cgdev)
                 goto out;
         }
 
-        ctc_add_attributes(&cgdev->dev);
+        if (ctc_add_attributes(&cgdev->dev)) {
+                ctc_netdev_unregister(dev);
+                dev->priv = NULL;
+                ctc_free_netdevice(dev, 1);
+                goto out;
+        }
 
         strlcpy(privptr->fsm->name, dev->name, sizeof (privptr->fsm->name));
 
diff --git a/drivers/s390/net/iucv.c b/drivers/s390/net/iucv.c
index 189a49275433..821dde86e240 100644
--- a/drivers/s390/net/iucv.c
+++ b/drivers/s390/net/iucv.c
@@ -335,8 +335,8 @@ do { \
 
 #else
 
-#define iucv_debug(lvl, fmt, args...)
-#define iucv_dumpit(title, buf, len)
+#define iucv_debug(lvl, fmt, args...)   do { } while (0)
+#define iucv_dumpit(title, buf, len)    do { } while (0)
 
 #endif
 
@@ -692,7 +692,7 @@ iucv_retrieve_buffer (void)
         iucv_debug(1, "entering");
         if (iucv_cpuid != -1) {
                 smp_call_function_on(iucv_retrieve_buffer_cpuid,
-                                     0, 0, 1, iucv_cpuid);
+                                     NULL, 0, 1, iucv_cpuid);
                 /* Release the cpu reserved by iucv_declare_buffer. */
                 smp_put_cpu(iucv_cpuid);
                 iucv_cpuid = -1;
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 2eded55ae88d..16ac68c27a27 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -670,9 +670,8 @@ lcs_ready_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         int index, rc;
 
         LCS_DBF_TEXT(5, trace, "rdybuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
+               buffer->state != BUF_STATE_PROCESSED);
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
         buffer->state = BUF_STATE_READY;
         index = buffer - channel->iob;
@@ -696,8 +695,7 @@ __lcs_processed_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         int index, prev, next;
 
         LCS_DBF_TEXT(5, trace, "prcsbuff");
-        if (buffer->state != BUF_STATE_READY)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_READY);
         buffer->state = BUF_STATE_PROCESSED;
         index = buffer - channel->iob;
         prev = (index - 1) & (LCS_NUM_BUFFS - 1);
@@ -729,9 +727,8 @@ lcs_release_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         unsigned long flags;
 
         LCS_DBF_TEXT(5, trace, "relbuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
+               buffer->state != BUF_STATE_PROCESSED);
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
         buffer->state = BUF_STATE_EMPTY;
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index b452cc1afd55..d7d1cc0a5c8e 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -112,7 +112,12 @@ struct iucv_connection {
 /**
  * Linked list of all connection structs.
  */
-static struct iucv_connection *iucv_connections;
+struct iucv_connection_struct {
+        struct iucv_connection *iucv_connections;
+        rwlock_t iucv_rwlock;
+};
+
+static struct iucv_connection_struct iucv_conns;
 
 /**
  * Representation of event-data for the
@@ -1368,8 +1373,10 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
         struct net_device *ndev = priv->conn->netdev;
         char    *p;
         char    *tmp;
-        char    username[10];
+        char    username[9];
         int     i;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
 
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
         if (count>9) {
@@ -1382,7 +1389,7 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
         tmp = strsep((char **) &buf, "\n");
         for (i=0, p=tmp; i<8 && *p; i++, p++) {
                 if (isalnum(*p) || (*p == '$'))
-                        username[i]= *p;
+                        username[i]= toupper(*p);
                 else if (*p == '\n') {
                         /* trailing lf, grr */
                         break;
@@ -1395,11 +1402,11 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
                         return -EINVAL;
                 }
         }
-        while (i<9)
+        while (i<8)
                 username[i++] = ' ';
-        username[9] = '\0';
+        username[8] = '\0';
 
-        if (memcmp(username, priv->conn->userid, 8)) {
+        if (memcmp(username, priv->conn->userid, 9)) {
                 /* username changed */
                 if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
                         PRINT_WARN(
@@ -1410,6 +1417,19 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
                         return -EBUSY;
                 }
         }
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
+        while (*clist) {
+                if (!strncmp(username, (*clist)->userid, 9) ||
+                    ((*clist)->netdev != ndev))
+                        break;
+                clist = &((*clist)->next);
+        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
+        if (*clist) {
+                PRINT_WARN("netiucv: Connection to %s already exists\n",
+                        username);
+                return -EEXIST;
+        }
         memcpy(priv->conn->userid, username, 9);
 
         return count;
@@ -1781,13 +1801,15 @@ netiucv_unregister_device(struct device *dev)
 static struct iucv_connection *
 netiucv_new_connection(struct net_device *dev, char *username)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        unsigned long flags;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
         struct iucv_connection *conn =
                 kzalloc(sizeof(struct iucv_connection), GFP_KERNEL);
 
         if (conn) {
                 skb_queue_head_init(&conn->collect_queue);
                 skb_queue_head_init(&conn->commit_queue);
+                spin_lock_init(&conn->collect_lock);
                 conn->max_buffsize = NETIUCV_BUFSIZE_DEFAULT;
                 conn->netdev = dev;
 
@@ -1822,8 +1844,10 @@ netiucv_new_connection(struct net_device *dev, char *username)
                         fsm_newstate(conn->fsm, CONN_STATE_STOPPED);
                 }
 
+                write_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
                 conn->next = *clist;
                 *clist = conn;
+                write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
         }
         return conn;
 }
@@ -1835,14 +1859,17 @@ netiucv_new_connection(struct net_device *dev, char *username)
 static void
 netiucv_remove_connection(struct iucv_connection *conn)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
 
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
         if (conn == NULL)
                 return;
+        write_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
         while (*clist) {
                 if (*clist == conn) {
                         *clist = conn->next;
+                        write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
                         if (conn->handle) {
                                 iucv_unregister_program(conn->handle);
                                 conn->handle = NULL;
@@ -1855,6 +1882,7 @@ netiucv_remove_connection(struct iucv_connection *conn)
                 }
                 clist = &((*clist)->next);
         }
+        write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
 }
 
 /**
@@ -1947,9 +1975,11 @@ static ssize_t
 conn_write(struct device_driver *drv, const char *buf, size_t count)
 {
         char *p;
-        char username[10];
+        char username[9];
         int i, ret;
         struct net_device *dev;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
 
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
         if (count>9) {
@@ -1960,7 +1990,7 @@ conn_write(struct device_driver *drv, const char *buf, size_t count)
 
         for (i=0, p=(char *)buf; i<8 && *p; i++, p++) {
                 if (isalnum(*p) || (*p == '$'))
-                        username[i]= *p;
+                        username[i]= toupper(*p);
                 else if (*p == '\n') {
                         /* trailing lf, grr */
                         break;
@@ -1971,9 +2001,22 @@ conn_write(struct device_driver *drv, const char *buf, size_t count)
                         return -EINVAL;
                 }
         }
-        while (i<9)
+        while (i<8)
                 username[i++] = ' ';
-        username[9] = '\0';
+        username[8] = '\0';
+
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
+        while (*clist) {
+                if (!strncmp(username, (*clist)->userid, 9))
+                        break;
+                clist = &((*clist)->next);
+        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
+        if (*clist) {
+                PRINT_WARN("netiucv: Connection to %s already exists\n",
+                        username);
+                return -EEXIST;
+        }
         dev = netiucv_init_netdevice(username);
         if (!dev) {
                 PRINT_WARN(
@@ -2015,7 +2058,8 @@ DRIVER_ATTR(connection, 0200, NULL, conn_write);
 static ssize_t
 remove_write (struct device_driver *drv, const char *buf, size_t count)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
         struct net_device *ndev;
         struct netiucv_priv *priv;
         struct device *dev;
@@ -2026,10 +2070,10 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
         if (count >= IFNAMSIZ)
-                count = IFNAMSIZ-1;
+                count = IFNAMSIZ - 1;;
 
         for (i=0, p=(char *)buf; i<count && *p; i++, p++) {
-                if ((*p == '\n') | (*p == ' ')) {
+                if ((*p == '\n') || (*p == ' ')) {
                         /* trailing lf, grr */
                         break;
                 } else {
@@ -2038,6 +2082,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
         }
         name[i] = '\0';
 
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
         while (*clist) {
                 ndev = (*clist)->netdev;
                 priv = (struct netiucv_priv*)ndev->priv;
@@ -2047,6 +2092,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
                         clist = &((*clist)->next);
                         continue;
                 }
+                read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
                 if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
                         PRINT_WARN(
                                 "netiucv: net device %s active with peer %s\n",
@@ -2060,6 +2106,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
                 netiucv_unregister_device(dev);
                 return count;
         }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
         PRINT_WARN("netiucv: net device %s unknown\n", name);
         IUCV_DBF_TEXT(data, 2, "remove_write: unknown device\n");
         return -EINVAL;
@@ -2077,8 +2124,8 @@ static void __exit
 netiucv_exit(void)
 {
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
-        while (iucv_connections) {
-                struct net_device *ndev = iucv_connections->netdev;
+        while (iucv_conns.iucv_connections) {
+                struct net_device *ndev = iucv_conns.iucv_connections->netdev;
                 struct netiucv_priv *priv = (struct netiucv_priv*)ndev->priv;
                 struct device *dev = priv->dev;
 
@@ -2120,6 +2167,7 @@ netiucv_init(void)
         if (!ret) {
                 ret = driver_create_file(&netiucv_driver, &driver_attr_remove);
                 netiucv_banner();
+                rwlock_init(&iucv_conns.iucv_rwlock);
         } else {
                 PRINT_ERR("NETIUCV: failed to add driver attribute.\n");
                 IUCV_DBF_TEXT_(setup, 2, "ret %d from driver_create_file\n", ret);
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 619f4a0c7160..821383d8cbe7 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -176,7 +176,6 @@ extern struct ccwgroup_driver qeth_ccwgroup_driver;
 /**
  * card stuff
  */
-#ifdef CONFIG_QETH_PERF_STATS
 struct qeth_perf_stats {
         unsigned int bufs_rec;
         unsigned int bufs_sent;
@@ -211,8 +210,10 @@ struct qeth_perf_stats {
         unsigned int large_send_cnt;
         unsigned int sg_skbs_sent;
         unsigned int sg_frags_sent;
+        /* initial values when measuring starts */
+        unsigned long initial_rx_packets;
+        unsigned long initial_tx_packets;
 };
-#endif /* CONFIG_QETH_PERF_STATS */
 
 /* Routing stuff */
 struct qeth_routing_info {
@@ -462,6 +463,7 @@ enum qeth_qdio_info_states {
         QETH_QDIO_UNINITIALIZED,
         QETH_QDIO_ALLOCATED,
         QETH_QDIO_ESTABLISHED,
+        QETH_QDIO_CLEANING
 };
 
 struct qeth_buffer_pool_entry {
@@ -536,7 +538,7 @@ struct qeth_qdio_out_q {
 } __attribute__ ((aligned(256)));
 
 struct qeth_qdio_info {
-        volatile enum qeth_qdio_info_states state;
+        atomic_t state;
         /* input */
         struct qeth_qdio_q *in_q;
         struct qeth_qdio_buffer_pool in_buf_pool;
@@ -767,6 +769,7 @@ struct qeth_card_options {
         int fake_ll;
         int layer2;
         enum qeth_large_send_types large_send;
+        int performance_stats;
 };
 
 /*
@@ -819,9 +822,7 @@ struct qeth_card {
         struct list_head cmd_waiter_list;
         /* QDIO buffer handling */
         struct qeth_qdio_info qdio;
-#ifdef CONFIG_QETH_PERF_STATS
         struct qeth_perf_stats perf_stats;
-#endif /* CONFIG_QETH_PERF_STATS */
         int use_hard_stop;
         int (*orig_hard_header)(struct sk_buff *,struct net_device *,
                                 unsigned short,void *,void *,unsigned);
@@ -859,23 +860,18 @@ qeth_get_ipa_adp_type(enum qeth_link_types link_type)
         }
 }
 
-static inline int
-qeth_realloc_headroom(struct qeth_card *card, struct sk_buff **skb, int size)
+static inline struct sk_buff *
+qeth_realloc_headroom(struct qeth_card *card, struct sk_buff *skb, int size)
 {
-        struct sk_buff *new_skb = NULL;
-
-        if (skb_headroom(*skb) < size){
-                new_skb = skb_realloc_headroom(*skb, size);
-                if (!new_skb) {
-                        PRINT_ERR("qeth_prepare_skb: could "
-                                  "not realloc headroom for qeth_hdr "
-                                  "on interface %s", QETH_CARD_IFNAME(card));
-                        return -ENOMEM;
-                }
-                kfree_skb(*skb);
-                *skb = new_skb;
-        }
-        return 0;
+        struct sk_buff *new_skb = skb;
+
+        if (skb_headroom(skb) >= size)
+                return skb;
+        new_skb = skb_realloc_headroom(skb, size);
+        if (!new_skb) 
+                PRINT_ERR("Could not realloc headroom for qeth_hdr "
+                          "on interface %s", QETH_CARD_IFNAME(card));
+        return new_skb;
 }
 
 static inline struct sk_buff *
@@ -885,16 +881,15 @@ qeth_pskb_unshare(struct sk_buff *skb, int pri)
         if (!skb_cloned(skb))
                 return skb;
         nskb = skb_copy(skb, pri);
-        kfree_skb(skb); /* free our shared copy */
         return nskb;
 }
 
 static inline void *
-qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
+qeth_push_skb(struct qeth_card *card, struct sk_buff *skb, int size)
 {
         void *hdr;
 
-        hdr = (void *) skb_push(*skb, size);
+        hdr = (void *) skb_push(skb, size);
         /*
          * sanity check, the Linux memory allocation scheme should
          * never present us cases like this one (the qdio header size plus
@@ -903,8 +898,7 @@ qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
         if ((((unsigned long) hdr) & (~(PAGE_SIZE - 1))) !=
             (((unsigned long) hdr + size +
               QETH_IP_HEADER_SIZE) & (~(PAGE_SIZE - 1)))) {
-                PRINT_ERR("qeth_prepare_skb: misaligned "
-                          "packet on interface %s. Discarded.",
+                PRINT_ERR("Misaligned packet on interface %s. Discarded.",
                           QETH_CARD_IFNAME(card));
                 return NULL;
         }
@@ -1056,13 +1050,11 @@ qeth_get_arphdr_type(int cardtype, int linktype)
         }
 }
 
-#ifdef CONFIG_QETH_PERF_STATS
 static inline int
 qeth_get_micros(void)
 {
         return (int) (get_clock() >> 12);
 }
-#endif
 
 static inline int
 qeth_get_qdio_q_format(struct qeth_card *card)
@@ -1096,10 +1088,11 @@ qeth_string_to_ipaddr4(const char *buf, __u8 *addr)
 {
         int count = 0, rc = 0;
         int in[4];
+        char c;
 
-        rc = sscanf(buf, "%d.%d.%d.%d%n",
-                    &in[0], &in[1], &in[2], &in[3], &count);
-        if (rc != 4  || count<=0)
+        rc = sscanf(buf, "%u.%u.%u.%u%c",
+                    &in[0], &in[1], &in[2], &in[3], &c);
+        if (rc != 4 && (rc != 5 || c != '\n'))
                 return -EINVAL;
         for (count = 0; count < 4; count++) {
                 if (in[count] > 255)
@@ -1123,24 +1116,28 @@ qeth_ipaddr6_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
 {
-        char *end, *start;
+        const char *end, *end_tmp, *start;
         __u16 *in;
         char num[5];
         int num2, cnt, out, found, save_cnt;
         unsigned short in_tmp[8] = {0, };
 
         cnt = out = found = save_cnt = num2 = 0;
-        end = start = (char *) buf;
+        end = start = buf;
         in = (__u16 *) addr;
         memset(in, 0, 16);
-        while (end) {
-                end = strchr(end,':');
+        while (*end) {
+                end = strchr(start,':');
                 if (end == NULL) {
-                        end = (char *)buf + (strlen(buf));
-                        out = 1;
+                        end = buf + strlen(buf);
+                        if ((end_tmp = strchr(start, '\n')) != NULL)
+                                end = end_tmp;
+                        out = 1;
                 }
                 if ((end - start)) {
                         memset(num, 0, 5);
+                        if ((end - start) > 4)
+                                return -EINVAL;
                         memcpy(num, start, end - start);
                         if (!qeth_isxdigit(num))
                                 return -EINVAL;
@@ -1158,6 +1155,8 @@ qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
                 }
                 start = ++end;
         }
+        if (cnt + save_cnt > 8)
+                return -EINVAL;
         cnt = 7;
         while (save_cnt)
                 in[cnt--] = in_tmp[--save_cnt];
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index 8491598f9149..a363721cf28d 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -179,9 +179,8 @@ out_check:
                         flush_cnt++;
                 }
         } else {
-#ifdef CONFIG_QETH_PERF_STATS
-                queue->card->perf_stats.skbs_sent_pack++;
-#endif
+                if (queue->card->options.performance_stats)
+                        queue->card->perf_stats.skbs_sent_pack++;
                 QETH_DBF_TEXT(trace, 6, "fillbfpa");
                 if (buf->next_element_to_fill >=
                                 QETH_MAX_BUFFER_ELEMENTS(queue->card)) {
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 36733b9823c6..5613b4564fa2 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -84,6 +84,8 @@ static debug_info_t *qeth_dbf_qerr = NULL;
 
 DEFINE_PER_CPU(char[256], qeth_dbf_txt_buf);
 
+static struct lock_class_key qdio_out_skb_queue_key;
+
 /**
  * some more definitions and declarations
  */
@@ -1071,6 +1073,7 @@ qeth_set_intial_options(struct qeth_card *card)
                 card->options.layer2 = 1;
         else
                 card->options.layer2 = 0;
+        card->options.performance_stats = 1;
 }
 
 /**
@@ -1706,6 +1709,7 @@ qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
                                            "IP address reset.\n",
                                            QETH_CARD_IFNAME(card),
                                            card->info.chpid);
+                                netif_carrier_on(card->dev);
                                 qeth_schedule_recovery(card);
                                 return NULL;
                         case IPA_CMD_MODCCID:
@@ -2462,24 +2466,6 @@ qeth_rebuild_skb_fake_ll(struct qeth_card *card, struct sk_buff *skb,
                 qeth_rebuild_skb_fake_ll_eth(card, skb, hdr);
 }
 
-static inline void
-qeth_rebuild_skb_vlan(struct qeth_card *card, struct sk_buff *skb,
-                      struct qeth_hdr *hdr)
-{
-#ifdef CONFIG_QETH_VLAN
-        u16 *vlan_tag;
-
-        if (hdr->hdr.l3.ext_flags &
-            (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
-                vlan_tag = (u16 *) skb_push(skb, VLAN_HLEN);
-                *vlan_tag = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
-                        hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
-                *(vlan_tag + 1) = skb->protocol;
-                skb->protocol = __constant_htons(ETH_P_8021Q);
-        }
-#endif /* CONFIG_QETH_VLAN */
-}
-
 static inline __u16
 qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                         struct qeth_hdr *hdr)
@@ -2508,15 +2494,16 @@ qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
         return vlan_id;
 }
 
-static inline void
+static inline __u16
 qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                  struct qeth_hdr *hdr)
 {
+        unsigned short vlan_id = 0;
 #ifdef CONFIG_QETH_IPV6
         if (hdr->hdr.l3.flags & QETH_HDR_PASSTHRU) {
                 skb->pkt_type = PACKET_HOST;
                 skb->protocol = qeth_type_trans(skb, card->dev);
-                return;
+                return 0;
         }
 #endif /* CONFIG_QETH_IPV6 */
         skb->protocol = htons((hdr->hdr.l3.flags & QETH_HDR_IPV6)? ETH_P_IPV6 :
@@ -2538,7 +2525,13 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
         default:
                 skb->pkt_type = PACKET_HOST;
         }
-        qeth_rebuild_skb_vlan(card, skb, hdr);
+
+        if (hdr->hdr.l3.ext_flags &
+            (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
+                vlan_id = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
+                        hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
+        }
+
         if (card->options.fake_ll)
                 qeth_rebuild_skb_fake_ll(card, skb, hdr);
         else
@@ -2554,6 +2547,7 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                 else
                         skb->ip_summed = SW_CHECKSUMMING;
         }
+        return vlan_id;
 }
 
 static inline void
@@ -2566,20 +2560,20 @@ qeth_process_inbound_buffer(struct qeth_card *card,
         int offset;
         int rxrc;
         __u16 vlan_tag = 0;
+        __u16 *vlan_addr;
 
         /* get first element of current buffer */
         element = (struct qdio_buffer_element *)&buf->buffer->element[0];
         offset = 0;
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.bufs_rec++;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.bufs_rec++;
         while((skb = qeth_get_next_skb(card, buf->buffer, &element,
                                        &offset, &hdr))) {
                 skb->dev = card->dev;
                 if (hdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2)
                         vlan_tag = qeth_layer2_rebuild_skb(card, skb, hdr);
                 else if (hdr->hdr.l3.id == QETH_HEADER_TYPE_LAYER3)
-                        qeth_rebuild_skb(card, skb, hdr);
+                        vlan_tag = qeth_rebuild_skb(card, skb, hdr);
                 else { /*in case of OSN*/
                         skb_push(skb, sizeof(struct qeth_hdr));
                         memcpy(skb->data, hdr, sizeof(struct qeth_hdr));
@@ -2589,14 +2583,19 @@ qeth_process_inbound_buffer(struct qeth_card *card,
                         dev_kfree_skb_any(skb);
                         continue;
                 }
+                if (card->info.type == QETH_CARD_TYPE_OSN)
+                        rxrc = card->osn_info.data_cb(skb);
+                else
 #ifdef CONFIG_QETH_VLAN
                 if (vlan_tag)
-                        vlan_hwaccel_rx(skb, card->vlangrp, vlan_tag);
+                        if (card->vlangrp)
+                                vlan_hwaccel_rx(skb, card->vlangrp, vlan_tag);
+                        else {
+                                dev_kfree_skb_any(skb);
+                                continue;
+                        }
                 else
 #endif
-                if (card->info.type == QETH_CARD_TYPE_OSN)
-                        rxrc = card->osn_info.data_cb(skb);
-                else
                         rxrc = netif_rx(skb);
                 card->dev->last_rx = jiffies;
                 card->stats.rx_packets++;
@@ -2624,7 +2623,7 @@ qeth_init_input_buffer(struct qeth_card *card, struct qeth_qdio_buffer *buf)
 {
         struct qeth_buffer_pool_entry *pool_entry;
         int i;
-
+ 
         pool_entry = qeth_get_buffer_pool_entry(card);
         /*
          * since the buffer is accessed only from the input_tasklet
@@ -2698,17 +2697,18 @@ qeth_queue_input_buffer(struct qeth_card *card, int index)
                  * 'index') un-requeued -> this buffer is the first buffer that
                  * will be requeued the next time
                  */
-#ifdef CONFIG_QETH_PERF_STATS
-                card->perf_stats.inbound_do_qdio_cnt++;
-                card->perf_stats.inbound_do_qdio_start_time = qeth_get_micros();
-#endif
+                if (card->options.performance_stats) {
+                        card->perf_stats.inbound_do_qdio_cnt++;
+                        card->perf_stats.inbound_do_qdio_start_time =
+                                qeth_get_micros();
+                }
                 rc = do_QDIO(CARD_DDEV(card),
                              QDIO_FLAG_SYNC_INPUT | QDIO_FLAG_UNDER_INTERRUPT,
                              0, queue->next_buf_to_init, count, NULL);
-#ifdef CONFIG_QETH_PERF_STATS
-                card->perf_stats.inbound_do_qdio_time += qeth_get_micros() -
-                        card->perf_stats.inbound_do_qdio_start_time;
-#endif
+                if (card->options.performance_stats)
+                        card->perf_stats.inbound_do_qdio_time +=
+                                qeth_get_micros() -
+                                card->perf_stats.inbound_do_qdio_start_time;
                 if (rc){
                         PRINT_WARN("qeth_queue_input_buffer's do_QDIO "
                                    "return %i (device %s).\n",
@@ -2744,10 +2744,10 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
         QETH_DBF_TEXT(trace, 6, "qdinput");
         card = (struct qeth_card *) card_ptr;
         net_dev = card->dev;
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.inbound_cnt++;
-        card->perf_stats.inbound_start_time = qeth_get_micros();
-#endif
+        if (card->options.performance_stats) {
+                card->perf_stats.inbound_cnt++;
+                card->perf_stats.inbound_start_time = qeth_get_micros();
+        }
         if (status & QDIO_STATUS_LOOK_FOR_ERROR) {
                 if (status & QDIO_STATUS_ACTIVATE_CHECK_CONDITION){
                         QETH_DBF_TEXT(trace, 1,"qdinchk");
@@ -2769,10 +2769,9 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
                 qeth_put_buffer_pool_entry(card, buffer->pool_entry);
                 qeth_queue_input_buffer(card, index);
         }
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.inbound_time += qeth_get_micros() -
-                card->perf_stats.inbound_start_time;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.inbound_time += qeth_get_micros() -
+                        card->perf_stats.inbound_start_time;
 }
 
 static inline int
@@ -2862,10 +2861,11 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
         }
 
         queue->card->dev->trans_start = jiffies;
-#ifdef CONFIG_QETH_PERF_STATS
-        queue->card->perf_stats.outbound_do_qdio_cnt++;
-        queue->card->perf_stats.outbound_do_qdio_start_time = qeth_get_micros();
-#endif
+        if (queue->card->options.performance_stats) {
+                queue->card->perf_stats.outbound_do_qdio_cnt++;
+                queue->card->perf_stats.outbound_do_qdio_start_time =
+                        qeth_get_micros();
+        }
         if (under_int)
                 rc = do_QDIO(CARD_DDEV(queue->card),
                              QDIO_FLAG_SYNC_OUTPUT | QDIO_FLAG_UNDER_INTERRUPT,
@@ -2873,10 +2873,10 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
         else
                 rc = do_QDIO(CARD_DDEV(queue->card), QDIO_FLAG_SYNC_OUTPUT,
                              queue->queue_no, index, count, NULL);
-#ifdef CONFIG_QETH_PERF_STATS
-        queue->card->perf_stats.outbound_do_qdio_time += qeth_get_micros() -
-                queue->card->perf_stats.outbound_do_qdio_start_time;
-#endif
+        if (queue->card->options.performance_stats)
+                queue->card->perf_stats.outbound_do_qdio_time +=
+                        qeth_get_micros() -
+                        queue->card->perf_stats.outbound_do_qdio_start_time;
         if (rc){
                 QETH_DBF_TEXT(trace, 2, "flushbuf");
                 QETH_DBF_TEXT_(trace, 2, " err%d", rc);
@@ -2888,9 +2888,8 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
                 return;
         }
         atomic_add(count, &queue->used_buffers);
-#ifdef CONFIG_QETH_PERF_STATS
-        queue->card->perf_stats.bufs_sent += count;
-#endif
+        if (queue->card->options.performance_stats)
+                queue->card->perf_stats.bufs_sent += count;
 }
 
 /*
@@ -2905,9 +2904,8 @@ qeth_switch_to_packing_if_needed(struct qeth_qdio_out_q *queue)
                     >= QETH_HIGH_WATERMARK_PACK){
                         /* switch non-PACKING -> PACKING */
                         QETH_DBF_TEXT(trace, 6, "np->pack");
-#ifdef CONFIG_QETH_PERF_STATS
-                        queue->card->perf_stats.sc_dp_p++;
-#endif
+                        if (queue->card->options.performance_stats)
+                                queue->card->perf_stats.sc_dp_p++;
                         queue->do_pack = 1;
                 }
         }
@@ -2930,9 +2928,8 @@ qeth_switch_to_nonpacking_if_needed(struct qeth_qdio_out_q *queue)
                     <= QETH_LOW_WATERMARK_PACK) {
                         /* switch PACKING -> non-PACKING */
                         QETH_DBF_TEXT(trace, 6, "pack->np");
-#ifdef CONFIG_QETH_PERF_STATS
-                        queue->card->perf_stats.sc_p_dp++;
-#endif
+                        if (queue->card->options.performance_stats)
+                                queue->card->perf_stats.sc_p_dp++;
                         queue->do_pack = 0;
                         /* flush packing buffers */
                         buffer = &queue->bufs[queue->next_buf_to_fill];
@@ -2944,7 +2941,7 @@ qeth_switch_to_nonpacking_if_needed(struct qeth_qdio_out_q *queue)
                                 queue->next_buf_to_fill =
                                         (queue->next_buf_to_fill + 1) %
                                         QDIO_MAX_BUFFERS_PER_Q;
-                        }
+                        }
                 }
         }
         return flush_count;
@@ -3000,11 +2997,10 @@ qeth_check_outbound_queue(struct qeth_qdio_out_q *queue)
                             !atomic_read(&queue->set_pci_flags_count))
                                 flush_cnt +=
                                         qeth_flush_buffers_on_no_pci(queue);
-#ifdef CONFIG_QETH_PERF_STATS
-                        if (q_was_packing)
+                        if (queue->card->options.performance_stats &&
+                            q_was_packing)
                                 queue->card->perf_stats.bufs_sent_pack +=
                                         flush_cnt;
-#endif
                         if (flush_cnt)
                                 qeth_flush_buffers(queue, 1, index, flush_cnt);
                         atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
@@ -3034,10 +3030,11 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
                         return;
                 }
         }
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_handler_cnt++;
-        card->perf_stats.outbound_handler_start_time = qeth_get_micros();
-#endif
+        if (card->options.performance_stats) {
+                card->perf_stats.outbound_handler_cnt++;
+                card->perf_stats.outbound_handler_start_time =
+                        qeth_get_micros();
+        }
         for(i = first_element; i < (first_element + count); ++i){
                 buffer = &queue->bufs[i % QDIO_MAX_BUFFERS_PER_Q];
                 /*we only handle the KICK_IT error by doing a recovery */
@@ -3056,10 +3053,9 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
                 qeth_check_outbound_queue(queue);
 
         netif_wake_queue(queue->card->dev);
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_handler_time += qeth_get_micros() -
-                card->perf_stats.outbound_handler_start_time;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.outbound_handler_time += qeth_get_micros() -
+                        card->perf_stats.outbound_handler_start_time;
 }
 
 static void
@@ -3183,13 +3179,14 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
 
         QETH_DBF_TEXT(setup, 2, "allcqdbf");
 
-        if (card->qdio.state == QETH_QDIO_ALLOCATED)
+        if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_UNINITIALIZED,
+                QETH_QDIO_ALLOCATED) != QETH_QDIO_UNINITIALIZED)
                 return 0;
 
         card->qdio.in_q = kmalloc(sizeof(struct qeth_qdio_q),
                                   GFP_KERNEL|GFP_DMA);
         if (!card->qdio.in_q)
-                return - ENOMEM;
+                goto out_nomem;
         QETH_DBF_TEXT(setup, 2, "inq");
         QETH_DBF_HEX(setup, 2, &card->qdio.in_q, sizeof(void *));
         memset(card->qdio.in_q, 0, sizeof(struct qeth_qdio_q));
@@ -3198,27 +3195,19 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
                 card->qdio.in_q->bufs[i].buffer =
                         &card->qdio.in_q->qdio_bufs[i];
         /* inbound buffer pool */
-        if (qeth_alloc_buffer_pool(card)){
-                kfree(card->qdio.in_q);
-                return -ENOMEM;
-        }
+        if (qeth_alloc_buffer_pool(card))
+                goto out_freeinq;
         /* outbound */
         card->qdio.out_qs =
                 kmalloc(card->qdio.no_out_queues *
                         sizeof(struct qeth_qdio_out_q *), GFP_KERNEL);
-        if (!card->qdio.out_qs){
-                qeth_free_buffer_pool(card);
-                return -ENOMEM;
-        }
-        for (i = 0; i < card->qdio.no_out_queues; ++i){
+        if (!card->qdio.out_qs)
+                goto out_freepool;
+        for (i = 0; i < card->qdio.no_out_queues; ++i) {
                 card->qdio.out_qs[i] = kmalloc(sizeof(struct qeth_qdio_out_q),
                                                GFP_KERNEL|GFP_DMA);
-                if (!card->qdio.out_qs[i]){
-                        while (i > 0)
-                                kfree(card->qdio.out_qs[--i]);
-                        kfree(card->qdio.out_qs);
-                        return -ENOMEM;
-                }
+                if (!card->qdio.out_qs[i])
+                        goto out_freeoutq;
                 QETH_DBF_TEXT_(setup, 2, "outq %i", i);
                 QETH_DBF_HEX(setup, 2, &card->qdio.out_qs[i], sizeof(void *));
                 memset(card->qdio.out_qs[i], 0, sizeof(struct qeth_qdio_out_q));
@@ -3229,11 +3218,25 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
                                 &card->qdio.out_qs[i]->qdio_bufs[j];
                         skb_queue_head_init(&card->qdio.out_qs[i]->bufs[j].
                                             skb_list);
+                        lockdep_set_class(
+                                &card->qdio.out_qs[i]->bufs[j].skb_list.lock,
+                                &qdio_out_skb_queue_key);
                         INIT_LIST_HEAD(&card->qdio.out_qs[i]->bufs[j].ctx_list);
                 }
         }
-        card->qdio.state = QETH_QDIO_ALLOCATED;
         return 0;
+
+out_freeoutq:
+        while (i > 0)
+                kfree(card->qdio.out_qs[--i]);
+        kfree(card->qdio.out_qs);
+out_freepool:
+        qeth_free_buffer_pool(card);
+out_freeinq:
+        kfree(card->qdio.in_q);
+out_nomem:
+        atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
+        return -ENOMEM;
 }
 
 static void
@@ -3242,7 +3245,8 @@ qeth_free_qdio_buffers(struct qeth_card *card)
         int i, j;
 
         QETH_DBF_TEXT(trace, 2, "freeqdbf");
-        if (card->qdio.state == QETH_QDIO_UNINITIALIZED)
+        if (atomic_swap(&card->qdio.state, QETH_QDIO_UNINITIALIZED) ==
+                QETH_QDIO_UNINITIALIZED)
                 return;
         kfree(card->qdio.in_q);
         /* inbound buffer pool */
@@ -3255,7 +3259,6 @@ qeth_free_qdio_buffers(struct qeth_card *card)
                 kfree(card->qdio.out_qs[i]);
         }
         kfree(card->qdio.out_qs);
-        card->qdio.state = QETH_QDIO_UNINITIALIZED;
 }
 
 static void
@@ -3277,7 +3280,7 @@ static void
 qeth_init_qdio_info(struct qeth_card *card)
 {
         QETH_DBF_TEXT(setup, 4, "intqdinf");
-        card->qdio.state = QETH_QDIO_UNINITIALIZED;
+        atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
         /* inbound */
         card->qdio.in_buf_size = QETH_IN_BUF_SIZE_DEFAULT;
         card->qdio.init_pool.buf_count = QETH_IN_BUF_COUNT_DEFAULT;
@@ -3340,7 +3343,7 @@ qeth_qdio_establish(struct qeth_card *card)
         struct qdio_buffer **in_sbal_ptrs;
         struct qdio_buffer **out_sbal_ptrs;
         int i, j, k;
-        int rc;
+        int rc = 0;
 
         QETH_DBF_TEXT(setup, 2, "qdioest");
 
@@ -3399,8 +3402,10 @@ qeth_qdio_establish(struct qeth_card *card)
         init_data.input_sbal_addr_array  = (void **) in_sbal_ptrs;
         init_data.output_sbal_addr_array = (void **) out_sbal_ptrs;
 
-        if (!(rc = qdio_initialize(&init_data)))
-                card->qdio.state = QETH_QDIO_ESTABLISHED;
+        if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ALLOCATED,
+                QETH_QDIO_ESTABLISHED) == QETH_QDIO_ALLOCATED)
+                if ((rc = qdio_initialize(&init_data)))
+                        atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
 
         kfree(out_sbal_ptrs);
         kfree(in_sbal_ptrs);
@@ -3516,13 +3521,20 @@ qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
         int rc = 0;
 
         QETH_DBF_TEXT(trace,3,"qdioclr");
-        if (card->qdio.state == QETH_QDIO_ESTABLISHED){
+        switch (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ESTABLISHED,
+                QETH_QDIO_CLEANING)) {
+        case QETH_QDIO_ESTABLISHED:
                 if ((rc = qdio_cleanup(CARD_DDEV(card),
-                             (card->info.type == QETH_CARD_TYPE_IQD) ?
-                             QDIO_FLAG_CLEANUP_USING_HALT :
-                             QDIO_FLAG_CLEANUP_USING_CLEAR)))
+                                (card->info.type == QETH_CARD_TYPE_IQD) ?
+                                QDIO_FLAG_CLEANUP_USING_HALT :
+                                QDIO_FLAG_CLEANUP_USING_CLEAR)))
                         QETH_DBF_TEXT_(trace, 3, "1err%d", rc);
-                card->qdio.state = QETH_QDIO_ALLOCATED;
+                atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                break;
+        case QETH_QDIO_CLEANING:
+                return rc;
+        default:
+                break;
         }
         if ((rc = qeth_clear_halt_card(card, use_halt)))
                 QETH_DBF_TEXT_(trace, 3, "2err%d", rc);
@@ -3682,10 +3694,10 @@ qeth_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* return OK; otherwise ksoftirqd goes to 100% */
                 return NETDEV_TX_OK;
         }
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_cnt++;
-        card->perf_stats.outbound_start_time = qeth_get_micros();
-#endif
+        if (card->options.performance_stats) {
+                card->perf_stats.outbound_cnt++;
+                card->perf_stats.outbound_start_time = qeth_get_micros();
+        }
         netif_stop_queue(dev);
         if ((rc = qeth_send_packet(card, skb))) {
                 if (rc == -EBUSY) {
@@ -3699,10 +3711,9 @@ qeth_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
         netif_wake_queue(dev);
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_time += qeth_get_micros() -
-                card->perf_stats.outbound_start_time;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.outbound_time += qeth_get_micros() -
+                        card->perf_stats.outbound_start_time;
         return rc;
 }
 
@@ -3917,49 +3928,59 @@ qeth_get_ip_version(struct sk_buff *skb)
         }
 }
 
-static inline int
-qeth_prepare_skb(struct qeth_card *card, struct sk_buff **skb,
-                 struct qeth_hdr **hdr, int ipv)
+static inline struct qeth_hdr *
+__qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb, int ipv)
 {
-        int rc = 0;
 #ifdef CONFIG_QETH_VLAN
         u16 *tag;
-#endif
-
-        QETH_DBF_TEXT(trace, 6, "prepskb");
-        if (card->info.type == QETH_CARD_TYPE_OSN) {
-                *hdr = (struct qeth_hdr *)(*skb)->data;
-                return rc;
-        }
-        rc = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
-        if (rc)
-                return rc;
-#ifdef CONFIG_QETH_VLAN
-        if (card->vlangrp && vlan_tx_tag_present(*skb) &&
+        if (card->vlangrp && vlan_tx_tag_present(skb) &&
             ((ipv == 6) || card->options.layer2) ) {
                 /*
                  * Move the mac addresses (6 bytes src, 6 bytes dest)
                  * to the beginning of the new header.  We are using three
                  * memcpys instead of one memmove to save cycles.
                  */
-                skb_push(*skb, VLAN_HLEN);
-                memcpy((*skb)->data, (*skb)->data + 4, 4);
-                memcpy((*skb)->data + 4, (*skb)->data + 8, 4);
-                memcpy((*skb)->data + 8, (*skb)->data + 12, 4);
-                tag = (u16 *)((*skb)->data + 12);
+                skb_push(skb, VLAN_HLEN);
+                memcpy(skb->data, skb->data + 4, 4);
+                memcpy(skb->data + 4, skb->data + 8, 4);
+                memcpy(skb->data + 8, skb->data + 12, 4);
+                tag = (u16 *)(skb->data + 12);
                 /*
                  * first two bytes  = ETH_P_8021Q (0x8100)
                  * second two bytes = VLANID
                  */
                 *tag = __constant_htons(ETH_P_8021Q);
-                *(tag + 1) = htons(vlan_tx_tag_get(*skb));
+                *(tag + 1) = htons(vlan_tx_tag_get(skb));
         }
 #endif
-        *hdr = (struct qeth_hdr *)
-                qeth_push_skb(card, skb, sizeof(struct qeth_hdr));
-        if (*hdr == NULL)
-                return -EINVAL;
-        return 0;
+        return ((struct qeth_hdr *)
+                qeth_push_skb(card, skb, sizeof(struct qeth_hdr)));
+}
+
+static inline void
+__qeth_free_new_skb(struct sk_buff *orig_skb, struct sk_buff *new_skb)
+{
+        if (orig_skb != new_skb)
+                dev_kfree_skb_any(new_skb);
+}
+
+static inline struct sk_buff *
+qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb,
+                 struct qeth_hdr **hdr, int ipv)
+{
+        struct sk_buff *new_skb;
+        
+        QETH_DBF_TEXT(trace, 6, "prepskb");
+
+        new_skb = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
+        if (new_skb == NULL)
+                return NULL;
+        *hdr = __qeth_prepare_skb(card, new_skb, ipv);
+        if (*hdr == NULL) {
+                __qeth_free_new_skb(skb, new_skb);
+                return NULL;
+        }
+        return new_skb;
 }
 
 static inline u8
@@ -4201,9 +4222,8 @@ qeth_fill_buffer(struct qeth_qdio_out_q *queue,
                 flush_cnt = 1;
         } else {
                 QETH_DBF_TEXT(trace, 6, "fillbfpa");
-#ifdef CONFIG_QETH_PERF_STATS
-                queue->card->perf_stats.skbs_sent_pack++;
-#endif
+                if (queue->card->options.performance_stats)
+                        queue->card->perf_stats.skbs_sent_pack++;
                 if (buf->next_element_to_fill >=
                                 QETH_MAX_BUFFER_ELEMENTS(queue->card)) {
                         /*
@@ -4240,21 +4260,15 @@ qeth_do_send_packet_fast(struct qeth_card *card, struct qeth_qdio_out_q *queue,
          * check if buffer is empty to make sure that we do not 'overtake'
          * ourselves and try to fill a buffer that is already primed
          */
-        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) {
-                card->stats.tx_dropped++;
-                atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
-                return -EBUSY;
-        }
+        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) 
+                goto out;
         if (ctx == NULL)
                 queue->next_buf_to_fill = (queue->next_buf_to_fill + 1) %
                                           QDIO_MAX_BUFFERS_PER_Q;
         else {
                 buffers_needed = qeth_eddp_check_buffers_for_context(queue,ctx);
-                if (buffers_needed < 0) {
-                        card->stats.tx_dropped++;
-                        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
-                        return -EBUSY;
-                }
+                if (buffers_needed < 0) 
+                        goto out;
                 queue->next_buf_to_fill =
                         (queue->next_buf_to_fill + buffers_needed) %
                         QDIO_MAX_BUFFERS_PER_Q;
@@ -4269,6 +4283,9 @@ qeth_do_send_packet_fast(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                 qeth_flush_buffers(queue, 0, index, flush_cnt);
         }
         return 0;
+out:
+        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
+        return -EBUSY;
 }
 
 static inline int
@@ -4294,8 +4311,7 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
          * check if buffer is empty to make sure that we do not 'overtake'
          * ourselves and try to fill a buffer that is already primed
          */
-        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY){
-                card->stats.tx_dropped++;
+        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) {
                 atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
                 return -EBUSY;
         }
@@ -4318,7 +4334,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                                  * again */
                                 if (atomic_read(&buffer->state) !=
                                                 QETH_QDIO_BUF_EMPTY){
-                                        card->stats.tx_dropped++;
                                         qeth_flush_buffers(queue, 0, start_index, flush_count);
                                         atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
                                         return -EBUSY;
@@ -4329,7 +4344,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                          * free buffers) to handle eddp context */
                         if (qeth_eddp_check_buffers_for_context(queue,ctx) < 0){
                                 printk("eddp tx_dropped 1\n");
-                                card->stats.tx_dropped++;
                                 rc = -EBUSY;
                                 goto out;
                         }
@@ -4341,7 +4355,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                 tmp = qeth_eddp_fill_buffer(queue,ctx,queue->next_buf_to_fill);
                 if (tmp < 0) {
                         printk("eddp tx_dropped 2\n");
-                        card->stats.tx_dropped++;
                         rc = - EBUSY;
                         goto out;
                 }
@@ -4375,10 +4388,8 @@ out:
                         qeth_flush_buffers(queue, 0, start_index, flush_count);
         }
         /* at this point the queue is UNLOCKED again */
-#ifdef CONFIG_QETH_PERF_STATS
-        if (do_pack)
+        if (queue->card->options.performance_stats && do_pack)
                 queue->card->perf_stats.bufs_sent_pack += flush_count;
-#endif /* CONFIG_QETH_PERF_STATS */
 
         return rc;
 }
@@ -4389,21 +4400,21 @@ qeth_get_elements_no(struct qeth_card *card, void *hdr,
 {
         int elements_needed = 0;
 
-        if (skb_shinfo(skb)->nr_frags > 0) {
+        if (skb_shinfo(skb)->nr_frags > 0) 
                 elements_needed = (skb_shinfo(skb)->nr_frags + 1);
-        }
-        if (elements_needed == 0 )
+        if (elements_needed == 0)
                 elements_needed = 1 + (((((unsigned long) hdr) % PAGE_SIZE)
                                         + skb->len) >> PAGE_SHIFT);
         if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)){
-                PRINT_ERR("qeth_do_send_packet: invalid size of "
-                          "IP packet (Number=%d / Length=%d). Discarded.\n",
+                PRINT_ERR("Invalid size of IP packet "
+                          "(Number=%d / Length=%d). Discarded.\n",
                           (elements_needed+elems), skb->len);
                 return 0;
         }
         return elements_needed;
 }
 
+
 static inline int
 qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
 {
@@ -4417,108 +4428,110 @@ qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
         int tx_bytes = skb->len;
         unsigned short nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned short tso_size = skb_shinfo(skb)->gso_size;
+        struct sk_buff *new_skb, *new_skb2;
         int rc;
 
         QETH_DBF_TEXT(trace, 6, "sendpkt");
 
+        new_skb = skb;
+        if ((card->info.type == QETH_CARD_TYPE_OSN) &&
+            (skb->protocol == htons(ETH_P_IPV6)))
+                return -EPERM;
+        cast_type = qeth_get_cast_type(card, skb);
+        if ((cast_type == RTN_BROADCAST) &&
+            (card->info.broadcast_capable == 0))
+                return -EPERM;
+        queue = card->qdio.out_qs
+                [qeth_get_priority_queue(card, skb, ipv, cast_type)];
         if (!card->options.layer2) {
                 ipv = qeth_get_ip_version(skb);
                 if ((card->dev->hard_header == qeth_fake_header) && ipv) {
-                        if ((skb = qeth_pskb_unshare(skb,GFP_ATOMIC)) == NULL) {
-                                card->stats.tx_dropped++;
-                                dev_kfree_skb_irq(skb);
-                                return 0;
-                        }
+                        new_skb = qeth_pskb_unshare(skb, GFP_ATOMIC);
+                        if (!new_skb)
+                                return -ENOMEM;
                         if(card->dev->type == ARPHRD_IEEE802_TR){
-                                skb_pull(skb, QETH_FAKE_LL_LEN_TR);
+                                skb_pull(new_skb, QETH_FAKE_LL_LEN_TR);
                         } else {
-                                skb_pull(skb, QETH_FAKE_LL_LEN_ETH);
+                                skb_pull(new_skb, QETH_FAKE_LL_LEN_ETH);
                         }
                 }
         }
-        if ((card->info.type == QETH_CARD_TYPE_OSN) &&
-                (skb->protocol == htons(ETH_P_IPV6))) {
-                dev_kfree_skb_any(skb);
-                return 0;
-        }
-        cast_type = qeth_get_cast_type(card, skb);
-        if ((cast_type == RTN_BROADCAST) &&
-            (card->info.broadcast_capable == 0)){
-                card->stats.tx_dropped++;
-                card->stats.tx_errors++;
-                dev_kfree_skb_any(skb);
-                return NETDEV_TX_OK;
-        }
-        queue = card->qdio.out_qs
-                [qeth_get_priority_queue(card, skb, ipv, cast_type)];
-
-        if (skb_shinfo(skb)->gso_size)
+        if (skb_is_gso(skb))
                 large_send = card->options.large_send;
-
-        /*are we able to do TSO ? If so ,prepare and send it from here */
+        /* check on OSN device*/
+        if (card->info.type == QETH_CARD_TYPE_OSN)
+                hdr = (struct qeth_hdr *)new_skb->data;
+        /*are we able to do TSO ? */
         if ((large_send == QETH_LARGE_SEND_TSO) &&
             (cast_type == RTN_UNSPEC)) {
-                rc = qeth_tso_prepare_packet(card, skb, ipv, cast_type);
+                rc = qeth_tso_prepare_packet(card, new_skb, ipv, cast_type);
                 if (rc) {
-                        card->stats.tx_dropped++;
-                        card->stats.tx_errors++;
-                        dev_kfree_skb_any(skb);
-                        return NETDEV_TX_OK;
+                        __qeth_free_new_skb(skb, new_skb);
+                        return rc;
                 }
                 elements_needed++;
-        } else {
-                if ((rc = qeth_prepare_skb(card, &skb, &hdr, ipv))) {
-                        QETH_DBF_TEXT_(trace, 4, "pskbe%d", rc);
-                        return rc;
+        } else if (card->info.type != QETH_CARD_TYPE_OSN) {
+                new_skb2 = qeth_prepare_skb(card, new_skb, &hdr, ipv);
+                if (!new_skb2) {
+                        __qeth_free_new_skb(skb, new_skb);
+                        return -EINVAL;
                 }
-                if (card->info.type != QETH_CARD_TYPE_OSN)
-                        qeth_fill_header(card, hdr, skb, ipv, cast_type);
+                if (new_skb != skb)
+                        __qeth_free_new_skb(new_skb2, new_skb);
+                new_skb = new_skb2;
+                qeth_fill_header(card, hdr, new_skb, ipv, cast_type);
         }
-
         if (large_send == QETH_LARGE_SEND_EDDP) {
-                ctx = qeth_eddp_create_context(card, skb, hdr);
+                ctx = qeth_eddp_create_context(card, new_skb, hdr);
                 if (ctx == NULL) {
+                        __qeth_free_new_skb(skb, new_skb);
                         PRINT_WARN("could not create eddp context\n");
                         return -EINVAL;
                 }
         } else {
-                int elems = qeth_get_elements_no(card,(void*) hdr, skb,
+                int elems = qeth_get_elements_no(card,(void*) hdr, new_skb,
                                                  elements_needed);
-                if (!elems)
+                if (!elems) {
+                        __qeth_free_new_skb(skb, new_skb);
                         return -EINVAL;
+                }
                 elements_needed += elems;
         }
 
         if (card->info.type != QETH_CARD_TYPE_IQD)
-                rc = qeth_do_send_packet(card, queue, skb, hdr,
+                rc = qeth_do_send_packet(card, queue, new_skb, hdr,
                                          elements_needed, ctx);
         else
-                rc = qeth_do_send_packet_fast(card, queue, skb, hdr,
+                rc = qeth_do_send_packet_fast(card, queue, new_skb, hdr,
                                               elements_needed, ctx);
-        if (!rc){
+        if (!rc) {
                 card->stats.tx_packets++;
                 card->stats.tx_bytes += tx_bytes;
-#ifdef CONFIG_QETH_PERF_STATS
-                if (tso_size &&
-                   !(large_send == QETH_LARGE_SEND_NO)) {
-                        card->perf_stats.large_send_bytes += tx_bytes;
-                        card->perf_stats.large_send_cnt++;
-                }
-                if (nr_frags > 0){
-                        card->perf_stats.sg_skbs_sent++;
-                        /* nr_frags + skb->data */
-                        card->perf_stats.sg_frags_sent +=
-                                nr_frags + 1;
+                if (new_skb != skb)
+                        dev_kfree_skb_any(skb);
+                if (card->options.performance_stats) {
+                        if (tso_size &&
+                            !(large_send == QETH_LARGE_SEND_NO)) {
+                                card->perf_stats.large_send_bytes += tx_bytes;
+                                card->perf_stats.large_send_cnt++;
+                        }
+                        if (nr_frags > 0) {
+                                card->perf_stats.sg_skbs_sent++;
+                                /* nr_frags + skb->data */
+                                card->perf_stats.sg_frags_sent +=
+                                        nr_frags + 1;
+                        }
                 }
-#endif /* CONFIG_QETH_PERF_STATS */
+        } else {
+                card->stats.tx_dropped++;
+                __qeth_free_new_skb(skb, new_skb);
         }
         if (ctx != NULL) {
                 /* drop creator's reference */
                 qeth_eddp_put_context(ctx);
                 /* free skb; it's not referenced by a buffer */
-                if (rc == 0)
-                        dev_kfree_skb_any(skb);
-
+                if (!rc)
+                       dev_kfree_skb_any(new_skb);
         }
         return rc;
 }
@@ -4797,7 +4810,7 @@ static struct qeth_cmd_buffer *
 qeth_get_setassparms_cmd(struct qeth_card *, enum qeth_ipa_funcs,
                          __u16, __u16, enum qeth_prot_versions);
 static int
-qeth_arp_query(struct qeth_card *card, char *udata)
+qeth_arp_query(struct qeth_card *card, char __user *udata)
 {
         struct qeth_cmd_buffer *iob;
         struct qeth_arp_query_info qinfo = {0, };
@@ -4930,7 +4943,7 @@ qeth_get_adapter_cmd(struct qeth_card *card, __u32 command, __u32 cmdlen)
  * function to send SNMP commands to OSA-E card
  */
 static int
-qeth_snmp_command(struct qeth_card *card, char *udata)
+qeth_snmp_command(struct qeth_card *card, char __user *udata)
 {
         struct qeth_cmd_buffer *iob;
         struct qeth_ipa_cmd *cmd;
@@ -5272,6 +5285,7 @@ qeth_free_vlan_buffer(struct qeth_card *card, struct qeth_qdio_out_buffer *buf,
         struct sk_buff_head tmp_list;
 
         skb_queue_head_init(&tmp_list);
+        lockdep_set_class(&tmp_list.lock, &qdio_out_skb_queue_key);
         for(i = 0; i < QETH_MAX_BUFFER_ELEMENTS(card); ++i){
                 while ((skb = skb_dequeue(&buf->skb_list))){
                         if (vlan_tx_tag_present(skb) &&
@@ -7330,6 +7344,8 @@ qeth_setrouting_v6(struct qeth_card *card)
         QETH_DBF_TEXT(trace,3,"setrtg6");
 #ifdef CONFIG_QETH_IPV6
 
+        if (!qeth_is_supported(card, IPA_IPV6))
+                return 0;
         qeth_correct_routing_type(card, &card->options.route6.type,
                                   QETH_PROT_IPV6);
 
@@ -7868,12 +7884,12 @@ __qeth_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 QETH_DBF_TEXT_(setup, 2, "5err%d", rc);
                 goto out_remove;
         }
-        card->state = CARD_STATE_SOFTSETUP;
 
         if ((rc = qeth_init_qdio_queues(card))){
                 QETH_DBF_TEXT_(setup, 2, "6err%d", rc);
                 goto out_remove;
         }
+        card->state = CARD_STATE_SOFTSETUP;
         netif_carrier_on(card->dev);
 
         qeth_set_allowed_threads(card, 0xffffffff, 0);
@@ -7901,9 +7917,9 @@ qeth_set_online(struct ccwgroup_device *gdev)
 }
 
 static struct ccw_device_id qeth_ids[] = {
-        {CCW_DEVICE(0x1731, 0x01), driver_info:QETH_CARD_TYPE_OSAE},
-        {CCW_DEVICE(0x1731, 0x05), driver_info:QETH_CARD_TYPE_IQD},
-        {CCW_DEVICE(0x1731, 0x06), driver_info:QETH_CARD_TYPE_OSN},
+        {CCW_DEVICE(0x1731, 0x01), .driver_info = QETH_CARD_TYPE_OSAE},
+        {CCW_DEVICE(0x1731, 0x05), .driver_info = QETH_CARD_TYPE_IQD},
+        {CCW_DEVICE(0x1731, 0x06), .driver_info = QETH_CARD_TYPE_OSN},
         {},
 };
 MODULE_DEVICE_TABLE(ccw, qeth_ids);
@@ -8372,7 +8388,7 @@ out:
 
 static struct notifier_block qeth_ip_notifier = {
         qeth_ip_event,
-        0
+        NULL,
 };
 
 #ifdef CONFIG_QETH_IPV6
@@ -8425,7 +8441,7 @@ out:
 
 static struct notifier_block qeth_ip6_notifier = {
         qeth_ip6_event,
-        0
+        NULL,
 };
 #endif
 
@@ -8443,16 +8459,17 @@ __qeth_reboot_event_card(struct device *dev, void *data)
 static int
 qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
+        int ret;
 
-        driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
-                               __qeth_reboot_event_card);
-        return NOTIFY_DONE;
+        ret = driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                                     __qeth_reboot_event_card);
+        return ret ? NOTIFY_BAD : NOTIFY_DONE;
 }
 
 
 static struct notifier_block qeth_reboot_notifier = {
         qeth_reboot_event,
-        0
+        NULL,
 };
 
 static int
@@ -8501,9 +8518,9 @@ static int
 qeth_ipv6_init(void)
 {
         qeth_old_arp_constructor = arp_tbl.constructor;
-        write_lock(&arp_tbl.lock);
+        write_lock_bh(&arp_tbl.lock);
         arp_tbl.constructor = qeth_arp_constructor;
-        write_unlock(&arp_tbl.lock);
+        write_unlock_bh(&arp_tbl.lock);
 
         arp_direct_ops = (struct neigh_ops*)
                 kmalloc(sizeof(struct neigh_ops), GFP_KERNEL);
@@ -8519,9 +8536,9 @@ qeth_ipv6_init(void)
 static void
 qeth_ipv6_uninit(void)
 {
-        write_lock(&arp_tbl.lock);
+        write_lock_bh(&arp_tbl.lock);
         arp_tbl.constructor = qeth_old_arp_constructor;
-        write_unlock(&arp_tbl.lock);
+        write_unlock_bh(&arp_tbl.lock);
         kfree(arp_direct_ops);
 }
 #endif /* CONFIG_QETH_IPV6 */
@@ -8529,34 +8546,44 @@ qeth_ipv6_uninit(void)
 static void
 qeth_sysfs_unregister(void)
 {
+        s390_root_dev_unregister(qeth_root_dev);
         qeth_remove_driver_attributes();
         ccw_driver_unregister(&qeth_ccw_driver);
         ccwgroup_driver_unregister(&qeth_ccwgroup_driver);
-        s390_root_dev_unregister(qeth_root_dev);
 }
+
 /**
  * register qeth at sysfs
  */
 static int
 qeth_sysfs_register(void)
 {
-        int rc=0;
+        int rc;
 
         rc = ccwgroup_driver_register(&qeth_ccwgroup_driver);
         if (rc)
-                return rc;
+                goto out;
+
         rc = ccw_driver_register(&qeth_ccw_driver);
         if (rc)
-                return rc;
+                goto out_ccw_driver;
+
         rc = qeth_create_driver_attributes();
         if (rc)
-                return rc;
+                goto out_qeth_attr;
+
         qeth_root_dev = s390_root_dev_register("qeth");
-        if (IS_ERR(qeth_root_dev)) {
-                rc = PTR_ERR(qeth_root_dev);
-                return rc;
-        }
-        return 0;
+        rc = IS_ERR(qeth_root_dev) ? PTR_ERR(qeth_root_dev) : 0;
+        if (!rc)
+                goto out;
+
+        qeth_remove_driver_attributes();
+out_qeth_attr:
+        ccw_driver_unregister(&qeth_ccw_driver);
+out_ccw_driver:
+        ccwgroup_driver_unregister(&qeth_ccwgroup_driver);
+out:
+        return rc;
 }
 
 /***
@@ -8565,7 +8592,7 @@ qeth_sysfs_register(void)
 static int __init
 qeth_init(void)
 {
-        int rc=0;
+        int rc;
 
         PRINT_INFO("loading %s\n", version);
 
@@ -8574,20 +8601,26 @@ qeth_init(void)
         spin_lock_init(&qeth_notify_lock);
         rwlock_init(&qeth_card_list.rwlock);
 
-        if (qeth_register_dbf_views())
+        rc = qeth_register_dbf_views();
+        if (rc)
                 goto out_err;
-        if (qeth_sysfs_register())
-                goto out_sysfs;
+
+        rc = qeth_sysfs_register();
+        if (rc)
+                goto out_dbf;
 
 #ifdef CONFIG_QETH_IPV6
-        if (qeth_ipv6_init()) {
-                PRINT_ERR("Out of memory during ipv6 init.\n");
+        rc = qeth_ipv6_init();
+        if (rc) {
+                PRINT_ERR("Out of memory during ipv6 init code = %d\n", rc);
                 goto out_sysfs;
         }
 #endif /* QETH_IPV6 */
-        if (qeth_register_notifiers())
+        rc = qeth_register_notifiers();
+        if (rc)
                 goto out_ipv6;
-        if (qeth_create_procfs_entries())
+        rc = qeth_create_procfs_entries();
+        if (rc)
                 goto out_notifiers;
 
         return rc;
@@ -8597,12 +8630,13 @@ out_notifiers:
 out_ipv6:
 #ifdef CONFIG_QETH_IPV6
         qeth_ipv6_uninit();
-#endif /* QETH_IPV6 */
 out_sysfs:
+#endif /* QETH_IPV6 */
         qeth_sysfs_unregister();
+out_dbf:
         qeth_unregister_dbf_views();
 out_err:
-        PRINT_ERR("Initialization failed");
+        PRINT_ERR("Initialization failed with code %d\n", rc);
         return rc;
 }
 
diff --git a/drivers/s390/net/qeth_proc.c b/drivers/s390/net/qeth_proc.c
index 66f2da14e6e3..faa768e59257 100644
--- a/drivers/s390/net/qeth_proc.c
+++ b/drivers/s390/net/qeth_proc.c
@@ -173,7 +173,6 @@ static struct file_operations qeth_procfile_fops = {
 #define QETH_PERF_PROCFILE_NAME "qeth_perf"
 static struct proc_dir_entry *qeth_perf_procfile;
 
-#ifdef CONFIG_QETH_PERF_STATS
 static int
 qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
 {
@@ -192,14 +191,21 @@ qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
                         CARD_DDEV_ID(card),
                         QETH_CARD_IFNAME(card)
                   );
+        if (!card->options.performance_stats)
+                seq_printf(s, "Performance statistics are deactivated.\n");
         seq_printf(s, "  Skb's/buffers received                 : %lu/%u\n"
                       "  Skb's/buffers sent                     : %lu/%u\n\n",
-                        card->stats.rx_packets, card->perf_stats.bufs_rec,
-                        card->stats.tx_packets, card->perf_stats.bufs_sent
+                        card->stats.rx_packets -
+                                card->perf_stats.initial_rx_packets,
+                        card->perf_stats.bufs_rec,
+                        card->stats.tx_packets -
+                                card->perf_stats.initial_tx_packets,
+                        card->perf_stats.bufs_sent
                   );
         seq_printf(s, "  Skb's/buffers sent without packing     : %lu/%u\n"
                       "  Skb's/buffers sent with packing        : %u/%u\n\n",
-                   card->stats.tx_packets - card->perf_stats.skbs_sent_pack,
+                   card->stats.tx_packets - card->perf_stats.initial_tx_packets
+                                          - card->perf_stats.skbs_sent_pack,
                    card->perf_stats.bufs_sent - card->perf_stats.bufs_sent_pack,
                    card->perf_stats.skbs_sent_pack,
                    card->perf_stats.bufs_sent_pack
@@ -275,11 +281,6 @@ static struct file_operations qeth_perf_procfile_fops = {
         .release = seq_release,
 };
 
-#define qeth_perf_procfile_created qeth_perf_procfile
-#else
-#define qeth_perf_procfile_created 1
-#endif /* CONFIG_QETH_PERF_STATS */
-
 int __init
 qeth_create_procfs_entries(void)
 {
@@ -288,15 +289,13 @@ qeth_create_procfs_entries(void)
         if (qeth_procfile)
                 qeth_procfile->proc_fops = &qeth_procfile_fops;
 
-#ifdef CONFIG_QETH_PERF_STATS
         qeth_perf_procfile = create_proc_entry(QETH_PERF_PROCFILE_NAME,
                                            S_IFREG | 0444, NULL);
         if (qeth_perf_procfile)
                 qeth_perf_procfile->proc_fops = &qeth_perf_procfile_fops;
-#endif /* CONFIG_QETH_PERF_STATS */
 
         if (qeth_procfile &&
-            qeth_perf_procfile_created)
+            qeth_perf_procfile)
                 return 0;
         else
                 return -ENOMEM;
diff --git a/drivers/s390/net/qeth_sys.c b/drivers/s390/net/qeth_sys.c
index 185a9cfbcbdc..5836737ac58f 100644
--- a/drivers/s390/net/qeth_sys.c
+++ b/drivers/s390/net/qeth_sys.c
@@ -743,6 +743,47 @@ static DEVICE_ATTR(layer2, 0644, qeth_dev_layer2_show,
                    qeth_dev_layer2_store);
 
 static ssize_t
+qeth_dev_performance_stats_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct qeth_card *card = dev->driver_data;
+
+        if (!card)
+                return -EINVAL;
+
+        return sprintf(buf, "%i\n", card->options.performance_stats ? 1:0);
+}
+
+static ssize_t
+qeth_dev_performance_stats_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct qeth_card *card = dev->driver_data;
+        char *tmp;
+        int i;
+
+        if (!card)
+                return -EINVAL;
+
+        i = simple_strtoul(buf, &tmp, 16);
+        if ((i == 0) || (i == 1)) {
+                if (i == card->options.performance_stats)
+                        return count;
+                card->options.performance_stats = i;
+                if (i == 0)
+                        memset(&card->perf_stats, 0,
+                                sizeof(struct qeth_perf_stats));
+                card->perf_stats.initial_rx_packets = card->stats.rx_packets;
+                card->perf_stats.initial_tx_packets = card->stats.tx_packets;
+        } else {
+                PRINT_WARN("performance_stats: write 0 or 1 to this file!\n");
+                return -EINVAL;
+        }
+        return count;
+}
+
+static DEVICE_ATTR(performance_stats, 0644, qeth_dev_performance_stats_show,
+                   qeth_dev_performance_stats_store);
+
+static ssize_t
 qeth_dev_large_send_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct qeth_card *card = dev->driver_data;
@@ -928,6 +969,7 @@ static struct device_attribute * qeth_device_attrs[] = {
         &dev_attr_canonical_macaddr,
         &dev_attr_layer2,
         &dev_attr_large_send,
+        &dev_attr_performance_stats,
         NULL,
 };
 
@@ -1110,12 +1152,12 @@ qeth_parse_ipatoe(const char* buf, enum qeth_prot_versions proto,
 {
         const char *start, *end;
         char *tmp;
-        char buffer[49] = {0, };
+        char buffer[40] = {0, };
 
         start = buf;
         /* get address string */
         end = strchr(start, '/');
-        if (!end || (end-start >= 49)){
+        if (!end || (end - start >= 40)){
                 PRINT_WARN("Invalid format for ipato_addx/delx. "
                            "Use <ip addr>/<mask bits>\n");
                 return -EINVAL;
@@ -1127,7 +1169,12 @@ qeth_parse_ipatoe(const char* buf, enum qeth_prot_versions proto,
         }
         start = end + 1;
         *mask_bits = simple_strtoul(start, &tmp, 10);
-
+        if (!strlen(start) ||
+            (tmp == start) ||
+            (*mask_bits > ((proto == QETH_PROT_IPV4) ? 32 : 128))) {
+                PRINT_WARN("Invalid mask bits for ipato_addx/delx !\n");
+                return -EINVAL;
+        }
         return 0;
 }
 
@@ -1698,11 +1745,16 @@ qeth_create_device_attributes(struct device *dev)
                 sysfs_remove_group(&dev->kobj, &qeth_device_attr_group);
                 sysfs_remove_group(&dev->kobj, &qeth_device_ipato_group);
                 sysfs_remove_group(&dev->kobj, &qeth_device_vipa_group);
+                return ret;
         }
-        if ((ret = sysfs_create_group(&dev->kobj, &qeth_device_blkt_group)))
+        if ((ret = sysfs_create_group(&dev->kobj, &qeth_device_blkt_group))){
+                sysfs_remove_group(&dev->kobj, &qeth_device_attr_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_ipato_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_vipa_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_rxip_group);
                 return ret;
-
-        return ret;
+        }
+        return 0;
 }
 
 void
@@ -1755,7 +1807,7 @@ qeth_driver_group_store(struct device_driver *ddrv, const char *buf,
 }
 
 
-static DRIVER_ATTR(group, 0200, 0, qeth_driver_group_store);
+static DRIVER_ATTR(group, 0200, NULL, qeth_driver_group_store);
 
 static ssize_t
 qeth_driver_notifier_register_store(struct device_driver *ddrv, const char *buf,
@@ -1783,7 +1835,7 @@ qeth_driver_notifier_register_store(struct device_driver *ddrv, const char *buf,
         return count;
 }
 
-static DRIVER_ATTR(notifier_register, 0200, 0,
+static DRIVER_ATTR(notifier_register, 0200, NULL,
                    qeth_driver_notifier_register_store);
 
 int
diff --git a/drivers/s390/net/qeth_tso.h b/drivers/s390/net/qeth_tso.h
index 593f298142c1..14504afb044e 100644
--- a/drivers/s390/net/qeth_tso.h
+++ b/drivers/s390/net/qeth_tso.h
@@ -24,7 +24,7 @@ static inline struct qeth_hdr_tso *
 qeth_tso_prepare_skb(struct qeth_card *card, struct sk_buff **skb)
 {
         QETH_DBF_TEXT(trace, 5, "tsoprsk");
-        return qeth_push_skb(card, skb, sizeof(struct qeth_hdr_tso));
+        return qeth_push_skb(card, *skb, sizeof(struct qeth_hdr_tso));
 }
 
 /**
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 72118ee68954..b8179c27ceb6 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -66,7 +66,7 @@ smsg_message_pending(iucv_MessagePending *eib, void *pgm_data)
                 return;
         }
         rc = iucv_receive(eib->ippathid, eib->ipmsgid, eib->iptrgcls,
-                          msg, len, 0, 0, 0);
+                          msg, len, NULL, NULL, NULL);
         if (rc == 0) {
                 msg[len] = 0;
                 EBCASC(msg, len);
@@ -122,7 +122,7 @@ smsg_unregister_callback(char *prefix, void (*callback)(char *from, char *str))
         struct smsg_callback *cb, *tmp;
 
         spin_lock(&smsg_list_lock);
-        cb = 0;
+        cb = NULL;
         list_for_each_entry(tmp, &smsg_list, list)
                 if (tmp->callback == callback &&
                     strcmp(tmp->prefix, prefix) == 0) {
@@ -139,7 +139,7 @@ smsg_exit(void)
 {
         if (smsg_handle > 0) {
                 cpcmd("SET SMSG OFF", NULL, 0, NULL);
-                iucv_sever(smsg_pathid, 0);
+                iucv_sever(smsg_pathid, NULL);
                 iucv_unregister_program(smsg_handle);
                 driver_unregister(&smsg_driver);
         }
@@ -162,19 +162,19 @@ smsg_init(void)
                 return rc;
         }
         smsg_handle = iucv_register_program("SMSGIUCV        ", "*MSG    ",
-                                            pgmmask, &smsg_ops, 0);
+                                            pgmmask, &smsg_ops, NULL);
         if (!smsg_handle) {
                 printk(KERN_ERR "SMSGIUCV: failed to register to iucv");
                 driver_unregister(&smsg_driver);
                 return -EIO;    /* better errno ? */
         }
-        rc = iucv_connect (&smsg_pathid, 255, 0, "*MSG    ", 0, 0, 0, 0,
-                           smsg_handle, 0);
+        rc = iucv_connect (&smsg_pathid, 255, NULL, "*MSG    ", NULL, 0,
+                           NULL, NULL, smsg_handle, NULL);
         if (rc) {
                 printk(KERN_ERR "SMSGIUCV: failed to connect to *MSG");
                 iucv_unregister_program(smsg_handle);
                 driver_unregister(&smsg_driver);
-                smsg_handle = 0;
+                smsg_handle = NULL;
                 return -EIO;
         }
         cpcmd("SET SMSG IUCV", NULL, 0, NULL);
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 432136f96e64..5399c5d99b81 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -111,6 +111,16 @@ repeat:
                         break;
                 case CRW_RSC_CPATH:
                         pr_debug("source is channel path %02X\n", crw[0].rsid);
+                        /*
+                         * Check for solicited machine checks. These are
+                         * created by reset channel path and need not be
+                         * reported to the common I/O layer.
+                         */
+                        if (crw[chain].slct) {
+                                DBG(KERN_INFO"solicited machine check for "
+                                    "channel path %02X\n", crw[0].rsid);
+                                break;
+                        }
                         switch (crw[0].erc) {
                         case CRW_ERC_IPARM: /* Path has come. */
                                 ret = chp_process_crw(crw[0].rsid, 1);
@@ -378,6 +388,8 @@ s390_do_machine_check(struct pt_regs *regs)
         struct mcck_struct *mcck;
         int umode;
 
+        lockdep_off();
+
         mci = (struct mci *) &S390_lowcore.mcck_interruption_code;
         mcck = &__get_cpu_var(cpu_mcck);
         umode = user_mode(regs);
@@ -482,6 +494,7 @@ s390_do_machine_check(struct pt_regs *regs)
                 mcck->warning = 1;
                 set_thread_flag(TIF_MCCK_PENDING);
         }
+        lockdep_on();
 }
 
 /*
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 9cd789b8acd4..adc9d8f2c28f 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -112,6 +112,105 @@ _zfcp_hex_dump(char *addr, int count)
                 printk("\n");
 }
 
+
+/****************************************************************/
+/****** Functions to handle the request ID hash table    ********/
+/****************************************************************/
+
+#define ZFCP_LOG_AREA                   ZFCP_LOG_AREA_FSF
+
+static int zfcp_reqlist_init(struct zfcp_adapter *adapter)
+{
+        int i;
+
+        adapter->req_list = kcalloc(REQUEST_LIST_SIZE, sizeof(struct list_head),
+                                    GFP_KERNEL);
+
+        if (!adapter->req_list)
+                return -ENOMEM;
+
+        for (i=0; i<REQUEST_LIST_SIZE; i++)
+                INIT_LIST_HEAD(&adapter->req_list[i]);
+
+        return 0;
+}
+
+static void zfcp_reqlist_free(struct zfcp_adapter *adapter)
+{
+        struct zfcp_fsf_req *request, *tmp;
+        unsigned int i;
+
+        for (i=0; i<REQUEST_LIST_SIZE; i++) {
+                if (list_empty(&adapter->req_list[i]))
+                        continue;
+
+                list_for_each_entry_safe(request, tmp,
+                                         &adapter->req_list[i], list)
+                        list_del(&request->list);
+        }
+
+        kfree(adapter->req_list);
+}
+
+void zfcp_reqlist_add(struct zfcp_adapter *adapter,
+                      struct zfcp_fsf_req *fsf_req)
+{
+        unsigned int i;
+
+        i = fsf_req->req_id % REQUEST_LIST_SIZE;
+        list_add_tail(&fsf_req->list, &adapter->req_list[i]);
+}
+
+void zfcp_reqlist_remove(struct zfcp_adapter *adapter, unsigned long req_id)
+{
+        struct zfcp_fsf_req *request, *tmp;
+        unsigned int i, counter;
+        u64 dbg_tmp[2];
+
+        i = req_id % REQUEST_LIST_SIZE;
+        BUG_ON(list_empty(&adapter->req_list[i]));
+
+        counter = 0;
+        list_for_each_entry_safe(request, tmp, &adapter->req_list[i], list) {
+                if (request->req_id == req_id) {
+                        dbg_tmp[0] = (u64) atomic_read(&adapter->reqs_active);
+                        dbg_tmp[1] = (u64) counter;
+                        debug_event(adapter->erp_dbf, 4, (void *) dbg_tmp, 16);
+                        list_del(&request->list);
+                        break;
+                }
+                counter++;
+        }
+}
+
+struct zfcp_fsf_req *zfcp_reqlist_ismember(struct zfcp_adapter *adapter,
+                                           unsigned long req_id)
+{
+        struct zfcp_fsf_req *request, *tmp;
+        unsigned int i;
+
+        i = req_id % REQUEST_LIST_SIZE;
+
+        list_for_each_entry_safe(request, tmp, &adapter->req_list[i], list)
+                if (request->req_id == req_id)
+                        return request;
+
+        return NULL;
+}
+
+int zfcp_reqlist_isempty(struct zfcp_adapter *adapter)
+{
+        unsigned int i;
+
+        for (i=0; i<REQUEST_LIST_SIZE; i++)
+                if (!list_empty(&adapter->req_list[i]))
+                        return 0;
+
+        return 1;
+}
+
+#undef ZFCP_LOG_AREA
+
 /****************************************************************/
 /************** Uncategorised Functions *************************/
 /****************************************************************/
@@ -961,8 +1060,12 @@ zfcp_adapter_enqueue(struct ccw_device *ccw_device)
         INIT_LIST_HEAD(&adapter->port_remove_lh);
 
         /* initialize list of fsf requests */
-        spin_lock_init(&adapter->fsf_req_list_lock);
-        INIT_LIST_HEAD(&adapter->fsf_req_list_head);
+        spin_lock_init(&adapter->req_list_lock);
+        retval = zfcp_reqlist_init(adapter);
+        if (retval) {
+                ZFCP_LOG_INFO("request list initialization failed\n");
+                goto failed_low_mem_buffers;
+        }
 
         /* initialize debug locks */
 
@@ -1041,8 +1144,6 @@ zfcp_adapter_enqueue(struct ccw_device *ccw_device)
  *              !0 - struct zfcp_adapter  data structure could not be removed
  *                      (e.g. still used)
  * locks:       adapter list write lock is assumed to be held by caller
- *              adapter->fsf_req_list_lock is taken and released within this 
- *              function and must not be held on entry
  */
 void
 zfcp_adapter_dequeue(struct zfcp_adapter *adapter)
@@ -1054,14 +1155,14 @@ zfcp_adapter_dequeue(struct zfcp_adapter *adapter)
         zfcp_sysfs_adapter_remove_files(&adapter->ccw_device->dev);
         dev_set_drvdata(&adapter->ccw_device->dev, NULL);
         /* sanity check: no pending FSF requests */
-        spin_lock_irqsave(&adapter->fsf_req_list_lock, flags);
-        retval = !list_empty(&adapter->fsf_req_list_head);
-        spin_unlock_irqrestore(&adapter->fsf_req_list_lock, flags);
-        if (retval) {
+        spin_lock_irqsave(&adapter->req_list_lock, flags);
+        retval = zfcp_reqlist_isempty(adapter);
+        spin_unlock_irqrestore(&adapter->req_list_lock, flags);
+        if (!retval) {
                 ZFCP_LOG_NORMAL("bug: adapter %s (%p) still in use, "
                                 "%i requests outstanding\n",
                                 zfcp_get_busid_by_adapter(adapter), adapter,
-                                atomic_read(&adapter->fsf_reqs_active));
+                                atomic_read(&adapter->reqs_active));
                 retval = -EBUSY;
                 goto out;
         }
@@ -1087,6 +1188,7 @@ zfcp_adapter_dequeue(struct zfcp_adapter *adapter)
         zfcp_free_low_mem_buffers(adapter);
         /* free memory of adapter data structure and queues */
         zfcp_qdio_free_queues(adapter);
+        zfcp_reqlist_free(adapter);
         kfree(adapter->fc_stats);
         kfree(adapter->stats_reset_data);
         ZFCP_LOG_TRACE("freeing adapter structure\n");
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index 57d8e4bfb8d9..fdabadeaa9ee 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -164,6 +164,11 @@ zfcp_ccw_set_online(struct ccw_device *ccw_device)
         retval = zfcp_adapter_scsi_register(adapter);
         if (retval)
                 goto out_scsi_register;
+
+        /* initialize request counter */
+        BUG_ON(!zfcp_reqlist_isempty(adapter));
+        adapter->req_no = 0;
+
         zfcp_erp_modify_adapter_status(adapter, ZFCP_STATUS_COMMON_RUNNING,
                                        ZFCP_SET);
         zfcp_erp_adapter_reopen(adapter, ZFCP_STATUS_COMMON_ERP_FAILED);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 2df512a18e2c..94d1b74db356 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -52,7 +52,7 @@
 /********************* GENERAL DEFINES *********************************/
 
 /* zfcp version number, it consists of major, minor, and patch-level number */
-#define ZFCP_VERSION            "4.7.0"
+#define ZFCP_VERSION            "4.8.0"
 
 /**
  * zfcp_sg_to_address - determine kernel address from struct scatterlist
@@ -80,7 +80,7 @@ zfcp_address_to_sg(void *address, struct scatterlist *list)
 #define REQUEST_LIST_SIZE 128
 
 /********************* SCSI SPECIFIC DEFINES *********************************/
-#define ZFCP_SCSI_ER_TIMEOUT                    (100*HZ)
+#define ZFCP_SCSI_ER_TIMEOUT                    (10*HZ)
 
 /********************* CIO/QDIO SPECIFIC DEFINES *****************************/
 
@@ -886,11 +886,11 @@ struct zfcp_adapter {
         struct list_head        port_remove_lh;    /* head of ports to be
                                                       removed */
         u32                     ports;             /* number of remote ports */
-        struct timer_list       scsi_er_timer;     /* SCSI err recovery watch */
-        struct list_head        fsf_req_list_head; /* head of FSF req list */
-        spinlock_t              fsf_req_list_lock; /* lock for ops on list of
-                                                      FSF requests */
-        atomic_t                fsf_reqs_active;   /* # active FSF reqs */
+        struct timer_list       scsi_er_timer;     /* SCSI err recovery watch */
+        atomic_t                reqs_active;       /* # active FSF reqs */
+        unsigned long           req_no;            /* unique FSF req number */
+        struct list_head        *req_list;         /* list of pending reqs */
+        spinlock_t              req_list_lock;     /* request list lock */
         struct zfcp_qdio_queue  request_queue;     /* request queue */
         u32                     fsf_req_seq_no;    /* FSF cmnd seq number */
         wait_queue_head_t       request_wq;        /* can be used to wait for
@@ -986,6 +986,7 @@ struct zfcp_unit {
 /* FSF request */
 struct zfcp_fsf_req {
         struct list_head       list;           /* list of FSF requests */
+        unsigned long          req_id;         /* unique request ID */
         struct zfcp_adapter    *adapter;       /* adapter request belongs to */
         u8                     sbal_number;    /* nr of SBALs free for use */
         u8                     sbal_first;     /* first SBAL for this request */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 909731b99d26..7f60b6fdf724 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -64,8 +64,8 @@ static int zfcp_erp_strategy_check_action(struct zfcp_erp_action *, int);
 static int zfcp_erp_adapter_strategy(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_generic(struct zfcp_erp_action *, int);
 static int zfcp_erp_adapter_strategy_close(struct zfcp_erp_action *);
-static int zfcp_erp_adapter_strategy_close_qdio(struct zfcp_erp_action *);
-static int zfcp_erp_adapter_strategy_close_fsf(struct zfcp_erp_action *);
+static void zfcp_erp_adapter_strategy_close_qdio(struct zfcp_erp_action *);
+static void zfcp_erp_adapter_strategy_close_fsf(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open_qdio(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open_fsf(struct zfcp_erp_action *);
@@ -93,10 +93,9 @@ static int zfcp_erp_unit_strategy_clearstati(struct zfcp_unit *);
 static int zfcp_erp_unit_strategy_close(struct zfcp_erp_action *);
 static int zfcp_erp_unit_strategy_open(struct zfcp_erp_action *);
 
-static int zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *);
-static int zfcp_erp_action_dismiss_port(struct zfcp_port *);
-static int zfcp_erp_action_dismiss_unit(struct zfcp_unit *);
-static int zfcp_erp_action_dismiss(struct zfcp_erp_action *);
+static void zfcp_erp_action_dismiss_port(struct zfcp_port *);
+static void zfcp_erp_action_dismiss_unit(struct zfcp_unit *);
+static void zfcp_erp_action_dismiss(struct zfcp_erp_action *);
 
 static int zfcp_erp_action_enqueue(int, struct zfcp_adapter *,
                                    struct zfcp_port *, struct zfcp_unit *);
@@ -135,29 +134,39 @@ zfcp_fsf_request_timeout_handler(unsigned long data)
         zfcp_erp_adapter_reopen(adapter, 0);
 }
 
-/*
- * function:    zfcp_fsf_scsi_er_timeout_handler
- *
- * purpose:     This function needs to be called whenever a SCSI error recovery
- *              action (abort/reset) does not return.
- *              Re-opening the adapter means that the command can be returned
- *              by zfcp (it is guarranteed that it does not return via the
- *              adapter anymore). The buffer can then be used again.
- *    
- * returns:     sod all
+/**
+ * zfcp_fsf_scsi_er_timeout_handler - timeout handler for scsi eh tasks
+ *
+ * This function needs to be called whenever a SCSI error recovery
+ * action (abort/reset) does not return.  Re-opening the adapter means
+ * that the abort/reset command can be returned by zfcp. It won't complete
+ * via the adapter anymore (because qdio queues are closed). If ERP is
+ * already running on this adapter it will be stopped.
  */
-void
-zfcp_fsf_scsi_er_timeout_handler(unsigned long data)
+void zfcp_fsf_scsi_er_timeout_handler(unsigned long data)
 {
         struct zfcp_adapter *adapter = (struct zfcp_adapter *) data;
+        unsigned long flags;
 
         ZFCP_LOG_NORMAL("warning: SCSI error recovery timed out. "
                         "Restarting all operations on the adapter %s\n",
                         zfcp_get_busid_by_adapter(adapter));
         debug_text_event(adapter->erp_dbf, 1, "eh_lmem_tout");
-        zfcp_erp_adapter_reopen(adapter, 0);
 
-        return;
+        write_lock_irqsave(&adapter->erp_lock, flags);
+        if (atomic_test_mask(ZFCP_STATUS_ADAPTER_ERP_PENDING,
+                             &adapter->status)) {
+                zfcp_erp_modify_adapter_status(adapter,
+                       ZFCP_STATUS_COMMON_UNBLOCKED|ZFCP_STATUS_COMMON_OPEN,
+                       ZFCP_CLEAR);
+                zfcp_erp_action_dismiss_adapter(adapter);
+                write_unlock_irqrestore(&adapter->erp_lock, flags);
+                /* dismiss all pending requests including requests for ERP */
+                zfcp_fsf_req_dismiss_all(adapter);
+                adapter->fsf_req_seq_no = 0;
+        } else
+                write_unlock_irqrestore(&adapter->erp_lock, flags);
+        zfcp_erp_adapter_reopen(adapter, 0);
 }
 
 /*
@@ -670,17 +679,10 @@ zfcp_erp_unit_reopen(struct zfcp_unit *unit, int clear_mask)
         return retval;
 }
 
-/*
- * function:    
- *
- * purpose:     disable I/O,
- *              return any open requests and clean them up,
- *              aim: no pending and incoming I/O
- *
- * returns:
+/**
+ * zfcp_erp_adapter_block - mark adapter as blocked, block scsi requests
  */
-static void
-zfcp_erp_adapter_block(struct zfcp_adapter *adapter, int clear_mask)
+static void zfcp_erp_adapter_block(struct zfcp_adapter *adapter, int clear_mask)
 {
         debug_text_event(adapter->erp_dbf, 6, "a_bl");
         zfcp_erp_modify_adapter_status(adapter,
@@ -688,15 +690,10 @@ zfcp_erp_adapter_block(struct zfcp_adapter *adapter, int clear_mask)
                                        clear_mask, ZFCP_CLEAR);
 }
 
-/*
- * function:    
- *
- * purpose:     enable I/O
- *
- * returns:
+/**
+ * zfcp_erp_adapter_unblock - mark adapter as unblocked, allow scsi requests
  */
-static void
-zfcp_erp_adapter_unblock(struct zfcp_adapter *adapter)
+static void zfcp_erp_adapter_unblock(struct zfcp_adapter *adapter)
 {
         debug_text_event(adapter->erp_dbf, 6, "a_ubl");
         atomic_set_mask(ZFCP_STATUS_COMMON_UNBLOCKED, &adapter->status);
@@ -848,18 +845,16 @@ zfcp_erp_strategy_check_fsfreq(struct zfcp_erp_action *erp_action)
         struct zfcp_adapter *adapter = erp_action->adapter;
 
         if (erp_action->fsf_req) {
-                /* take lock to ensure that request is not being deleted meanwhile */
-                spin_lock(&adapter->fsf_req_list_lock);
-                /* check whether fsf req does still exist */
-                list_for_each_entry(fsf_req, &adapter->fsf_req_list_head, list)
-                    if (fsf_req == erp_action->fsf_req)
-                        break;
-                if (fsf_req && (fsf_req->erp_action == erp_action)) {
+                /* take lock to ensure that request is not deleted meanwhile */
+                spin_lock(&adapter->req_list_lock);
+                if ((!zfcp_reqlist_ismember(adapter,
+                                            erp_action->fsf_req->req_id)) &&
+                    (fsf_req->erp_action == erp_action)) {
                         /* fsf_req still exists */
                         debug_text_event(adapter->erp_dbf, 3, "a_ca_req");
                         debug_event(adapter->erp_dbf, 3, &fsf_req,
                                     sizeof (unsigned long));
-                        /* dismiss fsf_req of timed out or dismissed erp_action */
+                        /* dismiss fsf_req of timed out/dismissed erp_action */
                         if (erp_action->status & (ZFCP_STATUS_ERP_DISMISSED |
                                                   ZFCP_STATUS_ERP_TIMEDOUT)) {
                                 debug_text_event(adapter->erp_dbf, 3,
@@ -892,30 +887,22 @@ zfcp_erp_strategy_check_fsfreq(struct zfcp_erp_action *erp_action)
                          */
                         erp_action->fsf_req = NULL;
                 }
-                spin_unlock(&adapter->fsf_req_list_lock);
+                spin_unlock(&adapter->req_list_lock);
         } else
                 debug_text_event(adapter->erp_dbf, 3, "a_ca_noreq");
 
         return retval;
 }
 
-/*
- * purpose:     generic handler for asynchronous events related to erp_action events
- *              (normal completion, time-out, dismissing, retry after
- *              low memory condition)
- *
- * note:        deletion of timer is not required (e.g. in case of a time-out),
- *              but a second try does no harm,
- *              we leave it in here to allow for greater simplification
+/**
+ * zfcp_erp_async_handler_nolock - complete erp_action
  *
- * returns:     0 - there was an action to handle
- *              !0 - otherwise
+ * Used for normal completion, time-out, dismissal and failure after
+ * low memory condition.
  */
-static int
-zfcp_erp_async_handler_nolock(struct zfcp_erp_action *erp_action,
-                              unsigned long set_mask)
+static void zfcp_erp_async_handler_nolock(struct zfcp_erp_action *erp_action,
+                                          unsigned long set_mask)
 {
-        int retval;
         struct zfcp_adapter *adapter = erp_action->adapter;
 
         if (zfcp_erp_action_exists(erp_action) == ZFCP_ERP_ACTION_RUNNING) {
@@ -926,43 +913,26 @@ zfcp_erp_async_handler_nolock(struct zfcp_erp_action *erp_action,
                         del_timer(&erp_action->timer);
                 erp_action->status |= set_mask;
                 zfcp_erp_action_ready(erp_action);
-                retval = 0;
         } else {
                 /* action is ready or gone - nothing to do */
                 debug_text_event(adapter->erp_dbf, 3, "a_asyh_gone");
                 debug_event(adapter->erp_dbf, 3, &erp_action->action,
                             sizeof (int));
-                retval = 1;
         }
-
-        return retval;
 }
 
-/*
- * purpose:     generic handler for asynchronous events related to erp_action
- *               events (normal completion, time-out, dismissing, retry after
- *              low memory condition)
- *
- * note:        deletion of timer is not required (e.g. in case of a time-out),
- *              but a second try does no harm,
- *              we leave it in here to allow for greater simplification
- *
- * returns:     0 - there was an action to handle
- *              !0 - otherwise
+/**
+ * zfcp_erp_async_handler - wrapper for erp_async_handler_nolock w/ locking
  */
-int
-zfcp_erp_async_handler(struct zfcp_erp_action *erp_action,
-                       unsigned long set_mask)
+void zfcp_erp_async_handler(struct zfcp_erp_action *erp_action,
+                            unsigned long set_mask)
 {
         struct zfcp_adapter *adapter = erp_action->adapter;
         unsigned long flags;
-        int retval;
 
         write_lock_irqsave(&adapter->erp_lock, flags);
-        retval = zfcp_erp_async_handler_nolock(erp_action, set_mask);
+        zfcp_erp_async_handler_nolock(erp_action, set_mask);
         write_unlock_irqrestore(&adapter->erp_lock, flags);
-
-        return retval;
 }
 
 /*
@@ -999,17 +969,15 @@ zfcp_erp_timeout_handler(unsigned long data)
         zfcp_erp_async_handler(erp_action, ZFCP_STATUS_ERP_TIMEDOUT);
 }
 
-/*
- * purpose:     is called for an erp_action which needs to be ended
- *              though not being done,
- *              this is usually required if an higher is generated,
- *              action gets an appropriate flag and will be processed
- *              accordingly
+/**
+ * zfcp_erp_action_dismiss - dismiss an erp_action
  *
- * locks:       erp_lock held (thus we need to call another handler variant)
+ * adapter->erp_lock must be held
+ * 
+ * Dismissal of an erp_action is usually required if an erp_action of
+ * higher priority is generated.
  */
-static int
-zfcp_erp_action_dismiss(struct zfcp_erp_action *erp_action)
+static void zfcp_erp_action_dismiss(struct zfcp_erp_action *erp_action)
 {
         struct zfcp_adapter *adapter = erp_action->adapter;
 
@@ -1017,8 +985,6 @@ zfcp_erp_action_dismiss(struct zfcp_erp_action *erp_action)
         debug_event(adapter->erp_dbf, 2, &erp_action->action, sizeof (int));
 
         zfcp_erp_async_handler_nolock(erp_action, ZFCP_STATUS_ERP_DISMISSED);
-
-        return 0;
 }
 
 int
@@ -2074,18 +2040,12 @@ zfcp_erp_adapter_strategy_open_qdio(struct zfcp_erp_action *erp_action)
         return retval;
 }
 
-/*
- * function:    zfcp_qdio_cleanup
- *
- * purpose:     cleans up QDIO operation for the specified adapter
- *
- * returns:     0 - successful cleanup
- *              !0 - failed cleanup
+/**
+ * zfcp_erp_adapter_strategy_close_qdio - close qdio queues for an adapter
  */
-int
+static void
 zfcp_erp_adapter_strategy_close_qdio(struct zfcp_erp_action *erp_action)
 {
-        int retval = ZFCP_ERP_SUCCEEDED;
         int first_used;
         int used_count;
         struct zfcp_adapter *adapter = erp_action->adapter;
@@ -2094,15 +2054,13 @@ zfcp_erp_adapter_strategy_close_qdio(struct zfcp_erp_action *erp_action)
                 ZFCP_LOG_DEBUG("error: attempt to shut down inactive QDIO "
                                "queues on adapter %s\n",
                                zfcp_get_busid_by_adapter(adapter));
-                retval = ZFCP_ERP_FAILED;
-                goto out;
+                return;
         }
 
         /*
          * Get queue_lock and clear QDIOUP flag. Thus it's guaranteed that
          * do_QDIO won't be called while qdio_shutdown is in progress.
          */
-
         write_lock_irq(&adapter->request_queue.queue_lock);
         atomic_clear_mask(ZFCP_STATUS_ADAPTER_QDIOUP, &adapter->status);
         write_unlock_irq(&adapter->request_queue.queue_lock);
@@ -2134,8 +2092,6 @@ zfcp_erp_adapter_strategy_close_qdio(struct zfcp_erp_action *erp_action)
         adapter->request_queue.free_index = 0;
         atomic_set(&adapter->request_queue.free_count, 0);
         adapter->request_queue.distance_from_int = 0;
- out:
-        return retval;
 }
 
 static int
@@ -2168,9 +2124,9 @@ zfcp_erp_adapter_strategy_open_fsf_xconfig(struct zfcp_erp_action *erp_action)
                 atomic_clear_mask(ZFCP_STATUS_ADAPTER_HOST_CON_INIT,
                                   &adapter->status);
                 ZFCP_LOG_DEBUG("Doing exchange config data\n");
-                write_lock(&adapter->erp_lock);
+                write_lock_irq(&adapter->erp_lock);
                 zfcp_erp_action_to_running(erp_action);
-                write_unlock(&adapter->erp_lock);
+                write_unlock_irq(&adapter->erp_lock);
                 zfcp_erp_timeout_init(erp_action);
                 if (zfcp_fsf_exchange_config_data(erp_action)) {
                         retval = ZFCP_ERP_FAILED;
@@ -2236,9 +2192,9 @@ zfcp_erp_adapter_strategy_open_fsf_xport(struct zfcp_erp_action *erp_action)
         adapter = erp_action->adapter;
         atomic_clear_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
 
-        write_lock(&adapter->erp_lock);
+        write_lock_irq(&adapter->erp_lock);
         zfcp_erp_action_to_running(erp_action);
-        write_unlock(&adapter->erp_lock);
+        write_unlock_irq(&adapter->erp_lock);
 
         zfcp_erp_timeout_init(erp_action);
         ret = zfcp_fsf_exchange_port_data(erp_action, adapter, NULL);
@@ -2258,11 +2214,11 @@ zfcp_erp_adapter_strategy_open_fsf_xport(struct zfcp_erp_action *erp_action)
                               "%s)\n", zfcp_get_busid_by_adapter(adapter));
                 ret = ZFCP_ERP_FAILED;
         }
-        if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status)) {
-                ZFCP_LOG_INFO("error: exchange port data failed (adapter "
+
+        /* don't treat as error for the sake of compatibility */
+        if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status))
+                ZFCP_LOG_INFO("warning: exchange port data failed (adapter "
                               "%s\n", zfcp_get_busid_by_adapter(adapter));
-                ret = ZFCP_ERP_FAILED;
-        }
 
         return ret;
 }
@@ -2292,18 +2248,12 @@ zfcp_erp_adapter_strategy_open_fsf_statusread(struct zfcp_erp_action
         return retval;
 }
 
-/*
- * function:    zfcp_fsf_cleanup
- *
- * purpose:     cleanup FSF operation for specified adapter
- *
- * returns:     0 - FSF operation successfully cleaned up
- *              !0 - failed to cleanup FSF operation for this adapter
+/**
+ * zfcp_erp_adapter_strategy_close_fsf - stop FSF operations for an adapter
  */
-static int
+static void
 zfcp_erp_adapter_strategy_close_fsf(struct zfcp_erp_action *erp_action)
 {
-        int retval = ZFCP_ERP_SUCCEEDED;
         struct zfcp_adapter *adapter = erp_action->adapter;
 
         /*
@@ -2317,8 +2267,6 @@ zfcp_erp_adapter_strategy_close_fsf(struct zfcp_erp_action *erp_action)
         /* all ports and units are closed */
         zfcp_erp_modify_adapter_status(adapter,
                                        ZFCP_STATUS_COMMON_OPEN, ZFCP_CLEAR);
-
-        return retval;
 }
 
 /*
@@ -3293,10 +3241,8 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
 }
 
 
-static int
-zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
+void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
 {
-        int retval = 0;
         struct zfcp_port *port;
 
         debug_text_event(adapter->erp_dbf, 5, "a_actab");
@@ -3305,14 +3251,10 @@ zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
         else
                 list_for_each_entry(port, &adapter->port_list_head, list)
                     zfcp_erp_action_dismiss_port(port);
-
-        return retval;
 }
 
-static int
-zfcp_erp_action_dismiss_port(struct zfcp_port *port)
+static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
 {
-        int retval = 0;
         struct zfcp_unit *unit;
         struct zfcp_adapter *adapter = port->adapter;
 
@@ -3323,22 +3265,16 @@ zfcp_erp_action_dismiss_port(struct zfcp_port *port)
         else
                 list_for_each_entry(unit, &port->unit_list_head, list)
                     zfcp_erp_action_dismiss_unit(unit);
-
-        return retval;
 }
 
-static int
-zfcp_erp_action_dismiss_unit(struct zfcp_unit *unit)
+static void zfcp_erp_action_dismiss_unit(struct zfcp_unit *unit)
 {
-        int retval = 0;
         struct zfcp_adapter *adapter = unit->port->adapter;
 
         debug_text_event(adapter->erp_dbf, 5, "u_actab");
         debug_event(adapter->erp_dbf, 5, &unit->fcp_lun, sizeof (fcp_lun_t));
         if (atomic_test_mask(ZFCP_STATUS_COMMON_ERP_INUSE, &unit->status))
                 zfcp_erp_action_dismiss(&unit->erp_action);
-
-        return retval;
 }
 
 static inline void
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index d02366004cdd..146d7a2b4c4a 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -63,7 +63,6 @@ extern int  zfcp_qdio_allocate_queues(struct zfcp_adapter *);
 extern void zfcp_qdio_free_queues(struct zfcp_adapter *);
 extern int  zfcp_qdio_determine_pci(struct zfcp_qdio_queue *,
                                     struct zfcp_fsf_req *);
-extern int  zfcp_qdio_reqid_check(struct zfcp_adapter *, void *);
 
 extern volatile struct qdio_buffer_element *zfcp_qdio_sbale_req
         (struct zfcp_fsf_req *, int, int);
@@ -140,6 +139,7 @@ extern void zfcp_erp_modify_adapter_status(struct zfcp_adapter *, u32, int);
 extern int  zfcp_erp_adapter_reopen(struct zfcp_adapter *, int);
 extern int  zfcp_erp_adapter_shutdown(struct zfcp_adapter *, int);
 extern void zfcp_erp_adapter_failed(struct zfcp_adapter *);
+extern void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *);
 
 extern void zfcp_erp_modify_port_status(struct zfcp_port *, u32, int);
 extern int  zfcp_erp_port_reopen(struct zfcp_port *, int);
@@ -156,7 +156,7 @@ extern void zfcp_erp_unit_failed(struct zfcp_unit *);
 extern int  zfcp_erp_thread_setup(struct zfcp_adapter *);
 extern int  zfcp_erp_thread_kill(struct zfcp_adapter *);
 extern int  zfcp_erp_wait(struct zfcp_adapter *);
-extern int  zfcp_erp_async_handler(struct zfcp_erp_action *, unsigned long);
+extern void zfcp_erp_async_handler(struct zfcp_erp_action *, unsigned long);
 
 extern int  zfcp_test_link(struct zfcp_port *);
 
@@ -190,5 +190,10 @@ extern void zfcp_scsi_dbf_event_abort(const char *, struct zfcp_adapter *,
                                       struct zfcp_fsf_req *);
 extern void zfcp_scsi_dbf_event_devreset(const char *, u8, struct zfcp_unit *,
                                          struct scsi_cmnd *);
+extern void zfcp_reqlist_add(struct zfcp_adapter *, struct zfcp_fsf_req *);
+extern void zfcp_reqlist_remove(struct zfcp_adapter *, unsigned long);
+extern struct zfcp_fsf_req *zfcp_reqlist_ismember(struct zfcp_adapter *,
+                                                  unsigned long);
+extern int zfcp_reqlist_isempty(struct zfcp_adapter *);
 
 #endif  /* ZFCP_EXT_H */
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 6335f9229184..ff2eacf5ec8c 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -49,7 +49,6 @@ static int zfcp_fsf_fsfstatus_qual_eval(struct zfcp_fsf_req *);
 static void zfcp_fsf_link_down_info_eval(struct zfcp_adapter *,
         struct fsf_link_down_info *);
 static int zfcp_fsf_req_dispatch(struct zfcp_fsf_req *);
-static void zfcp_fsf_req_dismiss(struct zfcp_fsf_req *);
 
 /* association between FSF command and FSF QTCB type */
 static u32 fsf_qtcb_type[] = {
@@ -146,47 +145,48 @@ zfcp_fsf_req_free(struct zfcp_fsf_req *fsf_req)
                 kfree(fsf_req);
 }
 
-/*
- * function:    
- *
- * purpose:     
- *
- * returns:
- *
- * note: qdio queues shall be down (no ongoing inbound processing)
+/**
+ * zfcp_fsf_req_dismiss - dismiss a single fsf request
  */
-int
-zfcp_fsf_req_dismiss_all(struct zfcp_adapter *adapter)
+static void zfcp_fsf_req_dismiss(struct zfcp_adapter *adapter,
+                                 struct zfcp_fsf_req *fsf_req,
+                                 unsigned int counter)
 {
-        struct zfcp_fsf_req *fsf_req, *tmp;
-        unsigned long flags;
-        LIST_HEAD(remove_queue);
-
-        spin_lock_irqsave(&adapter->fsf_req_list_lock, flags);
-        list_splice_init(&adapter->fsf_req_list_head, &remove_queue);
-        atomic_set(&adapter->fsf_reqs_active, 0);
-        spin_unlock_irqrestore(&adapter->fsf_req_list_lock, flags);
+        u64 dbg_tmp[2];
 
-        list_for_each_entry_safe(fsf_req, tmp, &remove_queue, list) {
-                list_del(&fsf_req->list);
-                zfcp_fsf_req_dismiss(fsf_req);
-        }
-
-        return 0;
+        dbg_tmp[0] = (u64) atomic_read(&adapter->reqs_active);
+        dbg_tmp[1] = (u64) counter;
+        debug_event(adapter->erp_dbf, 4, (void *) dbg_tmp, 16);
+        list_del(&fsf_req->list);
+        fsf_req->status |= ZFCP_STATUS_FSFREQ_DISMISSED;
+        zfcp_fsf_req_complete(fsf_req);
 }
 
-/*
- * function:    
- *
- * purpose:     
- *
- * returns:
+/**
+ * zfcp_fsf_req_dismiss_all - dismiss all remaining fsf requests
  */
-static void
-zfcp_fsf_req_dismiss(struct zfcp_fsf_req *fsf_req)
+int zfcp_fsf_req_dismiss_all(struct zfcp_adapter *adapter)
 {
-        fsf_req->status |= ZFCP_STATUS_FSFREQ_DISMISSED;
-        zfcp_fsf_req_complete(fsf_req);
+        struct zfcp_fsf_req *request, *tmp;
+        unsigned long flags;
+        unsigned int i, counter;
+
+        spin_lock_irqsave(&adapter->req_list_lock, flags);
+        atomic_set(&adapter->reqs_active, 0);
+        for (i=0; i<REQUEST_LIST_SIZE; i++) {
+                if (list_empty(&adapter->req_list[i]))
+                        continue;
+
+                counter = 0;
+                list_for_each_entry_safe(request, tmp,
+                                         &adapter->req_list[i], list) {
+                        zfcp_fsf_req_dismiss(adapter, request, counter);
+                        counter++;
+                }
+        }
+        spin_unlock_irqrestore(&adapter->req_list_lock, flags);
+
+        return 0;
 }
 
 /*
@@ -2227,7 +2227,7 @@ zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action,
         /* setup new FSF request */
         retval = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA,
                                      erp_action ? ZFCP_REQ_AUTO_CLEANUP : 0,
-                                     0, &lock_flags, &fsf_req);
+                                     NULL, &lock_flags, &fsf_req);
         if (retval < 0) {
                 ZFCP_LOG_INFO("error: Out of resources. Could not create an "
                               "exchange port data request for"
@@ -4592,12 +4592,14 @@ static inline void
 zfcp_fsf_req_qtcb_init(struct zfcp_fsf_req *fsf_req)
 {
         if (likely(fsf_req->qtcb != NULL)) {
-                fsf_req->qtcb->prefix.req_seq_no = fsf_req->adapter->fsf_req_seq_no;
-                fsf_req->qtcb->prefix.req_id = (unsigned long)fsf_req;
+                fsf_req->qtcb->prefix.req_seq_no =
+                        fsf_req->adapter->fsf_req_seq_no;
+                fsf_req->qtcb->prefix.req_id = fsf_req->req_id;
                 fsf_req->qtcb->prefix.ulp_info = ZFCP_ULP_INFO_VERSION;
-                fsf_req->qtcb->prefix.qtcb_type = fsf_qtcb_type[fsf_req->fsf_command];
+                fsf_req->qtcb->prefix.qtcb_type =
+                        fsf_qtcb_type[fsf_req->fsf_command];
                 fsf_req->qtcb->prefix.qtcb_version = ZFCP_QTCB_VERSION;
-                fsf_req->qtcb->header.req_handle = (unsigned long)fsf_req;
+                fsf_req->qtcb->header.req_handle = fsf_req->req_id;
                 fsf_req->qtcb->header.fsf_command = fsf_req->fsf_command;
         }
 }
@@ -4654,6 +4656,7 @@ zfcp_fsf_req_create(struct zfcp_adapter *adapter, u32 fsf_cmd, int req_flags,
 {
         volatile struct qdio_buffer_element *sbale;
         struct zfcp_fsf_req *fsf_req = NULL;
+        unsigned long flags;
         int ret = 0;
         struct zfcp_qdio_queue *req_queue = &adapter->request_queue;
 
@@ -4668,6 +4671,12 @@ zfcp_fsf_req_create(struct zfcp_adapter *adapter, u32 fsf_cmd, int req_flags,
 
         fsf_req->adapter = adapter;
         fsf_req->fsf_command = fsf_cmd;
+        INIT_LIST_HEAD(&fsf_req->list);
+        
+        /* unique request id */
+        spin_lock_irqsave(&adapter->req_list_lock, flags);
+        fsf_req->req_id = adapter->req_no++;
+        spin_unlock_irqrestore(&adapter->req_list_lock, flags);
 
         zfcp_fsf_req_qtcb_init(fsf_req);
 
@@ -4707,7 +4716,7 @@ zfcp_fsf_req_create(struct zfcp_adapter *adapter, u32 fsf_cmd, int req_flags,
         sbale = zfcp_qdio_sbale_req(fsf_req, fsf_req->sbal_curr, 0);
 
         /* setup common SBALE fields */
-        sbale[0].addr = fsf_req;
+        sbale[0].addr = (void *) fsf_req->req_id;
         sbale[0].flags |= SBAL_FLAGS0_COMMAND;
         if (likely(fsf_req->qtcb != NULL)) {
                 sbale[1].addr = (void *) fsf_req->qtcb;
@@ -4747,7 +4756,7 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
         volatile struct qdio_buffer_element *sbale;
         int inc_seq_no;
         int new_distance_from_int;
-        unsigned long flags;
+        u64 dbg_tmp[2];
         int retval = 0;
 
         adapter = fsf_req->adapter;
@@ -4761,10 +4770,10 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
         ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_TRACE, (char *) sbale[1].addr,
                       sbale[1].length);
 
-        /* put allocated FSF request at list tail */
-        spin_lock_irqsave(&adapter->fsf_req_list_lock, flags);
-        list_add_tail(&fsf_req->list, &adapter->fsf_req_list_head);
-        spin_unlock_irqrestore(&adapter->fsf_req_list_lock, flags);
+        /* put allocated FSF request into hash table */
+        spin_lock(&adapter->req_list_lock);
+        zfcp_reqlist_add(adapter, fsf_req);
+        spin_unlock(&adapter->req_list_lock);
 
         inc_seq_no = (fsf_req->qtcb != NULL);
 
@@ -4803,6 +4812,10 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
                          QDIO_FLAG_SYNC_OUTPUT,
                          0, fsf_req->sbal_first, fsf_req->sbal_number, NULL);
 
+        dbg_tmp[0] = (unsigned long) sbale[0].addr;
+        dbg_tmp[1] = (u64) retval;
+        debug_event(adapter->erp_dbf, 4, (void *) dbg_tmp, 16);
+
         if (unlikely(retval)) {
                 /* Queues are down..... */
                 retval = -EIO;
@@ -4812,22 +4825,17 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
                  */
                 if (timer)
                         del_timer(timer);
-                spin_lock_irqsave(&adapter->fsf_req_list_lock, flags);
-                list_del(&fsf_req->list);
-                spin_unlock_irqrestore(&adapter->fsf_req_list_lock, flags);
-                /*
-                 * adjust the number of free SBALs in request queue as well as
-                 * position of first one
-                 */
+                spin_lock(&adapter->req_list_lock);
+                zfcp_reqlist_remove(adapter, fsf_req->req_id);
+                spin_unlock(&adapter->req_list_lock);
+                /* undo changes in request queue made for this request */
                 zfcp_qdio_zero_sbals(req_queue->buffer,
                                      fsf_req->sbal_first, fsf_req->sbal_number);
                 atomic_add(fsf_req->sbal_number, &req_queue->free_count);
-                req_queue->free_index -= fsf_req->sbal_number;   /* increase */
+                req_queue->free_index -= fsf_req->sbal_number;
                 req_queue->free_index += QDIO_MAX_BUFFERS_PER_Q;
                 req_queue->free_index %= QDIO_MAX_BUFFERS_PER_Q; /* wrap */
-                ZFCP_LOG_DEBUG
-                        ("error: do_QDIO failed. Buffers could not be enqueued "
-                         "to request queue.\n");
+                zfcp_erp_adapter_reopen(adapter, 0);
         } else {
                 req_queue->distance_from_int = new_distance_from_int;
                 /*
@@ -4843,7 +4851,7 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
                         adapter->fsf_req_seq_no++;
 
                 /* count FSF requests pending */
-                atomic_inc(&adapter->fsf_reqs_active);
+                atomic_inc(&adapter->reqs_active);
         }
         return retval;
 }
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 345a191926a4..dbd9f48e863e 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -282,6 +282,37 @@ zfcp_qdio_request_handler(struct ccw_device *ccw_device,
         return;
 }
 
+/**
+ * zfcp_qdio_reqid_check - checks for valid reqids or unsolicited status
+ */
+static int zfcp_qdio_reqid_check(struct zfcp_adapter *adapter, 
+                                 unsigned long req_id)
+{
+        struct zfcp_fsf_req *fsf_req;
+        unsigned long flags;
+
+        debug_long_event(adapter->erp_dbf, 4, req_id);
+
+        spin_lock_irqsave(&adapter->req_list_lock, flags);
+        fsf_req = zfcp_reqlist_ismember(adapter, req_id);
+
+        if (!fsf_req) {
+                spin_unlock_irqrestore(&adapter->req_list_lock, flags);
+                ZFCP_LOG_NORMAL("error: unknown request id (%ld).\n", req_id);
+                zfcp_erp_adapter_reopen(adapter, 0);
+                return -EINVAL;
+        }
+
+        zfcp_reqlist_remove(adapter, req_id);
+        atomic_dec(&adapter->reqs_active);
+        spin_unlock_irqrestore(&adapter->req_list_lock, flags);
+
+        /* finish the FSF request */
+        zfcp_fsf_req_complete(fsf_req);
+
+        return 0;
+}
+
 /*
  * function:    zfcp_qdio_response_handler
  *
@@ -344,7 +375,7 @@ zfcp_qdio_response_handler(struct ccw_device *ccw_device,
                         /* look for QDIO request identifiers in SB */
                         buffere = &buffer->element[buffere_index];
                         retval = zfcp_qdio_reqid_check(adapter,
-                                                       (void *) buffere->addr);
+                                        (unsigned long) buffere->addr);
 
                         if (retval) {
                                 ZFCP_LOG_NORMAL("bug: unexpected inbound "
@@ -415,51 +446,6 @@ zfcp_qdio_response_handler(struct ccw_device *ccw_device,
         return;
 }
 
-/*
- * function:    zfcp_qdio_reqid_check
- *
- * purpose:     checks for valid reqids or unsolicited status
- *
- * returns:     0 - valid request id or unsolicited status
- *              !0 - otherwise
- */
-int
-zfcp_qdio_reqid_check(struct zfcp_adapter *adapter, void *sbale_addr)
-{
-        struct zfcp_fsf_req *fsf_req;
-
-        /* invalid (per convention used in this driver) */
-        if (unlikely(!sbale_addr)) {
-                ZFCP_LOG_NORMAL("bug: invalid reqid\n");
-                return -EINVAL;
-        }
-
-        /* valid request id and thus (hopefully :) valid fsf_req address */
-        fsf_req = (struct zfcp_fsf_req *) sbale_addr;
-
-        /* serialize with zfcp_fsf_req_dismiss_all */
-        spin_lock(&adapter->fsf_req_list_lock);
-        if (list_empty(&adapter->fsf_req_list_head)) {
-                spin_unlock(&adapter->fsf_req_list_lock);
-                return 0;
-        }
-        list_del(&fsf_req->list);
-        atomic_dec(&adapter->fsf_reqs_active);
-        spin_unlock(&adapter->fsf_req_list_lock);
-        
-        if (unlikely(adapter != fsf_req->adapter)) {
-                ZFCP_LOG_NORMAL("bug: invalid reqid (fsf_req=%p, "
-                                "fsf_req->adapter=%p, adapter=%p)\n",
-                                fsf_req, fsf_req->adapter, adapter);
-                return -EINVAL;
-        }
-
-        /* finish the FSF request */
-        zfcp_fsf_req_complete(fsf_req);
-
-        return 0;
-}
-
 /**
  * zfcp_qdio_sbale_get - return pointer to SBALE of qdio_queue
  * @queue: queue from which SBALE should be returned
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 46e14f22ec18..1bb55086db9f 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -30,7 +30,6 @@ static int zfcp_scsi_queuecommand(struct scsi_cmnd *,
                                   void (*done) (struct scsi_cmnd *));
 static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *);
 static int zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *);
-static int zfcp_scsi_eh_bus_reset_handler(struct scsi_cmnd *);
 static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *);
 static int zfcp_task_management_function(struct zfcp_unit *, u8,
                                          struct scsi_cmnd *);
@@ -44,33 +43,24 @@ struct scsi_transport_template *zfcp_transport_template;
 
 struct zfcp_data zfcp_data = {
         .scsi_host_template = {
-              name:                    ZFCP_NAME,
-              proc_name:               "zfcp",
-              proc_info:               NULL,
-              detect:                  NULL,
-              slave_alloc:             zfcp_scsi_slave_alloc,
-              slave_configure:         zfcp_scsi_slave_configure,
-              slave_destroy:           zfcp_scsi_slave_destroy,
-              queuecommand:            zfcp_scsi_queuecommand,
-              eh_abort_handler:        zfcp_scsi_eh_abort_handler,
-              eh_device_reset_handler: zfcp_scsi_eh_device_reset_handler,
-              eh_bus_reset_handler:    zfcp_scsi_eh_bus_reset_handler,
-              eh_host_reset_handler:   zfcp_scsi_eh_host_reset_handler,
-                                       /* FIXME(openfcp): Tune */
-              can_queue:               4096,
-              this_id:                 -1,
-              /*
-               * FIXME:
-               * one less? can zfcp_create_sbale cope with it?
-               */
-              sg_tablesize:            ZFCP_MAX_SBALES_PER_REQ,
-              cmd_per_lun:             1,
-              unchecked_isa_dma:       0,
-              use_clustering:          1,
-              sdev_attrs:              zfcp_sysfs_sdev_attrs,
+                .name                   = ZFCP_NAME,
+                .proc_name              = "zfcp",
+                .slave_alloc            = zfcp_scsi_slave_alloc,
+                .slave_configure        = zfcp_scsi_slave_configure,
+                .slave_destroy          = zfcp_scsi_slave_destroy,
+                .queuecommand           = zfcp_scsi_queuecommand,
+                .eh_abort_handler       = zfcp_scsi_eh_abort_handler,
+                .eh_device_reset_handler = zfcp_scsi_eh_device_reset_handler,
+                .eh_bus_reset_handler   = zfcp_scsi_eh_host_reset_handler,
+                .eh_host_reset_handler  = zfcp_scsi_eh_host_reset_handler,
+                .can_queue              = 4096,
+                .this_id                = -1,
+                .sg_tablesize           = ZFCP_MAX_SBALES_PER_REQ,
+                .cmd_per_lun            = 1,
+                .use_clustering         = 1,
+                .sdev_attrs             = zfcp_sysfs_sdev_attrs,
         },
         .driver_version = ZFCP_VERSION,
-        /* rest initialised with zeros */
 };
 
 /* Find start of Response Information in FCP response unit*/
@@ -177,8 +167,14 @@ zfcp_scsi_slave_alloc(struct scsi_device *sdp)
         return retval;
 }
 
-static void
-zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
+/**
+ * zfcp_scsi_slave_destroy - called when scsi device is removed
+ *
+ * Remove reference to associated scsi device for an zfcp_unit.
+ * Mark zfcp_unit as failed. The scsi device might be deleted via sysfs
+ * or a scan for this device might have failed.
+ */
+static void zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
 {
         struct zfcp_unit *unit = (struct zfcp_unit *) sdpnt->hostdata;
 
@@ -186,6 +182,7 @@ zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
                 atomic_clear_mask(ZFCP_STATUS_UNIT_REGISTERED, &unit->status);
                 sdpnt->hostdata = NULL;
                 unit->device = NULL;
+                zfcp_erp_unit_failed(unit);
                 zfcp_unit_put(unit);
         } else {
                 ZFCP_LOG_NORMAL("bug: no unit associated with SCSI device at "
@@ -550,35 +547,38 @@ zfcp_task_management_function(struct zfcp_unit *unit, u8 tm_flags,
 }
 
 /**
- * zfcp_scsi_eh_bus_reset_handler - reset bus (reopen adapter)
+ * zfcp_scsi_eh_host_reset_handler - handler for host and bus reset
+ *
+ * If ERP is already running it will be stopped.
  */
-int
-zfcp_scsi_eh_bus_reset_handler(struct scsi_cmnd *scpnt)
+int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
 {
-        struct zfcp_unit *unit = (struct zfcp_unit*) scpnt->device->hostdata;
-        struct zfcp_adapter *adapter = unit->port->adapter;
-
-        ZFCP_LOG_NORMAL("bus reset because of problems with "
-                        "unit 0x%016Lx\n", unit->fcp_lun);
-        zfcp_erp_adapter_reopen(adapter, 0);
-        zfcp_erp_wait(adapter);
-
-        return SUCCESS;
-}
+        struct zfcp_unit *unit;
+        struct zfcp_adapter *adapter;
+        unsigned long flags;
 
-/**
- * zfcp_scsi_eh_host_reset_handler - reset host (reopen adapter)
- */
-int
-zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
-{
-        struct zfcp_unit *unit = (struct zfcp_unit*) scpnt->device->hostdata;
-        struct zfcp_adapter *adapter = unit->port->adapter;
+        unit = (struct zfcp_unit*) scpnt->device->hostdata;
+        adapter = unit->port->adapter;
 
-        ZFCP_LOG_NORMAL("host reset because of problems with "
+        ZFCP_LOG_NORMAL("host/bus reset because of problems with "
                         "unit 0x%016Lx\n", unit->fcp_lun);
-        zfcp_erp_adapter_reopen(adapter, 0);
-        zfcp_erp_wait(adapter);
+
+        write_lock_irqsave(&adapter->erp_lock, flags);
+        if (atomic_test_mask(ZFCP_STATUS_ADAPTER_ERP_PENDING,
+                             &adapter->status)) {
+                zfcp_erp_modify_adapter_status(adapter,
+                       ZFCP_STATUS_COMMON_UNBLOCKED|ZFCP_STATUS_COMMON_OPEN,
+                       ZFCP_CLEAR);
+                zfcp_erp_action_dismiss_adapter(adapter);
+                write_unlock_irqrestore(&adapter->erp_lock, flags);
+                zfcp_fsf_req_dismiss_all(adapter);
+                adapter->fsf_req_seq_no = 0;
+                zfcp_erp_adapter_reopen(adapter, 0);
+        } else {
+                write_unlock_irqrestore(&adapter->erp_lock, flags);
+                zfcp_erp_adapter_reopen(adapter, 0);
+                zfcp_erp_wait(adapter);
+        }
 
         return SUCCESS;
 }
diff --git a/drivers/sbus/sbus.c b/drivers/sbus/sbus.c
index 16b59773c0bb..935952ef88f1 100644
--- a/drivers/sbus/sbus.c
+++ b/drivers/sbus/sbus.c
@@ -233,7 +233,7 @@ static void __init build_one_sbus(struct device_node *dp, int num_sbus)
         sbus->ofdev.node = dp;
         sbus->ofdev.dev.parent = NULL;
         sbus->ofdev.dev.bus = &sbus_bus_type;
-        strcpy(sbus->ofdev.dev.bus_id, dp->path_component_name);
+        sprintf(sbus->ofdev.dev.bus_id, "sbus%d", num_sbus);
 
         if (of_device_register(&sbus->ofdev) != 0)
                 printk(KERN_DEBUG "sbus: device registration error for %s!\n",
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index eb7a6a4ded75..657a3ab75399 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -173,6 +173,7 @@ STATIC int NCR_700_bus_reset(struct scsi_cmnd * SCpnt);
 STATIC int NCR_700_host_reset(struct scsi_cmnd * SCpnt);
 STATIC void NCR_700_chip_setup(struct Scsi_Host *host);
 STATIC void NCR_700_chip_reset(struct Scsi_Host *host);
+STATIC int NCR_700_slave_alloc(struct scsi_device *SDpnt);
 STATIC int NCR_700_slave_configure(struct scsi_device *SDpnt);
 STATIC void NCR_700_slave_destroy(struct scsi_device *SDpnt);
 static int NCR_700_change_queue_depth(struct scsi_device *SDpnt, int depth);
@@ -182,10 +183,6 @@ STATIC struct device_attribute *NCR_700_dev_attrs[];
 
 STATIC struct scsi_transport_template *NCR_700_transport_template = NULL;
 
-struct NCR_700_sense {
-        unsigned char cmnd[MAX_COMMAND_SIZE];
-};
-
 static char *NCR_700_phase[] = {
         "",
         "after selection",
@@ -333,6 +330,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,
         tpnt->use_clustering = ENABLE_CLUSTERING;
         tpnt->slave_configure = NCR_700_slave_configure;
         tpnt->slave_destroy = NCR_700_slave_destroy;
+        tpnt->slave_alloc = NCR_700_slave_alloc;
         tpnt->change_queue_depth = NCR_700_change_queue_depth;
         tpnt->change_queue_type = NCR_700_change_queue_type;
 
@@ -611,9 +609,10 @@ NCR_700_scsi_done(struct NCR_700_Host_Parameters *hostdata,
                 struct NCR_700_command_slot *slot = 
                         (struct NCR_700_command_slot *)SCp->host_scribble;
                 
-                NCR_700_unmap(hostdata, SCp, slot);
+                dma_unmap_single(hostdata->dev, slot->pCmd,
+                                 sizeof(SCp->cmnd), DMA_TO_DEVICE);
                 if (slot->flags == NCR_700_FLAG_AUTOSENSE) {
-                        struct NCR_700_sense *sense = SCp->device->hostdata;
+                        char *cmnd = NCR_700_get_sense_cmnd(SCp->device);
 #ifdef NCR_700_DEBUG
                         printk(" ORIGINAL CMD %p RETURNED %d, new return is %d sense is\n",
                                SCp, SCp->cmnd[7], result);
@@ -624,10 +623,9 @@ NCR_700_scsi_done(struct NCR_700_Host_Parameters *hostdata,
                         /* restore the old result if the request sense was
                          * successful */
                         if(result == 0)
-                                result = sense->cmnd[7];
+                                result = cmnd[7];
                 } else
-                        dma_unmap_single(hostdata->dev, slot->pCmd,
-                                         sizeof(SCp->cmnd), DMA_TO_DEVICE);
+                        NCR_700_unmap(hostdata, SCp, slot);
 
                 free_slot(slot, hostdata);
 #ifdef NCR_700_DEBUG
@@ -969,14 +967,15 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
                    status_byte(hostdata->status[0]) == COMMAND_TERMINATED) {
                         struct NCR_700_command_slot *slot =
                                 (struct NCR_700_command_slot *)SCp->host_scribble;
-                        if(SCp->cmnd[0] == REQUEST_SENSE) {
+                        if(slot->flags == NCR_700_FLAG_AUTOSENSE) {
                                 /* OOPS: bad device, returning another
                                  * contingent allegiance condition */
                                 scmd_printk(KERN_ERR, SCp,
                                         "broken device is looping in contingent allegiance: ignoring\n");
                                 NCR_700_scsi_done(hostdata, SCp, hostdata->status[0]);
                         } else {
-                                struct NCR_700_sense *sense = SCp->device->hostdata;
+                                char *cmnd =
+                                        NCR_700_get_sense_cmnd(SCp->device);
 #ifdef NCR_DEBUG
                                 scsi_print_command(SCp);
                                 printk("  cmd %p has status %d, requesting sense\n",
@@ -994,21 +993,21 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
                                                  sizeof(SCp->cmnd),
                                                  DMA_TO_DEVICE);
 
-                                sense->cmnd[0] = REQUEST_SENSE;
-                                sense->cmnd[1] = (SCp->device->lun & 0x7) << 5;
-                                sense->cmnd[2] = 0;
-                                sense->cmnd[3] = 0;
-                                sense->cmnd[4] = sizeof(SCp->sense_buffer);
-                                sense->cmnd[5] = 0;
+                                cmnd[0] = REQUEST_SENSE;
+                                cmnd[1] = (SCp->device->lun & 0x7) << 5;
+                                cmnd[2] = 0;
+                                cmnd[3] = 0;
+                                cmnd[4] = sizeof(SCp->sense_buffer);
+                                cmnd[5] = 0;
                                 /* Here's a quiet hack: the
                                  * REQUEST_SENSE command is six bytes,
                                  * so store a flag indicating that
                                  * this was an internal sense request
                                  * and the original status at the end
                                  * of the command */
-                                sense->cmnd[6] = NCR_700_INTERNAL_SENSE_MAGIC;
-                                sense->cmnd[7] = hostdata->status[0];
-                                slot->pCmd = dma_map_single(hostdata->dev, sense->cmnd, sizeof(sense->cmnd), DMA_TO_DEVICE);
+                                cmnd[6] = NCR_700_INTERNAL_SENSE_MAGIC;
+                                cmnd[7] = hostdata->status[0];
+                                slot->pCmd = dma_map_single(hostdata->dev, cmnd, MAX_COMMAND_SIZE, DMA_TO_DEVICE);
                                 slot->dma_handle = dma_map_single(hostdata->dev, SCp->sense_buffer, sizeof(SCp->sense_buffer), DMA_FROM_DEVICE);
                                 slot->SG[0].ins = bS_to_host(SCRIPT_MOVE_DATA_IN | sizeof(SCp->sense_buffer));
                                 slot->SG[0].pAddr = bS_to_host(slot->dma_handle);
@@ -1530,7 +1529,7 @@ NCR_700_intr(int irq, void *dev_id, struct pt_regs *regs)
 
                         /* clear all the negotiated parameters */
                         __shost_for_each_device(SDp, host)
-                                SDp->hostdata = NULL;
+                                NCR_700_clear_flag(SDp, ~0);
                         
                         /* clear all the slots and their pending commands */
                         for(i = 0; i < NCR_700_COMMAND_SLOTS_PER_HOST; i++) {
@@ -2035,7 +2034,17 @@ NCR_700_set_offset(struct scsi_target *STp, int offset)
         spi_flags(STp) |= NCR_700_DEV_PRINT_SYNC_NEGOTIATION;
 }
 
+STATIC int
+NCR_700_slave_alloc(struct scsi_device *SDp)
+{
+        SDp->hostdata = kzalloc(sizeof(struct NCR_700_Device_Parameters),
+                                GFP_KERNEL);
 
+        if (!SDp->hostdata)
+                return -ENOMEM;
+
+        return 0;
+}
 
 STATIC int
 NCR_700_slave_configure(struct scsi_device *SDp)
@@ -2043,11 +2052,6 @@ NCR_700_slave_configure(struct scsi_device *SDp)
         struct NCR_700_Host_Parameters *hostdata = 
                 (struct NCR_700_Host_Parameters *)SDp->host->hostdata[0];
 
-        SDp->hostdata = kmalloc(GFP_KERNEL, sizeof(struct NCR_700_sense));
-
-        if (!SDp->hostdata)
-                return -ENOMEM;
-
         /* to do here: allocate memory; build a queue_full list */
         if(SDp->tagged_supported) {
                 scsi_set_tag_type(SDp, MSG_ORDERED_TAG);
diff --git a/drivers/scsi/53c700.h b/drivers/scsi/53c700.h
index 7f22a06fe5ec..97ebe71b701b 100644
--- a/drivers/scsi/53c700.h
+++ b/drivers/scsi/53c700.h
@@ -12,7 +12,7 @@
 #include <asm/io.h>
 
 #include <scsi/scsi_device.h>
-
+#include <scsi/scsi_cmnd.h>
 
 /* Turn on for general debugging---too verbose for normal use */
 #undef  NCR_700_DEBUG
@@ -76,11 +76,16 @@ struct NCR_700_SG_List {
         #define SCRIPT_RETURN                   0x90080000
 };
 
-/* We use device->hostdata to store negotiated parameters.  This is
- * supposed to be a pointer to a device private area, but we cannot
- * really use it as such since it will never be freed, so just use the
- * 32 bits to cram the information.  The SYNC negotiation sequence looks
- * like:
+struct NCR_700_Device_Parameters {
+        /* space for creating a request sense command. Really, except
+         * for the annoying SCSI-2 requirement for LUN information in
+         * cmnd[1], this could be in static storage */
+        unsigned char cmnd[MAX_COMMAND_SIZE];
+        __u8    depth;
+};
+
+
+/* The SYNC negotiation sequence looks like:
  * 
  * If DEV_NEGOTIATED_SYNC not set, tack and SDTR message on to the
  * initial identify for the device and set DEV_BEGIN_SYNC_NEGOTATION
@@ -98,19 +103,26 @@ struct NCR_700_SG_List {
 #define NCR_700_DEV_BEGIN_SYNC_NEGOTIATION      (1<<17)
 #define NCR_700_DEV_PRINT_SYNC_NEGOTIATION (1<<19)
 
+static inline char *NCR_700_get_sense_cmnd(struct scsi_device *SDp)
+{
+        struct NCR_700_Device_Parameters *hostdata = SDp->hostdata;
+
+        return hostdata->cmnd;
+}
+
 static inline void
 NCR_700_set_depth(struct scsi_device *SDp, __u8 depth)
 {
-        long l = (long)SDp->hostdata;
+        struct NCR_700_Device_Parameters *hostdata = SDp->hostdata;
 
-        l &= 0xffff00ff;
-        l |= 0xff00 & (depth << 8);
-        SDp->hostdata = (void *)l;
+        hostdata->depth = depth;
 }
 static inline __u8
 NCR_700_get_depth(struct scsi_device *SDp)
 {
-        return ((((unsigned long)SDp->hostdata) & 0xff00)>>8);
+        struct NCR_700_Device_Parameters *hostdata = SDp->hostdata;
+
+        return hostdata->depth;
 }
 static inline int
 NCR_700_is_flag_set(struct scsi_device *SDp, __u32 flag)
diff --git a/drivers/scsi/53c7xx.c b/drivers/scsi/53c7xx.c
index c690c2b89e41..acf292736b4e 100644
--- a/drivers/scsi/53c7xx.c
+++ b/drivers/scsi/53c7xx.c
@@ -3451,12 +3451,12 @@ create_cmd (Scsi_Cmnd *cmd) {
     for (i = 0; cmd->use_sg ? (i < cmd->use_sg) : !i; cmd_datain += 4, 
         cmd_dataout += 4, ++i) {
         u32 vbuf = cmd->use_sg
-            ? (u32)page_address(((struct scatterlist *)cmd->buffer)[i].page)+
-              ((struct scatterlist *)cmd->buffer)[i].offset
+            ? (u32)page_address(((struct scatterlist *)cmd->request_buffer)[i].page)+
+              ((struct scatterlist *)cmd->request_buffer)[i].offset
             : (u32)(cmd->request_buffer);
         u32 bbuf = virt_to_bus((void *)vbuf);
         u32 count = cmd->use_sg ?
-            ((struct scatterlist *)cmd->buffer)[i].length :
+            ((struct scatterlist *)cmd->request_buffer)[i].length :
             cmd->request_bufflen;
 
         /*
@@ -5417,7 +5417,7 @@ insn_to_offset (Scsi_Cmnd *cmd, u32 *insn) {
 
             if ((buffers = cmd->use_sg)) {
                 for (offset = 0, 
-                        segment = (struct scatterlist *) cmd->buffer;
+                        segment = (struct scatterlist *) cmd->request_buffer;
                      buffers && !((found = ((ptr >= (char *)page_address(segment->page)+segment->offset) && 
                             (ptr < ((char *)page_address(segment->page)+segment->offset+segment->length)))));
                      --buffers, offset += segment->length, ++segment)
diff --git a/drivers/scsi/NCR53C9x.c b/drivers/scsi/NCR53C9x.c
index 8a4659e94105..bdc6bb262bce 100644
--- a/drivers/scsi/NCR53C9x.c
+++ b/drivers/scsi/NCR53C9x.c
@@ -911,7 +911,7 @@ static void esp_get_dmabufs(struct NCR_ESP *esp, Scsi_Cmnd *sp)
                         sp->SCp.ptr =
                                 (char *) virt_to_phys(sp->request_buffer);
         } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->buffer;
+                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
                 sp->SCp.buffers_residual = sp->use_sg - 1;
                 sp->SCp.this_residual = sp->SCp.buffer->length;
                 if (esp->dma_mmu_get_scsi_sgl)
@@ -2152,29 +2152,23 @@ static int esp_do_data_finale(struct NCR_ESP *esp,
  */
 static int esp_should_clear_sync(Scsi_Cmnd *sp)
 {
-        unchar cmd1 = sp->cmnd[0];
-        unchar cmd2 = sp->data_cmnd[0];
+        unchar cmd = sp->cmnd[0];
 
         /* These cases are for spinning up a disk and
          * waiting for that spinup to complete.
          */
-        if(cmd1 == START_STOP ||
-           cmd2 == START_STOP)
+        if(cmd == START_STOP)
                 return 0;
 
-        if(cmd1 == TEST_UNIT_READY ||
-           cmd2 == TEST_UNIT_READY)
+        if(cmd == TEST_UNIT_READY)
                 return 0;
 
         /* One more special case for SCSI tape drives,
          * this is what is used to probe the device for
          * completion of a rewind or tape load operation.
          */
-        if(sp->device->type == TYPE_TAPE) {
-                if(cmd1 == MODE_SENSE ||
-                   cmd2 == MODE_SENSE)
-                        return 0;
-        }
+        if(sp->device->type == TYPE_TAPE && cmd == MODE_SENSE)
+                return 0;
 
         return 1;
 }
diff --git a/drivers/scsi/NCR_D700.c b/drivers/scsi/NCR_D700.c
index a06f547e87f7..d05681f9d81a 100644
--- a/drivers/scsi/NCR_D700.c
+++ b/drivers/scsi/NCR_D700.c
@@ -114,7 +114,7 @@ MODULE_DESCRIPTION("NCR Dual700 SCSI Driver");
 MODULE_LICENSE("GPL");
 module_param(NCR_D700, charp, 0);
 
-static __u8 __initdata id_array[2*(MCA_MAX_SLOT_NR + 1)] =
+static __u8 __devinitdata id_array[2*(MCA_MAX_SLOT_NR + 1)] =
         { [0 ... 2*(MCA_MAX_SLOT_NR + 1)-1] = 7 };
 
 #ifdef MODULE
@@ -173,7 +173,7 @@ struct NCR_D700_private {
         char                    pad;
 };
 
-static int 
+static int __devinit
 NCR_D700_probe_one(struct NCR_D700_private *p, int siop, int irq,
                    int slot, u32 region, int differential)
 {
@@ -243,7 +243,7 @@ NCR_D700_intr(int irq, void *data, struct pt_regs *regs)
  * essentially connectecd to the MCA bus independently, it is easier
  * to set them up as two separate host adapters, rather than one
  * adapter with two channels */
-static int
+static int __devinit
 NCR_D700_probe(struct device *dev)
 {
         struct NCR_D700_private *p;
@@ -329,7 +329,7 @@ NCR_D700_probe(struct device *dev)
         for (i = 0; i < 2; i++) {
                 int err;
 
-                if ((err = NCR_D700_probe_one(p, i, slot, irq,
+                if ((err = NCR_D700_probe_one(p, i, irq, slot,
                                               offset_addr + (0x80 * i),
                                               differential)) != 0)
                         printk("D700: SIOP%d: probe failed, error = %d\n",
@@ -349,7 +349,7 @@ NCR_D700_probe(struct device *dev)
         return 0;
 }
 
-static void
+static void __devexit
 NCR_D700_remove_one(struct Scsi_Host *host)
 {
         scsi_remove_host(host);
@@ -359,7 +359,7 @@ NCR_D700_remove_one(struct Scsi_Host *host)
         release_region(host->base, 64);
 }
 
-static int
+static int __devexit
 NCR_D700_remove(struct device *dev)
 {
         struct NCR_D700_private *p = dev_get_drvdata(dev);
@@ -380,7 +380,7 @@ static struct mca_driver NCR_D700_driver = {
                 .name           = "NCR_D700",
                 .bus            = &mca_bus_type,
                 .probe          = NCR_D700_probe,
-                .remove         = NCR_D700_remove,
+                .remove         = __devexit_p(NCR_D700_remove),
         },
 };
 
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 7cea514e810a..1cd3584ba7ff 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -92,31 +92,7 @@ static int aac_alloc_comm(struct aac_dev *dev, void **commaddr, unsigned long co
         init->AdapterFibsPhysicalAddress = cpu_to_le32((u32)phys);
         init->AdapterFibsSize = cpu_to_le32(fibsize);
         init->AdapterFibAlign = cpu_to_le32(sizeof(struct hw_fib));
-        /* 
-         * number of 4k pages of host physical memory. The aacraid fw needs
-         * this number to be less than 4gb worth of pages. num_physpages is in
-         * system page units. New firmware doesn't have any issues with the
-         * mapping system, but older Firmware did, and had *troubles* dealing
-         * with the math overloading past 32 bits, thus we must limit this
-         * field.
-         *
-         * This assumes the memory is mapped zero->n, which isnt
-         * always true on real computers. It also has some slight problems
-         * with the GART on x86-64. I've btw never tried DMA from PCI space
-         * on this platform but don't be surprised if its problematic.
-         * [AK: something is very very wrong when a driver tests this symbol.
-         *  Someone should figure out what the comment writer really meant here and fix
-         *  the code. Or just remove that bad code. ]
-         */
-#ifndef CONFIG_IOMMU
-        if ((num_physpages << (PAGE_SHIFT - 12)) <= AAC_MAX_HOSTPHYSMEMPAGES) {
-                init->HostPhysMemPages = 
-                        cpu_to_le32(num_physpages << (PAGE_SHIFT-12));
-        } else 
-#endif  
-        {
-                init->HostPhysMemPages = cpu_to_le32(AAC_MAX_HOSTPHYSMEMPAGES);
-        }
+        init->HostPhysMemPages = cpu_to_le32(AAC_MAX_HOSTPHYSMEMPAGES);
 
         init->InitFlags = 0;
         if (dev->new_comm_interface) {
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index 36e63f82d9f8..f974869ea323 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -551,6 +551,11 @@ struct aha152x_hostdata {
 struct aha152x_scdata {
         Scsi_Cmnd *next;        /* next sc in queue */
         struct semaphore *sem;  /* semaphore to block on */
+        unsigned char cmd_len;
+        unsigned char cmnd[MAX_COMMAND_SIZE];
+        unsigned short use_sg;
+        unsigned request_bufflen;
+        void *request_buffer;
 };
 
 
@@ -1006,11 +1011,20 @@ static int aha152x_internal_queue(Scsi_Cmnd *SCpnt, struct semaphore *sem, int p
                         return FAILED;
                 }
         } else {
+                struct aha152x_scdata *sc;
+
                 SCpnt->host_scribble = kmalloc(sizeof(struct aha152x_scdata), GFP_ATOMIC);
                 if(SCpnt->host_scribble==0) {
                         printk(ERR_LEAD "allocation failed\n", CMDINFO(SCpnt));
                         return FAILED;
                 }
+
+                sc = SCDATA(SCpnt);
+                memcpy(sc->cmnd, SCpnt->cmnd, sizeof(sc->cmnd));
+                sc->request_buffer  = SCpnt->request_buffer;
+                sc->request_bufflen = SCpnt->request_bufflen;
+                sc->use_sg          = SCpnt->use_sg;
+                sc->cmd_len         = SCpnt->cmd_len;
         }
 
         SCNEXT(SCpnt)           = NULL;
@@ -1165,6 +1179,10 @@ static int aha152x_device_reset(Scsi_Cmnd * SCpnt)
         DECLARE_MUTEX_LOCKED(sem);
         struct timer_list timer;
         int ret, issued, disconnected;
+        unsigned char old_cmd_len = SCpnt->cmd_len;
+        unsigned short old_use_sg = SCpnt->use_sg;
+        void *old_buffer = SCpnt->request_buffer;
+        unsigned old_bufflen = SCpnt->request_bufflen;
         unsigned long flags;
 
 #if defined(AHA152X_DEBUG)
@@ -1198,11 +1216,11 @@ static int aha152x_device_reset(Scsi_Cmnd * SCpnt)
         add_timer(&timer);
         down(&sem);
         del_timer(&timer);
-        
-        SCpnt->cmd_len         = SCpnt->old_cmd_len;
-        SCpnt->use_sg          = SCpnt->old_use_sg;
-        SCpnt->request_buffer  = SCpnt->buffer;
-        SCpnt->request_bufflen = SCpnt->bufflen;
+
+        SCpnt->cmd_len         = old_cmd_len;
+        SCpnt->use_sg          = old_use_sg;
+        SCpnt->request_buffer  = old_buffer;
+        SCpnt->request_bufflen = old_bufflen;
 
         DO_LOCK(flags);
 
@@ -1565,6 +1583,9 @@ static void busfree_run(struct Scsi_Host *shpnt)
 #endif
 
                 if(DONE_SC->SCp.phase & check_condition) {
+                        struct scsi_cmnd *cmd = HOSTDATA(shpnt)->done_SC;
+                        struct aha152x_scdata *sc = SCDATA(cmd);
+
 #if 0
                         if(HOSTDATA(shpnt)->debug & debug_eh) {
                                 printk(ERR_LEAD "received sense: ", CMDINFO(DONE_SC));
@@ -1573,13 +1594,13 @@ static void busfree_run(struct Scsi_Host *shpnt)
 #endif
 
                         /* restore old command */
-                        memcpy((void *) DONE_SC->cmnd, (void *) DONE_SC->data_cmnd, sizeof(DONE_SC->data_cmnd));
-                        DONE_SC->request_buffer  = DONE_SC->buffer;
-                        DONE_SC->request_bufflen = DONE_SC->bufflen;
-                        DONE_SC->use_sg          = DONE_SC->old_use_sg;
-                        DONE_SC->cmd_len         = DONE_SC->old_cmd_len;
+                        memcpy(cmd->cmnd, sc->cmnd, sizeof(sc->cmnd));
+                        cmd->request_buffer  = sc->request_buffer;
+                        cmd->request_bufflen = sc->request_bufflen;
+                        cmd->use_sg          = sc->use_sg;
+                        cmd->cmd_len         = sc->cmd_len;
 
-                        DONE_SC->SCp.Status = 0x02;
+                        cmd->SCp.Status = 0x02;
 
                         HOSTDATA(shpnt)->commands--;
                         if (!HOSTDATA(shpnt)->commands)
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index 15f6cd4279b7..904c25fb4ba4 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -940,14 +940,8 @@ static void ahci_host_intr(struct ata_port *ap)
                 return;
 
         /* ignore interim PIO setup fis interrupts */
-        if (ata_tag_valid(ap->active_tag)) {
-                struct ata_queued_cmd *qc =
-                        ata_qc_from_tag(ap, ap->active_tag);
-
-                if (qc && qc->tf.protocol == ATA_PROT_PIO &&
-                    (status & PORT_IRQ_PIOS_FIS))
-                        return;
-        }
+        if (ata_tag_valid(ap->active_tag) && (status & PORT_IRQ_PIOS_FIS)) 
+                return;
 
         if (ata_ratelimit())
                 ata_port_printk(ap, KERN_INFO, "spurious interrupt "
@@ -1052,7 +1046,7 @@ static void ahci_thaw(struct ata_port *ap)
 
 static void ahci_error_handler(struct ata_port *ap)
 {
-        if (!(ap->flags & ATA_FLAG_FROZEN)) {
+        if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
                 /* restart engine */
                 ahci_stop_engine(ap);
                 ahci_start_engine(ap);
@@ -1323,6 +1317,17 @@ static int ahci_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!printed_version++)
                 dev_printk(KERN_DEBUG, &pdev->dev, "version " DRV_VERSION "\n");
 
+        /* JMicron-specific fixup: make sure we're in AHCI mode */
+        /* This is protected from races with ata_jmicron by the pci probe
+           locking */
+        if (pdev->vendor == PCI_VENDOR_ID_JMICRON) {
+                /* AHCI enable, AHCI on function 0 */
+                pci_write_config_byte(pdev, 0x41, 0xa1);
+                /* Function 1 is the PATA controller */
+                if (PCI_FUNC(pdev->devfn))
+                        return -ENODEV;
+        }
+
         rc = pci_enable_device(pdev);
         if (rc)
                 return rc;
@@ -1378,10 +1383,6 @@ static int ahci_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (have_msi)
                 hpriv->flags |= AHCI_FLAG_MSI;
 
-        /* JMicron-specific fixup: make sure we're in AHCI mode */
-        if (pdev->vendor == 0x197b)
-                pci_write_config_byte(pdev, 0x41, 0xa1);
-
         /* initialize adapter */
         rc = ahci_host_init(probe_ent);
         if (rc)
diff --git a/drivers/scsi/aic7xxx/aic79xx.h b/drivers/scsi/aic7xxx/aic79xx.h
index eb7745692682..df3346b5caf8 100644
--- a/drivers/scsi/aic7xxx/aic79xx.h
+++ b/drivers/scsi/aic7xxx/aic79xx.h
@@ -1487,6 +1487,7 @@ typedef enum {
 } ahd_queue_alg;
 
 void                    ahd_set_tags(struct ahd_softc *ahd,
+                                     struct scsi_cmnd *cmd,
                                      struct ahd_devinfo *devinfo,
                                      ahd_queue_alg alg);
 
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 801fc81d0b20..653818d2f802 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -1090,7 +1090,7 @@ ahd_handle_seqint(struct ahd_softc *ahd, u_int intstat)
 
                         /* Notify XPT */
                         ahd_send_async(ahd, devinfo.channel, devinfo.target,
-                                       CAM_LUN_WILDCARD, AC_SENT_BDR, NULL);
+                                       CAM_LUN_WILDCARD, AC_SENT_BDR);
 
                         /*
                          * Allow the sequencer to continue with
@@ -3062,7 +3062,7 @@ ahd_set_syncrate(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
                 tinfo->curr.ppr_options = ppr_options;
 
                 ahd_send_async(ahd, devinfo->channel, devinfo->target,
-                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG, NULL);
+                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG);
                 if (bootverbose) {
                         if (offset != 0) {
                                 int options;
@@ -3184,7 +3184,7 @@ ahd_set_width(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
 
                 tinfo->curr.width = width;
                 ahd_send_async(ahd, devinfo->channel, devinfo->target,
-                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG, NULL);
+                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG);
                 if (bootverbose) {
                         printf("%s: target %d using %dbit transfers\n",
                                ahd_name(ahd), devinfo->target,
@@ -3211,12 +3211,14 @@ ahd_set_width(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
  * Update the current state of tagged queuing for a given target.
  */
 void
-ahd_set_tags(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
-             ahd_queue_alg alg)
+ahd_set_tags(struct ahd_softc *ahd, struct scsi_cmnd *cmd,
+             struct ahd_devinfo *devinfo, ahd_queue_alg alg)
 {
-        ahd_platform_set_tags(ahd, devinfo, alg);
+        struct scsi_device *sdev = cmd->device;
+
+        ahd_platform_set_tags(ahd, sdev, devinfo, alg);
         ahd_send_async(ahd, devinfo->channel, devinfo->target,
-                       devinfo->lun, AC_TRANSFER_NEG, &alg);
+                       devinfo->lun, AC_TRANSFER_NEG);
 }
 
 static void
@@ -4746,7 +4748,7 @@ ahd_handle_msg_reject(struct ahd_softc *ahd, struct ahd_devinfo *devinfo)
                         printf("(%s:%c:%d:%d): refuses tagged commands.  "
                                "Performing non-tagged I/O\n", ahd_name(ahd),
                                devinfo->channel, devinfo->target, devinfo->lun);
-                        ahd_set_tags(ahd, devinfo, AHD_QUEUE_NONE);
+                        ahd_set_tags(ahd, scb->io_ctx, devinfo, AHD_QUEUE_NONE);
                         mask = ~0x23;
                 } else {
                         printf("(%s:%c:%d:%d): refuses %s tagged commands.  "
@@ -4754,7 +4756,7 @@ ahd_handle_msg_reject(struct ahd_softc *ahd, struct ahd_devinfo *devinfo)
                                ahd_name(ahd), devinfo->channel, devinfo->target,
                                devinfo->lun, tag_type == MSG_ORDERED_TASK
                                ? "ordered" : "head of queue");
-                        ahd_set_tags(ahd, devinfo, AHD_QUEUE_BASIC);
+                        ahd_set_tags(ahd, scb->io_ctx, devinfo, AHD_QUEUE_BASIC);
                         mask = ~0x03;
                 }
 
@@ -5098,7 +5100,7 @@ ahd_handle_devreset(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
         
         if (status != CAM_SEL_TIMEOUT)
                 ahd_send_async(ahd, devinfo->channel, devinfo->target,
-                               CAM_LUN_WILDCARD, AC_SENT_BDR, NULL);
+                               CAM_LUN_WILDCARD, AC_SENT_BDR);
 
         if (message != NULL && bootverbose)
                 printf("%s: %s on %c:%d. %d SCBs aborted\n", ahd_name(ahd),
@@ -7287,7 +7289,7 @@ ahd_reset_cmds_pending(struct ahd_softc *ahd)
         ahd->flags &= ~AHD_UPDATE_PEND_CMDS;
 }
 
-void
+static void
 ahd_done_with_status(struct ahd_softc *ahd, struct scb *scb, uint32_t status)
 {
         cam_status ostat;
@@ -7952,7 +7954,7 @@ ahd_reset_channel(struct ahd_softc *ahd, char channel, int initiate_reset)
 #endif
         /* Notify the XPT that a bus reset occurred */
         ahd_send_async(ahd, devinfo.channel, CAM_TARGET_WILDCARD,
-                       CAM_LUN_WILDCARD, AC_BUS_RESET, NULL);
+                       CAM_LUN_WILDCARD, AC_BUS_RESET);
 
         /*
          * Revert to async/narrow transfers until we renegotiate.
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index e0ccdf362200..998999c0a972 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -243,25 +243,6 @@ ahd_print_path(struct ahd_softc *ahd, struct scb *scb)
 static uint32_t aic79xx_no_reset;
 
 /*
- * Certain PCI motherboards will scan PCI devices from highest to lowest,
- * others scan from lowest to highest, and they tend to do all kinds of
- * strange things when they come into contact with PCI bridge chips.  The
- * net result of all this is that the PCI card that is actually used to boot
- * the machine is very hard to detect.  Most motherboards go from lowest
- * PCI slot number to highest, and the first SCSI controller found is the
- * one you boot from.  The only exceptions to this are when a controller
- * has its BIOS disabled.  So, we by default sort all of our SCSI controllers
- * from lowest PCI slot number to highest PCI slot number.  We also force
- * all controllers with their BIOS disabled to the end of the list.  This
- * works on *almost* all computers.  Where it doesn't work, we have this
- * option.  Setting this option to non-0 will reverse the order of the sort
- * to highest first, then lowest, but will still leave cards with their BIOS
- * disabled at the very end.  That should fix everyone up unless there are
- * really strange cirumstances.
- */
-static uint32_t aic79xx_reverse_scan;
-
-/*
  * Should we force EXTENDED translation on a controller.
  *     0 == Use whatever is in the SEEPROM or default to off
  *     1 == Use whatever is in the SEEPROM or default to on
@@ -350,7 +331,6 @@ MODULE_PARM_DESC(aic79xx,
 "                               periodically to prevent tag starvation.\n"
 "                               This may be required by some older disk\n"
 "                               or drives/RAID arrays.\n"
-"       reverse_scan            Sort PCI devices highest Bus/Slot to lowest\n"
 "       tag_info:<tag_str>      Set per-target tag depth\n"
 "       global_tag_depth:<int>  Global tag depth for all targets on all buses\n"
 "       slewrate:<slewrate_list>Set the signal slew rate (0-15).\n"
@@ -484,7 +464,6 @@ ahd_linux_target_alloc(struct scsi_target *starget)
         struct seeprom_config *sc = ahd->seep_config;
         unsigned long flags;
         struct scsi_target **ahd_targp = ahd_linux_target_in_softc(starget);
-        struct ahd_linux_target *targ = scsi_transport_target_data(starget);
         struct ahd_devinfo devinfo;
         struct ahd_initiator_tinfo *tinfo;
         struct ahd_tmode_tstate *tstate;
@@ -495,7 +474,6 @@ ahd_linux_target_alloc(struct scsi_target *starget)
         BUG_ON(*ahd_targp != NULL);
 
         *ahd_targp = starget;
-        memset(targ, 0, sizeof(*targ));
 
         if (sc) {
                 int flags = sc->device_flags[starget->id];
@@ -551,15 +529,11 @@ ahd_linux_slave_alloc(struct scsi_device *sdev)
 {
         struct  ahd_softc *ahd =
                 *((struct ahd_softc **)sdev->host->hostdata);
-        struct scsi_target *starget = sdev->sdev_target;
-        struct ahd_linux_target *targ = scsi_transport_target_data(starget);
         struct ahd_linux_device *dev;
 
         if (bootverbose)
                 printf("%s: Slave Alloc %d\n", ahd_name(ahd), sdev->id);
 
-        BUG_ON(targ->sdev[sdev->lun] != NULL);
-
         dev = scsi_transport_device_data(sdev);
         memset(dev, 0, sizeof(*dev));
 
@@ -576,8 +550,6 @@ ahd_linux_slave_alloc(struct scsi_device *sdev)
          */
         dev->maxtags = 0;
         
-        targ->sdev[sdev->lun] = sdev;
-
         return (0);
 }
 
@@ -599,23 +571,6 @@ ahd_linux_slave_configure(struct scsi_device *sdev)
         return 0;
 }
 
-static void
-ahd_linux_slave_destroy(struct scsi_device *sdev)
-{
-        struct  ahd_softc *ahd;
-        struct  ahd_linux_device *dev = scsi_transport_device_data(sdev);
-        struct  ahd_linux_target *targ = scsi_transport_target_data(sdev->sdev_target);
-
-        ahd = *((struct ahd_softc **)sdev->host->hostdata);
-        if (bootverbose)
-                printf("%s: Slave Destroy %d\n", ahd_name(ahd), sdev->id);
-
-        BUG_ON(dev->active);
-
-        targ->sdev[sdev->lun] = NULL;
-
-}
-
 #if defined(__i386__)
 /*
  * Return the disk geometry for the given SCSI device.
@@ -822,7 +777,6 @@ struct scsi_host_template aic79xx_driver_template = {
         .use_clustering         = ENABLE_CLUSTERING,
         .slave_alloc            = ahd_linux_slave_alloc,
         .slave_configure        = ahd_linux_slave_configure,
-        .slave_destroy          = ahd_linux_slave_destroy,
         .target_alloc           = ahd_linux_target_alloc,
         .target_destroy         = ahd_linux_target_destroy,
 };
@@ -1057,7 +1011,6 @@ aic79xx_setup(char *s)
 #ifdef AHD_DEBUG
                 { "debug", &ahd_debug },
 #endif
-                { "reverse_scan", &aic79xx_reverse_scan },
                 { "periodic_otag", &aic79xx_periodic_otag },
                 { "pci_parity", &aic79xx_pci_parity },
                 { "seltime", &aic79xx_seltime },
@@ -1249,20 +1202,13 @@ void
 ahd_platform_free(struct ahd_softc *ahd)
 {
         struct scsi_target *starget;
-        int i, j;
+        int i;
 
         if (ahd->platform_data != NULL) {
                 /* destroy all of the device and target objects */
                 for (i = 0; i < AHD_NUM_TARGETS; i++) {
                         starget = ahd->platform_data->starget[i];
                         if (starget != NULL) {
-                                for (j = 0; j < AHD_NUM_LUNS; j++) {
-                                        struct ahd_linux_target *targ =
-                                                scsi_transport_target_data(starget);
-                                        if (targ->sdev[j] == NULL)
-                                                continue;
-                                        targ->sdev[j] = NULL;
-                                }
                                 ahd->platform_data->starget[i] = NULL;
                         }
                 }
@@ -1318,20 +1264,13 @@ ahd_platform_freeze_devq(struct ahd_softc *ahd, struct scb *scb)
 }
 
 void
-ahd_platform_set_tags(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
-                      ahd_queue_alg alg)
+ahd_platform_set_tags(struct ahd_softc *ahd, struct scsi_device *sdev,
+                      struct ahd_devinfo *devinfo, ahd_queue_alg alg)
 {
-        struct scsi_target *starget;
-        struct ahd_linux_target *targ;
         struct ahd_linux_device *dev;
-        struct scsi_device *sdev;
         int was_queuing;
         int now_queuing;
 
-        starget = ahd->platform_data->starget[devinfo->target];
-        targ = scsi_transport_target_data(starget);
-        BUG_ON(targ == NULL);
-        sdev = targ->sdev[devinfo->lun];
         if (sdev == NULL)
                 return;
 
@@ -1467,11 +1406,15 @@ ahd_linux_device_queue_depth(struct scsi_device *sdev)
         tags = ahd_linux_user_tagdepth(ahd, &devinfo);
         if (tags != 0 && sdev->tagged_supported != 0) {
 
-                ahd_set_tags(ahd, &devinfo, AHD_QUEUE_TAGGED);
+                ahd_platform_set_tags(ahd, sdev, &devinfo, AHD_QUEUE_TAGGED);
+                ahd_send_async(ahd, devinfo.channel, devinfo.target,
+                               devinfo.lun, AC_TRANSFER_NEG);
                 ahd_print_devinfo(ahd, &devinfo);
                 printf("Tagged Queuing enabled.  Depth %d\n", tags);
         } else {
-                ahd_set_tags(ahd, &devinfo, AHD_QUEUE_NONE);
+                ahd_platform_set_tags(ahd, sdev, &devinfo, AHD_QUEUE_NONE);
+                ahd_send_async(ahd, devinfo.channel, devinfo.target,
+                               devinfo.lun, AC_TRANSFER_NEG);
         }
 }
 
@@ -1629,7 +1572,7 @@ ahd_linux_isr(int irq, void *dev_id, struct pt_regs * regs)
 
 void
 ahd_send_async(struct ahd_softc *ahd, char channel,
-               u_int target, u_int lun, ac_code code, void *arg)
+               u_int target, u_int lun, ac_code code)
 {
         switch (code) {
         case AC_TRANSFER_NEG:
@@ -1956,7 +1899,7 @@ ahd_linux_handle_scsi_status(struct ahd_softc *ahd,
                         }
                         ahd_set_transaction_status(scb, CAM_REQUEUE_REQ);
                         ahd_set_scsi_status(scb, SCSI_STATUS_OK);
-                        ahd_platform_set_tags(ahd, &devinfo,
+                        ahd_platform_set_tags(ahd, sdev, &devinfo,
                                      (dev->flags & AHD_DEV_Q_BASIC)
                                    ? AHD_QUEUE_BASIC : AHD_QUEUE_TAGGED);
                         break;
@@ -1966,7 +1909,7 @@ ahd_linux_handle_scsi_status(struct ahd_softc *ahd,
                  * as if the target returned BUSY SCSI status.
                  */
                 dev->openings = 1;
-                ahd_platform_set_tags(ahd, &devinfo,
+                ahd_platform_set_tags(ahd, sdev, &devinfo,
                              (dev->flags & AHD_DEV_Q_BASIC)
                            ? AHD_QUEUE_BASIC : AHD_QUEUE_TAGGED);
                 ahd_set_scsi_status(scb, SCSI_STATUS_BUSY);
@@ -2778,8 +2721,6 @@ ahd_linux_init(void)
         if (!ahd_linux_transport_template)
                 return -ENODEV;
 
-        scsi_transport_reserve_target(ahd_linux_transport_template,
-                                      sizeof(struct ahd_linux_target));
         scsi_transport_reserve_device(ahd_linux_transport_template,
                                       sizeof(struct ahd_linux_device));
 
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.h b/drivers/scsi/aic7xxx/aic79xx_osm.h
index 92c6154575e7..601340d84410 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.h
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.h
@@ -93,7 +93,6 @@
 #endif
 
 /********************************** Misc Macros *******************************/
-#define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
 #define powerof2(x)     ((((x)-1)&(x))==0)
 
 /************************* Forward Declarations *******************************/
@@ -262,7 +261,6 @@ typedef enum {
         AHD_DEV_PERIODIC_OTAG    = 0x40, /* Send OTAG to prevent starvation */
 } ahd_linux_dev_flags;
 
-struct ahd_linux_target;
 struct ahd_linux_device {
         TAILQ_ENTRY(ahd_linux_device) links;
 
@@ -342,12 +340,6 @@ struct ahd_linux_device {
 #define AHD_OTAG_THRESH 500
 };
 
-struct ahd_linux_target {
-        struct scsi_device       *sdev[AHD_NUM_LUNS];
-        struct ahd_transinfo      last_tinfo;
-        struct ahd_softc         *ahd;
-};
-
 /********************* Definitions Required by the Core ***********************/
 /*
  * Number of SG segments we require.  So long as the S/G segments for
@@ -864,7 +856,7 @@ ahd_freeze_scb(struct scb *scb)
         }
 }
 
-void    ahd_platform_set_tags(struct ahd_softc *ahd,
+void    ahd_platform_set_tags(struct ahd_softc *ahd, struct scsi_device *sdev,
                               struct ahd_devinfo *devinfo, ahd_queue_alg);
 int     ahd_platform_abort_scbs(struct ahd_softc *ahd, int target,
                                 char channel, int lun, u_int tag,
@@ -873,7 +865,7 @@ irqreturn_t
         ahd_linux_isr(int irq, void *dev_id, struct pt_regs * regs);
 void    ahd_done(struct ahd_softc*, struct scb*);
 void    ahd_send_async(struct ahd_softc *, char channel,
-                       u_int target, u_int lun, ac_code, void *);
+                       u_int target, u_int lun, ac_code);
 void    ahd_print_path(struct ahd_softc *, struct scb *);
 
 #ifdef CONFIG_PCI
diff --git a/drivers/scsi/aic7xxx/aic79xx_proc.c b/drivers/scsi/aic7xxx/aic79xx_proc.c
index 24fd59a230bf..c5f0ee591509 100644
--- a/drivers/scsi/aic7xxx/aic79xx_proc.c
+++ b/drivers/scsi/aic7xxx/aic79xx_proc.c
@@ -47,7 +47,7 @@ static int	copy_info(struct info_str *info, char *fmt, ...);
 static void     ahd_dump_target_state(struct ahd_softc *ahd,
                                       struct info_str *info,
                                       u_int our_id, char channel,
-                                      u_int target_id, u_int target_offset);
+                                      u_int target_id);
 static void     ahd_dump_device_state(struct info_str *info,
                                       struct scsi_device *sdev);
 static int      ahd_proc_write_seeprom(struct ahd_softc *ahd,
@@ -204,10 +204,8 @@ ahd_format_transinfo(struct info_str *info, struct ahd_transinfo *tinfo)
 
 static void
 ahd_dump_target_state(struct ahd_softc *ahd, struct info_str *info,
-                      u_int our_id, char channel, u_int target_id,
-                      u_int target_offset)
+                      u_int our_id, char channel, u_int target_id)
 {
-        struct  ahd_linux_target *targ;
         struct  scsi_target *starget;
         struct  ahd_initiator_tinfo *tinfo;
         struct  ahd_tmode_tstate *tstate;
@@ -218,10 +216,9 @@ ahd_dump_target_state(struct ahd_softc *ahd, struct info_str *info,
         copy_info(info, "Target %d Negotiation Settings\n", target_id);
         copy_info(info, "\tUser: ");
         ahd_format_transinfo(info, &tinfo->user);
-        starget = ahd->platform_data->starget[target_offset];
+        starget = ahd->platform_data->starget[target_id];
         if (starget == NULL)
                 return;
-        targ = scsi_transport_target_data(starget);
 
         copy_info(info, "\tGoal: ");
         ahd_format_transinfo(info, &tinfo->goal);
@@ -231,7 +228,7 @@ ahd_dump_target_state(struct ahd_softc *ahd, struct info_str *info,
         for (lun = 0; lun < AHD_NUM_LUNS; lun++) {
                 struct scsi_device *dev;
 
-                dev = targ->sdev[lun];
+                dev = scsi_device_lookup_by_target(starget, lun);
 
                 if (dev == NULL)
                         continue;
@@ -355,7 +352,7 @@ ahd_linux_proc_info(struct Scsi_Host *shost, char *buffer, char **start,
         copy_info(&info, "Allocated SCBs: %d, SG List Length: %d\n\n",
                   ahd->scb_data.numscbs, AHD_NSEG);
 
-        max_targ = 15;
+        max_targ = 16;
 
         if (ahd->seep_config == NULL)
                 copy_info(&info, "No Serial EEPROM\n");
@@ -373,12 +370,12 @@ ahd_linux_proc_info(struct Scsi_Host *shost, char *buffer, char **start,
         copy_info(&info, "\n");
 
         if ((ahd->features & AHD_WIDE) == 0)
-                max_targ = 7;
+                max_targ = 8;
 
-        for (i = 0; i <= max_targ; i++) {
+        for (i = 0; i < max_targ; i++) {
 
                 ahd_dump_target_state(ahd, &info, ahd->our_id, 'A',
-                                      /*target_id*/i, /*target_offset*/i);
+                                      /*target_id*/i);
         }
         retval = info.pos > info.offset ? info.pos - info.offset : 0;
 done:
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index debf3e2a0798..aa4be8a31415 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -353,7 +353,6 @@ MODULE_PARM_DESC(aic7xxx,
 "                               periodically to prevent tag starvation.\n"
 "                               This may be required by some older disk\n"
 "                               drives or RAID arrays.\n"
-"       reverse_scan            Sort PCI devices highest Bus/Slot to lowest\n"
 "       tag_info:<tag_str>      Set per-target tag depth\n"
 "       global_tag_depth:<int>  Global tag depth for every target\n"
 "                               on every bus\n"
diff --git a/drivers/scsi/aic7xxx/aicasm/Makefile b/drivers/scsi/aic7xxx/aicasm/Makefile
index 8c91fda6482c..b98c5c1056c3 100644
--- a/drivers/scsi/aic7xxx/aicasm/Makefile
+++ b/drivers/scsi/aic7xxx/aicasm/Makefile
@@ -14,6 +14,8 @@ LIBS=	-ldb
 clean-files:= ${GENSRCS} ${GENHDRS} $(YSRCS:.y=.output) $(PROG)
 # Override default kernel CFLAGS.  This is a userland app.
 AICASM_CFLAGS:= -I/usr/include -I.
+LEX= flex
+YACC= bison
 YFLAGS= -d
 
 NOMAN=  noman
diff --git a/drivers/scsi/arm/Kconfig b/drivers/scsi/arm/Kconfig
index 06d7601cdf56..d006a8cb4a74 100644
--- a/drivers/scsi/arm/Kconfig
+++ b/drivers/scsi/arm/Kconfig
@@ -69,6 +69,7 @@ comment "The following drivers are not fully supported"
 config SCSI_CUMANA_1
         tristate "CumanaSCSI I support (EXPERIMENTAL)"
         depends on ARCH_ACORN && EXPERIMENTAL && SCSI
+        select SCSI_SPI_ATTRS
         help
           This enables support for the Cumana SCSI I card. If you have an
           Acorn system with one of these, say Y. If unsure, say N.
@@ -76,6 +77,7 @@ config SCSI_CUMANA_1
 config SCSI_ECOSCSI
         tristate "EcoScsi support (EXPERIMENTAL)"
         depends on ARCH_ACORN && EXPERIMENTAL && (ARCH_ARC || ARCH_A5K) && SCSI
+        select SCSI_SPI_ATTRS
         help
           This enables support for the EcoSCSI card -- a small card that sits
           in the Econet socket. If you have an Acorn system with one of these,
@@ -84,6 +86,7 @@ config SCSI_ECOSCSI
 config SCSI_OAK1
         tristate "Oak SCSI support (EXPERIMENTAL)"
         depends on ARCH_ACORN && EXPERIMENTAL && SCSI
+        select SCSI_SPI_ATTRS
         help
           This enables support for the Oak SCSI card. If you have an Acorn
           system with one of these, say Y. If unsure, say N.
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index 3e1053f111dc..4cf7afc31cc7 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2427,7 +2427,7 @@ int fas216_eh_abort(Scsi_Cmnd *SCpnt)
         info->stats.aborts += 1;
 
         printk(KERN_WARNING "scsi%d: abort command ", info->host->host_no);
-        __scsi_print_command(SCpnt->data_cmnd);
+        __scsi_print_command(SCpnt->cmnd);
 
         print_debug_list();
         fas216_dumpstate(info);
diff --git a/drivers/scsi/arm/scsi.h b/drivers/scsi/arm/scsi.h
index 6dd544a5eb56..8c2600ffc6af 100644
--- a/drivers/scsi/arm/scsi.h
+++ b/drivers/scsi/arm/scsi.h
@@ -74,7 +74,7 @@ static inline void init_SCp(Scsi_Cmnd *SCpnt)
                 unsigned long len = 0;
                 int buf;
 
-                SCpnt->SCp.buffer = (struct scatterlist *) SCpnt->buffer;
+                SCpnt->SCp.buffer = (struct scatterlist *) SCpnt->request_buffer;
                 SCpnt->SCp.buffers_residual = SCpnt->use_sg - 1;
                 SCpnt->SCp.ptr = (char *)
                          (page_address(SCpnt->SCp.buffer->page) +
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 94b1261a259d..a9bb3cb7e89b 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -105,9 +105,6 @@ enum {
         PIIX_FLAG_SCR           = (1 << 26), /* SCR available */
         PIIX_FLAG_AHCI          = (1 << 27), /* AHCI possible */
         PIIX_FLAG_CHECKINTR     = (1 << 28), /* make sure PCI INTx enabled */
-        PIIX_FLAG_COMBINED      = (1 << 29), /* combined mode possible */
-        /* ICH6/7 use different scheme for map value */
-        PIIX_FLAG_COMBINED_ICH6 = PIIX_FLAG_COMBINED | (1 << 30),
 
         /* combined mode.  if set, PATA is channel 0.
          * if clear, PATA is channel 1.
@@ -126,6 +123,8 @@ enum {
         ich6_sata               = 4,
         ich6_sata_ahci          = 5,
         ich6m_sata_ahci         = 6,
+        ich7m_sata_ahci         = 7,
+        ich8_sata_ahci          = 8,
 
         /* constants for mapping table */
         P0                      = 0,  /* port 0 */
@@ -141,11 +140,19 @@ enum {
 
 struct piix_map_db {
         const u32 mask;
+        const u16 port_enable;
+        const int present_shift;
         const int map[][4];
 };
 
+struct piix_host_priv {
+        const int *map;
+        const struct piix_map_db *map_db;
+};
+
 static int piix_init_one (struct pci_dev *pdev,
                                     const struct pci_device_id *ent);
+static void piix_host_stop(struct ata_host_set *host_set);
 static void piix_set_piomode (struct ata_port *ap, struct ata_device *adev);
 static void piix_set_dmamode (struct ata_port *ap, struct ata_device *adev);
 static void piix_pata_error_handler(struct ata_port *ap);
@@ -182,15 +189,15 @@ static const struct pci_device_id piix_pci_tbl[] = {
         /* 82801GB/GR/GH (ICH7, identical to ICH6) */
         { 0x8086, 0x27c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
         /* 2801GBM/GHM (ICH7M, identical to ICH6M) */
-        { 0x8086, 0x27c4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6m_sata_ahci },
+        { 0x8086, 0x27c4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich7m_sata_ahci },
         /* Enterprise Southbridge 2 (where's the datasheet?) */
         { 0x8086, 0x2680, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
         /* SATA Controller 1 IDE (ICH8, no datasheet yet) */
-        { 0x8086, 0x2820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
+        { 0x8086, 0x2820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_ahci },
         /* SATA Controller 2 IDE (ICH8, ditto) */
-        { 0x8086, 0x2825, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
+        { 0x8086, 0x2825, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_ahci },
         /* Mobile SATA Controller IDE (ICH8M, ditto) */
-        { 0x8086, 0x2828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6m_sata_ahci },
+        { 0x8086, 0x2828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_ahci },
 
         { }     /* terminate list */
 };
@@ -254,7 +261,7 @@ static const struct ata_port_operations piix_pata_ops = {
 
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
-        .host_stop              = ata_host_stop,
+        .host_stop              = piix_host_stop,
 };
 
 static const struct ata_port_operations piix_sata_ops = {
@@ -284,11 +291,13 @@ static const struct ata_port_operations piix_sata_ops = {
 
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
-        .host_stop              = ata_host_stop,
+        .host_stop              = piix_host_stop,
 };
 
-static struct piix_map_db ich5_map_db = {
+static const struct piix_map_db ich5_map_db = {
         .mask = 0x7,
+        .port_enable = 0x3,
+        .present_shift = 4,
         .map = {
                 /* PM   PS   SM   SS       MAP  */
                 {  P0,  NA,  P1,  NA }, /* 000b */
@@ -302,8 +311,10 @@ static struct piix_map_db ich5_map_db = {
         },
 };
 
-static struct piix_map_db ich6_map_db = {
+static const struct piix_map_db ich6_map_db = {
         .mask = 0x3,
+        .port_enable = 0xf,
+        .present_shift = 4,
         .map = {
                 /* PM   PS   SM   SS       MAP */
                 {  P0,  P2,  P1,  P3 }, /* 00b */
@@ -313,8 +324,10 @@ static struct piix_map_db ich6_map_db = {
         },
 };
 
-static struct piix_map_db ich6m_map_db = {
+static const struct piix_map_db ich6m_map_db = {
         .mask = 0x3,
+        .port_enable = 0x5,
+        .present_shift = 4,
         .map = {
                 /* PM   PS   SM   SS       MAP */
                 {  P0,  P2,  RV,  RV }, /* 00b */
@@ -324,6 +337,47 @@ static struct piix_map_db ich6m_map_db = {
         },
 };
 
+static const struct piix_map_db ich7m_map_db = {
+        .mask = 0x3,
+        .port_enable = 0x5,
+        .present_shift = 4,
+
+        /* Map 01b isn't specified in the doc but some notebooks use
+         * it anyway.  ATM, the only case spotted carries subsystem ID
+         * 1025:0107.  This is the only difference from ich6m.
+         */
+        .map = {
+                /* PM   PS   SM   SS       MAP */
+                {  P0,  P2,  RV,  RV }, /* 00b */
+                { IDE, IDE,  P1,  P3 }, /* 01b */
+                {  P0,  P2, IDE, IDE }, /* 10b */
+                {  RV,  RV,  RV,  RV },
+        },
+};
+
+static const struct piix_map_db ich8_map_db = {
+        .mask = 0x3,
+        .port_enable = 0x3,
+        .present_shift = 8,
+        .map = {
+                /* PM   PS   SM   SS       MAP */
+                {  P0,  NA,  P1,  NA }, /* 00b (hardwired) */
+                {  RV,  RV,  RV,  RV },
+                {  RV,  RV,  RV,  RV }, /* 10b (never) */
+                {  RV,  RV,  RV,  RV },
+        },
+};
+
+static const struct piix_map_db *piix_map_db_table[] = {
+        [ich5_sata]             = &ich5_map_db,
+        [esb_sata]              = &ich5_map_db,
+        [ich6_sata]             = &ich6_map_db,
+        [ich6_sata_ahci]        = &ich6_map_db,
+        [ich6m_sata_ahci]       = &ich6m_map_db,
+        [ich7m_sata_ahci]       = &ich7m_map_db,
+        [ich8_sata_ahci]        = &ich8_map_db,
+};
+
 static struct ata_port_info piix_port_info[] = {
         /* piix4_pata */
         {
@@ -356,63 +410,82 @@ static struct ata_port_info piix_port_info[] = {
         /* ich5_sata */
         {
                 .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED |
-                                  PIIX_FLAG_CHECKINTR,
+                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_CHECKINTR |
+                                  PIIX_FLAG_IGNORE_PCS,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 */
                 .port_ops       = &piix_sata_ops,
-                .private_data   = &ich5_map_db,
         },
 
         /* i6300esb_sata */
         {
                 .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED |
+                .host_flags     = ATA_FLAG_SATA |
                                   PIIX_FLAG_CHECKINTR | PIIX_FLAG_IGNORE_PCS,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 */
                 .port_ops       = &piix_sata_ops,
-                .private_data   = &ich5_map_db,
         },
 
         /* ich6_sata */
         {
                 .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED_ICH6 |
+                .host_flags     = ATA_FLAG_SATA |
                                   PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 */
                 .port_ops       = &piix_sata_ops,
-                .private_data   = &ich6_map_db,
         },
 
         /* ich6_sata_ahci */
         {
                 .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED_ICH6 |
+                .host_flags     = ATA_FLAG_SATA |
                                   PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
                                   PIIX_FLAG_AHCI,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 */
                 .port_ops       = &piix_sata_ops,
-                .private_data   = &ich6_map_db,
         },
 
         /* ich6m_sata_ahci */
         {
                 .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED_ICH6 |
+                .host_flags     = ATA_FLAG_SATA |
+                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
+                                  PIIX_FLAG_AHCI,
+                .pio_mask       = 0x1f, /* pio0-4 */
+                .mwdma_mask     = 0x07, /* mwdma0-2 */
+                .udma_mask      = 0x7f, /* udma0-6 */
+                .port_ops       = &piix_sata_ops,
+        },
+
+        /* ich7m_sata_ahci */
+        {
+                .sht            = &piix_sht,
+                .host_flags     = ATA_FLAG_SATA |
+                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
+                                  PIIX_FLAG_AHCI,
+                .pio_mask       = 0x1f, /* pio0-4 */
+                .mwdma_mask     = 0x07, /* mwdma0-2 */
+                .udma_mask      = 0x7f, /* udma0-6 */
+                .port_ops       = &piix_sata_ops,
+        },
+
+        /* ich8_sata_ahci */
+        {
+                .sht            = &piix_sht,
+                .host_flags     = ATA_FLAG_SATA |
                                   PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
                                   PIIX_FLAG_AHCI,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 */
                 .port_ops       = &piix_sata_ops,
-                .private_data   = &ich6m_map_db,
         },
 };
 
@@ -427,6 +500,11 @@ MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, piix_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
 
+static int force_pcs = 0;
+module_param(force_pcs, int, 0444);
+MODULE_PARM_DESC(force_pcs, "force honoring or ignoring PCS to work around "
+                 "device mis-detection (0=default, 1=ignore PCS, 2=honor PCS)");
+
 /**
  *      piix_pata_cbl_detect - Probe host controller cable detect info
  *      @ap: Port for which cable detect info is desired
@@ -491,74 +569,83 @@ static void piix_pata_error_handler(struct ata_port *ap)
 }
 
 /**
- *      piix_sata_prereset - prereset for SATA host controller
+ *      piix_sata_present_mask - determine present mask for SATA host controller
  *      @ap: Target port
  *
- *      Reads and configures SATA PCI device's PCI config register
- *      Port Configuration and Status (PCS) to determine port and
- *      device availability.  Return -ENODEV to skip reset if no
- *      device is present.
+ *      Reads SATA PCI device's PCI config register Port Configuration
+ *      and Status (PCS) to determine port and device availability.
  *
  *      LOCKING:
  *      None (inherited from caller).
  *
  *      RETURNS:
- *      0 if device is present, -ENODEV otherwise.
+ *      determined present_mask
  */
-static int piix_sata_prereset(struct ata_port *ap)
+static unsigned int piix_sata_present_mask(struct ata_port *ap)
 {
         struct pci_dev *pdev = to_pci_dev(ap->host_set->dev);
-        const unsigned int *map = ap->host_set->private_data;
+        struct piix_host_priv *hpriv = ap->host_set->private_data;
+        const unsigned int *map = hpriv->map;
         int base = 2 * ap->hard_port_no;
         unsigned int present_mask = 0;
         int port, i;
-        u8 pcs;
+        u16 pcs;
 
-        pci_read_config_byte(pdev, ICH5_PCS, &pcs);
+        pci_read_config_word(pdev, ICH5_PCS, &pcs);
         DPRINTK("ata%u: ENTER, pcs=0x%x base=%d\n", ap->id, pcs, base);
 
-        /* enable all ports on this ap and wait for them to settle */
-        for (i = 0; i < 2; i++) {
-                port = map[base + i];
-                if (port >= 0)
-                        pcs |= 1 << port;
-        }
-
-        pci_write_config_byte(pdev, ICH5_PCS, pcs);
-        msleep(100);
-
-        /* let's see which devices are present */
-        pci_read_config_byte(pdev, ICH5_PCS, &pcs);
-
         for (i = 0; i < 2; i++) {
                 port = map[base + i];
                 if (port < 0)
                         continue;
-                if (ap->flags & PIIX_FLAG_IGNORE_PCS || pcs & 1 << (4 + port))
+                if ((ap->flags & PIIX_FLAG_IGNORE_PCS) ||
+                    (pcs & 1 << (hpriv->map_db->present_shift + port)))
                         present_mask |= 1 << i;
-                else
-                        pcs &= ~(1 << port);
         }
 
-        /* disable offline ports on non-AHCI controllers */
-        if (!(ap->flags & PIIX_FLAG_AHCI))
-                pci_write_config_byte(pdev, ICH5_PCS, pcs);
-
         DPRINTK("ata%u: LEAVE, pcs=0x%x present_mask=0x%x\n",
                 ap->id, pcs, present_mask);
 
-        if (!present_mask) {
-                ata_port_printk(ap, KERN_INFO, "SATA port has no device.\n");
-                ap->eh_context.i.action &= ~ATA_EH_RESET_MASK;
-                return 0;
+        return present_mask;
+}
+
+/**
+ *      piix_sata_softreset - reset SATA host port via ATA SRST
+ *      @ap: port to reset
+ *      @classes: resulting classes of attached devices
+ *
+ *      Reset SATA host port via ATA SRST.  On controllers with
+ *      reliable PCS present bits, the bits are used to determine
+ *      device presence.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep)
+ *
+ *      RETURNS:
+ *      0 on success, -errno otherwise.
+ */
+static int piix_sata_softreset(struct ata_port *ap, unsigned int *classes)
+{
+        unsigned int present_mask;
+        int i, rc;
+
+        present_mask = piix_sata_present_mask(ap);
+
+        rc = ata_std_softreset(ap, classes);
+        if (rc)
+                return rc;
+
+        for (i = 0; i < ATA_MAX_DEVICES; i++) {
+                if (!(present_mask & (1 << i)))
+                        classes[i] = ATA_DEV_NONE;
         }
 
-        return ata_std_prereset(ap);
+        return 0;
 }
 
 static void piix_sata_error_handler(struct ata_port *ap)
 {
-        ata_bmdma_drive_eh(ap, piix_sata_prereset, ata_std_softreset, NULL,
+        ata_bmdma_drive_eh(ap, ata_std_prereset, piix_sata_softreset, NULL,
                            ata_std_postreset);
 }
 
@@ -761,10 +848,40 @@ static int __devinit piix_check_450nx_errata(struct pci_dev *ata_dev)
         return no_piix_dma;
 }
 
+static void __devinit piix_init_pcs(struct pci_dev *pdev,
+                                    struct ata_port_info *pinfo,
+                                    const struct piix_map_db *map_db)
+{
+        u16 pcs, new_pcs;
+
+        pci_read_config_word(pdev, ICH5_PCS, &pcs);
+
+        new_pcs = pcs | map_db->port_enable;
+
+        if (new_pcs != pcs) {
+                DPRINTK("updating PCS from 0x%x to 0x%x\n", pcs, new_pcs);
+                pci_write_config_word(pdev, ICH5_PCS, new_pcs);
+                msleep(150);
+        }
+
+        if (force_pcs == 1) {
+                dev_printk(KERN_INFO, &pdev->dev,
+                           "force ignoring PCS (0x%x)\n", new_pcs);
+                pinfo[0].host_flags |= PIIX_FLAG_IGNORE_PCS;
+                pinfo[1].host_flags |= PIIX_FLAG_IGNORE_PCS;
+        } else if (force_pcs == 2) {
+                dev_printk(KERN_INFO, &pdev->dev,
+                           "force honoring PCS (0x%x)\n", new_pcs);
+                pinfo[0].host_flags &= ~PIIX_FLAG_IGNORE_PCS;
+                pinfo[1].host_flags &= ~PIIX_FLAG_IGNORE_PCS;
+        }
+}
+
 static void __devinit piix_init_sata_map(struct pci_dev *pdev,
-                                         struct ata_port_info *pinfo)
+                                         struct ata_port_info *pinfo,
+                                         const struct piix_map_db *map_db)
 {
-        struct piix_map_db *map_db = pinfo[0].private_data;
+        struct piix_host_priv *hpriv = pinfo[0].private_data;
         const unsigned int *map;
         int i, invalid_map = 0;
         u8 map_value;
@@ -788,6 +905,7 @@ static void __devinit piix_init_sata_map(struct pci_dev *pdev,
                 case IDE:
                         WARN_ON((i & 1) || map[i + 1] != IDE);
                         pinfo[i / 2] = piix_port_info[ich5_pata];
+                        pinfo[i / 2].private_data = hpriv;
                         i++;
                         printk(" IDE IDE");
                         break;
@@ -805,8 +923,8 @@ static void __devinit piix_init_sata_map(struct pci_dev *pdev,
                 dev_printk(KERN_ERR, &pdev->dev,
                            "invalid MAP value %u\n", map_value);
 
-        pinfo[0].private_data = (void *)map;
-        pinfo[1].private_data = (void *)map;
+        hpriv->map = map;
+        hpriv->map_db = map_db;
 }
 
 /**
@@ -829,6 +947,7 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         static int printed_version;
         struct ata_port_info port_info[2];
         struct ata_port_info *ppinfo[2] = { &port_info[0], &port_info[1] };
+        struct piix_host_priv *hpriv;
         unsigned long host_flags;
 
         if (!printed_version++)
@@ -839,8 +958,14 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!in_module_init)
                 return -ENODEV;
 
+        hpriv = kzalloc(sizeof(*hpriv), GFP_KERNEL);
+        if (!hpriv)
+                return -ENOMEM;
+
         port_info[0] = piix_port_info[ent->driver_data];
         port_info[1] = piix_port_info[ent->driver_data];
+        port_info[0].private_data = hpriv;
+        port_info[1].private_data = hpriv;
 
         host_flags = port_info[0].host_flags;
 
@@ -855,8 +980,12 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         /* Initialize SATA map */
-        if (host_flags & ATA_FLAG_SATA)
-                piix_init_sata_map(pdev, port_info);
+        if (host_flags & ATA_FLAG_SATA) {
+                piix_init_sata_map(pdev, port_info,
+                                   piix_map_db_table[ent->driver_data]);
+                piix_init_pcs(pdev, port_info,
+                              piix_map_db_table[ent->driver_data]);
+        }
 
         /* On ICH5, some BIOSen disable the interrupt using the
          * PCI_COMMAND_INTX_DISABLE bit added in PCI 2.3.
@@ -879,6 +1008,13 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         return ata_pci_init_one(pdev, ppinfo, 2);
 }
 
+static void piix_host_stop(struct ata_host_set *host_set)
+{
+        if (host_set->next == NULL)
+                kfree(host_set->private_data);
+        ata_host_stop(host_set);
+}
+
 static int __init piix_init(void)
 {
         int rc;
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index 007a14e5c3fd..e397129c90d1 100644
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -507,7 +507,7 @@ static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
      */
 
     if (cmd->use_sg) {
-        cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+        cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
         cmd->SCp.buffers_residual = cmd->use_sg - 1;
         cmd->SCp.ptr = (char *)page_address(cmd->SCp.buffer->page)+
                        cmd->SCp.buffer->offset;
diff --git a/drivers/scsi/atp870u.c b/drivers/scsi/atp870u.c
index 412f8301b757..0ec41f34f462 100644
--- a/drivers/scsi/atp870u.c
+++ b/drivers/scsi/atp870u.c
@@ -2625,29 +2625,32 @@ static int atp870u_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         unsigned int base_io, tmport, error,n;
         unsigned char host_id;
         struct Scsi_Host *shpnt = NULL;
-        struct atp_unit atp_dev, *p;
+        struct atp_unit *atpdev, *p;
         unsigned char setupdata[2][16];
         int count = 0;
-        
+
+        atpdev = kzalloc(sizeof(*atpdev), GFP_KERNEL);
+        if (!atpdev)
+                return -ENOMEM;
+
         if (pci_enable_device(pdev))
-                return -EIO;
+                goto err_eio;
 
         if (!pci_set_dma_mask(pdev, DMA_32BIT_MASK)) {
                 printk(KERN_INFO "atp870u: use 32bit DMA mask.\n");
         } else {
                 printk(KERN_ERR "atp870u: DMA mask required but not available.\n");
-                return -EIO;
+                goto err_eio;
         }
 
-        memset(&atp_dev, 0, sizeof atp_dev);
         /*
          * It's probably easier to weed out some revisions like
          * this than via the PCI device table
          */
         if (ent->device == PCI_DEVICE_ID_ARTOP_AEC7610) {
-                error = pci_read_config_byte(pdev, PCI_CLASS_REVISION, &atp_dev.chip_ver);
-                if (atp_dev.chip_ver < 2)
-                        return -EIO;
+                error = pci_read_config_byte(pdev, PCI_CLASS_REVISION, &atpdev->chip_ver);
+                if (atpdev->chip_ver < 2)
+                        goto err_eio;
         }
 
         switch (ent->device) {
@@ -2656,15 +2659,15 @@ static int atp870u_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         case ATP880_DEVID1:     
         case ATP880_DEVID2:     
         case ATP885_DEVID:      
-                atp_dev.chip_ver = 0x04;
+                atpdev->chip_ver = 0x04;
         default:
                 break;
         }
         base_io = pci_resource_start(pdev, 0);
         base_io &= 0xfffffff8;
-        
+
         if ((ent->device == ATP880_DEVID1)||(ent->device == ATP880_DEVID2)) {
-                error = pci_read_config_byte(pdev, PCI_CLASS_REVISION, &atp_dev.chip_ver);
+                error = pci_read_config_byte(pdev, PCI_CLASS_REVISION, &atpdev->chip_ver);
                 pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 0x80);//JCC082803
 
                 host_id = inb(base_io + 0x39);
@@ -2672,17 +2675,17 @@ static int atp870u_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
                 printk(KERN_INFO "   ACARD AEC-67160 PCI Ultra3 LVD Host Adapter: %d"
                         "    IO:%x, IRQ:%d.\n", count, base_io, pdev->irq);
-                atp_dev.ioport[0] = base_io + 0x40;
-                atp_dev.pciport[0] = base_io + 0x28;
-                atp_dev.dev_id = ent->device;
-                atp_dev.host_id[0] = host_id;
+                atpdev->ioport[0] = base_io + 0x40;
+                atpdev->pciport[0] = base_io + 0x28;
+                atpdev->dev_id = ent->device;
+                atpdev->host_id[0] = host_id;
 
                 tmport = base_io + 0x22;
-                atp_dev.scam_on = inb(tmport);
+                atpdev->scam_on = inb(tmport);
                 tmport += 0x13;
-                atp_dev.global_map[0] = inb(tmport);
+                atpdev->global_map[0] = inb(tmport);
                 tmport += 0x07;
-                atp_dev.ultra_map[0] = inw(tmport);
+                atpdev->ultra_map[0] = inw(tmport);
 
                 n = 0x3f09;
 next_fblk_880:
@@ -2695,57 +2698,57 @@ next_fblk_880:
                 if (inb(base_io + 0x30) == 0xff)
                         goto flash_ok_880;
 
-                atp_dev.sp[0][m++] = inb(base_io + 0x30);
-                atp_dev.sp[0][m++] = inb(base_io + 0x31);
-                atp_dev.sp[0][m++] = inb(base_io + 0x32);
-                atp_dev.sp[0][m++] = inb(base_io + 0x33);
+                atpdev->sp[0][m++] = inb(base_io + 0x30);
+                atpdev->sp[0][m++] = inb(base_io + 0x31);
+                atpdev->sp[0][m++] = inb(base_io + 0x32);
+                atpdev->sp[0][m++] = inb(base_io + 0x33);
                 outw(n, base_io + 0x34);
                 n += 0x0002;
-                atp_dev.sp[0][m++] = inb(base_io + 0x30);
-                atp_dev.sp[0][m++] = inb(base_io + 0x31);
-                atp_dev.sp[0][m++] = inb(base_io + 0x32);
-                atp_dev.sp[0][m++] = inb(base_io + 0x33);
+                atpdev->sp[0][m++] = inb(base_io + 0x30);
+                atpdev->sp[0][m++] = inb(base_io + 0x31);
+                atpdev->sp[0][m++] = inb(base_io + 0x32);
+                atpdev->sp[0][m++] = inb(base_io + 0x33);
                 outw(n, base_io + 0x34);
                 n += 0x0002;
-                atp_dev.sp[0][m++] = inb(base_io + 0x30);
-                atp_dev.sp[0][m++] = inb(base_io + 0x31);
-                atp_dev.sp[0][m++] = inb(base_io + 0x32);
-                atp_dev.sp[0][m++] = inb(base_io + 0x33);
+                atpdev->sp[0][m++] = inb(base_io + 0x30);
+                atpdev->sp[0][m++] = inb(base_io + 0x31);
+                atpdev->sp[0][m++] = inb(base_io + 0x32);
+                atpdev->sp[0][m++] = inb(base_io + 0x33);
                 outw(n, base_io + 0x34);
                 n += 0x0002;
-                atp_dev.sp[0][m++] = inb(base_io + 0x30);
-                atp_dev.sp[0][m++] = inb(base_io + 0x31);
-                atp_dev.sp[0][m++] = inb(base_io + 0x32);
-                atp_dev.sp[0][m++] = inb(base_io + 0x33);
+                atpdev->sp[0][m++] = inb(base_io + 0x30);
+                atpdev->sp[0][m++] = inb(base_io + 0x31);
+                atpdev->sp[0][m++] = inb(base_io + 0x32);
+                atpdev->sp[0][m++] = inb(base_io + 0x33);
                 n += 0x0018;
                 goto next_fblk_880;
 flash_ok_880:
                 outw(0, base_io + 0x34);
-                atp_dev.ultra_map[0] = 0;
-                atp_dev.async[0] = 0;
+                atpdev->ultra_map[0] = 0;
+                atpdev->async[0] = 0;
                 for (k = 0; k < 16; k++) {
                         n = 1;
                         n = n << k;
-                        if (atp_dev.sp[0][k] > 1) {
-                                atp_dev.ultra_map[0] |= n;
+                        if (atpdev->sp[0][k] > 1) {
+                                atpdev->ultra_map[0] |= n;
                         } else {
-                                if (atp_dev.sp[0][k] == 0)
-                                        atp_dev.async[0] |= n;
+                                if (atpdev->sp[0][k] == 0)
+                                        atpdev->async[0] |= n;
                         }
                 }
-                atp_dev.async[0] = ~(atp_dev.async[0]);
-                outb(atp_dev.global_map[0], base_io + 0x35);
+                atpdev->async[0] = ~(atpdev->async[0]);
+                outb(atpdev->global_map[0], base_io + 0x35);
  
                 shpnt = scsi_host_alloc(&atp870u_template, sizeof(struct atp_unit));
                 if (!shpnt)
-                        return -ENOMEM;
+                        goto err_nomem;
 
                 p = (struct atp_unit *)&shpnt->hostdata;
 
-                atp_dev.host = shpnt;
-                atp_dev.pdev = pdev;
+                atpdev->host = shpnt;
+                atpdev->pdev = pdev;
                 pci_set_drvdata(pdev, p);
-                memcpy(p, &atp_dev, sizeof atp_dev);
+                memcpy(p, atpdev, sizeof(*atpdev));
                 if (atp870u_init_tables(shpnt) < 0) {
                         printk(KERN_ERR "Unable to allocate tables for Acard controller\n");
                         goto unregister;
@@ -2798,24 +2801,24 @@ flash_ok_880:
                         printk(KERN_INFO "   ACARD AEC-67162 PCI Ultra3 LVD Host Adapter:  IO:%x, IRQ:%d.\n"
                                , base_io, pdev->irq);
                 
-                atp_dev.pdev = pdev;    
-                atp_dev.dev_id  = ent->device;
-                atp_dev.baseport = base_io;
-                atp_dev.ioport[0] = base_io + 0x80;
-                atp_dev.ioport[1] = base_io + 0xc0;
-                atp_dev.pciport[0] = base_io + 0x40;
-                atp_dev.pciport[1] = base_io + 0x50;
+                atpdev->pdev = pdev;
+                atpdev->dev_id  = ent->device;
+                atpdev->baseport = base_io;
+                atpdev->ioport[0] = base_io + 0x80;
+                atpdev->ioport[1] = base_io + 0xc0;
+                atpdev->pciport[0] = base_io + 0x40;
+                atpdev->pciport[1] = base_io + 0x50;
                                 
                 shpnt = scsi_host_alloc(&atp870u_template, sizeof(struct atp_unit));
                 if (!shpnt)
-                        return -ENOMEM;
+                        goto err_nomem;
                 
                 p = (struct atp_unit *)&shpnt->hostdata;
                 
-                atp_dev.host = shpnt;
-                atp_dev.pdev = pdev;
+                atpdev->host = shpnt;
+                atpdev->pdev = pdev;
                 pci_set_drvdata(pdev, p);
-                memcpy(p, &atp_dev, sizeof(struct atp_unit));
+                memcpy(p, atpdev, sizeof(struct atp_unit));
                 if (atp870u_init_tables(shpnt) < 0)
                         goto unregister;
                         
@@ -2974,33 +2977,33 @@ flash_ok_885:
                 printk(KERN_INFO "   ACARD AEC-671X PCI Ultra/W SCSI-2/3 Host Adapter: %d "
                         "IO:%x, IRQ:%d.\n", count, base_io, pdev->irq);
 
-                atp_dev.ioport[0] = base_io;
-                atp_dev.pciport[0] = base_io + 0x20;
-                atp_dev.dev_id = ent->device;
+                atpdev->ioport[0] = base_io;
+                atpdev->pciport[0] = base_io + 0x20;
+                atpdev->dev_id = ent->device;
                 host_id &= 0x07;
-                atp_dev.host_id[0] = host_id;
+                atpdev->host_id[0] = host_id;
                 tmport = base_io + 0x22;
-                atp_dev.scam_on = inb(tmport);
+                atpdev->scam_on = inb(tmport);
                 tmport += 0x0b;
-                atp_dev.global_map[0] = inb(tmport++);
-                atp_dev.ultra_map[0] = inw(tmport);
+                atpdev->global_map[0] = inb(tmport++);
+                atpdev->ultra_map[0] = inw(tmport);
 
-                if (atp_dev.ultra_map[0] == 0) {
-                        atp_dev.scam_on = 0x00;
-                        atp_dev.global_map[0] = 0x20;
-                        atp_dev.ultra_map[0] = 0xffff;
+                if (atpdev->ultra_map[0] == 0) {
+                        atpdev->scam_on = 0x00;
+                        atpdev->global_map[0] = 0x20;
+                        atpdev->ultra_map[0] = 0xffff;
                 }
 
                 shpnt = scsi_host_alloc(&atp870u_template, sizeof(struct atp_unit));
                 if (!shpnt)
-                        return -ENOMEM;
+                        goto err_nomem;
 
                 p = (struct atp_unit *)&shpnt->hostdata;
                 
-                atp_dev.host = shpnt;
-                atp_dev.pdev = pdev;
+                atpdev->host = shpnt;
+                atpdev->pdev = pdev;
                 pci_set_drvdata(pdev, p);
-                memcpy(p, &atp_dev, sizeof atp_dev);
+                memcpy(p, atpdev, sizeof(*atpdev));
                 if (atp870u_init_tables(shpnt) < 0)
                         goto unregister;
 
@@ -3010,7 +3013,7 @@ flash_ok_885:
                 }
 
                 spin_lock_irqsave(shpnt->host_lock, flags);
-                if (atp_dev.chip_ver > 0x07) {  /* check if atp876 chip then enable terminator */
+                if (atpdev->chip_ver > 0x07) {  /* check if atp876 chip then enable terminator */
                         tmport = base_io + 0x3e;
                         outb(0x00, tmport);
                 }
@@ -3044,7 +3047,7 @@ flash_ok_885:
                 outb((inb(tmport) & 0xef), tmport);
                 tmport++;
                 outb((inb(tmport) | 0x20), tmport);
-                if (atp_dev.chip_ver == 4)
+                if (atpdev->chip_ver == 4)
                         shpnt->max_id = 16;
                 else            
                         shpnt->max_id = 8;
@@ -3093,6 +3096,12 @@ unregister:
         printk("atp870u_prob:unregister\n");
         scsi_host_put(shpnt);
         return -1;              
+err_eio:
+        kfree(atpdev);
+        return -EIO;
+err_nomem:
+        kfree(atpdev);
+        return -ENOMEM;
 }
 
 /* The abort command does not leave the device in a clean state where
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index dddd2acce76f..61f6024b61ba 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -5,6 +5,7 @@
  * Additions for SCSI 3+ (SPC-3 T10/1416-D Rev 07 3 May 2002)
  *   by D. Gilbert and aeb (20020609)
  * Additions for SPC-3 T10/1416-D Rev 21 22 Sept 2004, D. Gilbert 20041025
+ * Update to SPC-4 T10/1713-D Rev 5a, 14 June 2006, D. Gilbert 20060702
  */
 
 #include <linux/blkdev.h>
@@ -36,55 +37,56 @@ static const char * cdb_byte0_names[] = {
 /* 00-03 */ "Test Unit Ready", "Rezero Unit/Rewind", NULL, "Request Sense",
 /* 04-07 */ "Format Unit/Medium", "Read Block Limits", NULL,
             "Reasssign Blocks",
-/* 08-0d */ "Read (6)", NULL, "Write (6)", "Seek (6)", NULL, NULL,
+/* 08-0d */ "Read(6)", NULL, "Write(6)", "Seek(6)", NULL, NULL,
 /* 0e-12 */ NULL, "Read Reverse", "Write Filemarks", "Space", "Inquiry",  
-/* 13-16 */ "Verify (6)", "Recover Buffered Data", "Mode Select (6)",
-            "Reserve (6)",
-/* 17-1a */ "Release (6)", "Copy", "Erase", "Mode Sense (6)", 
+/* 13-16 */ "Verify(6)", "Recover Buffered Data", "Mode Select(6)",
+            "Reserve(6)",
+/* 17-1a */ "Release(6)", "Copy", "Erase", "Mode Sense(6)",
 /* 1b-1d */ "Start/Stop Unit", "Receive Diagnostic", "Send Diagnostic", 
 /* 1e-1f */ "Prevent/Allow Medium Removal", NULL,
 /* 20-22 */  NULL, NULL, NULL,
 /* 23-28 */ "Read Format Capacities", "Set Window",
-            "Read Capacity (10)", NULL, NULL, "Read (10)", 
-/* 29-2d */ "Read Generation", "Write (10)", "Seek (10)", "Erase (10)", 
-            "Read updated block", 
-/* 2e-31 */ "Write Verify (10)", "Verify (10)", "Search High", "Search Equal", 
+            "Read Capacity(10)", NULL, NULL, "Read(10)",
+/* 29-2d */ "Read Generation", "Write(10)", "Seek(10)", "Erase(10)",
+            "Read updated block",
+/* 2e-31 */ "Write Verify(10)", "Verify(10)", "Search High", "Search Equal",
 /* 32-34 */ "Search Low", "Set Limits", "Prefetch/Read Position", 
-/* 35-37 */ "Synchronize Cache (10)", "Lock/Unlock Cache (10)",
+/* 35-37 */ "Synchronize Cache(10)", "Lock/Unlock Cache(10)",
             "Read Defect Data(10)", 
 /* 38-3c */ "Medium Scan", "Compare", "Copy Verify", "Write Buffer", 
             "Read Buffer", 
-/* 3d-3f */ "Update Block", "Read Long (10)",  "Write Long (10)",
-/* 40-41 */ "Change Definition", "Write Same (10)",
+/* 3d-3f */ "Update Block", "Read Long(10)",  "Write Long(10)",
+/* 40-41 */ "Change Definition", "Write Same(10)",
 /* 42-48 */ "Read sub-channel", "Read TOC/PMA/ATIP", "Read density support",
-            "Play audio (10)", "Get configuration", "Play audio msf",
+            "Play audio(10)", "Get configuration", "Play audio msf",
             "Play audio track/index",
-/* 49-4f */ "Play track relative (10)", "Get event status notification",
+/* 49-4f */ "Play track relative(10)", "Get event status notification",
             "Pause/resume", "Log Select", "Log Sense", "Stop play/scan",
             NULL,
 /* 50-55 */ "Xdwrite", "Xpwrite, Read disk info", "Xdread, Read track info",
-            "Reserve track", "Send OPC info", "Mode Select (10)",
-/* 56-5b */ "Reserve (10)", "Release (10)", "Repair track", "Read master cue",
-            "Mode Sense (10)", "Close track/session",
+            "Reserve track", "Send OPC info", "Mode Select(10)",
+/* 56-5b */ "Reserve(10)", "Release(10)", "Repair track", "Read master cue",
+            "Mode Sense(10)", "Close track/session",
 /* 5c-5f */ "Read buffer capacity", "Send cue sheet", "Persistent reserve in",
             "Persistent reserve out",
 /* 60-67 */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 68-6f */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 70-77 */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 78-7f */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, "Variable length",
-/* 80-84 */ "Xdwrite (16)", "Rebuild (16)", "Regenerate (16)", "Extended copy",
+/* 80-84 */ "Xdwrite(16)", "Rebuild(16)", "Regenerate(16)", "Extended copy",
             "Receive copy results",
-/* 85-89 */ "Memory Export In (16)", "Access control in", "Access control out",
-            "Read (16)", "Memory Export Out (16)",
-/* 8a-8f */ "Write (16)", NULL, "Read attributes", "Write attributes",
-            "Write and verify (16)", "Verify (16)",
-/* 90-94 */ "Pre-fetch (16)", "Synchronize cache (16)",
-            "Lock/unlock cache (16)", "Write same (16)", NULL,
+/* 85-89 */ "ATA command pass through(16)", "Access control in",
+            "Access control out", "Read(16)", "Memory Export Out(16)",
+/* 8a-8f */ "Write(16)", NULL, "Read attributes", "Write attributes",
+            "Write and verify(16)", "Verify(16)",
+/* 90-94 */ "Pre-fetch(16)", "Synchronize cache(16)",
+            "Lock/unlock cache(16)", "Write same(16)", NULL,
 /* 95-99 */ NULL, NULL, NULL, NULL, NULL,
-/* 9a-9f */ NULL, NULL, NULL, NULL, "Service action in (16)",
-            "Service action out (16)",
-/* a0-a5 */ "Report luns", "Blank", "Send event", "Maintenance in",
-            "Maintenance out", "Move medium/play audio(12)",
+/* 9a-9f */ NULL, NULL, NULL, NULL, "Service action in(16)",
+            "Service action out(16)",
+/* a0-a5 */ "Report luns", "ATA command pass through(12)/Blank",
+            "Security protocol in", "Maintenance in", "Maintenance out",
+            "Move medium/play audio(12)",
 /* a6-a9 */ "Exchange medium", "Move medium attached", "Read(12)",
             "Play track relative(12)",
 /* aa-ae */ "Write(12)", NULL, "Erase(12), Get Performance",
@@ -92,12 +94,12 @@ static const char * cdb_byte0_names[] = {
 /* af-b1 */ "Verify(12)", "Search data high(12)", "Search data equal(12)",
 /* b2-b4 */ "Search data low(12)", "Set limits(12)",
             "Read element status attached",
-/* b5-b6 */ "Request volume element address", "Send volume tag, set streaming",
+/* b5-b6 */ "Security protocol out", "Send volume tag, set streaming",
 /* b7-b9 */ "Read defect data(12)", "Read element status", "Read CD msf",
 /* ba-bc */ "Redundancy group (in), Scan",
-            "Redundancy group (out), Set cd-rom speed", "Spare in, Play cd",
-/* bd-bf */ "Spare out, Mechanism status", "Volume set in, Read cd",
-            "Volume set out, Send DVD structure",
+            "Redundancy group (out), Set cd-rom speed", "Spare (in), Play cd",
+/* bd-bf */ "Spare (out), Mechanism status", "Volume set (in), Read cd",
+            "Volume set (out), Send DVD structure",
 };
 
 struct value_name_pair {
@@ -112,6 +114,7 @@ static const struct value_name_pair maint_in_arr[] = {
         {0xc, "Report supported operation codes"},
         {0xd, "Report supported task management functions"},
         {0xe, "Report priority"},
+        {0xf, "Report timestamp"},
 };
 #define MAINT_IN_SZ ARRAY_SIZE(maint_in_arr)
 
@@ -120,6 +123,7 @@ static const struct value_name_pair maint_out_arr[] = {
         {0xa, "Set target port groups"},
         {0xb, "Change aliases"},
         {0xe, "Set priority"},
+        {0xe, "Set timestamp"},
 };
 #define MAINT_OUT_SZ ARRAY_SIZE(maint_out_arr)
 
@@ -427,6 +431,7 @@ static struct error_info additional[] =
         {0x001A, "Rewind operation in progress"},
         {0x001B, "Set capacity operation in progress"},
         {0x001C, "Verify operation in progress"},
+        {0x001D, "ATA pass through information available"},
 
         {0x0100, "No index/sector signal"},
 
@@ -438,7 +443,7 @@ static struct error_info additional[] =
 
         {0x0400, "Logical unit not ready, cause not reportable"},
         {0x0401, "Logical unit is in process of becoming ready"},
-        {0x0402, "Logical unit not ready, initializing cmd. required"},
+        {0x0402, "Logical unit not ready, initializing command required"},
         {0x0403, "Logical unit not ready, manual intervention required"},
         {0x0404, "Logical unit not ready, format in progress"},
         {0x0405, "Logical unit not ready, rebuild in progress"},
@@ -478,6 +483,9 @@ static struct error_info additional[] =
         {0x0B00, "Warning"},
         {0x0B01, "Warning - specified temperature exceeded"},
         {0x0B02, "Warning - enclosure degraded"},
+        {0x0B03, "Warning - background self-test failed"},
+        {0x0B04, "Warning - background pre-scan detected medium error"},
+        {0x0B05, "Warning - background medium scan detected medium error"},
 
         {0x0C00, "Write error"},
         {0x0C01, "Write error - recovered with auto reallocation"},
@@ -493,6 +501,7 @@ static struct error_info additional[] =
         {0x0C0B, "Auxiliary memory write error"},
         {0x0C0C, "Write error - unexpected unsolicited data"},
         {0x0C0D, "Write error - not enough unsolicited data"},
+        {0x0C0F, "Defects in error window"},
 
         {0x0D00, "Error detected by third party temporary initiator"},
         {0x0D01, "Third party device failure"},
@@ -504,11 +513,12 @@ static struct error_info additional[] =
         {0x0E00, "Invalid information unit"},
         {0x0E01, "Information unit too short"},
         {0x0E02, "Information unit too long"},
+        {0x0E03, "Invalid field in command information unit"},
 
         {0x1000, "Id CRC or ECC error"},
-        {0x1001, "Data block guard check failed"},
-        {0x1002, "Data block application tag check failed"},
-        {0x1003, "Data block reference tag check failed"},
+        {0x1001, "Logical block guard check failed"},
+        {0x1002, "Logical block application tag check failed"},
+        {0x1003, "Logical block reference tag check failed"},
 
         {0x1100, "Unrecovered read error"},
         {0x1101, "Read retries exhausted"},
@@ -530,6 +540,7 @@ static struct error_info additional[] =
         {0x1111, "Read error - loss of streaming"},
         {0x1112, "Auxiliary memory read error"},
         {0x1113, "Read error - failed retransmission request"},
+        {0x1114, "Read error - lba marked bad by application client"},
 
         {0x1200, "Address mark not found for id field"},
 
@@ -610,11 +621,14 @@ static struct error_info additional[] =
         {0x2100, "Logical block address out of range"},
         {0x2101, "Invalid element address"},
         {0x2102, "Invalid address for write"},
+        {0x2103, "Invalid write crossing layer jump"},
 
         {0x2200, "Illegal function (use 20 00, 24 00, or 26 00)"},
 
         {0x2400, "Invalid field in cdb"},
         {0x2401, "CDB decryption error"},
+        {0x2402, "Obsolete"},
+        {0x2403, "Obsolete"},
         {0x2404, "Security audit value frozen"},
         {0x2405, "Security working key frozen"},
         {0x2406, "Nonce not unique"},
@@ -637,7 +651,10 @@ static struct error_info additional[] =
         {0x260C, "Invalid operation for copy source or destination"},
         {0x260D, "Copy segment granularity violation"},
         {0x260E, "Invalid parameter while port is enabled"},
-        {0x260F, "Invalid data-out buffer integrity"},
+        {0x260F, "Invalid data-out buffer integrity check value"},
+        {0x2610, "Data decryption key fail limit reached"},
+        {0x2611, "Incomplete key-associated data set"},
+        {0x2612, "Vendor specific key reference not found"},
 
         {0x2700, "Write protected"},
         {0x2701, "Hardware write protected"},
@@ -649,6 +666,7 @@ static struct error_info additional[] =
 
         {0x2800, "Not ready to ready change, medium may have changed"},
         {0x2801, "Import or export element accessed"},
+        {0x2802, "Format-layer may have changed"},
 
         {0x2900, "Power on, reset, or bus device reset occurred"},
         {0x2901, "Power on occurred"},
@@ -669,6 +687,11 @@ static struct error_info additional[] =
         {0x2A07, "Implicit asymmetric access state transition failed"},
         {0x2A08, "Priority changed"},
         {0x2A09, "Capacity data has changed"},
+        {0x2A10, "Timestamp changed"},
+        {0x2A11, "Data encryption parameters changed by another i_t nexus"},
+        {0x2A12, "Data encryption parameters changed by vendor specific "
+                 "event"},
+        {0x2A13, "Data encryption key instance counter has changed"},
 
         {0x2B00, "Copy cannot execute since host cannot disconnect"},
 
@@ -690,6 +713,7 @@ static struct error_info additional[] =
         {0x2E00, "Insufficient time for operation"},
 
         {0x2F00, "Commands cleared by another initiator"},
+        {0x2F01, "Commands cleared by power loss notification"},
 
         {0x3000, "Incompatible medium installed"},
         {0x3001, "Cannot read medium - unknown format"},
@@ -702,7 +726,8 @@ static struct error_info additional[] =
         {0x3008, "Cannot write - application code mismatch"},
         {0x3009, "Current session not fixated for append"},
         {0x300A, "Cleaning request rejected"},
-        {0x300C, "WORM medium, overwrite attempted"},
+        {0x300C, "WORM medium - overwrite attempted"},
+        {0x300D, "WORM medium - integrity check"},
         {0x3010, "Medium not formatted"},
 
         {0x3100, "Medium format corrupted"},
@@ -790,6 +815,9 @@ static struct error_info additional[] =
         {0x3F0F, "Echo buffer overwritten"},
         {0x3F10, "Medium loadable"},
         {0x3F11, "Medium auxiliary memory accessible"},
+        {0x3F12, "iSCSI IP address added"},
+        {0x3F13, "iSCSI IP address removed"},
+        {0x3F14, "iSCSI IP address changed"},
 /*
  *      {0x40NN, "Ram failure"},
  *      {0x40NN, "Diagnostic failure on component nn"},
@@ -799,6 +827,7 @@ static struct error_info additional[] =
         {0x4300, "Message error"},
 
         {0x4400, "Internal target failure"},
+        {0x4471, "ATA device failed set features"},
 
         {0x4500, "Select or reselect failure"},
 
@@ -807,9 +836,10 @@ static struct error_info additional[] =
         {0x4700, "Scsi parity error"},
         {0x4701, "Data phase CRC error detected"},
         {0x4702, "Scsi parity error detected during st data phase"},
-        {0x4703, "Information unit CRC error detected"},
+        {0x4703, "Information unit iuCRC error detected"},
         {0x4704, "Asynchronous information protection error detected"},
         {0x4705, "Protocol service CRC error"},
+        {0x4706, "Phy test function in progress"},
         {0x477f, "Some commands cleared by iSCSI Protocol event"},
 
         {0x4800, "Initiator detected error message received"},
@@ -844,6 +874,8 @@ static struct error_info additional[] =
         {0x5300, "Media load or eject failed"},
         {0x5301, "Unload tape failure"},
         {0x5302, "Medium removal prevented"},
+        {0x5303, "Medium removal prevented by data transfer element"},
+        {0x5304, "Medium thread or unthread failure"},
 
         {0x5400, "Scsi to host system interface failure"},
 
@@ -855,6 +887,7 @@ static struct error_info additional[] =
         {0x5505, "Insufficient access control resources"},
         {0x5506, "Auxiliary memory out of space"},
         {0x5507, "Quota error"},
+        {0x5508, "Maximum number of supplemental decryption keys exceeded"},
 
         {0x5700, "Unable to recover table-of-contents"},
 
@@ -1004,6 +1037,7 @@ static struct error_info additional[] =
         {0x6708, "Assign failure occurred"},
         {0x6709, "Multiply assigned logical unit"},
         {0x670A, "Set target port groups command failed"},
+        {0x670B, "ATA device feature not enabled"},
 
         {0x6800, "Logical unit not configured"},
 
@@ -1030,6 +1064,8 @@ static struct error_info additional[] =
         {0x6F03, "Read of scrambled sector without authentication"},
         {0x6F04, "Media region code is mismatched to logical unit region"},
         {0x6F05, "Drive region must be permanent/region reset count error"},
+        {0x6F06, "Insufficient block count for binding nonce recording"},
+        {0x6F07, "Conflict in binding nonce recording"},
 /*
  *      {0x70NN, "Decompression exception short algorithm id of nn"},
  */
@@ -1041,6 +1077,8 @@ static struct error_info additional[] =
         {0x7203, "Session fixation error - incomplete track in session"},
         {0x7204, "Empty or partially written reserved track"},
         {0x7205, "No more track reservations allowed"},
+        {0x7206, "RMZ extension is not allowed"},
+        {0x7207, "No more test zone extensions are allowed"},
 
         {0x7300, "Cd control error"},
         {0x7301, "Power calibration area almost full"},
@@ -1049,6 +1087,18 @@ static struct error_info additional[] =
         {0x7304, "Program memory area update failure"},
         {0x7305, "Program memory area is full"},
         {0x7306, "RMA/PMA is almost full"},
+        {0x7310, "Current power calibration area almost full"},
+        {0x7311, "Current power calibration area is full"},
+        {0x7317, "RDZ is full"},
+
+        {0x7400, "Security error"},
+        {0x7401, "Unable to decrypt data"},
+        {0x7402, "Unencrypted data encountered while decrypting"},
+        {0x7403, "Incorrect data encryption key"},
+        {0x7404, "Cryptographic integrity validation failed"},
+        {0x7405, "Error decrypting data"},
+        {0x7471, "Logical unit access not authorized"},
+
         {0, NULL}
 };
 
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
index 10573c24a50b..5630868c1b25 100644
--- a/drivers/scsi/esp.c
+++ b/drivers/scsi/esp.c
@@ -1146,7 +1146,7 @@ static struct sbus_dev sun4_esp_dev;
 static int __init esp_sun4_probe(struct scsi_host_template *tpnt)
 {
         if (sun4_esp_physaddr) {
-                memset(&sun4_esp_dev, 0, sizeof(esp_dev));
+                memset(&sun4_esp_dev, 0, sizeof(sun4_esp_dev));
                 sun4_esp_dev.reg_addrs[0].phys_addr = sun4_esp_physaddr;
                 sun4_esp_dev.irqs[0] = 4;
                 sun4_esp_dev.resource[0].start = sun4_esp_physaddr;
@@ -1162,6 +1162,7 @@ static int __init esp_sun4_probe(struct scsi_host_template *tpnt)
 
 static int __devexit esp_sun4_remove(void)
 {
+        struct of_device *dev = &sun4_esp_dev.ofdev;
         struct esp *esp = dev_get_drvdata(&dev->dev);
 
         return esp_remove_common(esp);
@@ -1397,7 +1398,7 @@ static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
                         sp->SCp.ptr = NULL;
                 }
         } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->buffer;
+                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
                 sp->SCp.buffers_residual = sbus_map_sg(esp->sdev,
                                                        sp->SCp.buffer,
                                                        sp->use_sg,
@@ -1410,7 +1411,7 @@ static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
 static void esp_release_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
 {
         if (sp->use_sg) {
-                sbus_unmap_sg(esp->sdev, sp->buffer, sp->use_sg,
+                sbus_unmap_sg(esp->sdev, sp->request_buffer, sp->use_sg,
                               sp->sc_data_direction);
         } else if (sp->request_bufflen) {
                 sbus_unmap_single(esp->sdev,
@@ -2754,18 +2755,15 @@ static int esp_do_data_finale(struct esp *esp)
  */
 static int esp_should_clear_sync(struct scsi_cmnd *sp)
 {
-        u8 cmd1 = sp->cmnd[0];
-        u8 cmd2 = sp->data_cmnd[0];
+        u8 cmd = sp->cmnd[0];
 
         /* These cases are for spinning up a disk and
          * waiting for that spinup to complete.
          */
-        if (cmd1 == START_STOP ||
-            cmd2 == START_STOP)
+        if (cmd == START_STOP)
                 return 0;
 
-        if (cmd1 == TEST_UNIT_READY ||
-            cmd2 == TEST_UNIT_READY)
+        if (cmd == TEST_UNIT_READY)
                 return 0;
 
         /* One more special case for SCSI tape drives,
@@ -2773,8 +2771,7 @@ static int esp_should_clear_sync(struct scsi_cmnd *sp)
          * completion of a rewind or tape load operation.
          */
         if (sp->device->type == TYPE_TAPE) {
-                if (cmd1 == MODE_SENSE ||
-                    cmd2 == MODE_SENSE)
+                if (cmd == MODE_SENSE)
                         return 0;
         }
 
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index ab2f8b267908..bcb3444f1dcf 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -45,10 +45,6 @@ static char driver_name[] = "hptiop";
 static const char driver_name_long[] = "RocketRAID 3xxx SATA Controller driver";
 static const char driver_ver[] = "v1.0 (060426)";
 
-static DEFINE_SPINLOCK(hptiop_hba_list_lock);
-static LIST_HEAD(hptiop_hba_list);
-static int hptiop_cdev_major = -1;
-
 static void hptiop_host_request_callback(struct hptiop_hba *hba, u32 tag);
 static void hptiop_iop_request_callback(struct hptiop_hba *hba, u32 tag);
 static void hptiop_message_callback(struct hptiop_hba *hba, u32 msg);
@@ -577,7 +573,7 @@ static int hptiop_reset_hba(struct hptiop_hba *hba)
         if (atomic_xchg(&hba->resetting, 1) == 0) {
                 atomic_inc(&hba->reset_count);
                 writel(IOPMU_INBOUND_MSG0_RESET,
-                                &hba->iop->outbound_msgaddr0);
+                                &hba->iop->inbound_msgaddr0);
                 hptiop_pci_posting_flush(hba->iop);
         }
 
@@ -620,532 +616,11 @@ static int hptiop_adjust_disk_queue_depth(struct scsi_device *sdev,
         return queue_depth;
 }
 
-struct hptiop_getinfo {
-        char __user *buffer;
-        loff_t buflength;
-        loff_t bufoffset;
-        loff_t buffillen;
-        loff_t filpos;
-};
-
-static void hptiop_copy_mem_info(struct hptiop_getinfo *pinfo,
-                                        char *data, int datalen)
-{
-        if (pinfo->filpos < pinfo->bufoffset) {
-                if (pinfo->filpos + datalen <= pinfo->bufoffset) {
-                        pinfo->filpos += datalen;
-                        return;
-                } else {
-                        data += (pinfo->bufoffset - pinfo->filpos);
-                        datalen  -= (pinfo->bufoffset - pinfo->filpos);
-                        pinfo->filpos = pinfo->bufoffset;
-                }
-        }
-
-        pinfo->filpos += datalen;
-        if (pinfo->buffillen == pinfo->buflength)
-                return;
-
-        if (pinfo->buflength - pinfo->buffillen < datalen)
-                datalen = pinfo->buflength - pinfo->buffillen;
-
-        if (copy_to_user(pinfo->buffer + pinfo->buffillen, data, datalen))
-                return;
-
-        pinfo->buffillen += datalen;
-}
-
-static int hptiop_copy_info(struct hptiop_getinfo *pinfo, char *fmt, ...)
-{
-        va_list args;
-        char buf[128];
-        int len;
-
-        va_start(args, fmt);
-        len = vsnprintf(buf, sizeof(buf), fmt, args);
-        va_end(args);
-        hptiop_copy_mem_info(pinfo, buf, len);
-        return len;
-}
-
-static void hptiop_ioctl_done(struct hpt_ioctl_k *arg)
-{
-        arg->done = NULL;
-        wake_up(&arg->hba->ioctl_wq);
-}
-
-static void hptiop_do_ioctl(struct hpt_ioctl_k *arg)
-{
-        struct hptiop_hba *hba = arg->hba;
-        u32 val;
-        struct hpt_iop_request_ioctl_command __iomem *req;
-        int ioctl_retry = 0;
-
-        dprintk("scsi%d: hptiop_do_ioctl\n", hba->host->host_no);
-
-        /*
-         * check (in + out) buff size from application.
-         * outbuf must be dword aligned.
-         */
-        if (((arg->inbuf_size + 3) & ~3) + arg->outbuf_size >
-                        hba->max_request_size
-                                - sizeof(struct hpt_iop_request_header)
-                                - 4 * sizeof(u32)) {
-                dprintk("scsi%d: ioctl buf size (%d/%d) is too large\n",
-                                hba->host->host_no,
-                                arg->inbuf_size, arg->outbuf_size);
-                arg->result = HPT_IOCTL_RESULT_FAILED;
-                return;
-        }
-
-retry:
-        spin_lock_irq(hba->host->host_lock);
-
-        val = readl(&hba->iop->inbound_queue);
-        if (val == IOPMU_QUEUE_EMPTY) {
-                spin_unlock_irq(hba->host->host_lock);
-                dprintk("scsi%d: no free req for ioctl\n", hba->host->host_no);
-                arg->result = -1;
-                return;
-        }
-
-        req = (struct hpt_iop_request_ioctl_command __iomem *)
-                        ((unsigned long)hba->iop + val);
-
-        writel(HPT_CTL_CODE_LINUX_TO_IOP(arg->ioctl_code),
-                        &req->ioctl_code);
-        writel(arg->inbuf_size, &req->inbuf_size);
-        writel(arg->outbuf_size, &req->outbuf_size);
-
-        /*
-         * use the buffer on the IOP local memory first, then copy it
-         * back to host.
-         * the caller's request buffer shoudl be little-endian.
-         */
-        if (arg->inbuf_size)
-                memcpy_toio(req->buf, arg->inbuf, arg->inbuf_size);
-
-        /* correct the controller ID for IOP */
-        if ((arg->ioctl_code == HPT_IOCTL_GET_CHANNEL_INFO ||
-                arg->ioctl_code == HPT_IOCTL_GET_CONTROLLER_INFO_V2 ||
-                arg->ioctl_code == HPT_IOCTL_GET_CONTROLLER_INFO)
-                && arg->inbuf_size >= sizeof(u32))
-                writel(0, req->buf);
-
-        writel(IOP_REQUEST_TYPE_IOCTL_COMMAND, &req->header.type);
-        writel(0, &req->header.flags);
-        writel(offsetof(struct hpt_iop_request_ioctl_command, buf)
-                        + arg->inbuf_size, &req->header.size);
-        writel((u32)(unsigned long)arg, &req->header.context);
-        writel(BITS_PER_LONG > 32 ? (u32)((unsigned long)arg>>32) : 0,
-                        &req->header.context_hi32);
-        writel(IOP_RESULT_PENDING, &req->header.result);
-
-        arg->result = HPT_IOCTL_RESULT_FAILED;
-        arg->done = hptiop_ioctl_done;
-
-        writel(val, &hba->iop->inbound_queue);
-        hptiop_pci_posting_flush(hba->iop);
-
-        spin_unlock_irq(hba->host->host_lock);
-
-        wait_event_timeout(hba->ioctl_wq, arg->done == NULL, 60 * HZ);
-
-        if (arg->done != NULL) {
-                hptiop_reset_hba(hba);
-                if (ioctl_retry++ < 3)
-                        goto retry;
-        }
-
-        dprintk("hpt_iop_ioctl %x result %d\n",
-                        arg->ioctl_code, arg->result);
-}
-
-static int __hpt_do_ioctl(struct hptiop_hba *hba, u32 code, void *inbuf,
-                        u32 insize, void *outbuf, u32 outsize)
-{
-        struct hpt_ioctl_k arg;
-        arg.hba = hba;
-        arg.ioctl_code = code;
-        arg.inbuf = inbuf;
-        arg.outbuf = outbuf;
-        arg.inbuf_size = insize;
-        arg.outbuf_size = outsize;
-        arg.bytes_returned = NULL;
-        hptiop_do_ioctl(&arg);
-        return arg.result;
-}
-
-static inline int hpt_id_valid(__le32 id)
-{
-        return id != 0 && id != cpu_to_le32(0xffffffff);
-}
-
-static int hptiop_get_controller_info(struct hptiop_hba *hba,
-                                        struct hpt_controller_info *pinfo)
-{
-        int id = 0;
-
-        return __hpt_do_ioctl(hba, HPT_IOCTL_GET_CONTROLLER_INFO,
-                &id, sizeof(int), pinfo, sizeof(*pinfo));
-}
-
-
-static int hptiop_get_channel_info(struct hptiop_hba *hba, int bus,
-                                        struct hpt_channel_info *pinfo)
-{
-        u32 ids[2];
-
-        ids[0] = 0;
-        ids[1] = bus;
-        return __hpt_do_ioctl(hba, HPT_IOCTL_GET_CHANNEL_INFO,
-                                ids, sizeof(ids), pinfo, sizeof(*pinfo));
-
-}
-
-static int hptiop_get_logical_devices(struct hptiop_hba *hba,
-                                        __le32 *pids, int maxcount)
-{
-        int i;
-        u32 count = maxcount - 1;
-
-        if (__hpt_do_ioctl(hba, HPT_IOCTL_GET_LOGICAL_DEVICES,
-                        &count, sizeof(u32),
-                        pids, sizeof(u32) * maxcount))
-                return -1;
-
-        maxcount = le32_to_cpu(pids[0]);
-        for (i = 0; i < maxcount; i++)
-                pids[i] = pids[i+1];
-
-        return maxcount;
-}
-
-static int hptiop_get_device_info_v3(struct hptiop_hba *hba, __le32 id,
-                                struct hpt_logical_device_info_v3 *pinfo)
-{
-        return __hpt_do_ioctl(hba, HPT_IOCTL_GET_DEVICE_INFO_V3,
-                                &id, sizeof(u32),
-                                pinfo, sizeof(*pinfo));
-}
-
-static const char *get_array_status(struct hpt_logical_device_info_v3 *devinfo)
-{
-        static char s[64];
-        u32 flags = le32_to_cpu(devinfo->u.array.flags);
-        u32 trans_prog = le32_to_cpu(devinfo->u.array.transforming_progress);
-        u32 reb_prog = le32_to_cpu(devinfo->u.array.rebuilding_progress);
-
-        if (flags & ARRAY_FLAG_DISABLED)
-                return "Disabled";
-        else if (flags & ARRAY_FLAG_TRANSFORMING)
-                sprintf(s, "Expanding/Migrating %d.%d%%%s%s",
-                        trans_prog / 100,
-                        trans_prog % 100,
-                        (flags & (ARRAY_FLAG_NEEDBUILDING|ARRAY_FLAG_BROKEN))?
-                                        ", Critical" : "",
-                        ((flags & ARRAY_FLAG_NEEDINITIALIZING) &&
-                         !(flags & ARRAY_FLAG_REBUILDING) &&
-                         !(flags & ARRAY_FLAG_INITIALIZING))?
-                                        ", Unintialized" : "");
-        else if ((flags & ARRAY_FLAG_BROKEN) &&
-                                devinfo->u.array.array_type != AT_RAID6)
-                return "Critical";
-        else if (flags & ARRAY_FLAG_REBUILDING)
-                sprintf(s,
-                        (flags & ARRAY_FLAG_NEEDINITIALIZING)?
-                                "%sBackground initializing %d.%d%%" :
-                                        "%sRebuilding %d.%d%%",
-                        (flags & ARRAY_FLAG_BROKEN)? "Critical, " : "",
-                        reb_prog / 100,
-                        reb_prog % 100);
-        else if (flags & ARRAY_FLAG_VERIFYING)
-                sprintf(s, "%sVerifying %d.%d%%",
-                        (flags & ARRAY_FLAG_BROKEN)? "Critical, " : "",
-                        reb_prog / 100,
-                        reb_prog % 100);
-        else if (flags & ARRAY_FLAG_INITIALIZING)
-                sprintf(s, "%sForground initializing %d.%d%%",
-                        (flags & ARRAY_FLAG_BROKEN)? "Critical, " : "",
-                        reb_prog / 100,
-                        reb_prog % 100);
-        else if (flags & ARRAY_FLAG_NEEDTRANSFORM)
-                sprintf(s,"%s%s%s", "Need Expanding/Migrating",
-                        (flags & ARRAY_FLAG_BROKEN)? "Critical, " : "",
-                        ((flags & ARRAY_FLAG_NEEDINITIALIZING) &&
-                         !(flags & ARRAY_FLAG_REBUILDING) &&
-                         !(flags & ARRAY_FLAG_INITIALIZING))?
-                                ", Unintialized" : "");
-        else if (flags & ARRAY_FLAG_NEEDINITIALIZING &&
-                !(flags & ARRAY_FLAG_REBUILDING) &&
-                !(flags & ARRAY_FLAG_INITIALIZING))
-                sprintf(s,"%sUninitialized",
-                        (flags & ARRAY_FLAG_BROKEN)? "Critical, " : "");
-        else if ((flags & ARRAY_FLAG_NEEDBUILDING) ||
-                        (flags & ARRAY_FLAG_BROKEN))
-                return "Critical";
-        else
-                return "Normal";
-        return s;
-}
-
-static void hptiop_dump_devinfo(struct hptiop_hba *hba,
-                        struct hptiop_getinfo *pinfo, __le32 id, int indent)
-{
-        struct hpt_logical_device_info_v3 devinfo;
-        int i;
-        u64 capacity;
-
-        for (i = 0; i < indent; i++)
-                hptiop_copy_info(pinfo, "\t");
-
-        if (hptiop_get_device_info_v3(hba, id, &devinfo)) {
-                hptiop_copy_info(pinfo, "unknown\n");
-                return;
-        }
-
-        switch (devinfo.type) {
-
-        case LDT_DEVICE: {
-                struct hd_driveid *driveid;
-                u32 flags = le32_to_cpu(devinfo.u.device.flags);
-
-                driveid = (struct hd_driveid *)devinfo.u.device.ident;
-                /* model[] is 40 chars long, but we just want 20 chars here */
-                driveid->model[20] = 0;
-
-                if (indent)
-                        if (flags & DEVICE_FLAG_DISABLED)
-                                hptiop_copy_info(pinfo,"Missing\n");
-                        else
-                                hptiop_copy_info(pinfo, "CH%d %s\n",
-                                        devinfo.u.device.path_id + 1,
-                                        driveid->model);
-                else {
-                        capacity = le64_to_cpu(devinfo.capacity) * 512;
-                        do_div(capacity, 1000000);
-                        hptiop_copy_info(pinfo,
-                                "CH%d %s, %lluMB, %s %s%s%s%s\n",
-                                devinfo.u.device.path_id + 1,
-                                driveid->model,
-                                capacity,
-                                (flags & DEVICE_FLAG_DISABLED)?
-                                        "Disabled" : "Normal",
-                                devinfo.u.device.read_ahead_enabled?
-                                                "[RA]" : "",
-                                devinfo.u.device.write_cache_enabled?
-                                                "[WC]" : "",
-                                devinfo.u.device.TCQ_enabled?
-                                                "[TCQ]" : "",
-                                devinfo.u.device.NCQ_enabled?
-                                                "[NCQ]" : ""
-                        );
-                }
-                break;
-        }
-
-        case LDT_ARRAY:
-                if (devinfo.target_id != INVALID_TARGET_ID)
-                        hptiop_copy_info(pinfo, "[DISK %d_%d] ",
-                                        devinfo.vbus_id, devinfo.target_id);
-
-                capacity = le64_to_cpu(devinfo.capacity) * 512;
-                do_div(capacity, 1000000);
-                hptiop_copy_info(pinfo, "%s (%s), %lluMB, %s\n",
-                        devinfo.u.array.name,
-                        devinfo.u.array.array_type==AT_RAID0? "RAID0" :
-                                devinfo.u.array.array_type==AT_RAID1? "RAID1" :
-                                devinfo.u.array.array_type==AT_RAID5? "RAID5" :
-                                devinfo.u.array.array_type==AT_RAID6? "RAID6" :
-                                devinfo.u.array.array_type==AT_JBOD? "JBOD" :
-                                        "unknown",
-                        capacity,
-                        get_array_status(&devinfo));
-                for (i = 0; i < devinfo.u.array.ndisk; i++) {
-                        if (hpt_id_valid(devinfo.u.array.members[i])) {
-                                if (cpu_to_le16(1<<i) &
-                                        devinfo.u.array.critical_members)
-                                        hptiop_copy_info(pinfo, "\t*");
-                                hptiop_dump_devinfo(hba, pinfo,
-                                        devinfo.u.array.members[i], indent+1);
-                        }
-                        else
-                                hptiop_copy_info(pinfo, "\tMissing\n");
-                }
-                if (id == devinfo.u.array.transform_source) {
-                        hptiop_copy_info(pinfo, "\tExpanding/Migrating to:\n");
-                        hptiop_dump_devinfo(hba, pinfo,
-                                devinfo.u.array.transform_target, indent+1);
-                }
-                break;
-        }
-}
-
 static ssize_t hptiop_show_version(struct class_device *class_dev, char *buf)
 {
         return snprintf(buf, PAGE_SIZE, "%s\n", driver_ver);
 }
 
-static ssize_t hptiop_cdev_read(struct file *filp, char __user *buf,
-                                size_t count, loff_t *ppos)
-{
-        struct hptiop_hba *hba = filp->private_data;
-        struct hptiop_getinfo info;
-        int i, j, ndev;
-        struct hpt_controller_info con_info;
-        struct hpt_channel_info chan_info;
-        __le32 ids[32];
-
-        info.buffer     = buf;
-        info.buflength  = count;
-        info.bufoffset  = ppos ? *ppos : 0;
-        info.filpos     = 0;
-        info.buffillen  = 0;
-
-        if (hptiop_get_controller_info(hba, &con_info))
-                return -EIO;
-
-        for (i = 0; i < con_info.num_buses; i++) {
-                if (hptiop_get_channel_info(hba, i, &chan_info) == 0) {
-                        if (hpt_id_valid(chan_info.devices[0]))
-                                hptiop_dump_devinfo(hba, &info,
-                                                chan_info.devices[0], 0);
-                        if (hpt_id_valid(chan_info.devices[1]))
-                                hptiop_dump_devinfo(hba, &info,
-                                                chan_info.devices[1], 0);
-                }
-        }
-
-        ndev = hptiop_get_logical_devices(hba, ids,
-                                        sizeof(ids) / sizeof(ids[0]));
-
-        /*
-         * if hptiop_get_logical_devices fails, ndev==-1 and it just
-         * output nothing here
-         */
-        for (j = 0; j < ndev; j++)
-                hptiop_dump_devinfo(hba, &info, ids[j], 0);
-
-        if (ppos)
-                *ppos += info.buffillen;
-
-        return info.buffillen;
-}
-
-static int hptiop_cdev_ioctl(struct inode *inode,  struct file *file,
-                                        unsigned int cmd, unsigned long arg)
-{
-        struct hptiop_hba *hba = file->private_data;
-        struct hpt_ioctl_u ioctl_u;
-        struct hpt_ioctl_k ioctl_k;
-        u32 bytes_returned;
-        int err = -EINVAL;
-
-        if (copy_from_user(&ioctl_u,
-                (void __user *)arg, sizeof(struct hpt_ioctl_u)))
-                return -EINVAL;
-
-        if (ioctl_u.magic != HPT_IOCTL_MAGIC)
-                return -EINVAL;
-
-        ioctl_k.ioctl_code = ioctl_u.ioctl_code;
-        ioctl_k.inbuf = NULL;
-        ioctl_k.inbuf_size = ioctl_u.inbuf_size;
-        ioctl_k.outbuf = NULL;
-        ioctl_k.outbuf_size = ioctl_u.outbuf_size;
-        ioctl_k.hba = hba;
-        ioctl_k.bytes_returned = &bytes_returned;
-
-        /* verify user buffer */
-        if ((ioctl_k.inbuf_size && !access_ok(VERIFY_READ,
-                        ioctl_u.inbuf, ioctl_k.inbuf_size)) ||
-                (ioctl_k.outbuf_size && !access_ok(VERIFY_WRITE,
-                        ioctl_u.outbuf, ioctl_k.outbuf_size)) ||
-                (ioctl_u.bytes_returned && !access_ok(VERIFY_WRITE,
-                        ioctl_u.bytes_returned, sizeof(u32))) ||
-                ioctl_k.inbuf_size + ioctl_k.outbuf_size > 0x10000) {
-
-                dprintk("scsi%d: got bad user address\n", hba->host->host_no);
-                return -EINVAL;
-        }
-
-        /* map buffer to kernel. */
-        if (ioctl_k.inbuf_size) {
-                ioctl_k.inbuf = kmalloc(ioctl_k.inbuf_size, GFP_KERNEL);
-                if (!ioctl_k.inbuf) {
-                        dprintk("scsi%d: fail to alloc inbuf\n",
-                                        hba->host->host_no);
-                        err = -ENOMEM;
-                        goto err_exit;
-                }
-
-                if (copy_from_user(ioctl_k.inbuf,
-                                ioctl_u.inbuf, ioctl_k.inbuf_size)) {
-                        goto err_exit;
-                }
-        }
-
-        if (ioctl_k.outbuf_size) {
-                ioctl_k.outbuf = kmalloc(ioctl_k.outbuf_size, GFP_KERNEL);
-                if (!ioctl_k.outbuf) {
-                        dprintk("scsi%d: fail to alloc outbuf\n",
-                                        hba->host->host_no);
-                        err = -ENOMEM;
-                        goto err_exit;
-                }
-        }
-
-        hptiop_do_ioctl(&ioctl_k);
-
-        if (ioctl_k.result == HPT_IOCTL_RESULT_OK) {
-                if (ioctl_k.outbuf_size &&
-                        copy_to_user(ioctl_u.outbuf,
-                                ioctl_k.outbuf, ioctl_k.outbuf_size))
-                        goto err_exit;
-
-                if (ioctl_u.bytes_returned &&
-                        copy_to_user(ioctl_u.bytes_returned,
-                                &bytes_returned, sizeof(u32)))
-                        goto err_exit;
-
-                err = 0;
-        }
-
-err_exit:
-        kfree(ioctl_k.inbuf);
-        kfree(ioctl_k.outbuf);
-
-        return err;
-}
-
-static int hptiop_cdev_open(struct inode *inode, struct file *file)
-{
-        struct hptiop_hba *hba;
-        unsigned i = 0, minor = iminor(inode);
-        int ret = -ENODEV;
-
-        spin_lock(&hptiop_hba_list_lock);
-        list_for_each_entry(hba, &hptiop_hba_list, link) {
-                if (i == minor) {
-                        file->private_data = hba;
-                        ret = 0;
-                        goto out;
-                }
-                i++;
-        }
-
-out:
-        spin_unlock(&hptiop_hba_list_lock);
-        return ret;
-}
-
-static struct file_operations hptiop_cdev_fops = {
-        .owner = THIS_MODULE,
-        .read  = hptiop_cdev_read,
-        .ioctl = hptiop_cdev_ioctl,
-        .open  = hptiop_cdev_open,
-};
-
 static ssize_t hptiop_show_fw_version(struct class_device *class_dev, char *buf)
 {
         struct Scsi_Host *host = class_to_shost(class_dev);
@@ -1296,19 +771,13 @@ static int __devinit hptiop_probe(struct pci_dev *pcidev,
                 goto unmap_pci_bar;
         }
 
-        if (scsi_add_host(host, &pcidev->dev)) {
-                printk(KERN_ERR "scsi%d: scsi_add_host failed\n",
-                                        hba->host->host_no);
-                goto unmap_pci_bar;
-        }
-
         pci_set_drvdata(pcidev, host);
 
         if (request_irq(pcidev->irq, hptiop_intr, IRQF_SHARED,
                                         driver_name, hba)) {
                 printk(KERN_ERR "scsi%d: request irq %d failed\n",
                                         hba->host->host_no, pcidev->irq);
-                goto remove_scsi_host;
+                goto unmap_pci_bar;
         }
 
         /* Allocate request mem */
@@ -1355,9 +824,12 @@ static int __devinit hptiop_probe(struct pci_dev *pcidev,
         if (hptiop_initialize_iop(hba))
                 goto free_request_mem;
 
-        spin_lock(&hptiop_hba_list_lock);
-        list_add_tail(&hba->link, &hptiop_hba_list);
-        spin_unlock(&hptiop_hba_list_lock);
+        if (scsi_add_host(host, &pcidev->dev)) {
+                printk(KERN_ERR "scsi%d: scsi_add_host failed\n",
+                                        hba->host->host_no);
+                goto free_request_mem;
+        }
+
 
         scsi_scan_host(host);
 
@@ -1372,9 +844,6 @@ free_request_mem:
 free_request_irq:
         free_irq(hba->pcidev->irq, hba);
 
-remove_scsi_host:
-        scsi_remove_host(host);
-
 unmap_pci_bar:
         iounmap(hba->iop);
 
@@ -1422,10 +891,6 @@ static void hptiop_remove(struct pci_dev *pcidev)
 
         scsi_remove_host(host);
 
-        spin_lock(&hptiop_hba_list_lock);
-        list_del_init(&hba->link);
-        spin_unlock(&hptiop_hba_list_lock);
-
         hptiop_shutdown(pcidev);
 
         free_irq(hba->pcidev->irq, hba);
@@ -1462,27 +927,12 @@ static struct pci_driver hptiop_pci_driver = {
 
 static int __init hptiop_module_init(void)
 {
-        int error;
-
         printk(KERN_INFO "%s %s\n", driver_name_long, driver_ver);
-
-        error = pci_register_driver(&hptiop_pci_driver);
-        if (error < 0)
-                return error;
-
-        hptiop_cdev_major = register_chrdev(0, "hptiop", &hptiop_cdev_fops);
-        if (hptiop_cdev_major < 0) {
-                printk(KERN_WARNING "unable to register hptiop device.\n");
-                return hptiop_cdev_major;
-        }
-
-        return 0;
+        return pci_register_driver(&hptiop_pci_driver);
 }
 
 static void __exit hptiop_module_exit(void)
 {
-        dprintk("hptiop_module_exit\n");
-        unregister_chrdev(hptiop_cdev_major, "hptiop");
         pci_unregister_driver(&hptiop_pci_driver);
 }
 
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 944fc1203ebd..669ea4fff166 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -535,6 +535,7 @@ static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
                                    struct ibmvscsi_host_data *hostdata)
 {
         u64 *crq_as_u64 = (u64 *) &evt_struct->crq;
+        int request_status;
         int rc;
 
         /* If we have exhausted our request limit, just fail this request.
@@ -542,9 +543,18 @@ static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
          * (such as task management requests) that the mid layer may think we
          * can handle more requests (can_queue) when we actually can't
          */
-        if ((evt_struct->crq.format == VIOSRP_SRP_FORMAT) &&
-            (atomic_dec_if_positive(&hostdata->request_limit) < 0))
-                goto send_error;
+        if (evt_struct->crq.format == VIOSRP_SRP_FORMAT) {
+                request_status =
+                        atomic_dec_if_positive(&hostdata->request_limit);
+                /* If request limit was -1 when we started, it is now even
+                 * less than that
+                 */
+                if (request_status < -1)
+                        goto send_error;
+                /* Otherwise, if we have run out of requests */
+                else if (request_status < 0)
+                        goto send_busy;
+        }
 
         /* Copy the IU into the transfer area */
         *evt_struct->xfer_iu = evt_struct->iu;
@@ -567,11 +577,23 @@ static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
 
         return 0;
 
- send_error:
+ send_busy:
         unmap_cmd_data(&evt_struct->iu.srp.cmd, evt_struct, hostdata->dev);
 
         free_event_struct(&hostdata->pool, evt_struct);
         return SCSI_MLQUEUE_HOST_BUSY;
+
+ send_error:
+        unmap_cmd_data(&evt_struct->iu.srp.cmd, evt_struct, hostdata->dev);
+
+        if (evt_struct->cmnd != NULL) {
+                evt_struct->cmnd->result = DID_ERROR << 16;
+                evt_struct->cmnd_done(evt_struct->cmnd);
+        } else if (evt_struct->done)
+                evt_struct->done(evt_struct);
+
+        free_event_struct(&hostdata->pool, evt_struct);
+        return 0;
 }
 
 /**
@@ -1184,27 +1206,37 @@ void ibmvscsi_handle_crq(struct viosrp_crq *crq,
                 return;
         case 0xFF:      /* Hypervisor telling us the connection is closed */
                 scsi_block_requests(hostdata->host);
+                atomic_set(&hostdata->request_limit, 0);
                 if (crq->format == 0x06) {
                         /* We need to re-setup the interpartition connection */
                         printk(KERN_INFO
                                "ibmvscsi: Re-enabling adapter!\n");
-                        atomic_set(&hostdata->request_limit, -1);
                         purge_requests(hostdata, DID_REQUEUE);
-                        if (ibmvscsi_reenable_crq_queue(&hostdata->queue,
-                                                        hostdata) == 0)
-                                if (ibmvscsi_send_crq(hostdata,
-                                                      0xC001000000000000LL, 0))
+                        if ((ibmvscsi_reenable_crq_queue(&hostdata->queue,
+                                                        hostdata) == 0) ||
+                            (ibmvscsi_send_crq(hostdata,
+                                               0xC001000000000000LL, 0))) {
+                                        atomic_set(&hostdata->request_limit,
+                                                   -1);
                                         printk(KERN_ERR
-                                               "ibmvscsi: transmit error after"
+                                               "ibmvscsi: error after"
                                                " enable\n");
+                        }
                 } else {
                         printk(KERN_INFO
                                "ibmvscsi: Virtual adapter failed rc %d!\n",
                                crq->format);
 
-                        atomic_set(&hostdata->request_limit, -1);
                         purge_requests(hostdata, DID_ERROR);
-                        ibmvscsi_reset_crq_queue(&hostdata->queue, hostdata);
+                        if ((ibmvscsi_reset_crq_queue(&hostdata->queue,
+                                                        hostdata)) ||
+                            (ibmvscsi_send_crq(hostdata,
+                                               0xC001000000000000LL, 0))) {
+                                        atomic_set(&hostdata->request_limit,
+                                                   -1);
+                                        printk(KERN_ERR
+                                               "ibmvscsi: error after reset\n");
+                        }
                 }
                 scsi_unblock_requests(hostdata->host);
                 return;
@@ -1467,6 +1499,7 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         struct Scsi_Host *host;
         struct device *dev = &vdev->dev;
         unsigned long wait_switch = 0;
+        int rc;
 
         vdev->dev.driver_data = NULL;
 
@@ -1484,8 +1517,8 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         atomic_set(&hostdata->request_limit, -1);
         hostdata->host->max_sectors = 32 * 8; /* default max I/O 32 pages */
 
-        if (ibmvscsi_init_crq_queue(&hostdata->queue, hostdata,
-                                    max_requests) != 0) {
+        rc = ibmvscsi_init_crq_queue(&hostdata->queue, hostdata, max_requests);
+        if (rc != 0 && rc != H_RESOURCE) {
                 printk(KERN_ERR "ibmvscsi: couldn't initialize crq\n");
                 goto init_crq_failed;
         }
@@ -1505,7 +1538,8 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
          * to fail if the other end is not acive.  In that case we don't
          * want to scan
          */
-        if (ibmvscsi_send_crq(hostdata, 0xC001000000000000LL, 0) == 0) {
+        if (ibmvscsi_send_crq(hostdata, 0xC001000000000000LL, 0) == 0
+            || rc == H_RESOURCE) {
                 /*
                  * Wait around max init_timeout secs for the adapter to finish
                  * initializing. When we are done initializing, we will have a
diff --git a/drivers/scsi/ibmvscsi/iseries_vscsi.c b/drivers/scsi/ibmvscsi/iseries_vscsi.c
index 7eed0b098171..6aeb5f003c3c 100644
--- a/drivers/scsi/ibmvscsi/iseries_vscsi.c
+++ b/drivers/scsi/ibmvscsi/iseries_vscsi.c
@@ -81,7 +81,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
         int rc;
 
         single_host_data = hostdata;
-        rc = viopath_open(viopath_hostLp, viomajorsubtype_scsi, 0);
+        rc = viopath_open(viopath_hostLp, viomajorsubtype_scsi, max_requests);
         if (rc < 0) {
                 printk("viopath_open failed with rc %d in open_event_path\n",
                        rc);
diff --git a/drivers/scsi/ibmvscsi/rpa_vscsi.c b/drivers/scsi/ibmvscsi/rpa_vscsi.c
index 1a9992bdfef8..ed22b96580c6 100644
--- a/drivers/scsi/ibmvscsi/rpa_vscsi.c
+++ b/drivers/scsi/ibmvscsi/rpa_vscsi.c
@@ -208,6 +208,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
                             int max_requests)
 {
         int rc;
+        int retrc;
         struct vio_dev *vdev = to_vio_dev(hostdata->dev);
 
         queue->msgs = (struct viosrp_crq *)get_zeroed_page(GFP_KERNEL);
@@ -226,7 +227,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
         gather_partition_info();
         set_adapter_info(hostdata);
 
-        rc = plpar_hcall_norets(H_REG_CRQ,
+        retrc = rc = plpar_hcall_norets(H_REG_CRQ,
                                 vdev->unit_address,
                                 queue->msg_token, PAGE_SIZE);
         if (rc == H_RESOURCE)
@@ -237,6 +238,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
         if (rc == 2) {
                 /* Adapter is good, but other end is not ready */
                 printk(KERN_WARNING "ibmvscsi: Partner adapter not ready\n");
+                retrc = 0;
         } else if (rc != 0) {
                 printk(KERN_WARNING "ibmvscsi: Error %d opening adapter\n", rc);
                 goto reg_crq_failed;
@@ -263,7 +265,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
         tasklet_init(&hostdata->srp_task, (void *)ibmvscsi_task,
                      (unsigned long)hostdata);
 
-        return 0;
+        return retrc;
 
       req_irq_failed:
         do {
diff --git a/drivers/scsi/ide-scsi.c b/drivers/scsi/ide-scsi.c
index f7b5d7372d26..94d1de55607f 100644
--- a/drivers/scsi/ide-scsi.c
+++ b/drivers/scsi/ide-scsi.c
@@ -517,7 +517,7 @@ static ide_startstop_t idescsi_pc_intr (ide_drive_t *drive)
                 /* No more interrupts */
                 if (test_bit(IDESCSI_LOG_CMD, &scsi->log))
                         printk (KERN_INFO "Packet command completed, %d bytes transferred\n", pc->actually_transferred);
-                local_irq_enable();
+                local_irq_enable_in_hardirq();
                 if (status.b.check)
                         rq->errors++;
                 idescsi_end_request (drive, 1, 0);
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index b4743a9ecc80..058f094f945a 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -43,13 +43,10 @@
 
 #include "iscsi_tcp.h"
 
-#define ISCSI_TCP_VERSION "1.0-595"
-
 MODULE_AUTHOR("Dmitry Yusupov <dmitry_yus@yahoo.com>, "
               "Alex Aizman <itn780@yahoo.com>");
 MODULE_DESCRIPTION("iSCSI/TCP data-path");
 MODULE_LICENSE("GPL");
-MODULE_VERSION(ISCSI_TCP_VERSION);
 /* #define DEBUG_TCP */
 #define DEBUG_ASSERT
 
@@ -185,11 +182,19 @@ iscsi_hdr_extract(struct iscsi_tcp_conn *tcp_conn)
  * must be called with session lock
  */
 static void
-__iscsi_ctask_cleanup(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
+iscsi_tcp_cleanup_ctask(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
 {
         struct iscsi_tcp_cmd_task *tcp_ctask = ctask->dd_data;
+        struct iscsi_r2t_info *r2t;
         struct scsi_cmnd *sc;
 
+        /* flush ctask's r2t queues */
+        while (__kfifo_get(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*))) {
+                __kfifo_put(tcp_ctask->r2tpool.queue, (void*)&r2t,
+                            sizeof(void*));
+                debug_scsi("iscsi_tcp_cleanup_ctask pending r2t dropped\n");
+        }
+
         sc = ctask->sc;
         if (unlikely(!sc))
                 return;
@@ -374,6 +379,7 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
                 spin_unlock(&session->lock);
                 return 0;
         }
+
         rc = __kfifo_get(tcp_ctask->r2tpool.queue, (void*)&r2t, sizeof(void*));
         BUG_ON(!rc);
 
@@ -399,7 +405,7 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
         tcp_ctask->exp_r2tsn = r2tsn + 1;
         tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
         __kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
-        __kfifo_put(conn->xmitqueue, (void*)&ctask, sizeof(void*));
+        list_move_tail(&ctask->running, &conn->xmitqueue);
 
         scsi_queue_work(session->host, &conn->xmitwork);
         conn->r2t_pdus_cnt++;
@@ -477,6 +483,8 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
         case ISCSI_OP_SCSI_DATA_IN:
                 tcp_conn->in.ctask = session->cmds[itt];
                 rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);
+                if (rc)
+                        return rc;
                 /* fall through */
         case ISCSI_OP_SCSI_CMD_RSP:
                 tcp_conn->in.ctask = session->cmds[itt];
@@ -484,7 +492,7 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
                         goto copy_hdr;
 
                 spin_lock(&session->lock);
-                __iscsi_ctask_cleanup(conn, tcp_conn->in.ctask);
+                iscsi_tcp_cleanup_ctask(conn, tcp_conn->in.ctask);
                 rc = __iscsi_complete_pdu(conn, hdr, NULL, 0);
                 spin_unlock(&session->lock);
                 break;
@@ -500,13 +508,28 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
                 break;
         case ISCSI_OP_LOGIN_RSP:
         case ISCSI_OP_TEXT_RSP:
-        case ISCSI_OP_LOGOUT_RSP:
-        case ISCSI_OP_NOOP_IN:
         case ISCSI_OP_REJECT:
         case ISCSI_OP_ASYNC_EVENT:
+                /*
+                 * It is possible that we could get a PDU with a buffer larger
+                 * than 8K, but there are no targets that currently do this.
+                 * For now we fail until we find a vendor that needs it
+                 */
+                if (DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH <
+                    tcp_conn->in.datalen) {
+                        printk(KERN_ERR "iscsi_tcp: received buffer of len %u "
+                              "but conn buffer is only %u (opcode %0x)\n",
+                              tcp_conn->in.datalen,
+                              DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH, opcode);
+                        rc = ISCSI_ERR_PROTO;
+                        break;
+                }
+
                 if (tcp_conn->in.datalen)
                         goto copy_hdr;
         /* fall through */
+        case ISCSI_OP_LOGOUT_RSP:
+        case ISCSI_OP_NOOP_IN:
         case ISCSI_OP_SCSI_TMFUNC_RSP:
                 rc = iscsi_complete_pdu(conn, hdr, NULL, 0);
                 break;
@@ -523,7 +546,7 @@ copy_hdr:
          * skbs to complete the command then we have to copy the header
          * for later use
          */
-        if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <
+        if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <=
            (tcp_conn->in.datalen + tcp_conn->in.padding +
             (conn->datadgst_en ? 4 : 0))) {
                 debug_tcp("Copying header for later use. in.copy %d in.datalen"
@@ -614,9 +637,9 @@ iscsi_ctask_copy(struct iscsi_tcp_conn *tcp_conn, struct iscsi_cmd_task *ctask,
  *      byte counters.
  **/
 static inline int
-iscsi_tcp_copy(struct iscsi_tcp_conn *tcp_conn)
+iscsi_tcp_copy(struct iscsi_conn *conn)
 {
-        void *buf = tcp_conn->data;
+        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         int buf_size = tcp_conn->in.datalen;
         int buf_left = buf_size - tcp_conn->data_copied;
         int size = min(tcp_conn->in.copy, buf_left);
@@ -627,7 +650,7 @@ iscsi_tcp_copy(struct iscsi_tcp_conn *tcp_conn)
         BUG_ON(size <= 0);
 
         rc = skb_copy_bits(tcp_conn->in.skb, tcp_conn->in.offset,
-                           (char*)buf + tcp_conn->data_copied, size);
+                           (char*)conn->data + tcp_conn->data_copied, size);
         BUG_ON(rc);
 
         tcp_conn->in.offset += size;
@@ -745,10 +768,11 @@ static int iscsi_scsi_data_in(struct iscsi_conn *conn)
 done:
         /* check for non-exceptional status */
         if (tcp_conn->in.hdr->flags & ISCSI_FLAG_DATA_STATUS) {
-                debug_scsi("done [sc %lx res %d itt 0x%x]\n",
-                           (long)sc, sc->result, ctask->itt);
+                debug_scsi("done [sc %lx res %d itt 0x%x flags 0x%x]\n",
+                           (long)sc, sc->result, ctask->itt,
+                           tcp_conn->in.hdr->flags);
                 spin_lock(&conn->session->lock);
-                __iscsi_ctask_cleanup(conn, ctask);
+                iscsi_tcp_cleanup_ctask(conn, ctask);
                 __iscsi_complete_pdu(conn, tcp_conn->in.hdr, NULL, 0);
                 spin_unlock(&conn->session->lock);
         }
@@ -769,26 +793,25 @@ iscsi_data_recv(struct iscsi_conn *conn)
                 break;
         case ISCSI_OP_SCSI_CMD_RSP:
                 spin_lock(&conn->session->lock);
-                __iscsi_ctask_cleanup(conn, tcp_conn->in.ctask);
+                iscsi_tcp_cleanup_ctask(conn, tcp_conn->in.ctask);
                 spin_unlock(&conn->session->lock);
         case ISCSI_OP_TEXT_RSP:
         case ISCSI_OP_LOGIN_RSP:
-        case ISCSI_OP_NOOP_IN:
         case ISCSI_OP_ASYNC_EVENT:
         case ISCSI_OP_REJECT:
                 /*
                  * Collect data segment to the connection's data
                  * placeholder
                  */
-                if (iscsi_tcp_copy(tcp_conn)) {
+                if (iscsi_tcp_copy(conn)) {
                         rc = -EAGAIN;
                         goto exit;
                 }
 
-                rc = iscsi_complete_pdu(conn, tcp_conn->in.hdr, tcp_conn->data,
+                rc = iscsi_complete_pdu(conn, tcp_conn->in.hdr, conn->data,
                                         tcp_conn->in.datalen);
                 if (!rc && conn->datadgst_en && opcode != ISCSI_OP_LOGIN_RSP)
-                        iscsi_recv_digest_update(tcp_conn, tcp_conn->data,
+                        iscsi_recv_digest_update(tcp_conn, conn->data,
                                                 tcp_conn->in.datalen);
                 break;
         default:
@@ -843,7 +866,7 @@ more:
                        if (rc == -EAGAIN)
                                 goto nomore;
                        else {
-                                iscsi_conn_failure(conn, rc);
+                                iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
                                 return 0;
                        }
                 }
@@ -897,7 +920,7 @@ more:
                 if (rc) {
                         if (rc == -EAGAIN)
                                 goto again;
-                        iscsi_conn_failure(conn, rc);
+                        iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
                         return 0;
                 }
                 tcp_conn->in.copy -= tcp_conn->in.padding;
@@ -1028,9 +1051,8 @@ iscsi_conn_set_callbacks(struct iscsi_conn *conn)
 }
 
 static void
-iscsi_conn_restore_callbacks(struct iscsi_conn *conn)
+iscsi_conn_restore_callbacks(struct iscsi_tcp_conn *tcp_conn)
 {
-        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct sock *sk = tcp_conn->sock->sk;
 
         /* restore socket callbacks, see also: iscsi_conn_set_callbacks() */
@@ -1308,7 +1330,7 @@ iscsi_tcp_cmd_init(struct iscsi_cmd_task *ctask)
                                     ctask->imm_count -
                                     ctask->unsol_count;
 
-                debug_scsi("cmd [itt %x total %d imm %d imm_data %d "
+                debug_scsi("cmd [itt 0x%x total %d imm %d imm_data %d "
                            "r2t_data %d]\n",
                            ctask->itt, ctask->total_length, ctask->imm_count,
                            ctask->unsol_count, tcp_ctask->r2t_data_count);
@@ -1636,7 +1658,7 @@ handle_xmstate_sol_data(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
         }
 solicit_again:
         /*
-         * send Data-Out whitnin this R2T sequence.
+         * send Data-Out within this R2T sequence.
          */
         if (!r2t->data_count)
                 goto data_out_done;
@@ -1731,7 +1753,7 @@ handle_xmstate_w_pad(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
         struct iscsi_tcp_cmd_task *tcp_ctask = ctask->dd_data;
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct iscsi_data_task *dtask = tcp_ctask->dtask;
-        int sent, rc;
+        int sent = 0, rc;
 
         tcp_ctask->xmstate &= ~XMSTATE_W_PAD;
         iscsi_buf_init_iov(&tcp_ctask->sendbuf, (char*)&tcp_ctask->pad,
@@ -1900,27 +1922,32 @@ iscsi_tcp_conn_create(struct iscsi_cls_session *cls_session, uint32_t conn_idx)
         tcp_conn->in_progress = IN_PROGRESS_WAIT_HEADER;
         /* initial operational parameters */
         tcp_conn->hdr_size = sizeof(struct iscsi_hdr);
-        tcp_conn->data_size = DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH;
-
-        /* allocate initial PDU receive place holder */
-        if (tcp_conn->data_size <= PAGE_SIZE)
-                tcp_conn->data = kmalloc(tcp_conn->data_size, GFP_KERNEL);
-        else
-                tcp_conn->data = (void*)__get_free_pages(GFP_KERNEL,
-                                        get_order(tcp_conn->data_size));
-        if (!tcp_conn->data)
-                goto max_recv_dlenght_alloc_fail;
 
         return cls_conn;
 
-max_recv_dlenght_alloc_fail:
-        kfree(tcp_conn);
 tcp_conn_alloc_fail:
         iscsi_conn_teardown(cls_conn);
         return NULL;
 }
 
 static void
+iscsi_tcp_release_conn(struct iscsi_conn *conn)
+{
+        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+
+        if (!tcp_conn->sock)
+                return;
+
+        sock_hold(tcp_conn->sock->sk);
+        iscsi_conn_restore_callbacks(tcp_conn);
+        sock_put(tcp_conn->sock->sk);
+
+        sock_release(tcp_conn->sock);
+        tcp_conn->sock = NULL;
+        conn->recv_lock = NULL;
+}
+
+static void
 iscsi_tcp_conn_destroy(struct iscsi_cls_conn *cls_conn)
 {
         struct iscsi_conn *conn = cls_conn->dd_data;
@@ -1930,6 +1957,7 @@ iscsi_tcp_conn_destroy(struct iscsi_cls_conn *cls_conn)
         if (conn->hdrdgst_en || conn->datadgst_en)
                 digest = 1;
 
+        iscsi_tcp_release_conn(conn);
         iscsi_conn_teardown(cls_conn);
 
         /* now free tcp_conn */
@@ -1944,15 +1972,18 @@ iscsi_tcp_conn_destroy(struct iscsi_cls_conn *cls_conn)
                         crypto_free_tfm(tcp_conn->data_rx_tfm);
         }
 
-        /* free conn->data, size = MaxRecvDataSegmentLength */
-        if (tcp_conn->data_size <= PAGE_SIZE)
-                kfree(tcp_conn->data);
-        else
-                free_pages((unsigned long)tcp_conn->data,
-                           get_order(tcp_conn->data_size));
         kfree(tcp_conn);
 }
 
+static void
+iscsi_tcp_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
+{
+        struct iscsi_conn *conn = cls_conn->dd_data;
+
+        iscsi_conn_stop(cls_conn, flag);
+        iscsi_tcp_release_conn(conn);
+}
+
 static int
 iscsi_tcp_conn_bind(struct iscsi_cls_session *cls_session,
                     struct iscsi_cls_conn *cls_conn, uint64_t transport_eph,
@@ -2001,52 +2032,6 @@ iscsi_tcp_conn_bind(struct iscsi_cls_session *cls_session,
         return 0;
 }
 
-static void
-iscsi_tcp_cleanup_ctask(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
-{
-        struct iscsi_tcp_cmd_task *tcp_ctask = ctask->dd_data;
-        struct iscsi_r2t_info *r2t;
-
-        /* flush ctask's r2t queues */
-        while (__kfifo_get(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*)))
-                __kfifo_put(tcp_ctask->r2tpool.queue, (void*)&r2t,
-                            sizeof(void*));
-
-        __iscsi_ctask_cleanup(conn, ctask);
-}
-
-static void
-iscsi_tcp_suspend_conn_rx(struct iscsi_conn *conn)
-{
-        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
-        struct sock *sk;
-
-        if (!tcp_conn->sock)
-                return;
-
-        sk = tcp_conn->sock->sk;
-        write_lock_bh(&sk->sk_callback_lock);
-        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
-        write_unlock_bh(&sk->sk_callback_lock);
-}
-
-static void
-iscsi_tcp_terminate_conn(struct iscsi_conn *conn)
-{
-        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
-
-        if (!tcp_conn->sock)
-                return;
-
-        sock_hold(tcp_conn->sock->sk);
-        iscsi_conn_restore_callbacks(conn);
-        sock_put(tcp_conn->sock->sk);
-
-        sock_release(tcp_conn->sock);
-        tcp_conn->sock = NULL;
-        conn->recv_lock = NULL;
-}
-
 /* called with host lock */
 static void
 iscsi_tcp_mgmt_init(struct iscsi_conn *conn, struct iscsi_mgmt_task *mtask,
@@ -2057,6 +2042,7 @@ iscsi_tcp_mgmt_init(struct iscsi_conn *conn, struct iscsi_mgmt_task *mtask,
         iscsi_buf_init_iov(&tcp_mtask->headbuf, (char*)mtask->hdr,
                            sizeof(struct iscsi_hdr));
         tcp_mtask->xmstate = XMSTATE_IMM_HDR;
+        tcp_mtask->sent = 0;
 
         if (mtask->data_count)
                 iscsi_buf_init_iov(&tcp_mtask->sendbuf, (char*)mtask->data,
@@ -2130,50 +2116,16 @@ iscsi_r2tpool_free(struct iscsi_session *session)
 
 static int
 iscsi_conn_set_param(struct iscsi_cls_conn *cls_conn, enum iscsi_param param,
-                     uint32_t value)
+                     char *buf, int buflen)
 {
         struct iscsi_conn *conn = cls_conn->dd_data;
         struct iscsi_session *session = conn->session;
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+        int value;
 
         switch(param) {
-        case ISCSI_PARAM_MAX_RECV_DLENGTH: {
-                char *saveptr = tcp_conn->data;
-                gfp_t flags = GFP_KERNEL;
-
-                if (tcp_conn->data_size >= value) {
-                        conn->max_recv_dlength = value;
-                        break;
-                }
-
-                spin_lock_bh(&session->lock);
-                if (conn->stop_stage == STOP_CONN_RECOVER)
-                        flags = GFP_ATOMIC;
-                spin_unlock_bh(&session->lock);
-
-                if (value <= PAGE_SIZE)
-                        tcp_conn->data = kmalloc(value, flags);
-                else
-                        tcp_conn->data = (void*)__get_free_pages(flags,
-                                                             get_order(value));
-                if (tcp_conn->data == NULL) {
-                        tcp_conn->data = saveptr;
-                        return -ENOMEM;
-                }
-                if (tcp_conn->data_size <= PAGE_SIZE)
-                        kfree(saveptr);
-                else
-                        free_pages((unsigned long)saveptr,
-                                   get_order(tcp_conn->data_size));
-                conn->max_recv_dlength = value;
-                tcp_conn->data_size = value;
-                }
-                break;
-        case ISCSI_PARAM_MAX_XMIT_DLENGTH:
-                conn->max_xmit_dlength =  value;
-                break;
         case ISCSI_PARAM_HDRDGST_EN:
-                conn->hdrdgst_en = value;
+                iscsi_set_param(cls_conn, param, buf, buflen);
                 tcp_conn->hdr_size = sizeof(struct iscsi_hdr);
                 if (conn->hdrdgst_en) {
                         tcp_conn->hdr_size += sizeof(__u32);
@@ -2197,7 +2149,7 @@ iscsi_conn_set_param(struct iscsi_cls_conn *cls_conn, enum iscsi_param param,
                 }
                 break;
         case ISCSI_PARAM_DATADGST_EN:
-                conn->datadgst_en = value;
+                iscsi_set_param(cls_conn, param, buf, buflen);
                 if (conn->datadgst_en) {
                         if (!tcp_conn->data_tx_tfm)
                                 tcp_conn->data_tx_tfm =
@@ -2220,121 +2172,36 @@ iscsi_conn_set_param(struct iscsi_cls_conn *cls_conn, enum iscsi_param param,
                 tcp_conn->sendpage = conn->datadgst_en ?
                         sock_no_sendpage : tcp_conn->sock->ops->sendpage;
                 break;
-        case ISCSI_PARAM_INITIAL_R2T_EN:
-                session->initial_r2t_en = value;
-                break;
         case ISCSI_PARAM_MAX_R2T:
+                sscanf(buf, "%d", &value);
                 if (session->max_r2t == roundup_pow_of_two(value))
                         break;
                 iscsi_r2tpool_free(session);
-                session->max_r2t = value;
+                iscsi_set_param(cls_conn, param, buf, buflen);
                 if (session->max_r2t & (session->max_r2t - 1))
                         session->max_r2t = roundup_pow_of_two(session->max_r2t);
                 if (iscsi_r2tpool_alloc(session))
                         return -ENOMEM;
                 break;
-        case ISCSI_PARAM_IMM_DATA_EN:
-                session->imm_data_en = value;
-                break;
-        case ISCSI_PARAM_FIRST_BURST:
-                session->first_burst = value;
-                break;
-        case ISCSI_PARAM_MAX_BURST:
-                session->max_burst = value;
-                break;
-        case ISCSI_PARAM_PDU_INORDER_EN:
-                session->pdu_inorder_en = value;
-                break;
-        case ISCSI_PARAM_DATASEQ_INORDER_EN:
-                session->dataseq_inorder_en = value;
-                break;
-        case ISCSI_PARAM_ERL:
-                session->erl = value;
-                break;
-        case ISCSI_PARAM_IFMARKER_EN:
-                BUG_ON(value);
-                session->ifmarker_en = value;
-                break;
-        case ISCSI_PARAM_OFMARKER_EN:
-                BUG_ON(value);
-                session->ofmarker_en = value;
-                break;
-        case ISCSI_PARAM_EXP_STATSN:
-                conn->exp_statsn = value;
-                break;
         default:
-                break;
+                return iscsi_set_param(cls_conn, param, buf, buflen);
         }
 
         return 0;
 }
 
 static int
-iscsi_session_get_param(struct iscsi_cls_session *cls_session,
-                        enum iscsi_param param, uint32_t *value)
-{
-        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
-        struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
-
-        switch(param) {
-        case ISCSI_PARAM_INITIAL_R2T_EN:
-                *value = session->initial_r2t_en;
-                break;
-        case ISCSI_PARAM_MAX_R2T:
-                *value = session->max_r2t;
-                break;
-        case ISCSI_PARAM_IMM_DATA_EN:
-                *value = session->imm_data_en;
-                break;
-        case ISCSI_PARAM_FIRST_BURST:
-                *value = session->first_burst;
-                break;
-        case ISCSI_PARAM_MAX_BURST:
-                *value = session->max_burst;
-                break;
-        case ISCSI_PARAM_PDU_INORDER_EN:
-                *value = session->pdu_inorder_en;
-                break;
-        case ISCSI_PARAM_DATASEQ_INORDER_EN:
-                *value = session->dataseq_inorder_en;
-                break;
-        case ISCSI_PARAM_ERL:
-                *value = session->erl;
-                break;
-        case ISCSI_PARAM_IFMARKER_EN:
-                *value = session->ifmarker_en;
-                break;
-        case ISCSI_PARAM_OFMARKER_EN:
-                *value = session->ofmarker_en;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int
-iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
-                     enum iscsi_param param, uint32_t *value)
+iscsi_tcp_conn_get_param(struct iscsi_cls_conn *cls_conn,
+                         enum iscsi_param param, char *buf)
 {
         struct iscsi_conn *conn = cls_conn->dd_data;
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct inet_sock *inet;
+        struct ipv6_pinfo *np;
+        struct sock *sk;
+        int len;
 
         switch(param) {
-        case ISCSI_PARAM_MAX_RECV_DLENGTH:
-                *value = conn->max_recv_dlength;
-                break;
-        case ISCSI_PARAM_MAX_XMIT_DLENGTH:
-                *value = conn->max_xmit_dlength;
-                break;
-        case ISCSI_PARAM_HDRDGST_EN:
-                *value = conn->hdrdgst_en;
-                break;
-        case ISCSI_PARAM_DATADGST_EN:
-                *value = conn->datadgst_en;
-                break;
         case ISCSI_PARAM_CONN_PORT:
                 mutex_lock(&conn->xmitmutex);
                 if (!tcp_conn->sock) {
@@ -2343,30 +2210,9 @@ iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
                 }
 
                 inet = inet_sk(tcp_conn->sock->sk);
-                *value = be16_to_cpu(inet->dport);
+                len = sprintf(buf, "%hu\n", be16_to_cpu(inet->dport));
                 mutex_unlock(&conn->xmitmutex);
-        case ISCSI_PARAM_EXP_STATSN:
-                *value = conn->exp_statsn;
                 break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int
-iscsi_conn_get_str_param(struct iscsi_cls_conn *cls_conn,
-                         enum iscsi_param param, char *buf)
-{
-        struct iscsi_conn *conn = cls_conn->dd_data;
-        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
-        struct sock *sk;
-        struct inet_sock *inet;
-        struct ipv6_pinfo *np;
-        int len = 0;
-
-        switch (param) {
         case ISCSI_PARAM_CONN_ADDRESS:
                 mutex_lock(&conn->xmitmutex);
                 if (!tcp_conn->sock) {
@@ -2388,7 +2234,7 @@ iscsi_conn_get_str_param(struct iscsi_cls_conn *cls_conn,
                 mutex_unlock(&conn->xmitmutex);
                 break;
         default:
-                return -EINVAL;
+                return iscsi_conn_get_param(cls_conn, param, buf);
         }
 
         return len;
@@ -2468,8 +2314,7 @@ static void iscsi_tcp_session_destroy(struct iscsi_cls_session *cls_session)
 }
 
 static struct scsi_host_template iscsi_sht = {
-        .name                   = "iSCSI Initiator over TCP/IP, v"
-                                  ISCSI_TCP_VERSION,
+        .name                   = "iSCSI Initiator over TCP/IP",
         .queuecommand           = iscsi_queuecommand,
         .change_queue_depth     = iscsi_change_queue_depth,
         .can_queue              = ISCSI_XMIT_CMDS_MAX - 1,
@@ -2501,7 +2346,11 @@ static struct iscsi_transport iscsi_tcp_transport = {
                                   ISCSI_ERL |
                                   ISCSI_CONN_PORT |
                                   ISCSI_CONN_ADDRESS |
-                                  ISCSI_EXP_STATSN,
+                                  ISCSI_EXP_STATSN |
+                                  ISCSI_PERSISTENT_PORT |
+                                  ISCSI_PERSISTENT_ADDRESS |
+                                  ISCSI_TARGET_NAME |
+                                  ISCSI_TPGT,
         .host_template          = &iscsi_sht,
         .conndata_size          = sizeof(struct iscsi_conn),
         .max_conn               = 1,
@@ -2514,14 +2363,10 @@ static struct iscsi_transport iscsi_tcp_transport = {
         .bind_conn              = iscsi_tcp_conn_bind,
         .destroy_conn           = iscsi_tcp_conn_destroy,
         .set_param              = iscsi_conn_set_param,
-        .get_conn_param         = iscsi_conn_get_param,
-        .get_conn_str_param     = iscsi_conn_get_str_param,
+        .get_conn_param         = iscsi_tcp_conn_get_param,
         .get_session_param      = iscsi_session_get_param,
         .start_conn             = iscsi_conn_start,
-        .stop_conn              = iscsi_conn_stop,
-        /* these are called as part of conn recovery */
-        .suspend_conn_recv      = iscsi_tcp_suspend_conn_rx,
-        .terminate_conn         = iscsi_tcp_terminate_conn,
+        .stop_conn              = iscsi_tcp_conn_stop,
         /* IO */
         .send_pdu               = iscsi_conn_send_pdu,
         .get_stats              = iscsi_conn_get_stats,
diff --git a/drivers/scsi/iscsi_tcp.h b/drivers/scsi/iscsi_tcp.h
index 808302832e68..6a4ee704e46e 100644
--- a/drivers/scsi/iscsi_tcp.h
+++ b/drivers/scsi/iscsi_tcp.h
@@ -78,8 +78,6 @@ struct iscsi_tcp_conn {
         char                    hdrext[4*sizeof(__u16) +
                                     sizeof(__u32)];
         int                     data_copied;
-        char                    *data;          /* data placeholder */
-        int                     data_size;      /* actual recv_dlength */
         int                     stop_stage;     /* conn_stop() flag: *
                                                  * stop to recover,  *
                                                  * stop to terminate */
diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
index 3fd8a96f2af3..bfac4441d89f 100644
--- a/drivers/scsi/jazz_esp.c
+++ b/drivers/scsi/jazz_esp.c
@@ -257,7 +257,7 @@ static void dma_mmu_release_scsi_one (struct NCR_ESP *esp, struct scsi_cmnd *sp)
 static void dma_mmu_release_scsi_sgl (struct NCR_ESP *esp, struct scsi_cmnd *sp)
 {
     int sz = sp->use_sg - 1;
-    struct scatterlist *sg = (struct scatterlist *)sp->buffer;
+    struct scatterlist *sg = (struct scatterlist *)sp->request_buffer;
                         
     while(sz >= 0) {
         vdma_free(sg[sz].dma_address);
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 82caba464291..427b73a3886a 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -61,9 +61,9 @@
 #include "libata.h"
 
 /* debounce timing parameters in msecs { interval, duration, timeout } */
-const unsigned long sata_deb_timing_boot[]              = {   5,  100, 2000 };
-const unsigned long sata_deb_timing_eh[]                = {  25,  500, 2000 };
-const unsigned long sata_deb_timing_before_fsrst[]      = { 100, 2000, 5000 };
+const unsigned long sata_deb_timing_normal[]            = {   5,  100, 2000 };
+const unsigned long sata_deb_timing_hotplug[]           = {  25,  500, 2000 };
+const unsigned long sata_deb_timing_long[]              = { 100, 2000, 5000 };
 
 static unsigned int ata_dev_init_params(struct ata_device *dev,
                                         u16 heads, u16 sectors);
@@ -907,7 +907,7 @@ void ata_port_queue_task(struct ata_port *ap, void (*fn)(void *), void *data,
 {
         int rc;
 
-        if (ap->flags & ATA_FLAG_FLUSH_PORT_TASK)
+        if (ap->pflags & ATA_PFLAG_FLUSH_PORT_TASK)
                 return;
 
         PREPARE_WORK(&ap->port_task, fn, data);
@@ -938,7 +938,7 @@ void ata_port_flush_task(struct ata_port *ap)
         DPRINTK("ENTER\n");
 
         spin_lock_irqsave(ap->lock, flags);
-        ap->flags |= ATA_FLAG_FLUSH_PORT_TASK;
+        ap->pflags |= ATA_PFLAG_FLUSH_PORT_TASK;
         spin_unlock_irqrestore(ap->lock, flags);
 
         DPRINTK("flush #1\n");
@@ -957,7 +957,7 @@ void ata_port_flush_task(struct ata_port *ap)
         }
 
         spin_lock_irqsave(ap->lock, flags);
-        ap->flags &= ~ATA_FLAG_FLUSH_PORT_TASK;
+        ap->pflags &= ~ATA_PFLAG_FLUSH_PORT_TASK;
         spin_unlock_irqrestore(ap->lock, flags);
 
         if (ata_msg_ctl(ap))
@@ -1001,7 +1001,7 @@ unsigned ata_exec_internal(struct ata_device *dev,
         struct ata_queued_cmd *qc;
         unsigned int tag, preempted_tag;
         u32 preempted_sactive, preempted_qc_active;
-        DECLARE_COMPLETION(wait);
+        DECLARE_COMPLETION_ONSTACK(wait);
         unsigned long flags;
         unsigned int err_mask;
         int rc;
@@ -1009,7 +1009,7 @@ unsigned ata_exec_internal(struct ata_device *dev,
         spin_lock_irqsave(ap->lock, flags);
 
         /* no internal command while frozen */
-        if (ap->flags & ATA_FLAG_FROZEN) {
+        if (ap->pflags & ATA_PFLAG_FROZEN) {
                 spin_unlock_irqrestore(ap->lock, flags);
                 return AC_ERR_SYSTEM;
         }
@@ -1256,10 +1256,15 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
         swap_buf_le16(id, ATA_ID_WORDS);
 
         /* sanity check */
-        if ((class == ATA_DEV_ATA) != (ata_id_is_ata(id) | ata_id_is_cfa(id))) {
-                rc = -EINVAL;
-                reason = "device reports illegal type";
-                goto err_out;
+        rc = -EINVAL;
+        reason = "device reports illegal type";
+
+        if (class == ATA_DEV_ATA) {
+                if (!ata_id_is_ata(id) && !ata_id_is_cfa(id))
+                        goto err_out;
+        } else {
+                if (ata_id_is_ata(id))
+                        goto err_out;
         }
 
         if (post_reset && class == ATA_DEV_ATA) {
@@ -1325,6 +1330,19 @@ static void ata_dev_config_ncq(struct ata_device *dev,
                 snprintf(desc, desc_sz, "NCQ (depth %d/%d)", hdepth, ddepth);
 }
 
+static void ata_set_port_max_cmd_len(struct ata_port *ap)
+{
+        int i;
+
+        if (ap->host) {
+                ap->host->max_cmd_len = 0;
+                for (i = 0; i < ATA_MAX_DEVICES; i++)
+                        ap->host->max_cmd_len = max_t(unsigned int,
+                                                      ap->host->max_cmd_len,
+                                                      ap->device[i].cdb_len);
+        }
+}
+
 /**
  *      ata_dev_configure - Configure the specified ATA/ATAPI device
  *      @dev: Target device to configure
@@ -1344,7 +1362,7 @@ int ata_dev_configure(struct ata_device *dev, int print_info)
         struct ata_port *ap = dev->ap;
         const u16 *id = dev->id;
         unsigned int xfer_mask;
-        int i, rc;
+        int rc;
 
         if (!ata_dev_enabled(dev) && ata_msg_info(ap)) {
                 ata_dev_printk(dev, KERN_INFO,
@@ -1404,7 +1422,7 @@ int ata_dev_configure(struct ata_device *dev, int print_info)
                         ata_dev_config_ncq(dev, ncq_desc, sizeof(ncq_desc));
 
                         /* print device info to dmesg */
-                        if (ata_msg_info(ap))
+                        if (ata_msg_drv(ap) && print_info)
                                 ata_dev_printk(dev, KERN_INFO, "ATA-%d, "
                                         "max %s, %Lu sectors: %s %s\n",
                                         ata_id_major_version(id),
@@ -1427,7 +1445,7 @@ int ata_dev_configure(struct ata_device *dev, int print_info)
                         }
 
                         /* print device info to dmesg */
-                        if (ata_msg_info(ap))
+                        if (ata_msg_drv(ap) && print_info)
                                 ata_dev_printk(dev, KERN_INFO, "ATA-%d, "
                                         "max %s, %Lu sectors: CHS %u/%u/%u\n",
                                         ata_id_major_version(id),
@@ -1439,7 +1457,7 @@ int ata_dev_configure(struct ata_device *dev, int print_info)
 
                 if (dev->id[59] & 0x100) {
                         dev->multi_count = dev->id[59] & 0xff;
-                        if (ata_msg_info(ap))
+                        if (ata_msg_drv(ap) && print_info)
                                 ata_dev_printk(dev, KERN_INFO,
                                         "ata%u: dev %u multi count %u\n",
                                         ap->id, dev->devno, dev->multi_count);
@@ -1468,21 +1486,17 @@ int ata_dev_configure(struct ata_device *dev, int print_info)
                 }
 
                 /* print device info to dmesg */
-                if (ata_msg_info(ap))
+                if (ata_msg_drv(ap) && print_info)
                         ata_dev_printk(dev, KERN_INFO, "ATAPI, max %s%s\n",
                                        ata_mode_string(xfer_mask),
                                        cdb_intr_string);
         }
 
-        ap->host->max_cmd_len = 0;
-        for (i = 0; i < ATA_MAX_DEVICES; i++)
-                ap->host->max_cmd_len = max_t(unsigned int,
-                                              ap->host->max_cmd_len,
-                                              ap->device[i].cdb_len);
+        ata_set_port_max_cmd_len(ap);
 
         /* limit bridge transfers to udma5, 200 sectors */
         if (ata_dev_knobble(dev)) {
-                if (ata_msg_info(ap))
+                if (ata_msg_drv(ap) && print_info)
                         ata_dev_printk(dev, KERN_INFO,
                                        "applying bridge limits\n");
                 dev->udma_mask &= ATA_UDMA5;
@@ -2137,7 +2151,7 @@ int ata_set_mode(struct ata_port *ap, struct ata_device **r_failed_dev)
                  * return error code and failing device on failure.
                  */
                 for (i = 0; i < ATA_MAX_DEVICES; i++) {
-                        if (ata_dev_enabled(&ap->device[i])) {
+                        if (ata_dev_ready(&ap->device[i])) {
                                 ap->ops->set_mode(ap);
                                 break;
                         }
@@ -2203,7 +2217,8 @@ int ata_set_mode(struct ata_port *ap, struct ata_device **r_failed_dev)
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
                 dev = &ap->device[i];
 
-                if (!ata_dev_enabled(dev))
+                /* don't udpate suspended devices' xfer mode */
+                if (!ata_dev_ready(dev))
                         continue;
 
                 rc = ata_dev_set_mode(dev);
@@ -2579,7 +2594,7 @@ static void ata_wait_spinup(struct ata_port *ap)
 
         /* first, debounce phy if SATA */
         if (ap->cbl == ATA_CBL_SATA) {
-                rc = sata_phy_debounce(ap, sata_deb_timing_eh);
+                rc = sata_phy_debounce(ap, sata_deb_timing_hotplug);
 
                 /* if debounced successfully and offline, no need to wait */
                 if ((rc == 0 || rc == -EOPNOTSUPP) && ata_port_offline(ap))
@@ -2615,16 +2630,17 @@ static void ata_wait_spinup(struct ata_port *ap)
 int ata_std_prereset(struct ata_port *ap)
 {
         struct ata_eh_context *ehc = &ap->eh_context;
-        const unsigned long *timing;
+        const unsigned long *timing = sata_ehc_deb_timing(ehc);
         int rc;
 
-        /* hotplug? */
-        if (ehc->i.flags & ATA_EHI_HOTPLUGGED) {
-                if (ap->flags & ATA_FLAG_HRST_TO_RESUME)
-                        ehc->i.action |= ATA_EH_HARDRESET;
-                if (ap->flags & ATA_FLAG_SKIP_D2H_BSY)
-                        ata_wait_spinup(ap);
-        }
+        /* handle link resume & hotplug spinup */
+        if ((ehc->i.flags & ATA_EHI_RESUME_LINK) &&
+            (ap->flags & ATA_FLAG_HRST_TO_RESUME))
+                ehc->i.action |= ATA_EH_HARDRESET;
+
+        if ((ehc->i.flags & ATA_EHI_HOTPLUGGED) &&
+            (ap->flags & ATA_FLAG_SKIP_D2H_BSY))
+                ata_wait_spinup(ap);
 
         /* if we're about to do hardreset, nothing more to do */
         if (ehc->i.action & ATA_EH_HARDRESET)
@@ -2632,11 +2648,6 @@ int ata_std_prereset(struct ata_port *ap)
 
         /* if SATA, resume phy */
         if (ap->cbl == ATA_CBL_SATA) {
-                if (ap->flags & ATA_FLAG_LOADING)
-                        timing = sata_deb_timing_boot;
-                else
-                        timing = sata_deb_timing_eh;
-
                 rc = sata_phy_resume(ap, timing);
                 if (rc && rc != -EOPNOTSUPP) {
                         /* phy resume failed */
@@ -2724,6 +2735,8 @@ int ata_std_softreset(struct ata_port *ap, unsigned int *classes)
  */
 int sata_std_hardreset(struct ata_port *ap, unsigned int *class)
 {
+        struct ata_eh_context *ehc = &ap->eh_context;
+        const unsigned long *timing = sata_ehc_deb_timing(ehc);
         u32 scontrol;
         int rc;
 
@@ -2738,7 +2751,7 @@ int sata_std_hardreset(struct ata_port *ap, unsigned int *class)
                 if ((rc = sata_scr_read(ap, SCR_CONTROL, &scontrol)))
                         return rc;
 
-                scontrol = (scontrol & 0x0f0) | 0x302;
+                scontrol = (scontrol & 0x0f0) | 0x304;
 
                 if ((rc = sata_scr_write(ap, SCR_CONTROL, scontrol)))
                         return rc;
@@ -2761,7 +2774,7 @@ int sata_std_hardreset(struct ata_port *ap, unsigned int *class)
         msleep(1);
 
         /* bring phy back */
-        sata_phy_resume(ap, sata_deb_timing_eh);
+        sata_phy_resume(ap, timing);
 
         /* TODO: phy layer with polling, timeouts, etc. */
         if (ata_port_offline(ap)) {
@@ -4285,7 +4298,7 @@ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
         unsigned int i;
 
         /* no command while frozen */
-        if (unlikely(ap->flags & ATA_FLAG_FROZEN))
+        if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
                 return NULL;
 
         /* the last tag is reserved for internal command. */
@@ -4407,7 +4420,7 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
          * taken care of.
          */
         if (ap->ops->error_handler) {
-                WARN_ON(ap->flags & ATA_FLAG_FROZEN);
+                WARN_ON(ap->pflags & ATA_PFLAG_FROZEN);
 
                 if (unlikely(qc->err_mask))
                         qc->flags |= ATA_QCFLAG_FAILED;
@@ -5001,86 +5014,120 @@ int ata_flush_cache(struct ata_device *dev)
         return 0;
 }
 
-static int ata_standby_drive(struct ata_device *dev)
+static int ata_host_set_request_pm(struct ata_host_set *host_set,
+                                   pm_message_t mesg, unsigned int action,
+                                   unsigned int ehi_flags, int wait)
 {
-        unsigned int err_mask;
+        unsigned long flags;
+        int i, rc;
 
-        err_mask = ata_do_simple_cmd(dev, ATA_CMD_STANDBYNOW1);
-        if (err_mask) {
-                ata_dev_printk(dev, KERN_ERR, "failed to standby drive "
-                               "(err_mask=0x%x)\n", err_mask);
-                return -EIO;
-        }
+        for (i = 0; i < host_set->n_ports; i++) {
+                struct ata_port *ap = host_set->ports[i];
 
-        return 0;
-}
+                /* Previous resume operation might still be in
+                 * progress.  Wait for PM_PENDING to clear.
+                 */
+                if (ap->pflags & ATA_PFLAG_PM_PENDING) {
+                        ata_port_wait_eh(ap);
+                        WARN_ON(ap->pflags & ATA_PFLAG_PM_PENDING);
+                }
 
-static int ata_start_drive(struct ata_device *dev)
-{
-        unsigned int err_mask;
+                /* request PM ops to EH */
+                spin_lock_irqsave(ap->lock, flags);
 
-        err_mask = ata_do_simple_cmd(dev, ATA_CMD_IDLEIMMEDIATE);
-        if (err_mask) {
-                ata_dev_printk(dev, KERN_ERR, "failed to start drive "
-                               "(err_mask=0x%x)\n", err_mask);
-                return -EIO;
+                ap->pm_mesg = mesg;
+                if (wait) {
+                        rc = 0;
+                        ap->pm_result = &rc;
+                }
+
+                ap->pflags |= ATA_PFLAG_PM_PENDING;
+                ap->eh_info.action |= action;
+                ap->eh_info.flags |= ehi_flags;
+
+                ata_port_schedule_eh(ap);
+
+                spin_unlock_irqrestore(ap->lock, flags);
+
+                /* wait and check result */
+                if (wait) {
+                        ata_port_wait_eh(ap);
+                        WARN_ON(ap->pflags & ATA_PFLAG_PM_PENDING);
+                        if (rc)
+                                return rc;
+                }
         }
 
         return 0;
 }
 
 /**
- *      ata_device_resume - wakeup a previously suspended devices
- *      @dev: the device to resume
+ *      ata_host_set_suspend - suspend host_set
+ *      @host_set: host_set to suspend
+ *      @mesg: PM message
  *
- *      Kick the drive back into action, by sending it an idle immediate
- *      command and making sure its transfer mode matches between drive
- *      and host.
+ *      Suspend @host_set.  Actual operation is performed by EH.  This
+ *      function requests EH to perform PM operations and waits for EH
+ *      to finish.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
  *
+ *      RETURNS:
+ *      0 on success, -errno on failure.
  */
-int ata_device_resume(struct ata_device *dev)
+int ata_host_set_suspend(struct ata_host_set *host_set, pm_message_t mesg)
 {
-        struct ata_port *ap = dev->ap;
+        int i, j, rc;
 
-        if (ap->flags & ATA_FLAG_SUSPENDED) {
-                struct ata_device *failed_dev;
+        rc = ata_host_set_request_pm(host_set, mesg, 0, ATA_EHI_QUIET, 1);
+        if (rc)
+                goto fail;
 
-                ata_busy_sleep(ap, ATA_TMOUT_BOOT_QUICK, ATA_TMOUT_BOOT);
-                ata_busy_wait(ap, ATA_BUSY | ATA_DRQ, 200000);
+        /* EH is quiescent now.  Fail if we have any ready device.
+         * This happens if hotplug occurs between completion of device
+         * suspension and here.
+         */
+        for (i = 0; i < host_set->n_ports; i++) {
+                struct ata_port *ap = host_set->ports[i];
+
+                for (j = 0; j < ATA_MAX_DEVICES; j++) {
+                        struct ata_device *dev = &ap->device[j];
 
-                ap->flags &= ~ATA_FLAG_SUSPENDED;
-                while (ata_set_mode(ap, &failed_dev))
-                        ata_dev_disable(failed_dev);
+                        if (ata_dev_ready(dev)) {
+                                ata_port_printk(ap, KERN_WARNING,
+                                                "suspend failed, device %d "
+                                                "still active\n", dev->devno);
+                                rc = -EBUSY;
+                                goto fail;
+                        }
+                }
         }
-        if (!ata_dev_enabled(dev))
-                return 0;
-        if (dev->class == ATA_DEV_ATA)
-                ata_start_drive(dev);
 
+        host_set->dev->power.power_state = mesg;
         return 0;
+
+ fail:
+        ata_host_set_resume(host_set);
+        return rc;
 }
 
 /**
- *      ata_device_suspend - prepare a device for suspend
- *      @dev: the device to suspend
- *      @state: target power management state
+ *      ata_host_set_resume - resume host_set
+ *      @host_set: host_set to resume
  *
- *      Flush the cache on the drive, if appropriate, then issue a
- *      standbynow command.
+ *      Resume @host_set.  Actual operation is performed by EH.  This
+ *      function requests EH to perform PM operations and returns.
+ *      Note that all resume operations are performed parallely.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
  */
-int ata_device_suspend(struct ata_device *dev, pm_message_t state)
+void ata_host_set_resume(struct ata_host_set *host_set)
 {
-        struct ata_port *ap = dev->ap;
-
-        if (!ata_dev_enabled(dev))
-                return 0;
-        if (dev->class == ATA_DEV_ATA)
-                ata_flush_cache(dev);
-
-        if (state.event != PM_EVENT_FREEZE)
-                ata_standby_drive(dev);
-        ap->flags |= ATA_FLAG_SUSPENDED;
-        return 0;
+        ata_host_set_request_pm(host_set, PMSG_ON, ATA_EH_SOFTRESET,
+                                ATA_EHI_NO_AUTOPSY | ATA_EHI_QUIET, 0);
+        host_set->dev->power.power_state = PMSG_ON;
 }
 
 /**
@@ -5143,28 +5190,6 @@ void ata_host_stop (struct ata_host_set *host_set)
                 iounmap(host_set->mmio_base);
 }
 
-
-/**
- *      ata_host_remove - Unregister SCSI host structure with upper layers
- *      @ap: Port to unregister
- *      @do_unregister: 1 if we fully unregister, 0 to just stop the port
- *
- *      LOCKING:
- *      Inherited from caller.
- */
-
-static void ata_host_remove(struct ata_port *ap, unsigned int do_unregister)
-{
-        struct Scsi_Host *sh = ap->host;
-
-        DPRINTK("ENTER\n");
-
-        if (do_unregister)
-                scsi_remove_host(sh);
-
-        ap->ops->port_stop(ap);
-}
-
 /**
  *      ata_dev_init - Initialize an ata_device structure
  *      @dev: Device structure to initialize
@@ -5440,6 +5465,7 @@ int ata_device_add(const struct ata_probe_ent *ent)
                 }
 
                 if (ap->ops->error_handler) {
+                        struct ata_eh_info *ehi = &ap->eh_info;
                         unsigned long flags;
 
                         ata_port_probe(ap);
@@ -5447,10 +5473,11 @@ int ata_device_add(const struct ata_probe_ent *ent)
                         /* kick EH for boot probing */
                         spin_lock_irqsave(ap->lock, flags);
 
-                        ap->eh_info.probe_mask = (1 << ATA_MAX_DEVICES) - 1;
-                        ap->eh_info.action |= ATA_EH_SOFTRESET;
+                        ehi->probe_mask = (1 << ATA_MAX_DEVICES) - 1;
+                        ehi->action |= ATA_EH_SOFTRESET;
+                        ehi->flags |= ATA_EHI_NO_AUTOPSY | ATA_EHI_QUIET;
 
-                        ap->flags |= ATA_FLAG_LOADING;
+                        ap->pflags |= ATA_PFLAG_LOADING;
                         ata_port_schedule_eh(ap);
 
                         spin_unlock_irqrestore(ap->lock, flags);
@@ -5488,8 +5515,11 @@ int ata_device_add(const struct ata_probe_ent *ent)
 
 err_out:
         for (i = 0; i < count; i++) {
-                ata_host_remove(host_set->ports[i], 1);
-                scsi_host_put(host_set->ports[i]->host);
+                struct ata_port *ap = host_set->ports[i];
+                if (ap) {
+                        ap->ops->port_stop(ap);
+                        scsi_host_put(ap->host);
+                }
         }
 err_free_ret:
         kfree(host_set);
@@ -5514,11 +5544,11 @@ void ata_port_detach(struct ata_port *ap)
         int i;
 
         if (!ap->ops->error_handler)
-                return;
+                goto skip_eh;
 
         /* tell EH we're leaving & flush EH */
         spin_lock_irqsave(ap->lock, flags);
-        ap->flags |= ATA_FLAG_UNLOADING;
+        ap->pflags |= ATA_PFLAG_UNLOADING;
         spin_unlock_irqrestore(ap->lock, flags);
 
         ata_port_wait_eh(ap);
@@ -5550,6 +5580,7 @@ void ata_port_detach(struct ata_port *ap)
         cancel_delayed_work(&ap->hotplug_task);
         flush_workqueue(ata_aux_wq);
 
+ skip_eh:
         /* remove the associated SCSI host */
         scsi_remove_host(ap->host);
 }
@@ -5618,7 +5649,7 @@ int ata_scsi_release(struct Scsi_Host *host)
         DPRINTK("ENTER\n");
 
         ap->ops->port_disable(ap);
-        ata_host_remove(ap, 0);
+        ap->ops->port_stop(ap);
 
         DPRINTK("EXIT\n");
         return 1;
@@ -5723,20 +5754,55 @@ int pci_test_config_bits(struct pci_dev *pdev, const struct pci_bits *bits)
         return (tmp == bits->val) ? 1 : 0;
 }
 
-int ata_pci_device_suspend(struct pci_dev *pdev, pm_message_t state)
+void ata_pci_device_do_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-        return 0;
+
+        if (state.event == PM_EVENT_SUSPEND) {
+                pci_disable_device(pdev);
+                pci_set_power_state(pdev, PCI_D3hot);
+        }
 }
 
-int ata_pci_device_resume(struct pci_dev *pdev)
+void ata_pci_device_do_resume(struct pci_dev *pdev)
 {
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
         pci_enable_device(pdev);
         pci_set_master(pdev);
+}
+
+int ata_pci_device_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct ata_host_set *host_set = dev_get_drvdata(&pdev->dev);
+        int rc = 0;
+
+        rc = ata_host_set_suspend(host_set, state);
+        if (rc)
+                return rc;
+
+        if (host_set->next) {
+                rc = ata_host_set_suspend(host_set->next, state);
+                if (rc) {
+                        ata_host_set_resume(host_set);
+                        return rc;
+                }
+        }
+
+        ata_pci_device_do_suspend(pdev, state);
+
+        return 0;
+}
+
+int ata_pci_device_resume(struct pci_dev *pdev)
+{
+        struct ata_host_set *host_set = dev_get_drvdata(&pdev->dev);
+
+        ata_pci_device_do_resume(pdev);
+        ata_host_set_resume(host_set);
+        if (host_set->next)
+                ata_host_set_resume(host_set->next);
+
         return 0;
 }
 #endif /* CONFIG_PCI */
@@ -5842,9 +5908,9 @@ u32 ata_wait_register(void __iomem *reg, u32 mask, u32 val,
  * Do not depend on ABI/API stability.
  */
 
-EXPORT_SYMBOL_GPL(sata_deb_timing_boot);
-EXPORT_SYMBOL_GPL(sata_deb_timing_eh);
-EXPORT_SYMBOL_GPL(sata_deb_timing_before_fsrst);
+EXPORT_SYMBOL_GPL(sata_deb_timing_normal);
+EXPORT_SYMBOL_GPL(sata_deb_timing_hotplug);
+EXPORT_SYMBOL_GPL(sata_deb_timing_long);
 EXPORT_SYMBOL_GPL(ata_std_bios_param);
 EXPORT_SYMBOL_GPL(ata_std_ports);
 EXPORT_SYMBOL_GPL(ata_device_add);
@@ -5916,6 +5982,8 @@ EXPORT_SYMBOL_GPL(sata_scr_write);
 EXPORT_SYMBOL_GPL(sata_scr_write_flush);
 EXPORT_SYMBOL_GPL(ata_port_online);
 EXPORT_SYMBOL_GPL(ata_port_offline);
+EXPORT_SYMBOL_GPL(ata_host_set_suspend);
+EXPORT_SYMBOL_GPL(ata_host_set_resume);
 EXPORT_SYMBOL_GPL(ata_id_string);
 EXPORT_SYMBOL_GPL(ata_id_c_string);
 EXPORT_SYMBOL_GPL(ata_scsi_simulate);
@@ -5930,14 +5998,14 @@ EXPORT_SYMBOL_GPL(ata_pci_host_stop);
 EXPORT_SYMBOL_GPL(ata_pci_init_native_mode);
 EXPORT_SYMBOL_GPL(ata_pci_init_one);
 EXPORT_SYMBOL_GPL(ata_pci_remove_one);
+EXPORT_SYMBOL_GPL(ata_pci_device_do_suspend);
+EXPORT_SYMBOL_GPL(ata_pci_device_do_resume);
 EXPORT_SYMBOL_GPL(ata_pci_device_suspend);
 EXPORT_SYMBOL_GPL(ata_pci_device_resume);
 EXPORT_SYMBOL_GPL(ata_pci_default_filter);
 EXPORT_SYMBOL_GPL(ata_pci_clear_simplex);
 #endif /* CONFIG_PCI */
 
-EXPORT_SYMBOL_GPL(ata_device_suspend);
-EXPORT_SYMBOL_GPL(ata_device_resume);
 EXPORT_SYMBOL_GPL(ata_scsi_device_suspend);
 EXPORT_SYMBOL_GPL(ata_scsi_device_resume);
 
diff --git a/drivers/scsi/libata-eh.c b/drivers/scsi/libata-eh.c
index bf5a72aca8a4..29f59345305d 100644
--- a/drivers/scsi/libata-eh.c
+++ b/drivers/scsi/libata-eh.c
@@ -47,6 +47,8 @@
 
 static void __ata_port_freeze(struct ata_port *ap);
 static void ata_eh_finish(struct ata_port *ap);
+static void ata_eh_handle_port_suspend(struct ata_port *ap);
+static void ata_eh_handle_port_resume(struct ata_port *ap);
 
 static void ata_ering_record(struct ata_ering *ering, int is_io,
                              unsigned int err_mask)
@@ -190,7 +192,6 @@ enum scsi_eh_timer_return ata_scsi_timed_out(struct scsi_cmnd *cmd)
 void ata_scsi_error(struct Scsi_Host *host)
 {
         struct ata_port *ap = ata_shost_to_port(host);
-        spinlock_t *ap_lock = ap->lock;
         int i, repeat_cnt = ATA_EH_MAX_REPEAT;
         unsigned long flags;
 
@@ -217,7 +218,7 @@ void ata_scsi_error(struct Scsi_Host *host)
                 struct scsi_cmnd *scmd, *tmp;
                 int nr_timedout = 0;
 
-                spin_lock_irqsave(ap_lock, flags);
+                spin_lock_irqsave(ap->lock, flags);
 
                 list_for_each_entry_safe(scmd, tmp, &host->eh_cmd_q, eh_entry) {
                         struct ata_queued_cmd *qc;
@@ -256,43 +257,49 @@ void ata_scsi_error(struct Scsi_Host *host)
                 if (nr_timedout)
                         __ata_port_freeze(ap);
 
-                spin_unlock_irqrestore(ap_lock, flags);
+                spin_unlock_irqrestore(ap->lock, flags);
         } else
-                spin_unlock_wait(ap_lock);
+                spin_unlock_wait(ap->lock);
 
  repeat:
         /* invoke error handler */
         if (ap->ops->error_handler) {
+                /* process port resume request */
+                ata_eh_handle_port_resume(ap);
+
                 /* fetch & clear EH info */
-                spin_lock_irqsave(ap_lock, flags);
+                spin_lock_irqsave(ap->lock, flags);
 
                 memset(&ap->eh_context, 0, sizeof(ap->eh_context));
                 ap->eh_context.i = ap->eh_info;
                 memset(&ap->eh_info, 0, sizeof(ap->eh_info));
 
-                ap->flags |= ATA_FLAG_EH_IN_PROGRESS;
-                ap->flags &= ~ATA_FLAG_EH_PENDING;
+                ap->pflags |= ATA_PFLAG_EH_IN_PROGRESS;
+                ap->pflags &= ~ATA_PFLAG_EH_PENDING;
 
-                spin_unlock_irqrestore(ap_lock, flags);
+                spin_unlock_irqrestore(ap->lock, flags);
 
-                /* invoke EH.  if unloading, just finish failed qcs */
-                if (!(ap->flags & ATA_FLAG_UNLOADING))
+                /* invoke EH, skip if unloading or suspended */
+                if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)))
                         ap->ops->error_handler(ap);
                 else
                         ata_eh_finish(ap);
 
+                /* process port suspend request */
+                ata_eh_handle_port_suspend(ap);
+
                 /* Exception might have happend after ->error_handler
                  * recovered the port but before this point.  Repeat
                  * EH in such case.
                  */
-                spin_lock_irqsave(ap_lock, flags);
+                spin_lock_irqsave(ap->lock, flags);
 
-                if (ap->flags & ATA_FLAG_EH_PENDING) {
+                if (ap->pflags & ATA_PFLAG_EH_PENDING) {
                         if (--repeat_cnt) {
                                 ata_port_printk(ap, KERN_INFO,
                                         "EH pending after completion, "
                                         "repeating EH (cnt=%d)\n", repeat_cnt);
-                                spin_unlock_irqrestore(ap_lock, flags);
+                                spin_unlock_irqrestore(ap->lock, flags);
                                 goto repeat;
                         }
                         ata_port_printk(ap, KERN_ERR, "EH pending after %d "
@@ -302,14 +309,14 @@ void ata_scsi_error(struct Scsi_Host *host)
                 /* this run is complete, make sure EH info is clear */
                 memset(&ap->eh_info, 0, sizeof(ap->eh_info));
 
-                /* Clear host_eh_scheduled while holding ap_lock such
+                /* Clear host_eh_scheduled while holding ap->lock such
                  * that if exception occurs after this point but
                  * before EH completion, SCSI midlayer will
                  * re-initiate EH.
                  */
                 host->host_eh_scheduled = 0;
 
-                spin_unlock_irqrestore(ap_lock, flags);
+                spin_unlock_irqrestore(ap->lock, flags);
         } else {
                 WARN_ON(ata_qc_from_tag(ap, ap->active_tag) == NULL);
                 ap->ops->eng_timeout(ap);
@@ -321,24 +328,23 @@ void ata_scsi_error(struct Scsi_Host *host)
         scsi_eh_flush_done_q(&ap->eh_done_q);
 
         /* clean up */
-        spin_lock_irqsave(ap_lock, flags);
+        spin_lock_irqsave(ap->lock, flags);
 
-        if (ap->flags & ATA_FLAG_LOADING) {
-                ap->flags &= ~ATA_FLAG_LOADING;
-        } else {
-                if (ap->flags & ATA_FLAG_SCSI_HOTPLUG)
-                        queue_work(ata_aux_wq, &ap->hotplug_task);
-                if (ap->flags & ATA_FLAG_RECOVERED)
-                        ata_port_printk(ap, KERN_INFO, "EH complete\n");
-        }
+        if (ap->pflags & ATA_PFLAG_LOADING)
+                ap->pflags &= ~ATA_PFLAG_LOADING;
+        else if (ap->pflags & ATA_PFLAG_SCSI_HOTPLUG)
+                queue_work(ata_aux_wq, &ap->hotplug_task);
 
-        ap->flags &= ~(ATA_FLAG_SCSI_HOTPLUG | ATA_FLAG_RECOVERED);
+        if (ap->pflags & ATA_PFLAG_RECOVERED)
+                ata_port_printk(ap, KERN_INFO, "EH complete\n");
+
+        ap->pflags &= ~(ATA_PFLAG_SCSI_HOTPLUG | ATA_PFLAG_RECOVERED);
 
         /* tell wait_eh that we're done */
-        ap->flags &= ~ATA_FLAG_EH_IN_PROGRESS;
+        ap->pflags &= ~ATA_PFLAG_EH_IN_PROGRESS;
         wake_up_all(&ap->eh_wait_q);
 
-        spin_unlock_irqrestore(ap_lock, flags);
+        spin_unlock_irqrestore(ap->lock, flags);
 
         DPRINTK("EXIT\n");
 }
@@ -360,7 +366,7 @@ void ata_port_wait_eh(struct ata_port *ap)
  retry:
         spin_lock_irqsave(ap->lock, flags);
 
-        while (ap->flags & (ATA_FLAG_EH_PENDING | ATA_FLAG_EH_IN_PROGRESS)) {
+        while (ap->pflags & (ATA_PFLAG_EH_PENDING | ATA_PFLAG_EH_IN_PROGRESS)) {
                 prepare_to_wait(&ap->eh_wait_q, &wait, TASK_UNINTERRUPTIBLE);
                 spin_unlock_irqrestore(ap->lock, flags);
                 schedule();
@@ -489,7 +495,7 @@ void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
         WARN_ON(!ap->ops->error_handler);
 
         qc->flags |= ATA_QCFLAG_FAILED;
-        qc->ap->flags |= ATA_FLAG_EH_PENDING;
+        qc->ap->pflags |= ATA_PFLAG_EH_PENDING;
 
         /* The following will fail if timeout has already expired.
          * ata_scsi_error() takes care of such scmds on EH entry.
@@ -513,7 +519,7 @@ void ata_port_schedule_eh(struct ata_port *ap)
 {
         WARN_ON(!ap->ops->error_handler);
 
-        ap->flags |= ATA_FLAG_EH_PENDING;
+        ap->pflags |= ATA_PFLAG_EH_PENDING;
         scsi_schedule_eh(ap->host);
 
         DPRINTK("port EH scheduled\n");
@@ -578,7 +584,7 @@ static void __ata_port_freeze(struct ata_port *ap)
         if (ap->ops->freeze)
                 ap->ops->freeze(ap);
 
-        ap->flags |= ATA_FLAG_FROZEN;
+        ap->pflags |= ATA_PFLAG_FROZEN;
 
         DPRINTK("ata%u port frozen\n", ap->id);
 }
@@ -646,7 +652,7 @@ void ata_eh_thaw_port(struct ata_port *ap)
 
         spin_lock_irqsave(ap->lock, flags);
 
-        ap->flags &= ~ATA_FLAG_FROZEN;
+        ap->pflags &= ~ATA_PFLAG_FROZEN;
 
         if (ap->ops->thaw)
                 ap->ops->thaw(ap);
@@ -731,7 +737,7 @@ static void ata_eh_detach_dev(struct ata_device *dev)
 
         if (ata_scsi_offline_dev(dev)) {
                 dev->flags |= ATA_DFLAG_DETACHED;
-                ap->flags |= ATA_FLAG_SCSI_HOTPLUG;
+                ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
         }
 
         /* clear per-dev EH actions */
@@ -758,10 +764,29 @@ static void ata_eh_about_to_do(struct ata_port *ap, struct ata_device *dev,
                                unsigned int action)
 {
         unsigned long flags;
+        struct ata_eh_info *ehi = &ap->eh_info;
+        struct ata_eh_context *ehc = &ap->eh_context;
 
         spin_lock_irqsave(ap->lock, flags);
-        ata_eh_clear_action(dev, &ap->eh_info, action);
-        ap->flags |= ATA_FLAG_RECOVERED;
+
+        /* Reset is represented by combination of actions and EHI
+         * flags.  Suck in all related bits before clearing eh_info to
+         * avoid losing requested action.
+         */
+        if (action & ATA_EH_RESET_MASK) {
+                ehc->i.action |= ehi->action & ATA_EH_RESET_MASK;
+                ehc->i.flags |= ehi->flags & ATA_EHI_RESET_MODIFIER_MASK;
+
+                /* make sure all reset actions are cleared & clear EHI flags */
+                action |= ATA_EH_RESET_MASK;
+                ehi->flags &= ~ATA_EHI_RESET_MODIFIER_MASK;
+        }
+
+        ata_eh_clear_action(dev, ehi, action);
+
+        if (!(ehc->i.flags & ATA_EHI_QUIET))
+                ap->pflags |= ATA_PFLAG_RECOVERED;
+
         spin_unlock_irqrestore(ap->lock, flags);
 }
 
@@ -780,6 +805,12 @@ static void ata_eh_about_to_do(struct ata_port *ap, struct ata_device *dev,
 static void ata_eh_done(struct ata_port *ap, struct ata_device *dev,
                         unsigned int action)
 {
+        /* if reset is complete, clear all reset actions & reset modifier */
+        if (action & ATA_EH_RESET_MASK) {
+                action |= ATA_EH_RESET_MASK;
+                ap->eh_context.i.flags &= ~ATA_EHI_RESET_MODIFIER_MASK;
+        }
+
         ata_eh_clear_action(dev, &ap->eh_context.i, action);
 }
 
@@ -1027,7 +1058,7 @@ static void ata_eh_analyze_ncq_error(struct ata_port *ap)
         int tag, rc;
 
         /* if frozen, we can't do much */
-        if (ap->flags & ATA_FLAG_FROZEN)
+        if (ap->pflags & ATA_PFLAG_FROZEN)
                 return;
 
         /* is it NCQ device error? */
@@ -1266,8 +1297,6 @@ static int ata_eh_speed_down(struct ata_device *dev, int is_io,
 static void ata_eh_autopsy(struct ata_port *ap)
 {
         struct ata_eh_context *ehc = &ap->eh_context;
-        unsigned int action = ehc->i.action;
-        struct ata_device *failed_dev = NULL;
         unsigned int all_err_mask = 0;
         int tag, is_io = 0;
         u32 serror;
@@ -1275,13 +1304,16 @@ static void ata_eh_autopsy(struct ata_port *ap)
 
         DPRINTK("ENTER\n");
 
+        if (ehc->i.flags & ATA_EHI_NO_AUTOPSY)
+                return;
+
         /* obtain and analyze SError */
         rc = sata_scr_read(ap, SCR_ERROR, &serror);
         if (rc == 0) {
                 ehc->i.serror |= serror;
                 ata_eh_analyze_serror(ap);
         } else if (rc != -EOPNOTSUPP)
-                action |= ATA_EH_HARDRESET;
+                ehc->i.action |= ATA_EH_HARDRESET;
 
         /* analyze NCQ failure */
         ata_eh_analyze_ncq_error(ap);
@@ -1302,7 +1334,7 @@ static void ata_eh_autopsy(struct ata_port *ap)
                 qc->err_mask |= ehc->i.err_mask;
 
                 /* analyze TF */
-                action |= ata_eh_analyze_tf(qc, &qc->result_tf);
+                ehc->i.action |= ata_eh_analyze_tf(qc, &qc->result_tf);
 
                 /* DEV errors are probably spurious in case of ATA_BUS error */
                 if (qc->err_mask & AC_ERR_ATA_BUS)
@@ -1316,38 +1348,35 @@ static void ata_eh_autopsy(struct ata_port *ap)
                 /* SENSE_VALID trumps dev/unknown error and revalidation */
                 if (qc->flags & ATA_QCFLAG_SENSE_VALID) {
                         qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
-                        action &= ~ATA_EH_REVALIDATE;
+                        ehc->i.action &= ~ATA_EH_REVALIDATE;
                 }
 
                 /* accumulate error info */
-                failed_dev = qc->dev;
+                ehc->i.dev = qc->dev;
                 all_err_mask |= qc->err_mask;
                 if (qc->flags & ATA_QCFLAG_IO)
                         is_io = 1;
         }
 
         /* enforce default EH actions */
-        if (ap->flags & ATA_FLAG_FROZEN ||
+        if (ap->pflags & ATA_PFLAG_FROZEN ||
             all_err_mask & (AC_ERR_HSM | AC_ERR_TIMEOUT))
-                action |= ATA_EH_SOFTRESET;
+                ehc->i.action |= ATA_EH_SOFTRESET;
         else if (all_err_mask)
-                action |= ATA_EH_REVALIDATE;
+                ehc->i.action |= ATA_EH_REVALIDATE;
 
         /* if we have offending qcs and the associated failed device */
-        if (failed_dev) {
+        if (ehc->i.dev) {
                 /* speed down */
-                action |= ata_eh_speed_down(failed_dev, is_io, all_err_mask);
+                ehc->i.action |= ata_eh_speed_down(ehc->i.dev, is_io,
+                                                   all_err_mask);
 
                 /* perform per-dev EH action only on the offending device */
-                ehc->i.dev_action[failed_dev->devno] |=
-                        action & ATA_EH_PERDEV_MASK;
-                action &= ~ATA_EH_PERDEV_MASK;
+                ehc->i.dev_action[ehc->i.dev->devno] |=
+                        ehc->i.action & ATA_EH_PERDEV_MASK;
+                ehc->i.action &= ~ATA_EH_PERDEV_MASK;
         }
 
-        /* record autopsy result */
-        ehc->i.dev = failed_dev;
-        ehc->i.action = action;
-
         DPRINTK("EXIT\n");
 }
 
@@ -1385,7 +1414,7 @@ static void ata_eh_report(struct ata_port *ap)
                 return;
 
         frozen = "";
-        if (ap->flags & ATA_FLAG_FROZEN)
+        if (ap->pflags & ATA_PFLAG_FROZEN)
                 frozen = " frozen";
 
         if (ehc->i.dev) {
@@ -1465,11 +1494,14 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
         struct ata_eh_context *ehc = &ap->eh_context;
         unsigned int *classes = ehc->classes;
         int tries = ATA_EH_RESET_TRIES;
-        int verbose = !(ap->flags & ATA_FLAG_LOADING);
+        int verbose = !(ehc->i.flags & ATA_EHI_QUIET);
         unsigned int action;
         ata_reset_fn_t reset;
         int i, did_followup_srst, rc;
 
+        /* about to reset */
+        ata_eh_about_to_do(ap, NULL, ehc->i.action & ATA_EH_RESET_MASK);
+
         /* Determine which reset to use and record in ehc->i.action.
          * prereset() may examine and modify it.
          */
@@ -1518,8 +1550,7 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
                 ata_port_printk(ap, KERN_INFO, "%s resetting port\n",
                                 reset == softreset ? "soft" : "hard");
 
-        /* reset */
-        ata_eh_about_to_do(ap, NULL, ATA_EH_RESET_MASK);
+        /* mark that this EH session started with reset */
         ehc->i.flags |= ATA_EHI_DID_RESET;
 
         rc = ata_do_reset(ap, reset, classes);
@@ -1582,7 +1613,7 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
                         postreset(ap, classes);
 
                 /* reset successful, schedule revalidation */
-                ata_eh_done(ap, NULL, ATA_EH_RESET_MASK);
+                ata_eh_done(ap, NULL, ehc->i.action & ATA_EH_RESET_MASK);
                 ehc->i.action |= ATA_EH_REVALIDATE;
         }
 
@@ -1605,7 +1636,7 @@ static int ata_eh_revalidate_and_attach(struct ata_port *ap,
                 dev = &ap->device[i];
                 action = ata_eh_dev_action(dev);
 
-                if (action & ATA_EH_REVALIDATE && ata_dev_enabled(dev)) {
+                if (action & ATA_EH_REVALIDATE && ata_dev_ready(dev)) {
                         if (ata_port_offline(ap)) {
                                 rc = -EIO;
                                 break;
@@ -1636,7 +1667,7 @@ static int ata_eh_revalidate_and_attach(struct ata_port *ap,
                         }
 
                         spin_lock_irqsave(ap->lock, flags);
-                        ap->flags |= ATA_FLAG_SCSI_HOTPLUG;
+                        ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
                         spin_unlock_irqrestore(ap->lock, flags);
                 }
         }
@@ -1648,6 +1679,164 @@ static int ata_eh_revalidate_and_attach(struct ata_port *ap,
         return rc;
 }
 
+/**
+ *      ata_eh_suspend - handle suspend EH action
+ *      @ap: target host port
+ *      @r_failed_dev: result parameter to indicate failing device
+ *
+ *      Handle suspend EH action.  Disk devices are spinned down and
+ *      other types of devices are just marked suspended.  Once
+ *      suspended, no EH action to the device is allowed until it is
+ *      resumed.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ *
+ *      RETURNS:
+ *      0 on success, -errno otherwise
+ */
+static int ata_eh_suspend(struct ata_port *ap, struct ata_device **r_failed_dev)
+{
+        struct ata_device *dev;
+        int i, rc = 0;
+
+        DPRINTK("ENTER\n");
+
+        for (i = 0; i < ATA_MAX_DEVICES; i++) {
+                unsigned long flags;
+                unsigned int action, err_mask;
+
+                dev = &ap->device[i];
+                action = ata_eh_dev_action(dev);
+
+                if (!ata_dev_enabled(dev) || !(action & ATA_EH_SUSPEND))
+                        continue;
+
+                WARN_ON(dev->flags & ATA_DFLAG_SUSPENDED);
+
+                ata_eh_about_to_do(ap, dev, ATA_EH_SUSPEND);
+
+                if (dev->class == ATA_DEV_ATA && !(action & ATA_EH_PM_FREEZE)) {
+                        /* flush cache */
+                        rc = ata_flush_cache(dev);
+                        if (rc)
+                                break;
+
+                        /* spin down */
+                        err_mask = ata_do_simple_cmd(dev, ATA_CMD_STANDBYNOW1);
+                        if (err_mask) {
+                                ata_dev_printk(dev, KERN_ERR, "failed to "
+                                               "spin down (err_mask=0x%x)\n",
+                                               err_mask);
+                                rc = -EIO;
+                                break;
+                        }
+                }
+
+                spin_lock_irqsave(ap->lock, flags);
+                dev->flags |= ATA_DFLAG_SUSPENDED;
+                spin_unlock_irqrestore(ap->lock, flags);
+
+                ata_eh_done(ap, dev, ATA_EH_SUSPEND);
+        }
+
+        if (rc)
+                *r_failed_dev = dev;
+
+        DPRINTK("EXIT\n");
+        return 0;
+}
+
+/**
+ *      ata_eh_prep_resume - prep for resume EH action
+ *      @ap: target host port
+ *
+ *      Clear SUSPENDED in preparation for scheduled resume actions.
+ *      This allows other parts of EH to access the devices being
+ *      resumed.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ */
+static void ata_eh_prep_resume(struct ata_port *ap)
+{
+        struct ata_device *dev;
+        unsigned long flags;
+        int i;
+
+        DPRINTK("ENTER\n");
+
+        for (i = 0; i < ATA_MAX_DEVICES; i++) {
+                unsigned int action;
+
+                dev = &ap->device[i];
+                action = ata_eh_dev_action(dev);
+
+                if (!ata_dev_enabled(dev) || !(action & ATA_EH_RESUME))
+                        continue;
+
+                spin_lock_irqsave(ap->lock, flags);
+                dev->flags &= ~ATA_DFLAG_SUSPENDED;
+                spin_unlock_irqrestore(ap->lock, flags);
+        }
+
+        DPRINTK("EXIT\n");
+}
+
+/**
+ *      ata_eh_resume - handle resume EH action
+ *      @ap: target host port
+ *      @r_failed_dev: result parameter to indicate failing device
+ *
+ *      Handle resume EH action.  Target devices are already reset and
+ *      revalidated.  Spinning up is the only operation left.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ *
+ *      RETURNS:
+ *      0 on success, -errno otherwise
+ */
+static int ata_eh_resume(struct ata_port *ap, struct ata_device **r_failed_dev)
+{
+        struct ata_device *dev;
+        int i, rc = 0;
+
+        DPRINTK("ENTER\n");
+
+        for (i = 0; i < ATA_MAX_DEVICES; i++) {
+                unsigned int action, err_mask;
+
+                dev = &ap->device[i];
+                action = ata_eh_dev_action(dev);
+
+                if (!ata_dev_enabled(dev) || !(action & ATA_EH_RESUME))
+                        continue;
+
+                ata_eh_about_to_do(ap, dev, ATA_EH_RESUME);
+
+                if (dev->class == ATA_DEV_ATA && !(action & ATA_EH_PM_FREEZE)) {
+                        err_mask = ata_do_simple_cmd(dev,
+                                                     ATA_CMD_IDLEIMMEDIATE);
+                        if (err_mask) {
+                                ata_dev_printk(dev, KERN_ERR, "failed to "
+                                               "spin up (err_mask=0x%x)\n",
+                                               err_mask);
+                                rc = -EIO;
+                                break;
+                        }
+                }
+
+                ata_eh_done(ap, dev, ATA_EH_RESUME);
+        }
+
+        if (rc)
+                *r_failed_dev = dev;
+
+        DPRINTK("EXIT\n");
+        return 0;
+}
+
 static int ata_port_nr_enabled(struct ata_port *ap)
 {
         int i, cnt = 0;
@@ -1673,7 +1862,20 @@ static int ata_eh_skip_recovery(struct ata_port *ap)
         struct ata_eh_context *ehc = &ap->eh_context;
         int i;
 
-        if (ap->flags & ATA_FLAG_FROZEN || ata_port_nr_enabled(ap))
+        /* skip if all possible devices are suspended */
+        for (i = 0; i < ata_port_max_devices(ap); i++) {
+                struct ata_device *dev = &ap->device[i];
+
+                if (!(dev->flags & ATA_DFLAG_SUSPENDED))
+                        break;
+        }
+
+        if (i == ata_port_max_devices(ap))
+                return 1;
+
+        /* thaw frozen port, resume link and recover failed devices */
+        if ((ap->pflags & ATA_PFLAG_FROZEN) ||
+            (ehc->i.flags & ATA_EHI_RESUME_LINK) || ata_port_nr_enabled(ap))
                 return 0;
 
         /* skip if class codes for all vacant slots are ATA_DEV_NONE */
@@ -1744,9 +1946,12 @@ static int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
         rc = 0;
 
         /* if UNLOADING, finish immediately */
-        if (ap->flags & ATA_FLAG_UNLOADING)
+        if (ap->pflags & ATA_PFLAG_UNLOADING)
                 goto out;
 
+        /* prep for resume */
+        ata_eh_prep_resume(ap);
+
         /* skip EH if possible. */
         if (ata_eh_skip_recovery(ap))
                 ehc->i.action = 0;
@@ -1774,6 +1979,11 @@ static int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
         if (rc)
                 goto dev_fail;
 
+        /* resume devices */
+        rc = ata_eh_resume(ap, &dev);
+        if (rc)
+                goto dev_fail;
+
         /* configure transfer mode if the port has been reset */
         if (ehc->i.flags & ATA_EHI_DID_RESET) {
                 rc = ata_set_mode(ap, &dev);
@@ -1783,6 +1993,11 @@ static int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
                 }
         }
 
+        /* suspend devices */
+        rc = ata_eh_suspend(ap, &dev);
+        if (rc)
+                goto dev_fail;
+
         goto out;
 
  dev_fail:
@@ -1908,11 +2123,124 @@ void ata_do_eh(struct ata_port *ap, ata_prereset_fn_t prereset,
                ata_reset_fn_t softreset, ata_reset_fn_t hardreset,
                ata_postreset_fn_t postreset)
 {
-        if (!(ap->flags & ATA_FLAG_LOADING)) {
-                ata_eh_autopsy(ap);
-                ata_eh_report(ap);
-        }
-
+        ata_eh_autopsy(ap);
+        ata_eh_report(ap);
         ata_eh_recover(ap, prereset, softreset, hardreset, postreset);
         ata_eh_finish(ap);
 }
+
+/**
+ *      ata_eh_handle_port_suspend - perform port suspend operation
+ *      @ap: port to suspend
+ *
+ *      Suspend @ap.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ */
+static void ata_eh_handle_port_suspend(struct ata_port *ap)
+{
+        unsigned long flags;
+        int rc = 0;
+
+        /* are we suspending? */
+        spin_lock_irqsave(ap->lock, flags);
+        if (!(ap->pflags & ATA_PFLAG_PM_PENDING) ||
+            ap->pm_mesg.event == PM_EVENT_ON) {
+                spin_unlock_irqrestore(ap->lock, flags);
+                return;
+        }
+        spin_unlock_irqrestore(ap->lock, flags);
+
+        WARN_ON(ap->pflags & ATA_PFLAG_SUSPENDED);
+
+        /* suspend */
+        ata_eh_freeze_port(ap);
+
+        if (ap->ops->port_suspend)
+                rc = ap->ops->port_suspend(ap, ap->pm_mesg);
+
+        /* report result */
+        spin_lock_irqsave(ap->lock, flags);
+
+        ap->pflags &= ~ATA_PFLAG_PM_PENDING;
+        if (rc == 0)
+                ap->pflags |= ATA_PFLAG_SUSPENDED;
+        else
+                ata_port_schedule_eh(ap);
+
+        if (ap->pm_result) {
+                *ap->pm_result = rc;
+                ap->pm_result = NULL;
+        }
+
+        spin_unlock_irqrestore(ap->lock, flags);
+
+        return;
+}
+
+/**
+ *      ata_eh_handle_port_resume - perform port resume operation
+ *      @ap: port to resume
+ *
+ *      Resume @ap.
+ *
+ *      This function also waits upto one second until all devices
+ *      hanging off this port requests resume EH action.  This is to
+ *      prevent invoking EH and thus reset multiple times on resume.
+ *
+ *      On DPM resume, where some of devices might not be resumed
+ *      together, this may delay port resume upto one second, but such
+ *      DPM resumes are rare and 1 sec delay isn't too bad.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ */
+static void ata_eh_handle_port_resume(struct ata_port *ap)
+{
+        unsigned long timeout;
+        unsigned long flags;
+        int i, rc = 0;
+
+        /* are we resuming? */
+        spin_lock_irqsave(ap->lock, flags);
+        if (!(ap->pflags & ATA_PFLAG_PM_PENDING) ||
+            ap->pm_mesg.event != PM_EVENT_ON) {
+                spin_unlock_irqrestore(ap->lock, flags);
+                return;
+        }
+        spin_unlock_irqrestore(ap->lock, flags);
+
+        /* spurious? */
+        if (!(ap->pflags & ATA_PFLAG_SUSPENDED))
+                goto done;
+
+        if (ap->ops->port_resume)
+                rc = ap->ops->port_resume(ap);
+
+        /* give devices time to request EH */
+        timeout = jiffies + HZ; /* 1s max */
+        while (1) {
+                for (i = 0; i < ATA_MAX_DEVICES; i++) {
+                        struct ata_device *dev = &ap->device[i];
+                        unsigned int action = ata_eh_dev_action(dev);
+
+                        if ((dev->flags & ATA_DFLAG_SUSPENDED) &&
+                            !(action & ATA_EH_RESUME))
+                                break;
+                }
+
+                if (i == ATA_MAX_DEVICES || time_after(jiffies, timeout))
+                        break;
+                msleep(10);
+        }
+
+ done:
+        spin_lock_irqsave(ap->lock, flags);
+        ap->pflags &= ~(ATA_PFLAG_PM_PENDING | ATA_PFLAG_SUSPENDED);
+        if (ap->pm_result) {
+                *ap->pm_result = rc;
+                ap->pm_result = NULL;
+        }
+        spin_unlock_irqrestore(ap->lock, flags);
+}
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 2915bca691e8..e92c31d698ff 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -397,20 +397,129 @@ void ata_dump_status(unsigned id, struct ata_taskfile *tf)
         }
 }
 
-int ata_scsi_device_resume(struct scsi_device *sdev)
+/**
+ *      ata_scsi_device_suspend - suspend ATA device associated with sdev
+ *      @sdev: the SCSI device to suspend
+ *      @state: target power management state
+ *
+ *      Request suspend EH action on the ATA device associated with
+ *      @sdev and wait for the operation to complete.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ *
+ *      RETURNS:
+ *      0 on success, -errno otherwise.
+ */
+int ata_scsi_device_suspend(struct scsi_device *sdev, pm_message_t state)
 {
         struct ata_port *ap = ata_shost_to_port(sdev->host);
-        struct ata_device *dev = __ata_scsi_find_dev(ap, sdev);
+        struct ata_device *dev = ata_scsi_find_dev(ap, sdev);
+        unsigned long flags;
+        unsigned int action;
+        int rc = 0;
+
+        if (!dev)
+                goto out;
+
+        spin_lock_irqsave(ap->lock, flags);
+
+        /* wait for the previous resume to complete */
+        while (dev->flags & ATA_DFLAG_SUSPENDED) {
+                spin_unlock_irqrestore(ap->lock, flags);
+                ata_port_wait_eh(ap);
+                spin_lock_irqsave(ap->lock, flags);
+        }
+
+        /* if @sdev is already detached, nothing to do */
+        if (sdev->sdev_state == SDEV_OFFLINE ||
+            sdev->sdev_state == SDEV_CANCEL || sdev->sdev_state == SDEV_DEL)
+                goto out_unlock;
+
+        /* request suspend */
+        action = ATA_EH_SUSPEND;
+        if (state.event != PM_EVENT_SUSPEND)
+                action |= ATA_EH_PM_FREEZE;
+        ap->eh_info.dev_action[dev->devno] |= action;
+        ap->eh_info.flags |= ATA_EHI_QUIET;
+        ata_port_schedule_eh(ap);
+
+        spin_unlock_irqrestore(ap->lock, flags);
+
+        /* wait for EH to do the job */
+        ata_port_wait_eh(ap);
+
+        spin_lock_irqsave(ap->lock, flags);
+
+        /* If @sdev is still attached but the associated ATA device
+         * isn't suspended, the operation failed.
+         */
+        if (sdev->sdev_state != SDEV_OFFLINE &&
+            sdev->sdev_state != SDEV_CANCEL && sdev->sdev_state != SDEV_DEL &&
+            !(dev->flags & ATA_DFLAG_SUSPENDED))
+                rc = -EIO;
 
-        return ata_device_resume(dev);
+ out_unlock:
+        spin_unlock_irqrestore(ap->lock, flags);
+ out:
+        if (rc == 0)
+                sdev->sdev_gendev.power.power_state = state;
+        return rc;
 }
 
-int ata_scsi_device_suspend(struct scsi_device *sdev, pm_message_t state)
+/**
+ *      ata_scsi_device_resume - resume ATA device associated with sdev
+ *      @sdev: the SCSI device to resume
+ *
+ *      Request resume EH action on the ATA device associated with
+ *      @sdev and return immediately.  This enables parallel
+ *      wakeup/spinup of devices.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
+ *
+ *      RETURNS:
+ *      0.
+ */
+int ata_scsi_device_resume(struct scsi_device *sdev)
 {
         struct ata_port *ap = ata_shost_to_port(sdev->host);
-        struct ata_device *dev = __ata_scsi_find_dev(ap, sdev);
+        struct ata_device *dev = ata_scsi_find_dev(ap, sdev);
+        struct ata_eh_info *ehi = &ap->eh_info;
+        unsigned long flags;
+        unsigned int action;
 
-        return ata_device_suspend(dev, state);
+        if (!dev)
+                goto out;
+
+        spin_lock_irqsave(ap->lock, flags);
+
+        /* if @sdev is already detached, nothing to do */
+        if (sdev->sdev_state == SDEV_OFFLINE ||
+            sdev->sdev_state == SDEV_CANCEL || sdev->sdev_state == SDEV_DEL)
+                goto out_unlock;
+
+        /* request resume */
+        action = ATA_EH_RESUME;
+        if (sdev->sdev_gendev.power.power_state.event == PM_EVENT_SUSPEND)
+                __ata_ehi_hotplugged(ehi);
+        else
+                action |= ATA_EH_PM_FREEZE | ATA_EH_SOFTRESET;
+        ehi->dev_action[dev->devno] |= action;
+
+        /* We don't want autopsy and verbose EH messages.  Disable
+         * those if we're the only device on this link.
+         */
+        if (ata_port_max_devices(ap) == 1)
+                ehi->flags |= ATA_EHI_NO_AUTOPSY | ATA_EHI_QUIET;
+
+        ata_port_schedule_eh(ap);
+
+ out_unlock:
+        spin_unlock_irqrestore(ap->lock, flags);
+ out:
+        sdev->sdev_gendev.power.power_state = PMSG_ON;
+        return 0;
 }
 
 /**
@@ -2244,6 +2353,19 @@ static void atapi_qc_complete(struct ata_queued_cmd *qc)
                         ata_gen_ata_desc_sense(qc);
                 }
 
+                /* SCSI EH automatically locks door if sdev->locked is
+                 * set.  Sometimes door lock request continues to
+                 * fail, for example, when no media is present.  This
+                 * creates a loop - SCSI EH issues door lock which
+                 * fails and gets invoked again to acquire sense data
+                 * for the failed command.
+                 *
+                 * If door lock fails, always clear sdev->locked to
+                 * avoid this infinite loop.
+                 */
+                if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)
+                        qc->dev->sdev->locked = 0;
+
                 qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;
                 qc->scsidone(cmd);
                 ata_qc_free(qc);
@@ -2930,7 +3052,7 @@ void ata_scsi_hotplug(void *data)
         struct ata_port *ap = data;
         int i;
 
-        if (ap->flags & ATA_FLAG_UNLOADING) {
+        if (ap->pflags & ATA_PFLAG_UNLOADING) {
                 DPRINTK("ENTER/EXIT - unloading\n");
                 return;
         }
@@ -3011,6 +3133,7 @@ static int ata_scsi_user_scan(struct Scsi_Host *shost, unsigned int channel,
                 if (dev) {
                         ap->eh_info.probe_mask |= 1 << dev->devno;
                         ap->eh_info.action |= ATA_EH_SOFTRESET;
+                        ap->eh_info.flags |= ATA_EHI_RESUME_LINK;
                 } else
                         rc = -EINVAL;
         }
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 2673a11a9495..5884cd26d53a 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -189,6 +189,7 @@ static void iscsi_complete_command(struct iscsi_session *session,
 {
         struct scsi_cmnd *sc = ctask->sc;
 
+        ctask->state = ISCSI_TASK_COMPLETED;
         ctask->sc = NULL;
         list_del_init(&ctask->running);
         __kfifo_put(session->cmdpool.queue, (void*)&ctask, sizeof(void*));
@@ -275,6 +276,25 @@ out:
         return rc;
 }
 
+static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
+{
+        struct iscsi_tm_rsp *tmf = (struct iscsi_tm_rsp *)hdr;
+
+        conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
+        conn->tmfrsp_pdus_cnt++;
+
+        if (conn->tmabort_state != TMABORT_INITIAL)
+                return;
+
+        if (tmf->response == ISCSI_TMF_RSP_COMPLETE)
+                conn->tmabort_state = TMABORT_SUCCESS;
+        else if (tmf->response == ISCSI_TMF_RSP_NO_TASK)
+                conn->tmabort_state = TMABORT_NOT_FOUND;
+        else
+                conn->tmabort_state = TMABORT_FAILED;
+        wake_up(&conn->ehwait);
+}
+
 /**
  * __iscsi_complete_pdu - complete pdu
  * @conn: iscsi conn
@@ -340,6 +360,10 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 
                 switch(opcode) {
                 case ISCSI_OP_LOGOUT_RSP:
+                        if (datalen) {
+                                rc = ISCSI_ERR_PROTO;
+                                break;
+                        }
                         conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
                         /* fall through */
                 case ISCSI_OP_LOGIN_RSP:
@@ -348,7 +372,8 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                          * login related PDU's exp_statsn is handled in
                          * userspace
                          */
-                        rc = iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen);
+                        if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
+                                rc = ISCSI_ERR_CONN_FAILED;
                         list_del(&mtask->running);
                         if (conn->login_mtask != mtask)
                                 __kfifo_put(session->mgmtpool.queue,
@@ -360,25 +385,17 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                                 break;
                         }
 
-                        conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
-                        conn->tmfrsp_pdus_cnt++;
-                        if (conn->tmabort_state == TMABORT_INITIAL) {
-                                conn->tmabort_state =
-                                        ((struct iscsi_tm_rsp *)hdr)->
-                                        response == ISCSI_TMF_RSP_COMPLETE ?
-                                                TMABORT_SUCCESS:TMABORT_FAILED;
-                                /* unblock eh_abort() */
-                                wake_up(&conn->ehwait);
-                        }
+                        iscsi_tmf_rsp(conn, hdr);
                         break;
                 case ISCSI_OP_NOOP_IN:
-                        if (hdr->ttt != ISCSI_RESERVED_TAG) {
+                        if (hdr->ttt != ISCSI_RESERVED_TAG || datalen) {
                                 rc = ISCSI_ERR_PROTO;
                                 break;
                         }
                         conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
 
-                        rc = iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen);
+                        if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
+                                rc = ISCSI_ERR_CONN_FAILED;
                         list_del(&mtask->running);
                         if (conn->login_mtask != mtask)
                                 __kfifo_put(session->mgmtpool.queue,
@@ -391,14 +408,21 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
         } else if (itt == ISCSI_RESERVED_TAG) {
                 switch(opcode) {
                 case ISCSI_OP_NOOP_IN:
-                        if (!datalen) {
-                                rc = iscsi_check_assign_cmdsn(session,
-                                                 (struct iscsi_nopin*)hdr);
-                                if (!rc && hdr->ttt != ISCSI_RESERVED_TAG)
-                                        rc = iscsi_recv_pdu(conn->cls_conn,
-                                                            hdr, NULL, 0);
-                        } else
+                        if (datalen) {
                                 rc = ISCSI_ERR_PROTO;
+                                break;
+                        }
+
+                        rc = iscsi_check_assign_cmdsn(session,
+                                                 (struct iscsi_nopin*)hdr);
+                        if (rc)
+                                break;
+
+                        if (hdr->ttt == ISCSI_RESERVED_TAG)
+                                break;
+
+                        if (iscsi_recv_pdu(conn->cls_conn, hdr, NULL, 0))
+                                rc = ISCSI_ERR_CONN_FAILED;
                         break;
                 case ISCSI_OP_REJECT:
                         /* we need sth like iscsi_reject_rsp()*/
@@ -568,20 +592,24 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
         }
 
         /* process command queue */
-        while (__kfifo_get(conn->xmitqueue, (void*)&conn->ctask,
-                           sizeof(void*))) {
+        spin_lock_bh(&conn->session->lock);
+        while (!list_empty(&conn->xmitqueue)) {
                 /*
                  * iscsi tcp may readd the task to the xmitqueue to send
                  * write data
                  */
-                spin_lock_bh(&conn->session->lock);
-                if (list_empty(&conn->ctask->running))
-                        list_add_tail(&conn->ctask->running, &conn->run_list);
+                conn->ctask = list_entry(conn->xmitqueue.next,
+                                         struct iscsi_cmd_task, running);
+                conn->ctask->state = ISCSI_TASK_RUNNING;
+                list_move_tail(conn->xmitqueue.next, &conn->run_list);
                 spin_unlock_bh(&conn->session->lock);
+
                 rc = tt->xmit_cmd_task(conn, conn->ctask);
                 if (rc)
                         goto again;
+                spin_lock_bh(&conn->session->lock);
         }
+        spin_unlock_bh(&conn->session->lock);
         /* done with this ctask */
         conn->ctask = NULL;
 
@@ -691,6 +719,7 @@ int iscsi_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
         sc->SCp.phase = session->age;
         sc->SCp.ptr = (char *)ctask;
 
+        ctask->state = ISCSI_TASK_PENDING;
         ctask->mtask = NULL;
         ctask->conn = conn;
         ctask->sc = sc;
@@ -700,7 +729,7 @@ int iscsi_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
 
         session->tt->init_cmd_task(ctask);
 
-        __kfifo_put(conn->xmitqueue, (void*)&ctask, sizeof(void*));
+        list_add_tail(&ctask->running, &conn->xmitqueue);
         debug_scsi(
                "ctask enq [%s cid %d sc %lx itt 0x%x len %d cmdsn %d win %d]\n",
                 sc->sc_data_direction == DMA_TO_DEVICE ? "write" : "read",
@@ -977,31 +1006,27 @@ static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
 /*
  * xmit mutex and session lock must be held
  */
-#define iscsi_remove_task(tasktype)                                     \
-static struct iscsi_##tasktype *                                        \
-iscsi_remove_##tasktype(struct kfifo *fifo, uint32_t itt)               \
-{                                                                       \
-        int i, nr_tasks = __kfifo_len(fifo) / sizeof(void*);            \
-        struct iscsi_##tasktype *task;                                  \
-                                                                        \
-        debug_scsi("searching %d tasks\n", nr_tasks);                   \
-                                                                        \
-        for (i = 0; i < nr_tasks; i++) {                                \
-                __kfifo_get(fifo, (void*)&task, sizeof(void*));         \
-                debug_scsi("check task %u\n", task->itt);               \
-                                                                        \
-                if (task->itt == itt) {                                 \
-                        debug_scsi("matched task\n");                   \
-                        return task;                                    \
-                }                                                       \
-                                                                        \
-                __kfifo_put(fifo, (void*)&task, sizeof(void*));         \
-        }                                                               \
-        return NULL;                                                    \
-}
+static struct iscsi_mgmt_task *
+iscsi_remove_mgmt_task(struct kfifo *fifo, uint32_t itt)
+{
+        int i, nr_tasks = __kfifo_len(fifo) / sizeof(void*);
+        struct iscsi_mgmt_task *task;
+
+        debug_scsi("searching %d tasks\n", nr_tasks);
+
+        for (i = 0; i < nr_tasks; i++) {
+                __kfifo_get(fifo, (void*)&task, sizeof(void*));
+                debug_scsi("check task %u\n", task->itt);
 
-iscsi_remove_task(mgmt_task);
-iscsi_remove_task(cmd_task);
+                if (task->itt == itt) {
+                        debug_scsi("matched task\n");
+                        return task;
+                }
+
+                __kfifo_put(fifo, (void*)&task, sizeof(void*));
+        }
+        return NULL;
+}
 
 static int iscsi_ctask_mtask_cleanup(struct iscsi_cmd_task *ctask)
 {
@@ -1027,12 +1052,13 @@ static void fail_command(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask,
 {
         struct scsi_cmnd *sc;
 
-        conn->session->tt->cleanup_cmd_task(conn, ctask);
-        iscsi_ctask_mtask_cleanup(ctask);
-
         sc = ctask->sc;
         if (!sc)
                 return;
+
+        conn->session->tt->cleanup_cmd_task(conn, ctask);
+        iscsi_ctask_mtask_cleanup(ctask);
+
         sc->result = err;
         sc->resid = sc->request_bufflen;
         iscsi_complete_command(conn->session, ctask);
@@ -1043,7 +1069,6 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
         struct iscsi_cmd_task *ctask = (struct iscsi_cmd_task *)sc->SCp.ptr;
         struct iscsi_conn *conn = ctask->conn;
         struct iscsi_session *session = conn->session;
-        struct iscsi_cmd_task *pending_ctask;
         int rc;
 
         conn->eh_abort_cnt++;
@@ -1061,8 +1086,11 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
                 goto failed;
 
         /* ctask completed before time out */
-        if (!ctask->sc)
-                goto success;
+        if (!ctask->sc) {
+                spin_unlock_bh(&session->lock);
+                debug_scsi("sc completed while abort in progress\n");
+                goto success_rel_mutex;
+        }
 
         /* what should we do here ? */
         if (conn->ctask == ctask) {
@@ -1071,17 +1099,8 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
                 goto failed;
         }
 
-        /* check for the easy pending cmd abort */
-        pending_ctask = iscsi_remove_cmd_task(conn->xmitqueue, ctask->itt);
-        if (pending_ctask) {
-                /* iscsi_tcp queues write transfers on the xmitqueue */
-                if (list_empty(&pending_ctask->running)) {
-                        debug_scsi("found pending task\n");
-                        goto success;
-                } else
-                        __kfifo_put(conn->xmitqueue, (void*)&pending_ctask,
-                                    sizeof(void*));
-        }
+        if (ctask->state == ISCSI_TASK_PENDING)
+                goto success_cleanup;
 
         conn->tmabort_state = TMABORT_INITIAL;
 
@@ -1089,25 +1108,31 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
         rc = iscsi_exec_abort_task(sc, ctask);
         spin_lock_bh(&session->lock);
 
-        iscsi_ctask_mtask_cleanup(ctask);
         if (rc || sc->SCp.phase != session->age ||
             session->state != ISCSI_STATE_LOGGED_IN)
                 goto failed;
+        iscsi_ctask_mtask_cleanup(ctask);
 
-        /* ctask completed before tmf abort response */
-        if (!ctask->sc) {
-                debug_scsi("sc completed while abort in progress\n");
-                goto success;
-        }
-
-        if (conn->tmabort_state != TMABORT_SUCCESS) {
+        switch (conn->tmabort_state) {
+        case TMABORT_SUCCESS:
+                goto success_cleanup;
+        case TMABORT_NOT_FOUND:
+                if (!ctask->sc) {
+                        /* ctask completed before tmf abort response */
+                        spin_unlock_bh(&session->lock);
+                        debug_scsi("sc completed while abort in progress\n");
+                        goto success_rel_mutex;
+                }
+                /* fall through */
+        default:
+                /* timedout or failed */
                 spin_unlock_bh(&session->lock);
                 iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
                 spin_lock_bh(&session->lock);
                 goto failed;
         }
 
-success:
+success_cleanup:
         debug_scsi("abort success [sc %lx itt 0x%x]\n", (long)sc, ctask->itt);
         spin_unlock_bh(&session->lock);
 
@@ -1121,6 +1146,7 @@ success:
         spin_unlock(&session->lock);
         write_unlock_bh(conn->recv_lock);
 
+success_rel_mutex:
         mutex_unlock(&conn->xmitmutex);
         return SUCCESS;
 
@@ -1263,6 +1289,7 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
                 if (cmd_task_size)
                         ctask->dd_data = &ctask[1];
                 ctask->itt = cmd_i;
+                INIT_LIST_HEAD(&ctask->running);
         }
 
         spin_lock_init(&session->lock);
@@ -1282,18 +1309,24 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
                 if (mgmt_task_size)
                         mtask->dd_data = &mtask[1];
                 mtask->itt = ISCSI_MGMT_ITT_OFFSET + cmd_i;
+                INIT_LIST_HEAD(&mtask->running);
         }
 
         if (scsi_add_host(shost, NULL))
                 goto add_host_fail;
 
+        if (!try_module_get(iscsit->owner))
+                goto cls_session_fail;
+
         cls_session = iscsi_create_session(shost, iscsit, 0);
         if (!cls_session)
-                goto cls_session_fail;
+                goto module_put;
         *(unsigned long*)shost->hostdata = (unsigned long)cls_session;
 
         return cls_session;
 
+module_put:
+        module_put(iscsit->owner);
 cls_session_fail:
         scsi_remove_host(shost);
 add_host_fail:
@@ -1317,14 +1350,18 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 {
         struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
         struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
+        struct module *owner = cls_session->transport->owner;
 
         scsi_remove_host(shost);
 
         iscsi_pool_free(&session->mgmtpool, (void**)session->mgmt_cmds);
         iscsi_pool_free(&session->cmdpool, (void**)session->cmds);
 
+        kfree(session->targetname);
+
         iscsi_destroy_session(cls_session);
         scsi_host_put(shost);
+        module_put(owner);
 }
 EXPORT_SYMBOL_GPL(iscsi_session_teardown);
 
@@ -1355,12 +1392,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, uint32_t conn_idx)
         conn->tmabort_state = TMABORT_INITIAL;
         INIT_LIST_HEAD(&conn->run_list);
         INIT_LIST_HEAD(&conn->mgmt_run_list);
-
-        /* initialize general xmit PDU commands queue */
-        conn->xmitqueue = kfifo_alloc(session->cmds_max * sizeof(void*),
-                                        GFP_KERNEL, NULL);
-        if (conn->xmitqueue == ERR_PTR(-ENOMEM))
-                goto xmitqueue_alloc_fail;
+        INIT_LIST_HEAD(&conn->xmitqueue);
 
         /* initialize general immediate & non-immediate PDU commands queue */
         conn->immqueue = kfifo_alloc(session->mgmtpool_max * sizeof(void*),
@@ -1388,7 +1420,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, uint32_t conn_idx)
         data = kmalloc(DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH, GFP_KERNEL);
         if (!data)
                 goto login_mtask_data_alloc_fail;
-        conn->login_mtask->data = data;
+        conn->login_mtask->data = conn->data = data;
 
         init_timer(&conn->tmabort_timer);
         mutex_init(&conn->xmitmutex);
@@ -1404,8 +1436,6 @@ login_mtask_alloc_fail:
 mgmtqueue_alloc_fail:
         kfifo_free(conn->immqueue);
 immqueue_alloc_fail:
-        kfifo_free(conn->xmitqueue);
-xmitqueue_alloc_fail:
         iscsi_destroy_conn(cls_conn);
         return NULL;
 }
@@ -1426,12 +1456,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 
         set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
         mutex_lock(&conn->xmitmutex);
-        if (conn->c_stage == ISCSI_CONN_INITIAL_STAGE) {
-                if (session->tt->suspend_conn_recv)
-                        session->tt->suspend_conn_recv(conn);
-
-                session->tt->terminate_conn(conn);
-        }
 
         spin_lock_bh(&session->lock);
         conn->c_stage = ISCSI_CONN_CLEANUP_WAIT;
@@ -1468,7 +1492,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
         }
 
         spin_lock_bh(&session->lock);
-        kfree(conn->login_mtask->data);
+        kfree(conn->data);
+        kfree(conn->persistent_address);
         __kfifo_put(session->mgmtpool.queue, (void*)&conn->login_mtask,
                     sizeof(void*));
         list_del(&conn->item);
@@ -1483,7 +1508,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
                 session->cmdsn = session->max_cmdsn = session->exp_cmdsn = 1;
         spin_unlock_bh(&session->lock);
 
-        kfifo_free(conn->xmitqueue);
         kfifo_free(conn->immqueue);
         kfifo_free(conn->mgmtqueue);
 
@@ -1566,7 +1590,7 @@ static void fail_all_commands(struct iscsi_conn *conn)
         struct iscsi_cmd_task *ctask, *tmp;
 
         /* flush pending */
-        while (__kfifo_get(conn->xmitqueue, (void*)&ctask, sizeof(void*))) {
+        list_for_each_entry_safe(ctask, tmp, &conn->xmitqueue, running) {
                 debug_scsi("failing pending sc %p itt 0x%x\n", ctask->sc,
                            ctask->itt);
                 fail_command(conn, ctask, DID_BUS_BUSY << 16);
@@ -1609,8 +1633,9 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
         set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
         spin_unlock_bh(&session->lock);
 
-        if (session->tt->suspend_conn_recv)
-                session->tt->suspend_conn_recv(conn);
+        write_lock_bh(conn->recv_lock);
+        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
+        write_unlock_bh(conn->recv_lock);
 
         mutex_lock(&conn->xmitmutex);
         /*
@@ -1629,7 +1654,6 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
                 }
         }
 
-        session->tt->terminate_conn(conn);
         /*
          * flush queues.
          */
@@ -1697,6 +1721,185 @@ int iscsi_conn_bind(struct iscsi_cls_session *cls_session,
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_bind);
 
+
+int iscsi_set_param(struct iscsi_cls_conn *cls_conn,
+                    enum iscsi_param param, char *buf, int buflen)
+{
+        struct iscsi_conn *conn = cls_conn->dd_data;
+        struct iscsi_session *session = conn->session;
+        uint32_t value;
+
+        switch(param) {
+        case ISCSI_PARAM_MAX_RECV_DLENGTH:
+                sscanf(buf, "%d", &conn->max_recv_dlength);
+                break;
+        case ISCSI_PARAM_MAX_XMIT_DLENGTH:
+                sscanf(buf, "%d", &conn->max_xmit_dlength);
+                break;
+        case ISCSI_PARAM_HDRDGST_EN:
+                sscanf(buf, "%d", &conn->hdrdgst_en);
+                break;
+        case ISCSI_PARAM_DATADGST_EN:
+                sscanf(buf, "%d", &conn->datadgst_en);
+                break;
+        case ISCSI_PARAM_INITIAL_R2T_EN:
+                sscanf(buf, "%d", &session->initial_r2t_en);
+                break;
+        case ISCSI_PARAM_MAX_R2T:
+                sscanf(buf, "%d", &session->max_r2t);
+                break;
+        case ISCSI_PARAM_IMM_DATA_EN:
+                sscanf(buf, "%d", &session->imm_data_en);
+                break;
+        case ISCSI_PARAM_FIRST_BURST:
+                sscanf(buf, "%d", &session->first_burst);
+                break;
+        case ISCSI_PARAM_MAX_BURST:
+                sscanf(buf, "%d", &session->max_burst);
+                break;
+        case ISCSI_PARAM_PDU_INORDER_EN:
+                sscanf(buf, "%d", &session->pdu_inorder_en);
+                break;
+        case ISCSI_PARAM_DATASEQ_INORDER_EN:
+                sscanf(buf, "%d", &session->dataseq_inorder_en);
+                break;
+        case ISCSI_PARAM_ERL:
+                sscanf(buf, "%d", &session->erl);
+                break;
+        case ISCSI_PARAM_IFMARKER_EN:
+                sscanf(buf, "%d", &value);
+                BUG_ON(value);
+                break;
+        case ISCSI_PARAM_OFMARKER_EN:
+                sscanf(buf, "%d", &value);
+                BUG_ON(value);
+                break;
+        case ISCSI_PARAM_EXP_STATSN:
+                sscanf(buf, "%u", &conn->exp_statsn);
+                break;
+        case ISCSI_PARAM_TARGET_NAME:
+                /* this should not change between logins */
+                if (session->targetname)
+                        break;
+
+                session->targetname = kstrdup(buf, GFP_KERNEL);
+                if (!session->targetname)
+                        return -ENOMEM;
+                break;
+        case ISCSI_PARAM_TPGT:
+                sscanf(buf, "%d", &session->tpgt);
+                break;
+        case ISCSI_PARAM_PERSISTENT_PORT:
+                sscanf(buf, "%d", &conn->persistent_port);
+                break;
+        case ISCSI_PARAM_PERSISTENT_ADDRESS:
+                /*
+                 * this is the address returned in discovery so it should
+                 * not change between logins.
+                 */
+                if (conn->persistent_address)
+                        break;
+
+                conn->persistent_address = kstrdup(buf, GFP_KERNEL);
+                if (!conn->persistent_address)
+                        return -ENOMEM;
+                break;
+        default:
+                return -ENOSYS;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iscsi_set_param);
+
+int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
+                            enum iscsi_param param, char *buf)
+{
+        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
+        struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
+        int len;
+
+        switch(param) {
+        case ISCSI_PARAM_INITIAL_R2T_EN:
+                len = sprintf(buf, "%d\n", session->initial_r2t_en);
+                break;
+        case ISCSI_PARAM_MAX_R2T:
+                len = sprintf(buf, "%hu\n", session->max_r2t);
+                break;
+        case ISCSI_PARAM_IMM_DATA_EN:
+                len = sprintf(buf, "%d\n", session->imm_data_en);
+                break;
+        case ISCSI_PARAM_FIRST_BURST:
+                len = sprintf(buf, "%u\n", session->first_burst);
+                break;
+        case ISCSI_PARAM_MAX_BURST:
+                len = sprintf(buf, "%u\n", session->max_burst);
+                break;
+        case ISCSI_PARAM_PDU_INORDER_EN:
+                len = sprintf(buf, "%d\n", session->pdu_inorder_en);
+                break;
+        case ISCSI_PARAM_DATASEQ_INORDER_EN:
+                len = sprintf(buf, "%d\n", session->dataseq_inorder_en);
+                break;
+        case ISCSI_PARAM_ERL:
+                len = sprintf(buf, "%d\n", session->erl);
+                break;
+        case ISCSI_PARAM_TARGET_NAME:
+                len = sprintf(buf, "%s\n", session->targetname);
+                break;
+        case ISCSI_PARAM_TPGT:
+                len = sprintf(buf, "%d\n", session->tpgt);
+                break;
+        default:
+                return -ENOSYS;
+        }
+
+        return len;
+}
+EXPORT_SYMBOL_GPL(iscsi_session_get_param);
+
+int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
+                         enum iscsi_param param, char *buf)
+{
+        struct iscsi_conn *conn = cls_conn->dd_data;
+        int len;
+
+        switch(param) {
+        case ISCSI_PARAM_MAX_RECV_DLENGTH:
+                len = sprintf(buf, "%u\n", conn->max_recv_dlength);
+                break;
+        case ISCSI_PARAM_MAX_XMIT_DLENGTH:
+                len = sprintf(buf, "%u\n", conn->max_xmit_dlength);
+                break;
+        case ISCSI_PARAM_HDRDGST_EN:
+                len = sprintf(buf, "%d\n", conn->hdrdgst_en);
+                break;
+        case ISCSI_PARAM_DATADGST_EN:
+                len = sprintf(buf, "%d\n", conn->datadgst_en);
+                break;
+        case ISCSI_PARAM_IFMARKER_EN:
+                len = sprintf(buf, "%d\n", conn->ifmarker_en);
+                break;
+        case ISCSI_PARAM_OFMARKER_EN:
+                len = sprintf(buf, "%d\n", conn->ofmarker_en);
+                break;
+        case ISCSI_PARAM_EXP_STATSN:
+                len = sprintf(buf, "%u\n", conn->exp_statsn);
+                break;
+        case ISCSI_PARAM_PERSISTENT_PORT:
+                len = sprintf(buf, "%d\n", conn->persistent_port);
+                break;
+        case ISCSI_PARAM_PERSISTENT_ADDRESS:
+                len = sprintf(buf, "%s\n", conn->persistent_address);
+                break;
+        default:
+                return -ENOSYS;
+        }
+
+        return len;
+}
+EXPORT_SYMBOL_GPL(iscsi_conn_get_param);
+
 MODULE_AUTHOR("Mike Christie");
 MODULE_DESCRIPTION("iSCSI library functions");
 MODULE_LICENSE("GPL");
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 087c44539a16..d44f9aac6b8f 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -21,10 +21,12 @@
 
 struct lpfc_sli2_slim;
 
-#define LPFC_MAX_TARGET         256     /* max targets supported */
-#define LPFC_MAX_DISC_THREADS   64      /* max outstanding discovery els req */
-#define LPFC_MAX_NS_RETRY       3       /* max NameServer retries */
 
+#define LPFC_MAX_TARGET         256     /* max number of targets supported */
+#define LPFC_MAX_DISC_THREADS   64      /* max outstanding discovery els
+                                           requests */
+#define LPFC_MAX_NS_RETRY       3       /* Number of retry attempts to contact
+                                           the NameServer  before giving up. */
 #define LPFC_DFT_HBA_Q_DEPTH    2048    /* max cmds per hba */
 #define LPFC_LC_HBA_Q_DEPTH     1024    /* max cmds per low cost hba */
 #define LPFC_LP101_HBA_Q_DEPTH  128     /* max cmds per low cost hba */
@@ -41,7 +43,6 @@ struct lpfc_sli2_slim;
                              (( (u64)(high)<<16 ) << 16)|( (u64)(low))))
 /* Provide maximum configuration definitions. */
 #define LPFC_DRVR_TIMEOUT       16      /* driver iocb timeout value in sec */
-#define MAX_FCP_TARGET          256     /* max num of FCP targets supported */
 #define FC_MAX_ADPTMSG          64
 
 #define MAX_HBAEVT      32
@@ -174,7 +175,6 @@ struct lpfc_hba {
         dma_addr_t slim2p_mapping;
         uint16_t pci_cfg_value;
 
-        struct semaphore hba_can_block;
         int32_t hba_state;
 
 #define LPFC_STATE_UNKNOWN        0    /* HBA state is unknown */
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index b62a72dfab29..d384c16f4a87 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -219,8 +219,18 @@ lpfc_issue_lip(struct Scsi_Host *host)
                 return -ENOMEM;
 
         memset((void *)pmboxq, 0, sizeof (LPFC_MBOXQ_t));
-        lpfc_init_link(phba, pmboxq, phba->cfg_topology, phba->cfg_link_speed);
-        mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2);
+        pmboxq->mb.mbxCommand = MBX_DOWN_LINK;
+        pmboxq->mb.mbxOwner = OWN_HOST;
+
+        mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO * 2);
+
+        if ((mbxstatus == MBX_SUCCESS) && (pmboxq->mb.mbxStatus == 0)) {
+                memset((void *)pmboxq, 0, sizeof (LPFC_MBOXQ_t));
+                lpfc_init_link(phba, pmboxq, phba->cfg_topology,
+                               phba->cfg_link_speed);
+                mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
+                                                     phba->fc_ratov * 2);
+        }
 
         if (mbxstatus == MBX_TIMEOUT)
                 pmboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
@@ -233,51 +243,53 @@ lpfc_issue_lip(struct Scsi_Host *host)
         return 0;
 }
 
-static ssize_t
-lpfc_nport_evt_cnt_show(struct class_device *cdev, char *buf)
+static int
+lpfc_selective_reset(struct lpfc_hba *phba)
 {
-        struct Scsi_Host *host = class_to_shost(cdev);
-        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
-        return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
+        struct completion online_compl;
+        int status = 0;
+
+        init_completion(&online_compl);
+        lpfc_workq_post_event(phba, &status, &online_compl,
+                              LPFC_EVT_OFFLINE);
+        wait_for_completion(&online_compl);
+
+        if (status != 0)
+                return -EIO;
+
+        init_completion(&online_compl);
+        lpfc_workq_post_event(phba, &status, &online_compl,
+                              LPFC_EVT_ONLINE);
+        wait_for_completion(&online_compl);
+
+        if (status != 0)
+                return -EIO;
+
+        return 0;
 }
 
 static ssize_t
-lpfc_board_online_show(struct class_device *cdev, char *buf)
+lpfc_issue_reset(struct class_device *cdev, const char *buf, size_t count)
 {
         struct Scsi_Host *host = class_to_shost(cdev);
         struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
+        int status = -EINVAL;
 
-        if (phba->fc_flag & FC_OFFLINE_MODE)
-                return snprintf(buf, PAGE_SIZE, "0\n");
+        if (strncmp(buf, "selective", sizeof("selective") - 1) == 0)
+                status = lpfc_selective_reset(phba);
+
+        if (status == 0)
+                return strlen(buf);
         else
-                return snprintf(buf, PAGE_SIZE, "1\n");
+                return status;
 }
 
 static ssize_t
-lpfc_board_online_store(struct class_device *cdev, const char *buf,
-                                                                size_t count)
+lpfc_nport_evt_cnt_show(struct class_device *cdev, char *buf)
 {
         struct Scsi_Host *host = class_to_shost(cdev);
         struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
-        struct completion online_compl;
-        int val=0, status=0;
-
-        if (sscanf(buf, "%d", &val) != 1)
-                return -EINVAL;
-
-        init_completion(&online_compl);
-
-        if (val)
-                lpfc_workq_post_event(phba, &status, &online_compl,
-                                                        LPFC_EVT_ONLINE);
-        else
-                lpfc_workq_post_event(phba, &status, &online_compl,
-                                                        LPFC_EVT_OFFLINE);
-        wait_for_completion(&online_compl);
-        if (!status)
-                return strlen(buf);
-        else
-                return -EIO;
+        return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
 }
 
 static ssize_t
@@ -532,10 +544,9 @@ static CLASS_DEVICE_ATTR(lpfc_drvr_version, S_IRUGO, lpfc_drvr_version_show,
                          NULL);
 static CLASS_DEVICE_ATTR(management_version, S_IRUGO, management_version_show,
                          NULL);
-static CLASS_DEVICE_ATTR(board_online, S_IRUGO | S_IWUSR,
-                         lpfc_board_online_show, lpfc_board_online_store);
 static CLASS_DEVICE_ATTR(board_mode, S_IRUGO | S_IWUSR,
                          lpfc_board_mode_show, lpfc_board_mode_store);
+static CLASS_DEVICE_ATTR(issue_reset, S_IWUSR, NULL, lpfc_issue_reset);
 
 static int lpfc_poll = 0;
 module_param(lpfc_poll, int, 0);
@@ -695,12 +706,12 @@ LPFC_ATTR(discovery_threads, 32, 1, 64, "Maximum number of ELS commands "
                  "during discovery");
 
 /*
-# lpfc_max_luns: maximum number of LUNs per target driver will support
-# Value range is [1,32768]. Default value is 256.
-# NOTE: The SCSI layer will scan each target for this many luns
+# lpfc_max_luns: maximum allowed LUN.
+# Value range is [0,65535]. Default value is 255.
+# NOTE: The SCSI layer might probe all allowed LUN on some old targets.
 */
-LPFC_ATTR_R(max_luns, 256, 1, 32768,
-             "Maximum number of LUNs per target driver will support");
+LPFC_ATTR_R(max_luns, 255, 0, 65535,
+             "Maximum allowed LUN");
 
 /*
 # lpfc_poll_tmo: .Milliseconds driver will wait between polling FCP ring.
@@ -739,8 +750,8 @@ struct class_device_attribute *lpfc_host_attrs[] = {
         &class_device_attr_lpfc_max_luns,
         &class_device_attr_nport_evt_cnt,
         &class_device_attr_management_version,
-        &class_device_attr_board_online,
         &class_device_attr_board_mode,
+        &class_device_attr_issue_reset,
         &class_device_attr_lpfc_poll,
         &class_device_attr_lpfc_poll_tmo,
         NULL,
@@ -873,7 +884,7 @@ sysfs_mbox_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
                     phba->sysfs_mbox.mbox   == NULL ) {
                         sysfs_mbox_idle(phba);
                         spin_unlock_irq(host->host_lock);
-                        return -EINVAL;
+                        return -EAGAIN;
                 }
         }
 
@@ -989,14 +1000,15 @@ sysfs_mbox_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
                         spin_unlock_irq(phba->host->host_lock);
                         rc = lpfc_sli_issue_mbox_wait (phba,
                                                        phba->sysfs_mbox.mbox,
-                                                       phba->fc_ratov * 2);
+                                lpfc_mbox_tmo_val(phba,
+                                    phba->sysfs_mbox.mbox->mb.mbxCommand) * HZ);
                         spin_lock_irq(phba->host->host_lock);
                 }
 
                 if (rc != MBX_SUCCESS) {
                         sysfs_mbox_idle(phba);
                         spin_unlock_irq(host->host_lock);
-                        return -ENODEV;
+                        return  (rc == MBX_TIMEOUT) ? -ETIME : -ENODEV;
                 }
                 phba->sysfs_mbox.state = SMBOX_READING;
         }
@@ -1005,7 +1017,7 @@ sysfs_mbox_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
                 printk(KERN_WARNING  "mbox_read: Bad State\n");
                 sysfs_mbox_idle(phba);
                 spin_unlock_irq(host->host_lock);
-                return -EINVAL;
+                return -EAGAIN;
         }
 
         memcpy(buf, (uint8_t *) & phba->sysfs_mbox.mbox->mb + off, count);
@@ -1199,8 +1211,10 @@ lpfc_get_stats(struct Scsi_Host *shost)
         struct lpfc_hba *phba = (struct lpfc_hba *)shost->hostdata;
         struct lpfc_sli *psli = &phba->sli;
         struct fc_host_statistics *hs = &phba->link_stats;
+        struct lpfc_lnk_stat * lso = &psli->lnk_stat_offsets;
         LPFC_MBOXQ_t *pmboxq;
         MAILBOX_t *pmb;
+        unsigned long seconds;
         int rc = 0;
 
         pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
@@ -1261,22 +1275,103 @@ lpfc_get_stats(struct Scsi_Host *shost)
         hs->invalid_crc_count = pmb->un.varRdLnk.crcCnt;
         hs->error_frames = pmb->un.varRdLnk.crcCnt;
 
+        hs->link_failure_count -= lso->link_failure_count;
+        hs->loss_of_sync_count -= lso->loss_of_sync_count;
+        hs->loss_of_signal_count -= lso->loss_of_signal_count;
+        hs->prim_seq_protocol_err_count -= lso->prim_seq_protocol_err_count;
+        hs->invalid_tx_word_count -= lso->invalid_tx_word_count;
+        hs->invalid_crc_count -= lso->invalid_crc_count;
+        hs->error_frames -= lso->error_frames;
+
         if (phba->fc_topology == TOPOLOGY_LOOP) {
                 hs->lip_count = (phba->fc_eventTag >> 1);
+                hs->lip_count -= lso->link_events;
                 hs->nos_count = -1;
         } else {
                 hs->lip_count = -1;
                 hs->nos_count = (phba->fc_eventTag >> 1);
+                hs->nos_count -= lso->link_events;
         }
 
         hs->dumped_frames = -1;
 
-/* FIX ME */
-        /*hs->SecondsSinceLastReset = (jiffies - lpfc_loadtime) / HZ;*/
+        seconds = get_seconds();
+        if (seconds < psli->stats_start)
+                hs->seconds_since_last_reset = seconds +
+                                ((unsigned long)-1 - psli->stats_start);
+        else
+                hs->seconds_since_last_reset = seconds - psli->stats_start;
 
         return hs;
 }
 
+static void
+lpfc_reset_stats(struct Scsi_Host *shost)
+{
+        struct lpfc_hba *phba = (struct lpfc_hba *)shost->hostdata;
+        struct lpfc_sli *psli = &phba->sli;
+        struct lpfc_lnk_stat * lso = &psli->lnk_stat_offsets;
+        LPFC_MBOXQ_t *pmboxq;
+        MAILBOX_t *pmb;
+        int rc = 0;
+
+        pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+        if (!pmboxq)
+                return;
+        memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
+
+        pmb = &pmboxq->mb;
+        pmb->mbxCommand = MBX_READ_STATUS;
+        pmb->mbxOwner = OWN_HOST;
+        pmb->un.varWords[0] = 0x1; /* reset request */
+        pmboxq->context1 = NULL;
+
+        if ((phba->fc_flag & FC_OFFLINE_MODE) ||
+                (!(psli->sli_flag & LPFC_SLI2_ACTIVE)))
+                rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
+        else
+                rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2);
+
+        if (rc != MBX_SUCCESS) {
+                if (rc == MBX_TIMEOUT)
+                        pmboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
+                else
+                        mempool_free(pmboxq, phba->mbox_mem_pool);
+                return;
+        }
+
+        memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
+        pmb->mbxCommand = MBX_READ_LNK_STAT;
+        pmb->mbxOwner = OWN_HOST;
+        pmboxq->context1 = NULL;
+
+        if ((phba->fc_flag & FC_OFFLINE_MODE) ||
+            (!(psli->sli_flag & LPFC_SLI2_ACTIVE)))
+                rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
+        else
+                rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2);
+
+        if (rc != MBX_SUCCESS) {
+                if (rc == MBX_TIMEOUT)
+                        pmboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
+                else
+                        mempool_free( pmboxq, phba->mbox_mem_pool);
+                return;
+        }
+
+        lso->link_failure_count = pmb->un.varRdLnk.linkFailureCnt;
+        lso->loss_of_sync_count = pmb->un.varRdLnk.lossSyncCnt;
+        lso->loss_of_signal_count = pmb->un.varRdLnk.lossSignalCnt;
+        lso->prim_seq_protocol_err_count = pmb->un.varRdLnk.primSeqErrCnt;
+        lso->invalid_tx_word_count = pmb->un.varRdLnk.invalidXmitWord;
+        lso->invalid_crc_count = pmb->un.varRdLnk.crcCnt;
+        lso->error_frames = pmb->un.varRdLnk.crcCnt;
+        lso->link_events = (phba->fc_eventTag >> 1);
+
+        psli->stats_start = get_seconds();
+
+        return;
+}
 
 /*
  * The LPFC driver treats linkdown handling as target loss events so there
@@ -1420,8 +1515,7 @@ struct fc_function_template lpfc_transport_functions = {
          */
 
         .get_fc_host_stats = lpfc_get_stats,
-
-        /* the LPFC driver doesn't support resetting stats yet */
+        .reset_fc_host_stats = lpfc_reset_stats,
 
         .dd_fcrport_size = sizeof(struct lpfc_rport_data),
         .show_rport_maxframe_size = 1,
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index ee22173fce43..2a176467f71b 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -127,6 +127,7 @@ void lpfc_config_port(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_kill_board(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_mbox_put(struct lpfc_hba *, LPFC_MBOXQ_t *);
 LPFC_MBOXQ_t *lpfc_mbox_get(struct lpfc_hba *);
+int lpfc_mbox_tmo_val(struct lpfc_hba *, int);
 
 int lpfc_mem_alloc(struct lpfc_hba *);
 void lpfc_mem_free(struct lpfc_hba *);
@@ -147,6 +148,7 @@ int lpfc_sli_hba_setup(struct lpfc_hba *);
 int lpfc_sli_hba_down(struct lpfc_hba *);
 int lpfc_sli_issue_mbox(struct lpfc_hba *, LPFC_MBOXQ_t *, uint32_t);
 int lpfc_sli_handle_mb_event(struct lpfc_hba *);
+int lpfc_sli_flush_mbox_queue(struct lpfc_hba *);
 int lpfc_sli_handle_slow_ring_event(struct lpfc_hba *,
                                     struct lpfc_sli_ring *, uint32_t);
 void lpfc_sli_def_mbox_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index b65ee57af53e..bbb7310210b0 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -131,6 +131,7 @@ lpfc_ct_unsol_event(struct lpfc_hba * phba,
         }
 
 ct_unsol_event_exit_piocbq:
+        list_del(&head);
         if (pmbuf) {
                 list_for_each_entry_safe(matp, next_matp, &pmbuf->list, list) {
                         lpfc_mbuf_free(phba, matp->virt, matp->phys);
@@ -481,7 +482,7 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
                 if (CTrsp->CommandResponse.bits.CmdRsp ==
                     be16_to_cpu(SLI_CT_RESPONSE_FS_ACC)) {
                         lpfc_printf_log(phba, KERN_INFO, LOG_DISCOVERY,
-                                        "%d:0239 NameServer Rsp "
+                                        "%d:0208 NameServer Rsp "
                                         "Data: x%x\n",
                                         phba->brd_no,
                                         phba->fc_flag);
@@ -588,13 +589,9 @@ lpfc_get_hba_sym_node_name(struct lpfc_hba * phba, uint8_t * symbp)
 
         lpfc_decode_firmware_rev(phba, fwrev, 0);
 
-        if (phba->Port[0]) {
-                sprintf(symbp, "Emulex %s Port %s FV%s DV%s", phba->ModelName,
-                        phba->Port, fwrev, lpfc_release_version);
-        } else {
-                sprintf(symbp, "Emulex %s FV%s DV%s", phba->ModelName,
-                        fwrev, lpfc_release_version);
-        }
+        sprintf(symbp, "Emulex %s FV%s DV%s", phba->ModelName,
+                fwrev, lpfc_release_version);
+        return;
 }
 
 /*
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 283b7d824c34..3567de613162 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -648,33 +648,32 @@ lpfc_more_plogi(struct lpfc_hba * phba)
 }
 
 static struct lpfc_nodelist *
-lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
+lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_dmabuf *prsp,
                          struct lpfc_nodelist *ndlp)
 {
         struct lpfc_nodelist *new_ndlp;
-        struct lpfc_dmabuf *pcmd, *prsp;
         uint32_t *lp;
         struct serv_parm *sp;
         uint8_t name[sizeof (struct lpfc_name)];
         uint32_t rc;
 
-        pcmd = (struct lpfc_dmabuf *) cmdiocb->context2;
-        prsp = (struct lpfc_dmabuf *) pcmd->list.next;
         lp = (uint32_t *) prsp->virt;
         sp = (struct serv_parm *) ((uint8_t *) lp + sizeof (uint32_t));
+        memset(name, 0, sizeof (struct lpfc_name));
 
         /* Now we to find out if the NPort we are logging into, matches the WWPN
          * we have for that ndlp. If not, we have some work to do.
          */
         new_ndlp = lpfc_findnode_wwpn(phba, NLP_SEARCH_ALL, &sp->portName);
 
-        memset(name, 0, sizeof (struct lpfc_name));
-        rc =  memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name));
-        if (!rc || (new_ndlp == ndlp)) {
+        if (new_ndlp == ndlp)
                 return ndlp;
-        }
 
         if (!new_ndlp) {
+                rc =
+                   memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name));
+                if (!rc)
+                        return ndlp;
                 new_ndlp = mempool_alloc(phba->nlp_mem_pool, GFP_ATOMIC);
                 if (!new_ndlp)
                         return ndlp;
@@ -683,17 +682,21 @@ lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
         }
 
         lpfc_unreg_rpi(phba, new_ndlp);
-        new_ndlp->nlp_prev_state = ndlp->nlp_state;
         new_ndlp->nlp_DID = ndlp->nlp_DID;
-        new_ndlp->nlp_state = NLP_STE_PLOGI_ISSUE;
-        lpfc_nlp_list(phba, new_ndlp, NLP_PLOGI_LIST);
+        new_ndlp->nlp_prev_state = ndlp->nlp_prev_state;
+        new_ndlp->nlp_state = ndlp->nlp_state;
+        lpfc_nlp_list(phba, new_ndlp, ndlp->nlp_flag & NLP_LIST_MASK);
 
         /* Move this back to NPR list */
-        lpfc_unreg_rpi(phba, ndlp);
-        ndlp->nlp_DID = 0; /* Two ndlps cannot have the same did */
-        ndlp->nlp_state = NLP_STE_NPR_NODE;
-        lpfc_nlp_list(phba, ndlp, NLP_NPR_LIST);
-
+        if (memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name)) == 0) {
+                lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
+        }
+        else {
+                lpfc_unreg_rpi(phba, ndlp);
+                ndlp->nlp_DID = 0; /* Two ndlps cannot have the same did */
+                ndlp->nlp_state = NLP_STE_NPR_NODE;
+                lpfc_nlp_list(phba, ndlp, NLP_NPR_LIST);
+        }
         return new_ndlp;
 }
 
@@ -703,6 +706,7 @@ lpfc_cmpl_els_plogi(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
 {
         IOCB_t *irsp;
         struct lpfc_nodelist *ndlp;
+        struct lpfc_dmabuf *prsp;
         int disc, rc, did, type;
 
 
@@ -769,7 +773,10 @@ lpfc_cmpl_els_plogi(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
                 }
         } else {
                 /* Good status, call state machine */
-                ndlp = lpfc_plogi_confirm_nport(phba, cmdiocb, ndlp);
+                prsp = list_entry(((struct lpfc_dmabuf *)
+                        cmdiocb->context2)->list.next,
+                        struct lpfc_dmabuf, list);
+                ndlp = lpfc_plogi_confirm_nport(phba, prsp, ndlp);
                 rc = lpfc_disc_state_machine(phba, ndlp, cmdiocb,
                                         NLP_EVT_CMPL_PLOGI);
         }
@@ -821,7 +828,7 @@ lpfc_issue_els_plogi(struct lpfc_hba * phba, uint32_t did, uint8_t retry)
         pring = &psli->ring[LPFC_ELS_RING];     /* ELS ring */
 
         cmdsize = (sizeof (uint32_t) + sizeof (struct serv_parm));
-        elsiocb = lpfc_prep_els_iocb(phba, 1, cmdsize, retry, 0, did,
+        elsiocb = lpfc_prep_els_iocb(phba, 1, cmdsize, retry, NULL, did,
                                                                 ELS_CMD_PLOGI);
         if (!elsiocb)
                 return 1;
@@ -1841,9 +1848,12 @@ static void
 lpfc_cmpl_els_acc(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
                   struct lpfc_iocbq * rspiocb)
 {
+        IOCB_t *irsp;
         struct lpfc_nodelist *ndlp;
         LPFC_MBOXQ_t *mbox = NULL;
 
+        irsp = &rspiocb->iocb;
+
         ndlp = (struct lpfc_nodelist *) cmdiocb->context1;
         if (cmdiocb->context_un.mbox)
                 mbox = cmdiocb->context_un.mbox;
@@ -1886,9 +1896,15 @@ lpfc_cmpl_els_acc(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
                         mempool_free( mbox, phba->mbox_mem_pool);
                 } else {
                         mempool_free( mbox, phba->mbox_mem_pool);
-                        if (ndlp->nlp_flag & NLP_ACC_REGLOGIN) {
-                                lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
-                                ndlp = NULL;
+                        /* Do not call NO_LIST for lpfc_els_abort'ed ELS cmds */
+                        if (!((irsp->ulpStatus == IOSTAT_LOCAL_REJECT) &&
+                              ((irsp->un.ulpWord[4] == IOERR_SLI_ABORTED) ||
+                               (irsp->un.ulpWord[4] == IOERR_LINK_DOWN) ||
+                               (irsp->un.ulpWord[4] == IOERR_SLI_DOWN)))) {
+                                if (ndlp->nlp_flag & NLP_ACC_REGLOGIN) {
+                                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
+                                        ndlp = NULL;
+                                }
                         }
                 }
         }
@@ -2791,8 +2807,8 @@ lpfc_els_rsp_rps_acc(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 
         ndlp = (struct lpfc_nodelist *) pmb->context2;
         xri = (uint16_t) ((unsigned long)(pmb->context1));
-        pmb->context1 = 0;
-        pmb->context2 = 0;
+        pmb->context1 = NULL;
+        pmb->context2 = NULL;
 
         if (mb->mbxStatus) {
                 mempool_free( pmb, phba->mbox_mem_pool);
@@ -2832,7 +2848,7 @@ lpfc_els_rsp_rps_acc(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmb)
 
         /* Xmit ELS RPS ACC response tag <ulpIoTag> */
         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
-                        "%d:0128 Xmit ELS RPS ACC response tag x%x "
+                        "%d:0118 Xmit ELS RPS ACC response tag x%x "
                         "Data: x%x x%x x%x x%x x%x\n",
                         phba->brd_no,
                         elsiocb->iocb.ulpIoTag,
@@ -2941,7 +2957,7 @@ lpfc_els_rsp_rpl_acc(struct lpfc_hba * phba, uint16_t cmdsize,
 
         /* Xmit ELS RPL ACC response tag <ulpIoTag> */
         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
-                        "%d:0128 Xmit ELS RPL ACC response tag x%x "
+                        "%d:0120 Xmit ELS RPL ACC response tag x%x "
                         "Data: x%x x%x x%x x%x x%x\n",
                         phba->brd_no,
                         elsiocb->iocb.ulpIoTag,
@@ -3102,7 +3118,7 @@ lpfc_els_rcv_fan(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
         struct lpfc_nodelist *ndlp, *next_ndlp;
 
         /* FAN received */
-        lpfc_printf_log(phba, KERN_INFO, LOG_ELS, "%d:265 FAN received\n",
+        lpfc_printf_log(phba, KERN_INFO, LOG_ELS, "%d:0265 FAN received\n",
                                                                 phba->brd_no);
 
         icmd = &cmdiocb->iocb;
@@ -3282,10 +3298,9 @@ lpfc_els_timeout_handler(struct lpfc_hba *phba)
                 } else
                         lpfc_sli_release_iocbq(phba, piocb);
         }
-        if (phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt) {
-                phba->els_tmofunc.expires = jiffies + HZ * timeout;
-                add_timer(&phba->els_tmofunc);
-        }
+        if (phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt)
+                mod_timer(&phba->els_tmofunc, jiffies + HZ * timeout);
+
         spin_unlock_irq(phba->host->host_lock);
 }
 
@@ -3442,6 +3457,8 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                 if ((did & Fabric_DID_MASK) == Fabric_DID_MASK) {
                         ndlp->nlp_type |= NLP_FABRIC;
                 }
+                ndlp->nlp_state = NLP_STE_UNUSED_NODE;
+                lpfc_nlp_list(phba, ndlp, NLP_UNUSED_LIST);
         }
 
         phba->fc_stat.elsRcvFrame++;
@@ -3463,13 +3480,14 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                         rjt_err = 1;
                         break;
                 }
+                ndlp = lpfc_plogi_confirm_nport(phba, mp, ndlp);
                 lpfc_disc_state_machine(phba, ndlp, elsiocb, NLP_EVT_RCV_PLOGI);
                 break;
         case ELS_CMD_FLOGI:
                 phba->fc_stat.elsRcvFLOGI++;
                 lpfc_els_rcv_flogi(phba, elsiocb, ndlp, newnode);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         case ELS_CMD_LOGO:
@@ -3492,7 +3510,7 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                 phba->fc_stat.elsRcvRSCN++;
                 lpfc_els_rcv_rscn(phba, elsiocb, ndlp, newnode);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         case ELS_CMD_ADISC:
@@ -3535,28 +3553,28 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                 phba->fc_stat.elsRcvLIRR++;
                 lpfc_els_rcv_lirr(phba, elsiocb, ndlp);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         case ELS_CMD_RPS:
                 phba->fc_stat.elsRcvRPS++;
                 lpfc_els_rcv_rps(phba, elsiocb, ndlp);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         case ELS_CMD_RPL:
                 phba->fc_stat.elsRcvRPL++;
                 lpfc_els_rcv_rpl(phba, elsiocb, ndlp);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         case ELS_CMD_RNID:
                 phba->fc_stat.elsRcvRNID++;
                 lpfc_els_rcv_rnid(phba, elsiocb, ndlp);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         default:
@@ -3568,7 +3586,7 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                                 "%d:0115 Unknown ELS command x%x received from "
                                 "NPORT x%x\n", phba->brd_no, cmd, did);
                 if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                 }
                 break;
         }
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index adb086009ae0..b2f1552f1848 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -1084,7 +1084,7 @@ lpfc_register_remote_port(struct lpfc_hba * phba,
                 fc_remote_port_rolechg(rport, rport_ids.roles);
 
         if ((rport->scsi_target_id != -1) &&
-                (rport->scsi_target_id < MAX_FCP_TARGET)) {
+                (rport->scsi_target_id < LPFC_MAX_TARGET)) {
                 ndlp->nlp_sid = rport->scsi_target_id;
         }
 
@@ -1313,7 +1313,7 @@ lpfc_nlp_list(struct lpfc_hba * phba, struct lpfc_nodelist * nlp, int list)
                         if ((rport_add == mapped) &&
                             ((!nlp->rport) ||
                              (nlp->rport->scsi_target_id == -1) ||
-                             (nlp->rport->scsi_target_id >= MAX_FCP_TARGET))) {
+                             (nlp->rport->scsi_target_id >= LPFC_MAX_TARGET))) {
                                 nlp->nlp_state = NLP_STE_UNMAPPED_NODE;
                                 spin_lock_irq(phba->host->host_lock);
                                 nlp->nlp_flag |= NLP_TGT_NO_SCSIID;
@@ -1557,6 +1557,8 @@ lpfc_freenode(struct lpfc_hba * phba, struct lpfc_nodelist * ndlp)
                         mb->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
                 }
         }
+
+        spin_lock_irq(phba->host->host_lock);
         list_for_each_entry_safe(mb, nextmb, &phba->sli.mboxq, list) {
                 if ((mb->mb.mbxCommand == MBX_REG_LOGIN64) &&
                    (ndlp == (struct lpfc_nodelist *) mb->context2)) {
@@ -1569,6 +1571,7 @@ lpfc_freenode(struct lpfc_hba * phba, struct lpfc_nodelist * ndlp)
                         mempool_free(mb, phba->mbox_mem_pool);
                 }
         }
+        spin_unlock_irq(phba->host->host_lock);
 
         lpfc_els_abort(phba,ndlp,0);
         spin_lock_irq(phba->host->host_lock);
@@ -1782,7 +1785,7 @@ lpfc_findnode_did(struct lpfc_hba * phba, uint32_t order, uint32_t did)
                                 /* LOG change to REGLOGIN */
                                 /* FIND node DID reglogin */
                                 lpfc_printf_log(phba, KERN_INFO, LOG_NODE,
-                                                "%d:0931 FIND node DID reglogin"
+                                                "%d:0901 FIND node DID reglogin"
                                                 " Data: x%p x%x x%x x%x\n",
                                                 phba->brd_no,
                                                 ndlp, ndlp->nlp_DID,
@@ -1805,7 +1808,7 @@ lpfc_findnode_did(struct lpfc_hba * phba, uint32_t order, uint32_t did)
                                 /* LOG change to PRLI */
                                 /* FIND node DID prli */
                                 lpfc_printf_log(phba, KERN_INFO, LOG_NODE,
-                                                "%d:0931 FIND node DID prli "
+                                                "%d:0902 FIND node DID prli "
                                                 "Data: x%p x%x x%x x%x\n",
                                                 phba->brd_no,
                                                 ndlp, ndlp->nlp_DID,
@@ -1828,7 +1831,7 @@ lpfc_findnode_did(struct lpfc_hba * phba, uint32_t order, uint32_t did)
                                 /* LOG change to NPR */
                                 /* FIND node DID npr */
                                 lpfc_printf_log(phba, KERN_INFO, LOG_NODE,
-                                                "%d:0931 FIND node DID npr "
+                                                "%d:0903 FIND node DID npr "
                                                 "Data: x%p x%x x%x x%x\n",
                                                 phba->brd_no,
                                                 ndlp, ndlp->nlp_DID,
@@ -1851,7 +1854,7 @@ lpfc_findnode_did(struct lpfc_hba * phba, uint32_t order, uint32_t did)
                                 /* LOG change to UNUSED */
                                 /* FIND node DID unused */
                                 lpfc_printf_log(phba, KERN_INFO, LOG_NODE,
-                                                "%d:0931 FIND node DID unused "
+                                                "%d:0905 FIND node DID unused "
                                                 "Data: x%p x%x x%x x%x\n",
                                                 phba->brd_no,
                                                 ndlp, ndlp->nlp_DID,
@@ -2335,7 +2338,7 @@ lpfc_disc_timeout_handler(struct lpfc_hba *phba)
                 initlinkmbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
                 if (!initlinkmbox) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_DISCOVERY,
-                                        "%d:0226 Device Discovery "
+                                        "%d:0206 Device Discovery "
                                         "completion error\n",
                                         phba->brd_no);
                         phba->hba_state = LPFC_HBA_ERROR;
@@ -2365,7 +2368,7 @@ lpfc_disc_timeout_handler(struct lpfc_hba *phba)
                 if (!clearlambox) {
                         clrlaerr = 1;
                         lpfc_printf_log(phba, KERN_ERR, LOG_DISCOVERY,
-                                        "%d:0226 Device Discovery "
+                                        "%d:0207 Device Discovery "
                                         "completion error\n",
                                         phba->brd_no);
                         phba->hba_state = LPFC_HBA_ERROR;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 5a28d9bf8e4d..f6948ffe689a 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -71,6 +71,7 @@ lpfc_config_port_prep(struct lpfc_hba * phba)
         uint16_t offset = 0;
         static char licensed[56] =
                     "key unlock for use with gnu public licensed code only\0";
+        static int init_key = 1;
 
         pmb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
         if (!pmb) {
@@ -82,10 +83,13 @@ lpfc_config_port_prep(struct lpfc_hba * phba)
         phba->hba_state = LPFC_INIT_MBX_CMDS;
 
         if (lpfc_is_LC_HBA(phba->pcidev->device)) {
-                uint32_t *ptext = (uint32_t *) licensed;
+                if (init_key) {
+                        uint32_t *ptext = (uint32_t *) licensed;
 
-                for (i = 0; i < 56; i += sizeof (uint32_t), ptext++)
-                        *ptext = cpu_to_be32(*ptext);
+                        for (i = 0; i < 56; i += sizeof (uint32_t), ptext++)
+                                *ptext = cpu_to_be32(*ptext);
+                        init_key = 0;
+                }
 
                 lpfc_read_nv(phba, pmb);
                 memset((char*)mb->un.varRDnvp.rsvd3, 0,
@@ -405,19 +409,26 @@ lpfc_config_port_post(struct lpfc_hba * phba)
         }
         /* MBOX buffer will be freed in mbox compl */
 
-        i = 0;
+        return (0);
+}
+
+static int
+lpfc_discovery_wait(struct lpfc_hba *phba)
+{
+        int i = 0;
+
         while ((phba->hba_state != LPFC_HBA_READY) ||
                (phba->num_disc_nodes) || (phba->fc_prli_sent) ||
                ((phba->fc_map_cnt == 0) && (i<2)) ||
-               (psli->sli_flag & LPFC_SLI_MBOX_ACTIVE)) {
+               (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE)) {
                 /* Check every second for 30 retries. */
                 i++;
                 if (i > 30) {
-                        break;
+                        return -ETIMEDOUT;
                 }
                 if ((i >= 15) && (phba->hba_state <= LPFC_LINK_DOWN)) {
                         /* The link is down.  Set linkdown timeout */
-                        break;
+                        return -ETIMEDOUT;
                 }
 
                 /* Delay for 1 second to give discovery time to complete. */
@@ -425,12 +436,7 @@ lpfc_config_port_post(struct lpfc_hba * phba)
 
         }
 
-        /* Since num_disc_nodes keys off of PLOGI, delay a bit to let
-         * any potential PRLIs to flush thru the SLI sub-system.
-         */
-        msleep(50);
-
-        return (0);
+        return 0;
 }
 
 /************************************************************************/
@@ -939,12 +945,12 @@ lpfc_get_hba_model_desc(struct lpfc_hba * phba, uint8_t * mdp, uint8_t * descp)
                                         "10-port ", "PCIe"};
                         break;
                 default:
-                        m = (typeof(m)){ 0 };
+                        m = (typeof(m)){ NULL };
                         break;
                 }
                 break;
         default:
-                m = (typeof(m)){ 0 };
+                m = (typeof(m)){ NULL };
                 break;
         }
 
@@ -1339,7 +1345,8 @@ lpfc_offline(struct lpfc_hba * phba)
         struct lpfc_sli_ring *pring;
         struct lpfc_sli *psli;
         unsigned long iflag;
-        int i = 0;
+        int i;
+        int cnt = 0;
 
         if (!phba)
                 return 0;
@@ -1348,20 +1355,31 @@ lpfc_offline(struct lpfc_hba * phba)
                 return 0;
 
         psli = &phba->sli;
-        pring = &psli->ring[psli->fcp_ring];
 
         lpfc_linkdown(phba);
+        lpfc_sli_flush_mbox_queue(phba);
 
-        /* The linkdown event takes 30 seconds to timeout. */
-        while (pring->txcmplq_cnt) {
-                mdelay(10);
-                if (i++ > 3000)
-                        break;
+        for (i = 0; i < psli->num_rings; i++) {
+                pring = &psli->ring[i];
+                /* The linkdown event takes 30 seconds to timeout. */
+                while (pring->txcmplq_cnt) {
+                        mdelay(10);
+                        if (cnt++ > 3000) {
+                                lpfc_printf_log(phba,
+                                        KERN_WARNING, LOG_INIT,
+                                        "%d:0466 Outstanding IO when "
+                                        "bringing Adapter offline\n",
+                                        phba->brd_no);
+                                break;
+                        }
+                }
         }
 
+
         /* stop all timers associated with this hba */
         lpfc_stop_timer(phba);
         phba->work_hba_events = 0;
+        phba->work_ha = 0;
 
         lpfc_printf_log(phba,
                        KERN_WARNING,
@@ -1451,7 +1469,6 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_put_host;
 
         host->unique_id = phba->brd_no;
-        init_MUTEX(&phba->hba_can_block);
         INIT_LIST_HEAD(&phba->ctrspbuflist);
         INIT_LIST_HEAD(&phba->rnidrspbuflist);
         INIT_LIST_HEAD(&phba->freebufList);
@@ -1600,7 +1617,11 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_free_iocbq;
         }
 
-        /* We can rely on a queue depth attribute only after SLI HBA setup */
+        /*
+         * Set initial can_queue value since 0 is no longer supported and
+         * scsi_add_host will fail. This will be adjusted later based on the
+         * max xri value determined in hba setup.
+         */
         host->can_queue = phba->cfg_hba_queue_depth - 10;
 
         /* Tell the midlayer we support 16 byte commands */
@@ -1640,6 +1661,14 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_free_irq;
         }
 
+        /*
+         * hba setup may have changed the hba_queue_depth so we need to adjust
+         * the value of can_queue.
+         */
+        host->can_queue = phba->cfg_hba_queue_depth - 10;
+
+        lpfc_discovery_wait(phba);
+
         if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
                 spin_lock_irq(phba->host->host_lock);
                 lpfc_poll_start_timer(phba);
diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index e42f22aaf71b..4d016c2a1b26 100644
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -651,3 +651,19 @@ lpfc_mbox_get(struct lpfc_hba * phba)
 
         return mbq;
 }
+
+int
+lpfc_mbox_tmo_val(struct lpfc_hba *phba, int cmd)
+{
+        switch (cmd) {
+        case MBX_WRITE_NV:      /* 0x03 */
+        case MBX_UPDATE_CFG:    /* 0x1B */
+        case MBX_DOWN_LOAD:     /* 0x1C */
+        case MBX_DEL_LD_ENTRY:  /* 0x1D */
+        case MBX_LOAD_AREA:     /* 0x81 */
+        case MBX_FLASH_WR_ULA:  /* 0x98 */
+        case MBX_LOAD_EXP_ROM:  /* 0x9C */
+                return LPFC_MBOX_TMO_FLASH_CMD;
+        }
+        return LPFC_MBOX_TMO;
+}
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 07017658ac56..066292d3995a 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -133,6 +133,11 @@ lpfc_mem_free(struct lpfc_hba * phba)
 
         pci_pool_destroy(phba->lpfc_scsi_dma_buf_pool);
         pci_pool_destroy(phba->lpfc_mbuf_pool);
+
+        /* Free the iocb lookup array */
+        kfree(psli->iocbq_lookup);
+        psli->iocbq_lookup = NULL;
+
 }
 
 void *
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 27d60ad897cd..20449a8dd53d 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -179,7 +179,7 @@ lpfc_els_abort(struct lpfc_hba * phba, struct lpfc_nodelist * ndlp,
 
         /* Abort outstanding I/O on NPort <nlp_DID> */
         lpfc_printf_log(phba, KERN_INFO, LOG_DISCOVERY,
-                        "%d:0201 Abort outstanding I/O on NPort x%x "
+                        "%d:0205 Abort outstanding I/O on NPort x%x "
                         "Data: x%x x%x x%x\n",
                         phba->brd_no, ndlp->nlp_DID, ndlp->nlp_flag,
                         ndlp->nlp_state, ndlp->nlp_rpi);
@@ -393,6 +393,20 @@ lpfc_rcv_plogi(struct lpfc_hba * phba,
         mbox->context2  = ndlp;
         ndlp->nlp_flag |= (NLP_ACC_REGLOGIN | NLP_RCV_PLOGI);
 
+        /*
+         * If there is an outstanding PLOGI issued, abort it before
+         * sending ACC rsp for received PLOGI. If pending plogi
+         * is not canceled here, the plogi will be rejected by
+         * remote port and will be retried. On a configuration with
+         * single discovery thread, this will cause a huge delay in
+         * discovery. Also this will cause multiple state machines
+         * running in parallel for this node.
+         */
+        if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) {
+                /* software abort outstanding PLOGI */
+                lpfc_els_abort(phba, ndlp, 1);
+        }
+
         lpfc_els_rsp_acc(phba, ELS_CMD_PLOGI, cmdiocb, ndlp, mbox, 0);
         return 1;
 
@@ -1110,6 +1124,17 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_hba * phba,
                                 phba->brd_no,
                                 did, mb->mbxStatus, phba->hba_state);
 
+                /*
+                 * If RegLogin failed due to lack of HBA resources do not
+                 * retry discovery.
+                 */
+                if (mb->mbxStatus == MBXERR_RPI_FULL) {
+                        ndlp->nlp_prev_state = NLP_STE_UNUSED_NODE;
+                        ndlp->nlp_state = NLP_STE_UNUSED_NODE;
+                        lpfc_nlp_list(phba, ndlp, NLP_UNUSED_LIST);
+                        return ndlp->nlp_state;
+                }
+
                 /* Put ndlp in npr list set plogi timer for 1 sec */
                 mod_timer(&ndlp->nlp_delayfunc, jiffies + HZ * 1);
                 spin_lock_irq(phba->host->host_lock);
@@ -1590,7 +1615,13 @@ lpfc_rcv_padisc_npr_node(struct lpfc_hba * phba,
 
         lpfc_rcv_padisc(phba, ndlp, cmdiocb);
 
-        if (!(ndlp->nlp_flag & NLP_DELAY_TMO)) {
+        /*
+         * Do not start discovery if discovery is about to start
+         * or discovery in progress for this node. Starting discovery
+         * here will affect the counting of discovery threads.
+         */
+        if ((!(ndlp->nlp_flag & NLP_DELAY_TMO)) &&
+                (ndlp->nlp_flag & NLP_NPR_2B_DISC)){
                 if (ndlp->nlp_flag & NLP_NPR_ADISC) {
                         ndlp->nlp_prev_state = NLP_STE_NPR_NODE;
                         ndlp->nlp_state = NLP_STE_ADISC_ISSUE;
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 7dc4c2e6bed2..a8816a8738f8 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -21,6 +21,7 @@
 
 #include <linux/pci.h>
 #include <linux/interrupt.h>
+#include <linux/delay.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
@@ -41,20 +42,6 @@
 #define LPFC_ABORT_WAIT  2
 
 
-static inline void
-lpfc_block_requests(struct lpfc_hba * phba)
-{
-        down(&phba->hba_can_block);
-        scsi_block_requests(phba->host);
-}
-
-static inline void
-lpfc_unblock_requests(struct lpfc_hba * phba)
-{
-        scsi_unblock_requests(phba->host);
-        up(&phba->hba_can_block);
-}
-
 /*
  * This routine allocates a scsi buffer, which contains all the necessary
  * information needed to initiate a SCSI I/O.  The non-DMAable buffer region
@@ -167,22 +154,6 @@ static void
 lpfc_release_scsi_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
 {
         unsigned long iflag = 0;
-        /*
-         * There are only two special cases to consider.  (1) the scsi command
-         * requested scatter-gather usage or (2) the scsi command allocated
-         * a request buffer, but did not request use_sg.  There is a third
-         * case, but it does not require resource deallocation.
-         */
-        if ((psb->seg_cnt > 0) && (psb->pCmd->use_sg)) {
-                dma_unmap_sg(&phba->pcidev->dev, psb->pCmd->request_buffer,
-                                psb->seg_cnt, psb->pCmd->sc_data_direction);
-        } else {
-                 if ((psb->nonsg_phys) && (psb->pCmd->request_bufflen)) {
-                        dma_unmap_single(&phba->pcidev->dev, psb->nonsg_phys,
-                                                psb->pCmd->request_bufflen,
-                                                psb->pCmd->sc_data_direction);
-                 }
-        }
 
         spin_lock_irqsave(&phba->scsi_buf_list_lock, iflag);
         psb->pCmd = NULL;
@@ -296,6 +267,27 @@ lpfc_scsi_prep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * lpfc_cmd)
 }
 
 static void
+lpfc_scsi_unprep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
+{
+        /*
+         * There are only two special cases to consider.  (1) the scsi command
+         * requested scatter-gather usage or (2) the scsi command allocated
+         * a request buffer, but did not request use_sg.  There is a third
+         * case, but it does not require resource deallocation.
+         */
+        if ((psb->seg_cnt > 0) && (psb->pCmd->use_sg)) {
+                dma_unmap_sg(&phba->pcidev->dev, psb->pCmd->request_buffer,
+                                psb->seg_cnt, psb->pCmd->sc_data_direction);
+        } else {
+                 if ((psb->nonsg_phys) && (psb->pCmd->request_bufflen)) {
+                        dma_unmap_single(&phba->pcidev->dev, psb->nonsg_phys,
+                                                psb->pCmd->request_bufflen,
+                                                psb->pCmd->sc_data_direction);
+                 }
+        }
+}
+
+static void
 lpfc_handle_fcp_err(struct lpfc_scsi_buf *lpfc_cmd)
 {
         struct scsi_cmnd *cmnd = lpfc_cmd->pCmd;
@@ -468,6 +460,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
         cmd->scsi_done(cmd);
 
         if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
+                lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
                 lpfc_release_scsi_buf(phba, lpfc_cmd);
                 return;
         }
@@ -525,6 +518,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
                 }
         }
 
+        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
         lpfc_release_scsi_buf(phba, lpfc_cmd);
 }
 
@@ -623,6 +617,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_hba * phba, struct lpfc_scsi_buf * lpfc_cmd,
 static int
 lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
                              struct lpfc_scsi_buf *lpfc_cmd,
+                             unsigned int lun,
                              uint8_t task_mgmt_cmd)
 {
         struct lpfc_sli *psli;
@@ -641,8 +636,7 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
         piocb = &piocbq->iocb;
 
         fcp_cmnd = lpfc_cmd->fcp_cmnd;
-        int_to_scsilun(lpfc_cmd->pCmd->device->lun,
-                        &lpfc_cmd->fcp_cmnd->fcp_lun);
+        int_to_scsilun(lun, &lpfc_cmd->fcp_cmnd->fcp_lun);
         fcp_cmnd->fcpCntl2 = task_mgmt_cmd;
 
         piocb->ulpCommand = CMD_FCP_ICMND64_CR;
@@ -669,14 +663,16 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
 
 static int
 lpfc_scsi_tgt_reset(struct lpfc_scsi_buf * lpfc_cmd, struct lpfc_hba * phba,
-                    unsigned  tgt_id, struct lpfc_rport_data *rdata)
+                    unsigned  tgt_id, unsigned int lun,
+                    struct lpfc_rport_data *rdata)
 {
         struct lpfc_iocbq *iocbq;
         struct lpfc_iocbq *iocbqrsp;
         int ret;
 
         lpfc_cmd->rdata = rdata;
-        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, FCP_TARGET_RESET);
+        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, lun,
+                                           FCP_TARGET_RESET);
         if (!ret)
                 return FAILED;
 
@@ -836,6 +832,7 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
         return 0;
 
  out_host_busy_free_buf:
+        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
         lpfc_release_scsi_buf(phba, lpfc_cmd);
  out_host_busy:
         return SCSI_MLQUEUE_HOST_BUSY;
@@ -845,6 +842,21 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
         return 0;
 }
 
+static void
+lpfc_block_error_handler(struct scsi_cmnd *cmnd)
+{
+        struct Scsi_Host *shost = cmnd->device->host;
+        struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
+
+        spin_lock_irq(shost->host_lock);
+        while (rport->port_state == FC_PORTSTATE_BLOCKED) {
+                spin_unlock_irq(shost->host_lock);
+                msleep(1000);
+                spin_lock_irq(shost->host_lock);
+        }
+        spin_unlock_irq(shost->host_lock);
+        return;
+}
 
 static int
 lpfc_abort_handler(struct scsi_cmnd *cmnd)
@@ -859,7 +871,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
         unsigned int loop_count = 0;
         int ret = SUCCESS;
 
-        lpfc_block_requests(phba);
+        lpfc_block_error_handler(cmnd);
         spin_lock_irq(shost->host_lock);
 
         lpfc_cmd = (struct lpfc_scsi_buf *)cmnd->host_scribble;
@@ -945,7 +957,6 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
                         cmnd->device->lun, cmnd->serial_number);
 
         spin_unlock_irq(shost->host_lock);
-        lpfc_unblock_requests(phba);
 
         return ret;
 }
@@ -963,7 +974,7 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
         int ret = FAILED;
         int cnt, loopcnt;
 
-        lpfc_block_requests(phba);
+        lpfc_block_error_handler(cmnd);
         spin_lock_irq(shost->host_lock);
         /*
          * If target is not in a MAPPED state, delay the reset until
@@ -986,12 +997,12 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
         if (lpfc_cmd == NULL)
                 goto out;
 
-        lpfc_cmd->pCmd = cmnd;
         lpfc_cmd->timeout = 60;
         lpfc_cmd->scsi_hba = phba;
         lpfc_cmd->rdata = rdata;
 
-        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, FCP_LUN_RESET);
+        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, cmnd->device->lun,
+                                           FCP_LUN_RESET);
         if (!ret)
                 goto out_free_scsi_buf;
 
@@ -1018,7 +1029,6 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
         cmd_status = iocbqrsp->iocb.ulpStatus;
 
         lpfc_sli_release_iocbq(phba, iocbqrsp);
-        lpfc_release_scsi_buf(phba, lpfc_cmd);
 
         /*
          * All outstanding txcmplq I/Os should have been aborted by the device.
@@ -1057,6 +1067,8 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
         }
 
 out_free_scsi_buf:
+        lpfc_release_scsi_buf(phba, lpfc_cmd);
+
         lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
                         "%d:0713 SCSI layer issued LUN reset (%d, %d) "
                         "Data: x%x x%x x%x\n",
@@ -1065,7 +1077,6 @@ out_free_scsi_buf:
 
 out:
         spin_unlock_irq(shost->host_lock);
-        lpfc_unblock_requests(phba);
         return ret;
 }
 
@@ -1080,7 +1091,7 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
         int cnt, loopcnt;
         struct lpfc_scsi_buf * lpfc_cmd;
 
-        lpfc_block_requests(phba);
+        lpfc_block_error_handler(cmnd);
         spin_lock_irq(shost->host_lock);
 
         lpfc_cmd = lpfc_get_scsi_buf(phba);
@@ -1089,7 +1100,6 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
 
         /* The lpfc_cmd storage is reused.  Set all loop invariants. */
         lpfc_cmd->timeout = 60;
-        lpfc_cmd->pCmd = cmnd;
         lpfc_cmd->scsi_hba = phba;
 
         /*
@@ -1097,7 +1107,7 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
          * targets known to the driver.  Should any target reset
          * fail, this routine returns failure to the midlayer.
          */
-        for (i = 0; i < MAX_FCP_TARGET; i++) {
+        for (i = 0; i < LPFC_MAX_TARGET; i++) {
                 /* Search the mapped list for this target ID */
                 match = 0;
                 list_for_each_entry(ndlp, &phba->fc_nlpmap_list, nlp_listp) {
@@ -1109,11 +1119,11 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
                 if (!match)
                         continue;
 
-                ret = lpfc_scsi_tgt_reset(lpfc_cmd, phba,
-                                          i, ndlp->rport->dd_data);
+                ret = lpfc_scsi_tgt_reset(lpfc_cmd, phba, i, cmnd->device->lun,
+                                          ndlp->rport->dd_data);
                 if (ret != SUCCESS) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
-                                "%d:0713 Bus Reset on target %d failed\n",
+                                "%d:0700 Bus Reset on target %d failed\n",
                                 phba->brd_no, i);
                         err_count++;
                 }
@@ -1163,7 +1173,6 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
                         phba->brd_no, ret);
 out:
         spin_unlock_irq(shost->host_lock);
-        lpfc_unblock_requests(phba);
         return ret;
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index bb69a7a1ec59..70f4d5a1348e 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -191,35 +191,12 @@ static int
 lpfc_sli_ringtxcmpl_put(struct lpfc_hba * phba,
                         struct lpfc_sli_ring * pring, struct lpfc_iocbq * piocb)
 {
-        uint16_t iotag;
-
         list_add_tail(&piocb->list, &pring->txcmplq);
         pring->txcmplq_cnt++;
         if (unlikely(pring->ringno == LPFC_ELS_RING))
                 mod_timer(&phba->els_tmofunc,
                                         jiffies + HZ * (phba->fc_ratov << 1));
 
-        if (pring->fast_lookup) {
-                /* Setup fast lookup based on iotag for completion */
-                iotag = piocb->iocb.ulpIoTag;
-                if (iotag && (iotag < pring->fast_iotag))
-                        *(pring->fast_lookup + iotag) = piocb;
-                else {
-
-                        /* Cmd ring <ringno> put: iotag <iotag> greater then
-                           configured max <fast_iotag> wd0 <icmd> */
-                        lpfc_printf_log(phba,
-                                        KERN_ERR,
-                                        LOG_SLI,
-                                        "%d:0316 Cmd ring %d put: iotag x%x "
-                                        "greater then configured max x%x "
-                                        "wd0 x%x\n",
-                                        phba->brd_no,
-                                        pring->ringno, iotag,
-                                        pring->fast_iotag,
-                                        *(((uint32_t *)(&piocb->iocb)) + 7));
-                }
-        }
         return (0);
 }
 
@@ -343,7 +320,8 @@ lpfc_sli_next_iotag(struct lpfc_hba * phba, struct lpfc_iocbq * iocbq)
                         kfree(old_arr);
                         return iotag;
                 }
-        }
+        } else
+                spin_unlock_irq(phba->host->host_lock);
 
         lpfc_printf_log(phba, KERN_ERR,LOG_SLI,
                         "%d:0318 Failed to allocate IOTAG.last IOTAG is %d\n",
@@ -601,7 +579,7 @@ lpfc_sli_handle_mb_event(struct lpfc_hba * phba)
                         /* Stray Mailbox Interrupt, mbxCommand <cmd> mbxStatus
                            <status> */
                         lpfc_printf_log(phba,
-                                        KERN_ERR,
+                                        KERN_WARNING,
                                         LOG_MBOX | LOG_SLI,
                                         "%d:0304 Stray Mailbox Interrupt "
                                         "mbxCommand x%x mbxStatus x%x\n",
@@ -992,9 +970,11 @@ void lpfc_sli_poll_fcp_ring(struct lpfc_hba * phba)
                          * resources need to be recovered.
                          */
                         if (unlikely(irsp->ulpCommand == CMD_XRI_ABORTED_CX)) {
-                                printk(KERN_INFO "%s: IOCB cmd 0x%x processed."
-                                       " Skipping completion\n", __FUNCTION__,
-                                       irsp->ulpCommand);
+                                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+                                                "%d:0314 IOCB cmd 0x%x"
+                                                " processed. Skipping"
+                                                " completion", phba->brd_no,
+                                                irsp->ulpCommand);
                                 break;
                         }
 
@@ -1127,7 +1107,7 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba * phba,
                 if (unlikely(irsp->ulpStatus)) {
                         /* Rsp ring <ringno> error: IOCB */
                         lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
-                                "%d:0326 Rsp Ring %d error: IOCB Data: "
+                                "%d:0336 Rsp Ring %d error: IOCB Data: "
                                 "x%x x%x x%x x%x x%x x%x x%x x%x\n",
                                 phba->brd_no, pring->ringno,
                                 irsp->un.ulpWord[0], irsp->un.ulpWord[1],
@@ -1145,9 +1125,11 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba * phba,
                          * resources need to be recovered.
                          */
                         if (unlikely(irsp->ulpCommand == CMD_XRI_ABORTED_CX)) {
-                                printk(KERN_INFO "%s: IOCB cmd 0x%x processed. "
-                                       "Skipping completion\n", __FUNCTION__,
-                                       irsp->ulpCommand);
+                                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+                                                "%d:0333 IOCB cmd 0x%x"
+                                                " processed. Skipping"
+                                                " completion\n", phba->brd_no,
+                                                irsp->ulpCommand);
                                 break;
                         }
 
@@ -1178,7 +1160,7 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba * phba,
                         } else {
                                 /* Unknown IOCB command */
                                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-                                        "%d:0321 Unknown IOCB command "
+                                        "%d:0334 Unknown IOCB command "
                                         "Data: x%x, x%x x%x x%x x%x\n",
                                         phba->brd_no, type, irsp->ulpCommand,
                                         irsp->ulpStatus, irsp->ulpIoTag,
@@ -1261,7 +1243,7 @@ lpfc_sli_handle_slow_ring_event(struct lpfc_hba * phba,
                 lpfc_printf_log(phba,
                                 KERN_ERR,
                                 LOG_SLI,
-                                "%d:0312 Ring %d handler: portRspPut %d "
+                                "%d:0303 Ring %d handler: portRspPut %d "
                                 "is bigger then rsp ring %d\n",
                                 phba->brd_no,
                                 pring->ringno, portRspPut, portRspMax);
@@ -1406,7 +1388,7 @@ lpfc_sli_handle_slow_ring_event(struct lpfc_hba * phba,
                                         lpfc_printf_log(phba,
                                                 KERN_ERR,
                                                 LOG_SLI,
-                                                "%d:0321 Unknown IOCB command "
+                                                "%d:0335 Unknown IOCB command "
                                                 "Data: x%x x%x x%x x%x\n",
                                                 phba->brd_no,
                                                 irsp->ulpCommand,
@@ -1422,11 +1404,11 @@ lpfc_sli_handle_slow_ring_event(struct lpfc_hba * phba,
                                                                  next_iocb,
                                                                  &saveq->list,
                                                                  list) {
+                                                list_del(&rspiocbp->list);
                                                 lpfc_sli_release_iocbq(phba,
                                                                      rspiocbp);
                                         }
                                 }
-
                                 lpfc_sli_release_iocbq(phba, saveq);
                         }
                 }
@@ -1570,8 +1552,8 @@ lpfc_sli_brdready(struct lpfc_hba * phba, uint32_t mask)
 
 void lpfc_reset_barrier(struct lpfc_hba * phba)
 {
-        uint32_t * resp_buf;
-        uint32_t * mbox_buf;
+        uint32_t __iomem *resp_buf;
+        uint32_t __iomem *mbox_buf;
         volatile uint32_t mbox;
         uint32_t hc_copy;
         int  i;
@@ -1587,7 +1569,7 @@ void lpfc_reset_barrier(struct lpfc_hba * phba)
          * Tell the other part of the chip to suspend temporarily all
          * its DMA activity.
          */
-        resp_buf =  (uint32_t *)phba->MBslimaddr;
+        resp_buf = phba->MBslimaddr;
 
         /* Disable the error attention */
         hc_copy = readl(phba->HCregaddr);
@@ -1605,7 +1587,7 @@ void lpfc_reset_barrier(struct lpfc_hba * phba)
         ((MAILBOX_t *)&mbox)->mbxOwner = OWN_CHIP;
 
         writel(BARRIER_TEST_PATTERN, (resp_buf + 1));
-        mbox_buf = (uint32_t *)phba->MBslimaddr;
+        mbox_buf = phba->MBslimaddr;
         writel(mbox, mbox_buf);
 
         for (i = 0;
@@ -1734,15 +1716,13 @@ lpfc_sli_brdreset(struct lpfc_hba * phba)
         phba->fc_myDID = 0;
         phba->fc_prevDID = 0;
 
-        psli->sli_flag = 0;
-
         /* Turn off parity checking and serr during the physical reset */
         pci_read_config_word(phba->pcidev, PCI_COMMAND, &cfg_value);
         pci_write_config_word(phba->pcidev, PCI_COMMAND,
                               (cfg_value &
                                ~(PCI_COMMAND_PARITY | PCI_COMMAND_SERR)));
 
-        psli->sli_flag &= ~LPFC_SLI2_ACTIVE;
+        psli->sli_flag &= ~(LPFC_SLI2_ACTIVE | LPFC_PROCESS_LA);
         /* Now toggle INITFF bit in the Host Control Register */
         writel(HC_INITFF, phba->HCregaddr);
         mdelay(1);
@@ -1783,7 +1763,7 @@ lpfc_sli_brdrestart(struct lpfc_hba * phba)
 
         /* Restart HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-                        "%d:0328 Restart HBA Data: x%x x%x\n", phba->brd_no,
+                        "%d:0337 Restart HBA Data: x%x x%x\n", phba->brd_no,
                         phba->hba_state, psli->sli_flag);
 
         word0 = 0;
@@ -1805,7 +1785,7 @@ lpfc_sli_brdrestart(struct lpfc_hba * phba)
                 skip_post = 0;
                 word0 = 0;      /* This is really setting up word1 */
         }
-        to_slim = (uint8_t *) phba->MBslimaddr + sizeof (uint32_t);
+        to_slim = phba->MBslimaddr + sizeof (uint32_t);
         writel(*(uint32_t *) mb, to_slim);
         readl(to_slim); /* flush */
 
@@ -1815,6 +1795,9 @@ lpfc_sli_brdrestart(struct lpfc_hba * phba)
 
         spin_unlock_irq(phba->host->host_lock);
 
+        memset(&psli->lnk_stat_offsets, 0, sizeof(psli->lnk_stat_offsets));
+        psli->stats_start = get_seconds();
+
         if (skip_post)
                 mdelay(100);
         else
@@ -1925,6 +1908,9 @@ lpfc_sli_hba_setup(struct lpfc_hba * phba)
         }
 
         while (resetcount < 2 && !done) {
+                spin_lock_irq(phba->host->host_lock);
+                phba->sli.sli_flag |= LPFC_SLI_MBOX_ACTIVE;
+                spin_unlock_irq(phba->host->host_lock);
                 phba->hba_state = LPFC_STATE_UNKNOWN;
                 lpfc_sli_brdrestart(phba);
                 msleep(2500);
@@ -1932,6 +1918,9 @@ lpfc_sli_hba_setup(struct lpfc_hba * phba)
                 if (rc)
                         break;
 
+                spin_lock_irq(phba->host->host_lock);
+                phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE;
+                spin_unlock_irq(phba->host->host_lock);
                 resetcount++;
 
         /* Call pre CONFIG_PORT mailbox command initialization.  A value of 0
@@ -2217,7 +2206,8 @@ lpfc_sli_issue_mbox(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmbox, uint32_t flag)
                         return (MBX_NOT_FINISHED);
                 }
                 /* timeout active mbox command */
-                mod_timer(&psli->mbox_tmo, jiffies + HZ * LPFC_MBOX_TMO);
+                mod_timer(&psli->mbox_tmo, (jiffies +
+                               (HZ * lpfc_mbox_tmo_val(phba, mb->mbxCommand))));
         }
 
         /* Mailbox cmd <cmd> issue */
@@ -2277,7 +2267,6 @@ lpfc_sli_issue_mbox(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmbox, uint32_t flag)
                 break;
 
         case MBX_POLL:
-                i = 0;
                 psli->mbox_active = NULL;
                 if (psli->sli_flag & LPFC_SLI2_ACTIVE) {
                         /* First read mbox status word */
@@ -2291,11 +2280,14 @@ lpfc_sli_issue_mbox(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmbox, uint32_t flag)
                 /* Read the HBA Host Attention Register */
                 ha_copy = readl(phba->HAregaddr);
 
+                i = lpfc_mbox_tmo_val(phba, mb->mbxCommand);
+                i *= 1000; /* Convert to ms */
+
                 /* Wait for command to complete */
                 while (((word0 & OWN_CHIP) == OWN_CHIP) ||
                        (!(ha_copy & HA_MBATT) &&
                         (phba->hba_state > LPFC_WARM_START))) {
-                        if (i++ >= 100) {
+                        if (i-- <= 0) {
                                 psli->sli_flag &= ~LPFC_SLI_MBOX_ACTIVE;
                                 spin_unlock_irqrestore(phba->host->host_lock,
                                                        drvr_flag);
@@ -2313,7 +2305,7 @@ lpfc_sli_issue_mbox(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmbox, uint32_t flag)
 
                         /* Can be in interrupt context, do not sleep */
                         /* (or might be called with interrupts disabled) */
-                        mdelay(i);
+                        mdelay(1);
 
                         spin_lock_irqsave(phba->host->host_lock, drvr_flag);
 
@@ -2659,8 +2651,6 @@ lpfc_sli_hba_down(struct lpfc_hba * phba)
 
                 INIT_LIST_HEAD(&(pring->txq));
 
-                kfree(pring->fast_lookup);
-                pring->fast_lookup = NULL;
         }
 
         spin_unlock_irqrestore(phba->host->host_lock, flags);
@@ -3030,7 +3020,7 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba * phba,
 
                 if (timeleft == 0) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-                                        "%d:0329 IOCB wait timeout error - no "
+                                        "%d:0338 IOCB wait timeout error - no "
                                         "wake response Data x%x\n",
                                         phba->brd_no, timeout);
                         retval = IOCB_TIMEDOUT;
@@ -3110,6 +3100,24 @@ lpfc_sli_issue_mbox_wait(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq,
         return retval;
 }
 
+int
+lpfc_sli_flush_mbox_queue(struct lpfc_hba * phba)
+{
+        int i = 0;
+
+        while (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE && !phba->stopped) {
+                if (i++ > LPFC_MBOX_TMO * 1000)
+                        return 1;
+
+                if (lpfc_sli_handle_mb_event(phba) == 0)
+                        i = 0;
+
+                msleep(1);
+        }
+
+        return (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE) ? 1 : 0;
+}
+
 irqreturn_t
 lpfc_intr_handler(int irq, void *dev_id, struct pt_regs * regs)
 {
diff --git a/drivers/scsi/lpfc/lpfc_sli.h b/drivers/scsi/lpfc/lpfc_sli.h
index a52d6c6cf083..e26de6809358 100644
--- a/drivers/scsi/lpfc/lpfc_sli.h
+++ b/drivers/scsi/lpfc/lpfc_sli.h
@@ -135,8 +135,6 @@ struct lpfc_sli_ring {
         uint32_t fast_iotag;    /* max fastlookup based iotag           */
         uint32_t iotag_ctr;     /* keeps track of the next iotag to use */
         uint32_t iotag_max;     /* max iotag value to use               */
-        struct lpfc_iocbq ** fast_lookup; /* array of IOCB ptrs indexed by
-                                           iotag */
         struct list_head txq;
         uint16_t txq_cnt;       /* current length of queue */
         uint16_t txq_max;       /* max length */
@@ -174,6 +172,18 @@ struct lpfc_sli_stat {
         uint32_t mbox_busy;      /* Mailbox cmd busy */
 };
 
+/* Structure to store link status values when port stats are reset */
+struct lpfc_lnk_stat {
+        uint32_t link_failure_count;
+        uint32_t loss_of_sync_count;
+        uint32_t loss_of_signal_count;
+        uint32_t prim_seq_protocol_err_count;
+        uint32_t invalid_tx_word_count;
+        uint32_t invalid_crc_count;
+        uint32_t error_frames;
+        uint32_t link_events;
+};
+
 /* Structure used to hold SLI information */
 struct lpfc_sli {
         uint32_t num_rings;
@@ -203,6 +213,8 @@ struct lpfc_sli {
         struct lpfc_iocbq ** iocbq_lookup; /* array to lookup IOCB by IOTAG */
         size_t iocbq_lookup_len;           /* current lengs of the array */
         uint16_t  last_iotag;              /* last allocated IOTAG */
+        unsigned long  stats_start;        /* in seconds */
+        struct lpfc_lnk_stat lnk_stat_offsets;
 };
 
 /* Given a pointer to the start of the ring, and the slot number of
@@ -213,3 +225,9 @@ struct lpfc_sli {
 
 #define LPFC_MBOX_TMO           30      /* Sec tmo for outstanding mbox
                                            command */
+#define LPFC_MBOX_TMO_FLASH_CMD 300     /* Sec tmo for outstanding FLASH write
+                                         * or erase cmds. This is especially
+                                         * long because of the potential of
+                                         * multiple flash erases that can be
+                                         * spawned.
+                                         */
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 6b737568b831..c7091ea29f3f 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -18,7 +18,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "8.1.6"
+#define LPFC_DRIVER_VERSION "8.1.9"
 
 #define LPFC_DRIVER_NAME "lpfc"
 
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 93edaa8696cf..89ef34df5a1d 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -378,7 +378,7 @@ static void set_dma_cmds(struct fsc_state *state, struct scsi_cmnd *cmd)
                 int nseg;
 
                 total = 0;
-                scl = (struct scatterlist *) cmd->buffer;
+                scl = (struct scatterlist *) cmd->request_buffer;
                 nseg = pci_map_sg(state->pdev, scl, cmd->use_sg,
                                 cmd->sc_data_direction);
                 for (i = 0; i < nseg; ++i) {
diff --git a/drivers/scsi/megaraid/mega_common.h b/drivers/scsi/megaraid/mega_common.h
index 4675343228ad..8cd0bd1d0f7c 100644
--- a/drivers/scsi/megaraid/mega_common.h
+++ b/drivers/scsi/megaraid/mega_common.h
@@ -37,6 +37,12 @@
 #define LSI_MAX_CHANNELS                16
 #define LSI_MAX_LOGICAL_DRIVES_64LD     (64+1)
 
+#define HBA_SIGNATURE_64_BIT            0x299
+#define PCI_CONF_AMISIG64               0xa4
+
+#define MEGA_SCSI_INQ_EVPD              1
+#define MEGA_INVALID_FIELD_IN_CDB       0x24
+
 
 /**
  * scb_t - scsi command control block
diff --git a/drivers/scsi/megaraid/megaraid_ioctl.h b/drivers/scsi/megaraid/megaraid_ioctl.h
index bdaee144a1c3..b8aa34202ec3 100644
--- a/drivers/scsi/megaraid/megaraid_ioctl.h
+++ b/drivers/scsi/megaraid/megaraid_ioctl.h
@@ -132,6 +132,10 @@ typedef struct uioc {
 /* Driver Data: */
         void __user *           user_data;
         uint32_t                user_data_len;
+
+        /* 64bit alignment */
+        uint32_t                pad_for_64bit_align;
+
         mraid_passthru_t        __user *user_pthru;
 
         mraid_passthru_t        *pthru32;
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index 92715130ac09..cd982c877da0 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -10,7 +10,7 @@
  *         2 of the License, or (at your option) any later version.
  *
  * FILE         : megaraid_mbox.c
- * Version      : v2.20.4.8 (Apr 11 2006)
+ * Version      : v2.20.4.9 (Jul 16 2006)
  *
  * Authors:
  *      Atul Mukker             <Atul.Mukker@lsil.com>
@@ -720,6 +720,7 @@ megaraid_init_mbox(adapter_t *adapter)
         struct pci_dev          *pdev;
         mraid_device_t          *raid_dev;
         int                     i;
+        uint32_t                magic64;
 
 
         adapter->ito    = MBOX_TIMEOUT;
@@ -863,12 +864,33 @@ megaraid_init_mbox(adapter_t *adapter)
 
         // Set the DMA mask to 64-bit. All supported controllers as capable of
         // DMA in this range
-        if (pci_set_dma_mask(adapter->pdev, DMA_64BIT_MASK) != 0) {
-
-                con_log(CL_ANN, (KERN_WARNING
-                        "megaraid: could not set DMA mask for 64-bit.\n"));
+        pci_read_config_dword(adapter->pdev, PCI_CONF_AMISIG64, &magic64);
+
+        if (((magic64 == HBA_SIGNATURE_64_BIT) &&
+                ((adapter->pdev->subsystem_device !=
+                PCI_SUBSYS_ID_MEGARAID_SATA_150_6) ||
+                (adapter->pdev->subsystem_device !=
+                PCI_SUBSYS_ID_MEGARAID_SATA_150_4))) ||
+                (adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&
+                adapter->pdev->device == PCI_DEVICE_ID_VERDE) ||
+                (adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&
+                adapter->pdev->device == PCI_DEVICE_ID_DOBSON) ||
+                (adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&
+                adapter->pdev->device == PCI_DEVICE_ID_LINDSAY) ||
+                (adapter->pdev->vendor == PCI_VENDOR_ID_DELL &&
+                adapter->pdev->device == PCI_DEVICE_ID_PERC4_DI_EVERGLADES) ||
+                (adapter->pdev->vendor == PCI_VENDOR_ID_DELL &&
+                adapter->pdev->device == PCI_DEVICE_ID_PERC4E_DI_KOBUK)) {
+                if (pci_set_dma_mask(adapter->pdev, DMA_64BIT_MASK)) {
+                        con_log(CL_ANN, (KERN_WARNING
+                                "megaraid: DMA mask for 64-bit failed\n"));
 
-                goto out_free_sysfs_res;
+                        if (pci_set_dma_mask (adapter->pdev, DMA_32BIT_MASK)) {
+                                con_log(CL_ANN, (KERN_WARNING
+                                        "megaraid: 32-bit DMA mask failed\n"));
+                                goto out_free_sysfs_res;
+                        }
+                }
         }
 
         // setup tasklet for DPC
@@ -1622,6 +1644,14 @@ megaraid_mbox_build_cmd(adapter_t *adapter, struct scsi_cmnd *scp, int *busy)
                                 rdev->last_disp |= (1L << SCP2CHANNEL(scp));
                         }
 
+                        if (scp->cmnd[1] & MEGA_SCSI_INQ_EVPD) {
+                                scp->sense_buffer[0] = 0x70;
+                                scp->sense_buffer[2] = ILLEGAL_REQUEST;
+                                scp->sense_buffer[12] = MEGA_INVALID_FIELD_IN_CDB;
+                                scp->result = CHECK_CONDITION << 1;
+                                return NULL;
+                        }
+
                         /* Fall through */
 
                 case READ_CAPACITY:
diff --git a/drivers/scsi/megaraid/megaraid_mbox.h b/drivers/scsi/megaraid/megaraid_mbox.h
index 868fb0ec93e7..2b5a3285f799 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.h
+++ b/drivers/scsi/megaraid/megaraid_mbox.h
@@ -21,8 +21,8 @@
 #include "megaraid_ioctl.h"
 
 
-#define MEGARAID_VERSION        "2.20.4.8"
-#define MEGARAID_EXT_VERSION    "(Release Date: Mon Apr 11 12:27:22 EST 2006)"
+#define MEGARAID_VERSION        "2.20.4.9"
+#define MEGARAID_EXT_VERSION    "(Release Date: Sun Jul 16 12:27:22 EST 2006)"
 
 
 /*
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index e8f534fb336b..d85b9a8f1b8d 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c
@@ -10,7 +10,7 @@
  *         2 of the License, or (at your option) any later version.
  *
  * FILE         : megaraid_mm.c
- * Version      : v2.20.2.6 (Mar 7 2005)
+ * Version      : v2.20.2.7 (Jul 16 2006)
  *
  * Common management module
  */
diff --git a/drivers/scsi/megaraid/megaraid_mm.h b/drivers/scsi/megaraid/megaraid_mm.h
index 3d9e67d6849d..c8762b2b8ed1 100644
--- a/drivers/scsi/megaraid/megaraid_mm.h
+++ b/drivers/scsi/megaraid/megaraid_mm.h
@@ -27,9 +27,9 @@
 #include "megaraid_ioctl.h"
 
 
-#define LSI_COMMON_MOD_VERSION  "2.20.2.6"
+#define LSI_COMMON_MOD_VERSION  "2.20.2.7"
 #define LSI_COMMON_MOD_EXT_VERSION      \
-                "(Release Date: Mon Mar 7 00:01:03 EST 2005)"
+                "(Release Date: Sun Jul 16 00:01:03 EST 2006)"
 
 
 #define LSI_DBGLVL                      dbglevel
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index e5c017ccda59..a8c9627a15c4 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -10,7 +10,7 @@
  *         2 of the License, or (at your option) any later version.
  *
  * FILE         : megaraid_sas.c
- * Version      : v00.00.02.04
+ * Version      : v00.00.03.01
  *
  * Authors:
  *      Sreenivas Bagalkote     <Sreenivas.Bagalkote@lsil.com>
@@ -55,19 +55,25 @@ static struct pci_device_id megasas_pci_table[] = {
 
         {
          PCI_VENDOR_ID_LSI_LOGIC,
-         PCI_DEVICE_ID_LSI_SAS1064R, // xscale IOP
+         PCI_DEVICE_ID_LSI_SAS1064R, /* xscale IOP */
          PCI_ANY_ID,
          PCI_ANY_ID,
          },
         {
          PCI_VENDOR_ID_LSI_LOGIC,
-         PCI_DEVICE_ID_LSI_SAS1078R, // ppc IOP
+         PCI_DEVICE_ID_LSI_SAS1078R, /* ppc IOP */
          PCI_ANY_ID,
          PCI_ANY_ID,
         },
         {
+         PCI_VENDOR_ID_LSI_LOGIC,
+         PCI_DEVICE_ID_LSI_VERDE_ZCR,   /* xscale IOP, vega */
+         PCI_ANY_ID,
+         PCI_ANY_ID,
+         },
+        {
          PCI_VENDOR_ID_DELL,
-         PCI_DEVICE_ID_DELL_PERC5, // xscale IOP
+         PCI_DEVICE_ID_DELL_PERC5, /* xscale IOP */
          PCI_ANY_ID,
          PCI_ANY_ID,
          },
@@ -289,9 +295,14 @@ static struct megasas_instance_template megasas_instance_template_ppc = {
  * @regs:                       MFI register set
  */
 static inline void
-megasas_disable_intr(struct megasas_register_set __iomem * regs)
+megasas_disable_intr(struct megasas_instance *instance)
 {
         u32 mask = 0x1f; 
+        struct megasas_register_set __iomem *regs = instance->reg_set;
+
+        if(instance->pdev->device == PCI_DEVICE_ID_LSI_SAS1078R)
+                mask = 0xffffffff;
+
         writel(mask, &regs->outbound_intr_mask);
 
         /* Dummy readl to force pci flush */
@@ -1260,7 +1271,7 @@ megasas_transition_to_ready(struct megasas_instance* instance)
                         /*
                          * Bring it to READY state; assuming max wait 2 secs
                          */
-                        megasas_disable_intr(instance->reg_set);
+                        megasas_disable_intr(instance);
                         writel(MFI_INIT_READY, &instance->reg_set->inbound_doorbell);
 
                         max_wait = 10;
@@ -1757,6 +1768,11 @@ static int megasas_init_mfi(struct megasas_instance *instance)
         init_frame->data_xfer_len = sizeof(struct megasas_init_queue_info);
 
         /*
+         * disable the intr before firing the init frame to FW
+         */
+        megasas_disable_intr(instance);
+
+        /*
          * Issue the init frame in polled mode
          */
         if (megasas_issue_polled(instance, cmd)) {
@@ -2234,7 +2250,7 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         megasas_mgmt_info.max_index--;
 
         pci_set_drvdata(pdev, NULL);
-        megasas_disable_intr(instance->reg_set);
+        megasas_disable_intr(instance);
         free_irq(instance->pdev->irq, instance);
 
         megasas_release_mfi(instance);
@@ -2364,7 +2380,7 @@ static void megasas_detach_one(struct pci_dev *pdev)
 
         pci_set_drvdata(instance->pdev, NULL);
 
-        megasas_disable_intr(instance->reg_set);
+        megasas_disable_intr(instance);
 
         free_irq(instance->pdev->irq, instance);
 
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index 927d6ffef05f..3531a14222a7 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -18,9 +18,16 @@
 /**
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION                         "00.00.02.04"
-#define MEGASAS_RELDATE                         "Feb 03, 2006"
-#define MEGASAS_EXT_VERSION                     "Fri Feb 03 14:31:44 PST 2006"
+#define MEGASAS_VERSION                         "00.00.03.01"
+#define MEGASAS_RELDATE                         "May 14, 2006"
+#define MEGASAS_EXT_VERSION                     "Sun May 14 22:49:52 PDT 2006"
+
+/*
+ * Device IDs
+ */
+#define PCI_DEVICE_ID_LSI_SAS1078R              0x0060
+#define PCI_DEVICE_ID_LSI_VERDE_ZCR             0x0413
+
 /*
  * =====================================
  * MegaRAID SAS MFI firmware definitions
@@ -554,7 +561,11 @@ struct megasas_ctrl_info {
 #define MFI_POLL_TIMEOUT_SECS                   10
 
 #define MFI_REPLY_1078_MESSAGE_INTERRUPT        0x80000000
-#define PCI_DEVICE_ID_LSI_SAS1078R              0x00000060
+
+/*
+* register set for both 1068 and 1078 controllers
+* structure extended for 1078 registers
+*/
  
 struct megasas_register_set {
         u32     reserved_0[4];                  /*0000h*/
@@ -1150,10 +1161,10 @@ struct compat_megasas_iocpacket {
         struct compat_iovec sgl[MAX_IOCTL_SGE];
 } __attribute__ ((packed));
 
+#define MEGASAS_IOC_FIRMWARE32  _IOWR('M', 1, struct compat_megasas_iocpacket)
 #endif
 
 #define MEGASAS_IOC_FIRMWARE    _IOWR('M', 1, struct megasas_iocpacket)
-#define MEGASAS_IOC_FIRMWARE32  _IOWR('M', 1, struct compat_megasas_iocpacket)
 #define MEGASAS_IOC_GET_AEN     _IOW('M', 3, struct megasas_aen)
 
 struct megasas_mgmt_info {
diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index c88717727be8..5572981a9f92 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1268,7 +1268,7 @@ static void set_dma_cmds(struct mesh_state *ms, struct scsi_cmnd *cmd)
                 if (cmd->use_sg > 0) {
                         int nseg;
                         total = 0;
-                        scl = (struct scatterlist *) cmd->buffer;
+                        scl = (struct scatterlist *) cmd->request_buffer;
                         off = ms->data_ptr;
                         nseg = pci_map_sg(ms->pdev, scl, cmd->use_sg,
                                           cmd->sc_data_direction);
diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
index bd337a914298..bfb4f49e125d 100644
--- a/drivers/scsi/nsp32.c
+++ b/drivers/scsi/nsp32.c
@@ -2866,8 +2866,7 @@ static int nsp32_detect(struct scsi_host_template *sht)
          */
         nsp32_do_bus_reset(data);
 
-        ret = request_irq(host->irq, do_nsp32_isr,
-                          IRQF_SHARED | IRQF_SAMPLE_RANDOM, "nsp32", data);
+        ret = request_irq(host->irq, do_nsp32_isr, IRQF_SHARED, "nsp32", data);
         if (ret < 0) {
                 nsp32_msg(KERN_ERR, "Unable to allocate IRQ for NinjaSCSI32 "
                           "SCSI PCI controller. Interrupt: %d", host->irq);
@@ -2886,12 +2885,19 @@ static int nsp32_detect(struct scsi_host_template *sht)
         }
 
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,5,73))
-        scsi_add_host (host, &PCIDEV->dev);
+        ret = scsi_add_host(host, &PCIDEV->dev);
+        if (ret) {
+                nsp32_msg(KERN_ERR, "failed to add scsi host");
+                goto free_region;
+        }
         scsi_scan_host(host);
 #endif
         pci_set_drvdata(PCIDEV, host);
         return DETECT_OK;
 
+ free_region:
+        release_region(host->io_port, host->n_io_port);
+
  free_irq:
         free_irq(host->irq, data);
 
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index 7ff5851c040b..0d4c04e1f3de 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -1623,7 +1623,7 @@ static int nsp_cs_probe(struct pcmcia_device *link)
         /* Interrupt handler */
         link->irq.Handler        = &nspintr;
         link->irq.Instance       = info;
-        link->irq.Attributes     |= (IRQF_SHARED | IRQF_SAMPLE_RANDOM);
+        link->irq.Attributes     |= IRQF_SHARED;
 
         /* General socket configuration */
         link->conf.Attributes    = CONF_ENABLE_IRQ;
diff --git a/drivers/scsi/pdc_adma.c b/drivers/scsi/pdc_adma.c
index d1f38c32aa15..efc8fff1d250 100644
--- a/drivers/scsi/pdc_adma.c
+++ b/drivers/scsi/pdc_adma.c
@@ -183,7 +183,8 @@ static struct ata_port_info adma_port_info[] = {
         {
                 .sht            = &adma_ata_sht,
                 .host_flags     = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SRST |
-                                  ATA_FLAG_NO_LEGACY | ATA_FLAG_MMIO,
+                                  ATA_FLAG_NO_LEGACY | ATA_FLAG_MMIO |
+                                  ATA_FLAG_PIO_POLLING,
                 .pio_mask       = 0x10, /* pio4 */
                 .udma_mask      = 0x1f, /* udma0-4 */
                 .port_ops       = &adma_ata_ops,
diff --git a/drivers/scsi/pluto.c b/drivers/scsi/pluto.c
index 7abf64d1bfc9..0bd9c60e6455 100644
--- a/drivers/scsi/pluto.c
+++ b/drivers/scsi/pluto.c
@@ -169,8 +169,6 @@ int __init pluto_detect(struct scsi_host_template *tpnt)
                 SCpnt->request->rq_status = RQ_SCSI_BUSY;
                 
                 SCpnt->done = pluto_detect_done;
-                SCpnt->bufflen = 256;
-                SCpnt->buffer = fcs[i].inquiry;
                 SCpnt->request_bufflen = 256;
                 SCpnt->request_buffer = fcs[i].inquiry;
                 PLD(("set up %d %08lx\n", i, (long)SCpnt))
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index b818b9bfe678..8953991462d7 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -4209,7 +4209,7 @@ qla1280_setup(char *s)
 }
 
 
-static int
+static int __init
 qla1280_get_token(char *str)
 {
         char *sep;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index e96d58ded57c..87f90c4f08e9 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -16,15 +16,16 @@ qla2x00_sysfs_read_fw_dump(struct kobject *kobj, char *buf, loff_t off,
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
+        char *rbuf = (char *)ha->fw_dump;
 
         if (ha->fw_dump_reading == 0)
                 return 0;
-        if (off > ha->fw_dump_buffer_len)
-                return 0;
-        if (off + count > ha->fw_dump_buffer_len)
-                count = ha->fw_dump_buffer_len - off;
+        if (off > ha->fw_dump_len)
+                return 0;
+        if (off + count > ha->fw_dump_len)
+                count = ha->fw_dump_len - off;
 
-        memcpy(buf, &ha->fw_dump_buffer[off], count);
+        memcpy(buf, &rbuf[off], count);
 
         return (count);
 }
@@ -36,7 +37,6 @@ qla2x00_sysfs_write_fw_dump(struct kobject *kobj, char *buf, loff_t off,
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
         int reading;
-        uint32_t dump_size;
 
         if (off != 0)
                 return (0);
@@ -44,46 +44,27 @@ qla2x00_sysfs_write_fw_dump(struct kobject *kobj, char *buf, loff_t off,
         reading = simple_strtol(buf, NULL, 10);
         switch (reading) {
         case 0:
-                if (ha->fw_dump_reading == 1) {
-                        qla_printk(KERN_INFO, ha,
-                            "Firmware dump cleared on (%ld).\n", ha->host_no);
+                if (!ha->fw_dump_reading)
+                        break;
 
-                        vfree(ha->fw_dump_buffer);
-                        ha->fw_dump_buffer = NULL;
-                        ha->fw_dump_reading = 0;
-                        ha->fw_dumped = 0;
-                }
+                qla_printk(KERN_INFO, ha,
+                    "Firmware dump cleared on (%ld).\n", ha->host_no);
+
+                ha->fw_dump_reading = 0;
+                ha->fw_dumped = 0;
                 break;
         case 1:
                 if (ha->fw_dumped && !ha->fw_dump_reading) {
                         ha->fw_dump_reading = 1;
 
-                        if (IS_QLA24XX(ha) || IS_QLA54XX(ha))
-                                dump_size = FW_DUMP_SIZE_24XX;
-                        else {
-                                dump_size = FW_DUMP_SIZE_1M;
-                                if (ha->fw_memory_size < 0x20000)
-                                        dump_size = FW_DUMP_SIZE_128K;
-                                else if (ha->fw_memory_size < 0x80000)
-                                        dump_size = FW_DUMP_SIZE_512K;
-                        }
-                        ha->fw_dump_buffer = (char *)vmalloc(dump_size);
-                        if (ha->fw_dump_buffer == NULL) {
-                                qla_printk(KERN_WARNING, ha,
-                                    "Unable to allocate memory for firmware "
-                                    "dump buffer (%d).\n", dump_size);
-
-                                ha->fw_dump_reading = 0;
-                                return (count);
-                        }
                         qla_printk(KERN_INFO, ha,
-                            "Firmware dump ready for read on (%ld).\n",
+                            "Raw firmware dump ready for read on (%ld).\n",
                             ha->host_no);
-                        memset(ha->fw_dump_buffer, 0, dump_size);
-                        ha->isp_ops.ascii_fw_dump(ha);
-                        ha->fw_dump_buffer_len = strlen(ha->fw_dump_buffer);
                 }
                 break;
+        case 2:
+                qla2x00_alloc_fw_dump(ha);
+                break;
         }
         return (count);
 }
@@ -313,9 +294,6 @@ qla2x00_sysfs_read_vpd(struct kobject *kobj, char *buf, loff_t off,
         if (!capable(CAP_SYS_ADMIN) || off != 0)
                 return 0;
 
-        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha))
-                return -ENOTSUPP;
-
         /* Read NVRAM. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
         ha->isp_ops.read_nvram(ha, (uint8_t *)buf, ha->vpd_base, ha->vpd_size);
@@ -335,9 +313,6 @@ qla2x00_sysfs_write_vpd(struct kobject *kobj, char *buf, loff_t off,
         if (!capable(CAP_SYS_ADMIN) || off != 0 || count != ha->vpd_size)
                 return 0;
 
-        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha))
-                return -ENOTSUPP;
-
         /* Write NVRAM. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
         ha->isp_ops.write_nvram(ha, (uint8_t *)buf, ha->vpd_base, count);
@@ -357,6 +332,53 @@ static struct bin_attribute sysfs_vpd_attr = {
         .write = qla2x00_sysfs_write_vpd,
 };
 
+static ssize_t
+qla2x00_sysfs_read_sfp(struct kobject *kobj, char *buf, loff_t off,
+    size_t count)
+{
+        struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
+            struct device, kobj)));
+        uint16_t iter, addr, offset;
+        int rval;
+
+        if (!capable(CAP_SYS_ADMIN) || off != 0 || count != SFP_DEV_SIZE * 2)
+                return 0;
+
+        addr = 0xa0;
+        for (iter = 0, offset = 0; iter < (SFP_DEV_SIZE * 2) / SFP_BLOCK_SIZE;
+            iter++, offset += SFP_BLOCK_SIZE) {
+                if (iter == 4) {
+                        /* Skip to next device address. */
+                        addr = 0xa2;
+                        offset = 0;
+                }
+
+                rval = qla2x00_read_sfp(ha, ha->sfp_data_dma, addr, offset,
+                    SFP_BLOCK_SIZE);
+                if (rval != QLA_SUCCESS) {
+                        qla_printk(KERN_WARNING, ha,
+                            "Unable to read SFP data (%x/%x/%x).\n", rval,
+                            addr, offset);
+                        count = 0;
+                        break;
+                }
+                memcpy(buf, ha->sfp_data, SFP_BLOCK_SIZE);
+                buf += SFP_BLOCK_SIZE;
+        }
+
+        return count;
+}
+
+static struct bin_attribute sysfs_sfp_attr = {
+        .attr = {
+                .name = "sfp",
+                .mode = S_IRUSR | S_IWUSR,
+                .owner = THIS_MODULE,
+        },
+        .size = SFP_DEV_SIZE * 2,
+        .read = qla2x00_sysfs_read_sfp,
+};
+
 void
 qla2x00_alloc_sysfs_attr(scsi_qla_host_t *ha)
 {
@@ -367,7 +389,12 @@ qla2x00_alloc_sysfs_attr(scsi_qla_host_t *ha)
         sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_optrom_attr);
         sysfs_create_bin_file(&host->shost_gendev.kobj,
             &sysfs_optrom_ctl_attr);
-        sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_vpd_attr);
+        if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
+                sysfs_create_bin_file(&host->shost_gendev.kobj,
+                    &sysfs_vpd_attr);
+                sysfs_create_bin_file(&host->shost_gendev.kobj,
+                    &sysfs_sfp_attr);
+        }
 }
 
 void
@@ -380,7 +407,12 @@ qla2x00_free_sysfs_attr(scsi_qla_host_t *ha)
         sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_optrom_attr);
         sysfs_remove_bin_file(&host->shost_gendev.kobj,
             &sysfs_optrom_ctl_attr);
-        sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_vpd_attr);
+        if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
+                sysfs_remove_bin_file(&host->shost_gendev.kobj,
+                    &sysfs_vpd_attr);
+                sysfs_remove_bin_file(&host->shost_gendev.kobj,
+                    &sysfs_sfp_attr);
+        }
 
         if (ha->beacon_blink_led == 1)
                 ha->isp_ops.beacon_off(ha);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 74e54713aa7c..f6ed6962bc2b 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -8,7 +8,34 @@
 
 #include <linux/delay.h>
 
-static int qla_uprintf(char **, char *, ...);
+static inline void
+qla2xxx_prep_dump(scsi_qla_host_t *ha, struct qla2xxx_fw_dump *fw_dump)
+{
+        fw_dump->fw_major_version = htonl(ha->fw_major_version);
+        fw_dump->fw_minor_version = htonl(ha->fw_minor_version);
+        fw_dump->fw_subminor_version = htonl(ha->fw_subminor_version);
+        fw_dump->fw_attributes = htonl(ha->fw_attributes);
+
+        fw_dump->vendor = htonl(ha->pdev->vendor);
+        fw_dump->device = htonl(ha->pdev->device);
+        fw_dump->subsystem_vendor = htonl(ha->pdev->subsystem_vendor);
+        fw_dump->subsystem_device = htonl(ha->pdev->subsystem_device);
+}
+
+static inline void *
+qla2xxx_copy_queues(scsi_qla_host_t *ha, void *ptr)
+{
+        /* Request queue. */
+        memcpy(ptr, ha->request_ring, ha->request_q_length *
+            sizeof(request_t));
+
+        /* Response queue. */
+        ptr += ha->request_q_length * sizeof(request_t);
+        memcpy(ptr, ha->response_ring, ha->response_q_length  *
+            sizeof(response_t));
+
+        return ptr + (ha->response_q_length * sizeof(response_t));
+}
 
 /**
  * qla2300_fw_dump() - Dumps binary data from the 2300 firmware.
@@ -49,10 +76,11 @@ qla2300_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
                     "request...\n", ha->fw_dump);
                 goto qla2300_fw_dump_failed;
         }
-        fw = ha->fw_dump;
+        fw = &ha->fw_dump->isp.isp23;
+        qla2xxx_prep_dump(ha, ha->fw_dump);
 
         rval = QLA_SUCCESS;
-        fw->hccr = RD_REG_WORD(&reg->hccr);
+        fw->hccr = htons(RD_REG_WORD(&reg->hccr));
 
         /* Pause RISC. */
         WRT_REG_WORD(&reg->hccr, HCCR_PAUSE_RISC);
@@ -73,85 +101,86 @@ qla2300_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
         if (rval == QLA_SUCCESS) {
                 dmp_reg = (uint16_t __iomem *)(reg + 0);
                 for (cnt = 0; cnt < sizeof(fw->pbiu_reg) / 2; cnt++)
-                        fw->pbiu_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->pbiu_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x10);
                 for (cnt = 0; cnt < sizeof(fw->risc_host_reg) / 2; cnt++)
-                        fw->risc_host_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_host_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x40);
                 for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++)
-                        fw->mailbox_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->mailbox_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x40);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->resp_dma_reg) / 2; cnt++)
-                        fw->resp_dma_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->resp_dma_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x50);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->dma_reg) / 2; cnt++)
-                        fw->dma_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->dma_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x00);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0xA0);
                 for (cnt = 0; cnt < sizeof(fw->risc_hdw_reg) / 2; cnt++)
-                        fw->risc_hdw_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_hdw_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2000);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp0_reg) / 2; cnt++)
-                        fw->risc_gp0_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp0_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2200);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp1_reg) / 2; cnt++)
-                        fw->risc_gp1_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp1_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2400);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp2_reg) / 2; cnt++)
-                        fw->risc_gp2_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp2_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2600);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp3_reg) / 2; cnt++)
-                        fw->risc_gp3_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp3_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2800);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp4_reg) / 2; cnt++)
-                        fw->risc_gp4_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp4_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2A00);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp5_reg) / 2; cnt++)
-                        fw->risc_gp5_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp5_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2C00);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp6_reg) / 2; cnt++)
-                        fw->risc_gp6_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp6_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2E00);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp7_reg) / 2; cnt++)
-                        fw->risc_gp7_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp7_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x10);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->frame_buf_hdw_reg) / 2; cnt++)
-                        fw->frame_buf_hdw_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->frame_buf_hdw_reg[cnt] =
+                            htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x20);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->fpm_b0_reg) / 2; cnt++)
-                        fw->fpm_b0_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->fpm_b0_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x30);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->fpm_b1_reg) / 2; cnt++)
-                        fw->fpm_b1_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->fpm_b1_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 /* Reset RISC. */
                 WRT_REG_WORD(&reg->ctrl_status, CSR_ISP_SOFT_RESET);
@@ -226,7 +255,7 @@ qla2300_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 
                 if (test_and_clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags)) {
                         rval = mb0 & MBS_MASK;
-                        fw->risc_ram[cnt] = mb2;
+                        fw->risc_ram[cnt] = htons(mb2);
                 } else {
                         rval = QLA_FUNCTION_FAILED;
                 }
@@ -285,7 +314,7 @@ qla2300_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 
                 if (test_and_clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags)) {
                         rval = mb0 & MBS_MASK;
-                        fw->stack_ram[cnt] = mb2;
+                        fw->stack_ram[cnt] = htons(mb2);
                 } else {
                         rval = QLA_FUNCTION_FAILED;
                 }
@@ -345,12 +374,15 @@ qla2300_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 
                 if (test_and_clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags)) {
                         rval = mb0 & MBS_MASK;
-                        fw->data_ram[cnt] = mb2;
+                        fw->data_ram[cnt] = htons(mb2);
                 } else {
                         rval = QLA_FUNCTION_FAILED;
                 }
         }
 
+        if (rval == QLA_SUCCESS)
+                qla2xxx_copy_queues(ha, &fw->data_ram[cnt]);
+
         if (rval != QLA_SUCCESS) {
                 qla_printk(KERN_WARNING, ha,
                     "Failed to dump firmware (%x)!!!\n", rval);
@@ -369,193 +401,6 @@ qla2300_fw_dump_failed:
 }
 
 /**
- * qla2300_ascii_fw_dump() - Converts a binary firmware dump to ASCII.
- * @ha: HA context
- */
-void
-qla2300_ascii_fw_dump(scsi_qla_host_t *ha)
-{
-        uint32_t cnt;
-        char *uiter;
-        char fw_info[30];
-        struct qla2300_fw_dump *fw;
-        uint32_t data_ram_cnt;
-
-        uiter = ha->fw_dump_buffer;
-        fw = ha->fw_dump;
-
-        qla_uprintf(&uiter, "%s Firmware Version %s\n", ha->model_number,
-            ha->isp_ops.fw_version_str(ha, fw_info));
-
-        qla_uprintf(&uiter, "\n[==>BEG]\n");
-
-        qla_uprintf(&uiter, "HCCR Register:\n%04x\n\n", fw->hccr);
-
-        qla_uprintf(&uiter, "PBIU Registers:");
-        for (cnt = 0; cnt < sizeof (fw->pbiu_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->pbiu_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nReqQ-RspQ-Risc2Host Status registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_host_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_host_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nMailbox Registers:");
-        for (cnt = 0; cnt < sizeof (fw->mailbox_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->mailbox_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nAuto Request Response DMA Registers:");
-        for (cnt = 0; cnt < sizeof (fw->resp_dma_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->resp_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nDMA Registers:");
-        for (cnt = 0; cnt < sizeof (fw->dma_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC Hardware Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_hdw_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_hdw_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP0 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp0_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp0_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP1 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp1_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp1_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP2 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp2_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp2_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP3 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp3_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp3_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP4 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp4_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp4_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP5 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp5_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp5_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP6 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp6_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp6_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP7 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp7_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp7_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFrame Buffer Hardware Registers:");
-        for (cnt = 0; cnt < sizeof (fw->frame_buf_hdw_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->frame_buf_hdw_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFPM B0 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->fpm_b0_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->fpm_b0_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFPM B1 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->fpm_b1_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->fpm_b1_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nCode RAM Dump:");
-        for (cnt = 0; cnt < sizeof (fw->risc_ram) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n%04x: ", cnt + 0x0800);
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_ram[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nStack RAM Dump:");
-        for (cnt = 0; cnt < sizeof (fw->stack_ram) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n%05x: ", cnt + 0x10000);
-                }
-                qla_uprintf(&uiter, "%04x ", fw->stack_ram[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nData RAM Dump:");
-        data_ram_cnt = ha->fw_memory_size - 0x11000 + 1;
-        for (cnt = 0; cnt < data_ram_cnt; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n%05x: ", cnt + 0x11000);
-                }
-                qla_uprintf(&uiter, "%04x ", fw->data_ram[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\n[<==END] ISP Debug Dump.");
-}
-
-/**
  * qla2100_fw_dump() - Dumps binary data from the 2100/2200 firmware.
  * @ha: HA context
  * @hardware_locked: Called with the hardware_lock
@@ -591,10 +436,11 @@ qla2100_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
                     "request...\n", ha->fw_dump);
                 goto qla2100_fw_dump_failed;
         }
-        fw = ha->fw_dump;
+        fw = &ha->fw_dump->isp.isp21;
+        qla2xxx_prep_dump(ha, ha->fw_dump);
 
         rval = QLA_SUCCESS;
-        fw->hccr = RD_REG_WORD(&reg->hccr);
+        fw->hccr = htons(RD_REG_WORD(&reg->hccr));
 
         /* Pause RISC. */
         WRT_REG_WORD(&reg->hccr, HCCR_PAUSE_RISC);
@@ -608,79 +454,81 @@ qla2100_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
         if (rval == QLA_SUCCESS) {
                 dmp_reg = (uint16_t __iomem *)(reg + 0);
                 for (cnt = 0; cnt < sizeof(fw->pbiu_reg) / 2; cnt++)
-                        fw->pbiu_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->pbiu_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x10);
                 for (cnt = 0; cnt < ha->mbx_count; cnt++) {
                         if (cnt == 8) {
-                                dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0xe0);
+                                dmp_reg = (uint16_t __iomem *)
+                                        ((uint8_t __iomem *)reg + 0xe0);
                         }
-                        fw->mailbox_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->mailbox_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
                 }
 
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x20);
                 for (cnt = 0; cnt < sizeof(fw->dma_reg) / 2; cnt++)
-                        fw->dma_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->dma_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x00);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0xA0);
                 for (cnt = 0; cnt < sizeof(fw->risc_hdw_reg) / 2; cnt++)
-                        fw->risc_hdw_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_hdw_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2000);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp0_reg) / 2; cnt++)
-                        fw->risc_gp0_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp0_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2100);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp1_reg) / 2; cnt++)
-                        fw->risc_gp1_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp1_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2200);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp2_reg) / 2; cnt++)
-                        fw->risc_gp2_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp2_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2300);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp3_reg) / 2; cnt++)
-                        fw->risc_gp3_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp3_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2400);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp4_reg) / 2; cnt++)
-                        fw->risc_gp4_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp4_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2500);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp5_reg) / 2; cnt++)
-                        fw->risc_gp5_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp5_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2600);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp6_reg) / 2; cnt++)
-                        fw->risc_gp6_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp6_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->pcr, 0x2700);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->risc_gp7_reg) / 2; cnt++)
-                        fw->risc_gp7_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->risc_gp7_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x10);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->frame_buf_hdw_reg) / 2; cnt++)
-                        fw->frame_buf_hdw_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->frame_buf_hdw_reg[cnt] =
+                            htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x20);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->fpm_b0_reg) / 2; cnt++)
-                        fw->fpm_b0_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->fpm_b0_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 WRT_REG_WORD(&reg->ctrl_status, 0x30);
                 dmp_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->fpm_b1_reg) / 2; cnt++)
-                        fw->fpm_b1_reg[cnt] = RD_REG_WORD(dmp_reg++);
+                        fw->fpm_b1_reg[cnt] = htons(RD_REG_WORD(dmp_reg++));
 
                 /* Reset the ISP. */
                 WRT_REG_WORD(&reg->ctrl_status, CSR_ISP_SOFT_RESET);
@@ -755,12 +603,15 @@ qla2100_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 
                 if (test_and_clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags)) {
                         rval = mb0 & MBS_MASK;
-                        fw->risc_ram[cnt] = mb2;
+                        fw->risc_ram[cnt] = htons(mb2);
                 } else {
                         rval = QLA_FUNCTION_FAILED;
                 }
         }
 
+        if (rval == QLA_SUCCESS)
+                qla2xxx_copy_queues(ha, &fw->risc_ram[cnt]);
+
         if (rval != QLA_SUCCESS) {
                 qla_printk(KERN_WARNING, ha,
                     "Failed to dump firmware (%x)!!!\n", rval);
@@ -778,179 +629,6 @@ qla2100_fw_dump_failed:
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
-/**
- * qla2100_ascii_fw_dump() - Converts a binary firmware dump to ASCII.
- * @ha: HA context
- */
-void
-qla2100_ascii_fw_dump(scsi_qla_host_t *ha)
-{
-        uint32_t cnt;
-        char *uiter;
-        char fw_info[30];
-        struct qla2100_fw_dump *fw;
-
-        uiter = ha->fw_dump_buffer;
-        fw = ha->fw_dump;
-
-        qla_uprintf(&uiter, "%s Firmware Version %s\n", ha->model_number,
-            ha->isp_ops.fw_version_str(ha, fw_info));
-
-        qla_uprintf(&uiter, "\n[==>BEG]\n");
-
-        qla_uprintf(&uiter, "HCCR Register:\n%04x\n\n", fw->hccr);
-
-        qla_uprintf(&uiter, "PBIU Registers:");
-        for (cnt = 0; cnt < sizeof (fw->pbiu_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->pbiu_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nMailbox Registers:");
-        for (cnt = 0; cnt < sizeof (fw->mailbox_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->mailbox_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nDMA Registers:");
-        for (cnt = 0; cnt < sizeof (fw->dma_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC Hardware Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_hdw_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_hdw_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP0 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp0_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp0_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP1 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp1_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp1_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP2 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp2_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp2_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP3 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp3_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp3_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP4 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp4_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp4_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP5 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp5_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp5_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP6 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp6_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp6_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP7 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->risc_gp7_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_gp7_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFrame Buffer Hardware Registers:");
-        for (cnt = 0; cnt < sizeof (fw->frame_buf_hdw_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->frame_buf_hdw_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFPM B0 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->fpm_b0_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->fpm_b0_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFPM B1 Registers:");
-        for (cnt = 0; cnt < sizeof (fw->fpm_b1_reg) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n");
-                }
-                qla_uprintf(&uiter, "%04x ", fw->fpm_b1_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC SRAM:");
-        for (cnt = 0; cnt < sizeof (fw->risc_ram) / 2; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n%04x: ", cnt + 0x1000);
-                }
-                qla_uprintf(&uiter, "%04x ", fw->risc_ram[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\n[<==END] ISP Debug Dump.");
-
-        return;
-}
-
-static int
-qla_uprintf(char **uiter, char *fmt, ...)
-{
-        int     iter, len;
-        char    buf[128];
-        va_list args;
-
-        va_start(args, fmt);
-        len = vsprintf(buf, fmt, args);
-        va_end(args);
-
-        for (iter = 0; iter < len; iter++, *uiter += 1)
-                *uiter[0] = buf[iter];
-
-        return (len);
-}
-
-
 void
 qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 {
@@ -967,6 +645,7 @@ qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
         unsigned long   flags;
         struct qla24xx_fw_dump *fw;
         uint32_t        ext_mem_cnt;
+        void            *eft;
 
         risc_address = ext_mem_cnt = 0;
         memset(mb, 0, sizeof(mb));
@@ -987,10 +666,11 @@ qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
                     "request...\n", ha->fw_dump);
                 goto qla24xx_fw_dump_failed;
         }
-        fw = ha->fw_dump;
+        fw = &ha->fw_dump->isp.isp24;
+        qla2xxx_prep_dump(ha, ha->fw_dump);
 
         rval = QLA_SUCCESS;
-        fw->host_status = RD_REG_DWORD(&reg->host_status);
+        fw->host_status = htonl(RD_REG_DWORD(&reg->host_status));
 
         /* Pause RISC. */
         if ((RD_REG_DWORD(&reg->hccr) & HCCRX_RISC_PAUSE) == 0) {
@@ -1012,7 +692,7 @@ qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
                 /* Host interface registers. */
                 dmp_reg = (uint32_t __iomem *)(reg + 0);
                 for (cnt = 0; cnt < sizeof(fw->host_reg) / 4; cnt++)
-                        fw->host_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->host_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Disable interrupts. */
                 WRT_REG_DWORD(&reg->ictrl, 0);
@@ -1024,470 +704,471 @@ qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0000000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[0] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[0] = htonl(RD_REG_DWORD(dmp_reg));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0100000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[1] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[1] = htonl(RD_REG_DWORD(dmp_reg));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0200000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[2] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[2] = htonl(RD_REG_DWORD(dmp_reg));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0300000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[3] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[3] = htonl(RD_REG_DWORD(dmp_reg));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0400000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[4] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[4] = htonl(RD_REG_DWORD(dmp_reg));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0500000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[5] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[5] = htonl(RD_REG_DWORD(dmp_reg));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xF0);
                 WRT_REG_DWORD(dmp_reg, 0xB0600000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xFC);
-                fw->shadow_reg[6] = RD_REG_DWORD(dmp_reg);
+                fw->shadow_reg[6] = htonl(RD_REG_DWORD(dmp_reg));
 
                 /* Mailbox registers. */
                 mbx_reg = (uint16_t __iomem *)((uint8_t __iomem *)reg + 0x80);
                 for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++)
-                        fw->mailbox_reg[cnt] = RD_REG_WORD(mbx_reg++);
+                        fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg++));
 
                 /* Transfer sequence registers. */
                 iter_reg = fw->xseq_gp_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF00);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF10);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF20);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF30);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF40);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF50);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF60);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBF70);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBFE0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->xseq_0_reg) / 4; cnt++)
-                        fw->xseq_0_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->xseq_0_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xBFF0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->xseq_1_reg) / 4; cnt++)
-                        fw->xseq_1_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->xseq_1_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Receive sequence registers. */
                 iter_reg = fw->rseq_gp_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF00);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF10);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF20);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF30);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF40);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF50);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF60);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFF70);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFFD0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->rseq_0_reg) / 4; cnt++)
-                        fw->rseq_0_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->rseq_0_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFFE0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->rseq_1_reg) / 4; cnt++)
-                        fw->rseq_1_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->rseq_1_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0xFFF0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->rseq_2_reg) / 4; cnt++)
-                        fw->rseq_2_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->rseq_2_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Command DMA registers. */
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7100);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->cmd_dma_reg) / 4; cnt++)
-                        fw->cmd_dma_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->cmd_dma_reg[cnt] = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Queues. */
                 iter_reg = fw->req0_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7200);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 8; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xE4);
                 for (cnt = 0; cnt < 7; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->resp0_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7300);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 8; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xE4);
                 for (cnt = 0; cnt < 7; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->req1_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7400);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 8; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xE4);
                 for (cnt = 0; cnt < 7; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Transmit DMA registers. */
                 iter_reg = fw->xmt0_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7600);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7610);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->xmt1_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7620);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7630);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->xmt2_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7640);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7650);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->xmt3_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7660);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7670);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->xmt4_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7680);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7690);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x76A0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < sizeof(fw->xmt_data_dma_reg) / 4; cnt++)
-                        fw->xmt_data_dma_reg[cnt] = RD_REG_DWORD(dmp_reg++);
+                        fw->xmt_data_dma_reg[cnt] =
+                            htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Receive DMA registers. */
                 iter_reg = fw->rcvt0_data_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7700);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7710);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 iter_reg = fw->rcvt1_data_dma_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7720);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x7730);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* RISC registers. */
                 iter_reg = fw->risc_gp_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F00);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F10);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F20);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F30);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F40);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F50);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F60);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x0F70);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Local memory controller registers. */
                 iter_reg = fw->lmc_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3010);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3020);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3030);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3040);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3050);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x3060);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Fibre Protocol Module registers. */
                 iter_reg = fw->fpm_hdw_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4010);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4020);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4030);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4040);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4050);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4060);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4070);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4080);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x4090);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x40A0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x40B0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Frame Buffer registers. */
                 iter_reg = fw->fb_hdw_reg;
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6000);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6010);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6020);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6030);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6040);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6100);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6130);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6150);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6170);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x6190);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 WRT_REG_DWORD(&reg->iobase_addr, 0x61B0);
                 dmp_reg = (uint32_t __iomem *)((uint8_t __iomem *)reg + 0xC0);
                 for (cnt = 0; cnt < 16; cnt++)
-                        *iter_reg++ = RD_REG_DWORD(dmp_reg++);
+                        *iter_reg++ = htonl(RD_REG_DWORD(dmp_reg++));
 
                 /* Reset RISC. */
                 WRT_REG_DWORD(&reg->ctrl_status,
@@ -1577,7 +1258,7 @@ qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 
                 if (test_and_clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags)) {
                         rval = mb[0] & MBS_MASK;
-                        fw->code_ram[cnt] = (mb[3] << 16) | mb[2];
+                        fw->code_ram[cnt] = htonl((mb[3] << 16) | mb[2]);
                 } else {
                         rval = QLA_FUNCTION_FAILED;
                 }
@@ -1627,12 +1308,18 @@ qla24xx_fw_dump(scsi_qla_host_t *ha, int hardware_locked)
 
                 if (test_and_clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags)) {
                         rval = mb[0] & MBS_MASK;
-                        fw->ext_mem[cnt] = (mb[3] << 16) | mb[2];
+                        fw->ext_mem[cnt] = htonl((mb[3] << 16) | mb[2]);
                 } else {
                         rval = QLA_FUNCTION_FAILED;
                 }
         }
 
+        if (rval == QLA_SUCCESS) {
+                eft = qla2xxx_copy_queues(ha, &fw->ext_mem[cnt]);
+                if (ha->eft)
+                        memcpy(eft, ha->eft, ntohl(ha->fw_dump->eft_size));
+        }
+
         if (rval != QLA_SUCCESS) {
                 qla_printk(KERN_WARNING, ha,
                     "Failed to dump firmware (%x)!!!\n", rval);
@@ -1650,252 +1337,6 @@ qla24xx_fw_dump_failed:
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
-void
-qla24xx_ascii_fw_dump(scsi_qla_host_t *ha)
-{
-        uint32_t cnt;
-        char *uiter;
-        struct qla24xx_fw_dump *fw;
-        uint32_t ext_mem_cnt;
-
-        uiter = ha->fw_dump_buffer;
-        fw = ha->fw_dump;
-
-        qla_uprintf(&uiter, "ISP FW Version %d.%02d.%02d Attributes %04x\n",
-            ha->fw_major_version, ha->fw_minor_version,
-            ha->fw_subminor_version, ha->fw_attributes);
-
-        qla_uprintf(&uiter, "\nR2H Status Register\n%04x\n", fw->host_status);
-
-        qla_uprintf(&uiter, "\nHost Interface Registers");
-        for (cnt = 0; cnt < sizeof(fw->host_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->host_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nShadow Registers");
-        for (cnt = 0; cnt < sizeof(fw->shadow_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->shadow_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nMailbox Registers");
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->mailbox_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXSEQ GP Registers");
-        for (cnt = 0; cnt < sizeof(fw->xseq_gp_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xseq_gp_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXSEQ-0 Registers");
-        for (cnt = 0; cnt < sizeof(fw->xseq_0_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xseq_0_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXSEQ-1 Registers");
-        for (cnt = 0; cnt < sizeof(fw->xseq_1_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xseq_1_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRSEQ GP Registers");
-        for (cnt = 0; cnt < sizeof(fw->rseq_gp_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->rseq_gp_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRSEQ-0 Registers");
-        for (cnt = 0; cnt < sizeof(fw->rseq_0_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->rseq_0_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRSEQ-1 Registers");
-        for (cnt = 0; cnt < sizeof(fw->rseq_1_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->rseq_1_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRSEQ-2 Registers");
-        for (cnt = 0; cnt < sizeof(fw->rseq_2_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->rseq_2_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nCommand DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->cmd_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->cmd_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRequest0 Queue DMA Channel Registers");
-        for (cnt = 0; cnt < sizeof(fw->req0_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->req0_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nResponse0 Queue DMA Channel Registers");
-        for (cnt = 0; cnt < sizeof(fw->resp0_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->resp0_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRequest1 Queue DMA Channel Registers");
-        for (cnt = 0; cnt < sizeof(fw->req1_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->req1_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXMT0 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->xmt0_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xmt0_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXMT1 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->xmt1_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xmt1_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXMT2 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->xmt2_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xmt2_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXMT3 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->xmt3_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xmt3_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXMT4 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->xmt4_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xmt4_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nXMT Data DMA Common Registers");
-        for (cnt = 0; cnt < sizeof(fw->xmt_data_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->xmt_data_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRCV Thread 0 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->rcvt0_data_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->rcvt0_data_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRCV Thread 1 Data DMA Registers");
-        for (cnt = 0; cnt < sizeof(fw->rcvt1_data_dma_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->rcvt1_data_dma_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nRISC GP Registers");
-        for (cnt = 0; cnt < sizeof(fw->risc_gp_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->risc_gp_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nLMC Registers");
-        for (cnt = 0; cnt < sizeof(fw->lmc_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->lmc_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFPM Hardware Registers");
-        for (cnt = 0; cnt < sizeof(fw->fpm_hdw_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->fpm_hdw_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nFB Hardware Registers");
-        for (cnt = 0; cnt < sizeof(fw->fb_hdw_reg) / 4; cnt++) {
-                if (cnt % 8 == 0)
-                        qla_uprintf(&uiter, "\n");
-
-                qla_uprintf(&uiter, "%08x ", fw->fb_hdw_reg[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nCode RAM");
-        for (cnt = 0; cnt < sizeof (fw->code_ram) / 4; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n%08x: ", cnt + 0x20000);
-                }
-                qla_uprintf(&uiter, "%08x ", fw->code_ram[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n\nExternal Memory");
-        ext_mem_cnt = ha->fw_memory_size - 0x100000 + 1;
-        for (cnt = 0; cnt < ext_mem_cnt; cnt++) {
-                if (cnt % 8 == 0) {
-                        qla_uprintf(&uiter, "\n%08x: ", cnt + 0x100000);
-                }
-                qla_uprintf(&uiter, "%08x ", fw->ext_mem[cnt]);
-        }
-
-        qla_uprintf(&uiter, "\n[<==END] ISP Debug Dump");
-}
-
-
 /****************************************************************************/
 /*                         Driver Debug Functions.                          */
 /****************************************************************************/
diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
index ab6afeaa2f2c..533425338e05 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.h
+++ b/drivers/scsi/qla2xxx/qla_dbg.h
@@ -37,134 +37,86 @@
 /*
 * Macros use for debugging the driver.
 */
-#undef ENTER_TRACE
-#if defined(ENTER_TRACE)
-#define ENTER(x)        do { printk("qla2100 : Entering %s()\n", x); } while (0)
-#define LEAVE(x)        do { printk("qla2100 : Leaving %s()\n", x);  } while (0)
-#define ENTER_INTR(x)   do { printk("qla2100 : Entering %s()\n", x); } while (0)
-#define LEAVE_INTR(x)   do { printk("qla2100 : Leaving %s()\n", x);  } while (0)
-#else
-#define ENTER(x)        do {} while (0)
-#define LEAVE(x)        do {} while (0)
-#define ENTER_INTR(x)   do {} while (0)
-#define LEAVE_INTR(x)   do {} while (0)
-#endif
 
-#if  DEBUG_QLA2100
-#define DEBUG(x)        do {x;} while (0);
-#else
-#define DEBUG(x)        do {} while (0);
-#endif
+#define DEBUG(x)        do { if (extended_error_logging) { x; } } while (0)
 
 #if defined(QL_DEBUG_LEVEL_1)
-#define DEBUG1(x)       do {x;} while (0);
+#define DEBUG1(x)       do {x;} while (0)
 #else
-#define DEBUG1(x)       do {} while (0);
+#define DEBUG1(x)       do {} while (0)
 #endif
 
-#if defined(QL_DEBUG_LEVEL_2)
-#define DEBUG2(x)       do {x;} while (0);
-#define DEBUG2_3(x)     do {x;} while (0);
-#define DEBUG2_3_11(x)  do {x;} while (0);
-#define DEBUG2_9_10(x)    do {x;} while (0);
-#define DEBUG2_11(x)    do {x;} while (0);
-#define DEBUG2_13(x)    do {x;} while (0);
-#else
-#define DEBUG2(x)       do {} while (0);
-#endif
+#define DEBUG2(x)       do { if (extended_error_logging) { x; } } while (0)
+#define DEBUG2_3(x)     do { if (extended_error_logging) { x; } } while (0)
+#define DEBUG2_3_11(x)  do { if (extended_error_logging) { x; } } while (0)
+#define DEBUG2_9_10(x)  do { if (extended_error_logging) { x; } } while (0)
+#define DEBUG2_11(x)    do { if (extended_error_logging) { x; } } while (0)
+#define DEBUG2_13(x)    do { if (extended_error_logging) { x; } } while (0)
 
 #if defined(QL_DEBUG_LEVEL_3)
-#define DEBUG3(x)       do {x;} while (0);
-#define DEBUG2_3(x)     do {x;} while (0);
-#define DEBUG2_3_11(x)  do {x;} while (0);
-#define DEBUG3_11(x)    do {x;} while (0);
+#define DEBUG3(x)       do {x;} while (0)
+#define DEBUG3_11(x)    do {x;} while (0)
 #else
-#define DEBUG3(x)       do {} while (0);
-  #if !defined(QL_DEBUG_LEVEL_2)
-  #define DEBUG2_3(x)   do {} while (0);
-  #endif
+#define DEBUG3(x)       do {} while (0)
 #endif
 
 #if defined(QL_DEBUG_LEVEL_4)
-#define DEBUG4(x)       do {x;} while (0);
+#define DEBUG4(x)       do {x;} while (0)
 #else
-#define DEBUG4(x)       do {} while (0);
+#define DEBUG4(x)       do {} while (0)
 #endif
 
 #if defined(QL_DEBUG_LEVEL_5)
-#define DEBUG5(x)          do {x;} while (0);
+#define DEBUG5(x)          do {x;} while (0)
 #else
-#define DEBUG5(x)       do {} while (0);
+#define DEBUG5(x)       do {} while (0)
 #endif
 
 #if defined(QL_DEBUG_LEVEL_7)
-#define DEBUG7(x)          do {x;} while (0);
+#define DEBUG7(x)          do {x;} while (0)
 #else
-#define DEBUG7(x)          do {} while (0);
+#define DEBUG7(x)          do {} while (0)
 #endif
 
 #if defined(QL_DEBUG_LEVEL_9)
-#define DEBUG9(x)       do {x;} while (0);
-#define DEBUG9_10(x)    do {x;} while (0);
-#define DEBUG2_9_10(x)  do {x;} while (0);
+#define DEBUG9(x)       do {x;} while (0)
+#define DEBUG9_10(x)    do {x;} while (0)
 #else
-#define DEBUG9(x)       do {} while (0);
+#define DEBUG9(x)       do {} while (0)
 #endif
 
 #if defined(QL_DEBUG_LEVEL_10)
-#define DEBUG10(x)      do {x;} while (0);
-#define DEBUG2_9_10(x)  do {x;} while (0);
-#define DEBUG9_10(x)    do {x;} while (0);
+#define DEBUG10(x)      do {x;} while (0)
+#define DEBUG9_10(x)    do {x;} while (0)
 #else
-#define DEBUG10(x)      do {} while (0);
-  #if !defined(DEBUG2_9_10)
-  #define DEBUG2_9_10(x)        do {} while (0);
-  #endif
+#define DEBUG10(x)      do {} while (0)
   #if !defined(DEBUG9_10)
-  #define DEBUG9_10(x)  do {} while (0);
+  #define DEBUG9_10(x)  do {} while (0)
   #endif
 #endif
 
 #if defined(QL_DEBUG_LEVEL_11)
-#define DEBUG11(x)      do{x;} while(0);
-#if !defined(DEBUG2_11)
-#define DEBUG2_11(x)    do{x;} while(0);
-#endif
-#if !defined(DEBUG2_3_11)
-#define DEBUG2_3_11(x)  do{x;} while(0);
-#endif
+#define DEBUG11(x)      do{x;} while(0)
 #if !defined(DEBUG3_11)
-#define DEBUG3_11(x)    do{x;} while(0);
+#define DEBUG3_11(x)    do{x;} while(0)
 #endif
 #else
-#define DEBUG11(x)      do{} while(0);
-  #if !defined(QL_DEBUG_LEVEL_2)
-  #define DEBUG2_11(x)  do{} while(0);
-    #if !defined(QL_DEBUG_LEVEL_3)
-    #define DEBUG2_3_11(x) do{} while(0);
-    #endif
-  #endif
+#define DEBUG11(x)      do{} while(0)
   #if !defined(QL_DEBUG_LEVEL_3)
-  #define DEBUG3_11(x)  do{} while(0);
+  #define DEBUG3_11(x)  do{} while(0)
   #endif
 #endif
 
 #if defined(QL_DEBUG_LEVEL_12)
-#define DEBUG12(x)      do {x;} while (0);
+#define DEBUG12(x)      do {x;} while (0)
 #else
-#define DEBUG12(x)      do {} while (0);
+#define DEBUG12(x)      do {} while (0)
 #endif
 
 #if defined(QL_DEBUG_LEVEL_13)
 #define DEBUG13(x)      do {x;} while (0)
-#if !defined(DEBUG2_13)
-#define DEBUG2_13(x)    do {x;} while(0)
-#endif
 #else
 #define DEBUG13(x)      do {} while (0)
-#if !defined(QL_DEBUG_LEVEL_2)
-#define DEBUG2_13(x)    do {} while(0)
-#endif
 #endif
 
 #if defined(QL_DEBUG_LEVEL_14)
@@ -176,9 +128,6 @@
 /*
  * Firmware Dump structure definition
  */
-#define FW_DUMP_SIZE_128K       0xBC000
-#define FW_DUMP_SIZE_512K       0x2FC000
-#define FW_DUMP_SIZE_1M         0x5FC000
 
 struct qla2300_fw_dump {
         uint16_t hccr;
@@ -224,8 +173,6 @@ struct qla2100_fw_dump {
         uint16_t risc_ram[0xf000];
 };
 
-#define FW_DUMP_SIZE_24XX       0x2B0000
-
 struct qla24xx_fw_dump {
         uint32_t host_status;
         uint32_t host_reg[32];
@@ -257,3 +204,39 @@ struct qla24xx_fw_dump {
         uint32_t code_ram[0x2000];
         uint32_t ext_mem[1];
 };
+
+#define EFT_NUM_BUFFERS         4
+#define EFT_BYTES_PER_BUFFER    0x4000
+#define EFT_SIZE                ((EFT_BYTES_PER_BUFFER) * (EFT_NUM_BUFFERS))
+
+struct qla2xxx_fw_dump {
+        uint8_t signature[4];
+        uint32_t version;
+
+        uint32_t fw_major_version;
+        uint32_t fw_minor_version;
+        uint32_t fw_subminor_version;
+        uint32_t fw_attributes;
+
+        uint32_t vendor;
+        uint32_t device;
+        uint32_t subsystem_vendor;
+        uint32_t subsystem_device;
+
+        uint32_t fixed_size;
+        uint32_t mem_size;
+        uint32_t req_q_size;
+        uint32_t rsp_q_size;
+
+        uint32_t eft_size;
+        uint32_t eft_addr_l;
+        uint32_t eft_addr_h;
+
+        uint32_t header_size;
+
+        union {
+                struct qla2100_fw_dump isp21;
+                struct qla2300_fw_dump isp23;
+                struct qla24xx_fw_dump isp24;
+        } isp;
+};
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 6734453ea28a..0930260aec2c 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -487,6 +487,7 @@ typedef struct {
 #define MBA_IP_RCV_BUFFER_EMPTY 0x8026  /* IP receive buffer queue empty. */
 #define MBA_IP_HDR_DATA_SPLIT   0x8027  /* IP header/data splitting feature */
                                         /* used. */
+#define MBA_TRACE_NOTIFICATION  0x8028  /* Trace/Diagnostic notification. */
 #define MBA_POINT_TO_POINT      0x8030  /* Point to point mode. */
 #define MBA_CMPLT_1_16BIT       0x8031  /* Completion 1 16bit IOSB. */
 #define MBA_CMPLT_2_16BIT       0x8032  /* Completion 2 16bit IOSB. */
@@ -608,7 +609,9 @@ typedef struct {
 #define MBC_SERDES_PARAMS               0x10    /* Serdes Tx Parameters. */
 #define MBC_GET_IOCB_STATUS             0x12    /* Get IOCB status command. */
 #define MBC_GET_TIMEOUT_PARAMS          0x22    /* Get FW timeouts. */
+#define MBC_TRACE_CONTROL               0x27    /* Trace control command. */
 #define MBC_GEN_SYSTEM_ERROR            0x2a    /* Generate System Error. */
+#define MBC_READ_SFP                    0x31    /* Read SFP Data. */
 #define MBC_SET_TIMEOUT_PARAMS          0x32    /* Set FW timeouts. */
 #define MBC_MID_INITIALIZE_FIRMWARE     0x48    /* MID Initialize firmware. */
 #define MBC_MID_GET_VP_DATABASE         0x49    /* MID Get VP Database. */
@@ -618,6 +621,9 @@ typedef struct {
 #define MBC_GET_LINK_PRIV_STATS         0x6d    /* Get link & private data. */
 #define MBC_SET_VENDOR_ID               0x76    /* Set Vendor ID. */
 
+#define TC_ENABLE                       4
+#define TC_DISABLE                      5
+
 /* Firmware return data sizes */
 #define FCAL_MAP_SIZE   128
 
@@ -1997,7 +2003,6 @@ struct isp_operations {
                 uint32_t);
 
         void (*fw_dump) (struct scsi_qla_host *, int);
-        void (*ascii_fw_dump) (struct scsi_qla_host *);
 
         int (*beacon_on) (struct scsi_qla_host *);
         int (*beacon_off) (struct scsi_qla_host *);
@@ -2041,6 +2046,7 @@ typedef struct scsi_qla_host {
                 uint32_t        enable_led_scheme       :1;
                 uint32_t        msi_enabled             :1;
                 uint32_t        msix_enabled            :1;
+                uint32_t        disable_serdes          :1;
         } flags;
 
         atomic_t        loop_state;
@@ -2238,6 +2244,11 @@ typedef struct scsi_qla_host {
         struct sns_cmd_pkt      *sns_cmd;
         dma_addr_t              sns_cmd_dma;
 
+#define SFP_DEV_SIZE    256
+#define SFP_BLOCK_SIZE  64
+        void                    *sfp_data;
+        dma_addr_t              sfp_data_dma;
+
         struct task_struct      *dpc_thread;
         uint8_t dpc_active;                  /* DPC routine is active */
 
@@ -2303,11 +2314,12 @@ typedef struct scsi_qla_host {
         uint16_t        fw_seriallink_options24[4];
 
         /* Firmware dump information. */
-        void            *fw_dump;
+        struct qla2xxx_fw_dump *fw_dump;
+        uint32_t        fw_dump_len;
         int             fw_dumped;
         int             fw_dump_reading;
-        char            *fw_dump_buffer;
-        int             fw_dump_buffer_len;
+        dma_addr_t      eft_dma;
+        void            *eft;
 
         uint8_t         host_str[16];
         uint32_t        pci_attr;
diff --git a/drivers/scsi/qla2xxx/qla_devtbl.h b/drivers/scsi/qla2xxx/qla_devtbl.h
index a8fc0ffc7fc5..dd435410dfa2 100644
--- a/drivers/scsi/qla2xxx/qla_devtbl.h
+++ b/drivers/scsi/qla2xxx/qla_devtbl.h
@@ -1,4 +1,4 @@
-#define QLA_MODEL_NAMES         0x4A
+#define QLA_MODEL_NAMES         0x57
 
 /*
  * Adapter model names and descriptions.
@@ -76,6 +76,19 @@ static char *qla2x00_model_name[QLA_MODEL_NAMES*2] = {
         "QLE2440",      "PCI-Express to 4Gb FC, Single Channel",        /* 0x145 */
         "QLE2464",      "PCI-Express to 4Gb FC, Quad Channel",          /* 0x146 */
         "QLA2440",      "PCI-X 2.0 to 4Gb FC, Single Channel",          /* 0x147 */
-        " ",            " ",                                            /* 0x148 */
+        "HP AE369A",    "PCI-X 2.0 to 4Gb FC, Dual Channel",            /* 0x148 */
         "QLA2340",      "Sun 133MHz PCI-X to 2Gb FC, Single Channel",   /* 0x149 */
+        " ",            " ",                                            /* 0x14a */
+        " ",            " ",                                            /* 0x14b */
+        "QMC2432M",     "IBM eServer BC 4Gb FC Expansion Card CFFE",    /* 0x14c */
+        "QMC2422M",     "IBM eServer BC 4Gb FC Expansion Card CFFX",    /* 0x14d */
+        "QLE220",       "Sun PCI-Express to 4Gb FC, Single Channel",    /* 0x14e */
+        " ",            " ",                                            /* 0x14f */
+        " ",            " ",                                            /* 0x150 */
+        " ",            " ",                                            /* 0x151 */
+        "QME2462",      "PCI-Express to 4Gb FC, Dual Channel Mezz HBA", /* 0x152 */
+        "QMH2462",      "PCI-Express to 4Gb FC, Dual Channel Mezz HBA", /* 0x153 */
+        " ",            " ",                                            /* 0x154 */
+        "QLE220",       "PCI-Express to 4Gb FC, Single Channel",        /* 0x155 */
+        "QLE220",       "PCI-Express to 4Gb FC, Single Channel",        /* 0x156 */
 };
diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h
index 3af478663be7..a0a722cf4237 100644
--- a/drivers/scsi/qla2xxx/qla_fw.h
+++ b/drivers/scsi/qla2xxx/qla_fw.h
@@ -141,7 +141,7 @@ struct nvram_24xx {
          * BIT 2  = Enable Memory Map BIOS
          * BIT 3  = Enable Selectable Boot
          * BIT 4  = Disable RISC code load
-         * BIT 5  =
+         * BIT 5  = Disable Serdes
          * BIT 6  =
          * BIT 7  =
          *
@@ -278,7 +278,7 @@ struct init_cb_24xx {
         uint16_t response_q_length;
         uint16_t request_q_length;
 
-        uint16_t link_down_timeout;             /* Milliseconds. */
+        uint16_t link_down_on_nos;              /* Milliseconds. */
 
         uint16_t prio_request_q_length;
 
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 164d53ccbfd0..8311ac2b93a8 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -31,13 +31,9 @@ extern void qla2x00_update_fw_options(struct scsi_qla_host *);
 extern void qla24xx_update_fw_options(scsi_qla_host_t *);
 extern int qla2x00_load_risc(struct scsi_qla_host *, uint32_t *);
 extern int qla24xx_load_risc(scsi_qla_host_t *, uint32_t *);
-extern int qla24xx_load_risc_flash(scsi_qla_host_t *, uint32_t *);
-
-extern fc_port_t *qla2x00_alloc_fcport(scsi_qla_host_t *, gfp_t);
 
 extern int qla2x00_loop_resync(scsi_qla_host_t *);
 
-extern int qla2x00_find_new_loop_id(scsi_qla_host_t *, fc_port_t *);
 extern int qla2x00_fabric_login(scsi_qla_host_t *, fc_port_t *, uint16_t *);
 extern int qla2x00_local_device_login(scsi_qla_host_t *, fc_port_t *);
 
@@ -51,6 +47,8 @@ extern int qla2x00_abort_isp(scsi_qla_host_t *);
 extern void qla2x00_update_fcport(scsi_qla_host_t *, fc_port_t *);
 extern void qla2x00_reg_remote_port(scsi_qla_host_t *, fc_port_t *);
 
+extern void qla2x00_alloc_fw_dump(scsi_qla_host_t *);
+
 /*
  * Global Data in qla_os.c source file.
  */
@@ -61,6 +59,8 @@ extern int qlport_down_retry;
 extern int ql2xplogiabsentdevice;
 extern int ql2xloginretrycount;
 extern int ql2xfdmienable;
+extern int ql2xallocfwdump;
+extern int extended_error_logging;
 
 extern void qla2x00_sp_compl(scsi_qla_host_t *, srb_t *);
 
@@ -80,8 +80,6 @@ extern void qla2xxx_wake_dpc(scsi_qla_host_t *);
 /*
  * Global Function Prototypes in qla_iocb.c source file.
  */
-extern void qla2x00_isp_cmd(scsi_qla_host_t *);
-
 extern uint16_t qla2x00_calc_iocbs_32(uint16_t);
 extern uint16_t qla2x00_calc_iocbs_64(uint16_t);
 extern void qla2x00_build_scsi_iocbs_32(srb_t *, cmd_entry_t *, uint16_t);
@@ -204,6 +202,12 @@ qla2x00_set_serdes_params(scsi_qla_host_t *, uint16_t, uint16_t, uint16_t);
 extern int
 qla2x00_stop_firmware(scsi_qla_host_t *);
 
+extern int
+qla2x00_trace_control(scsi_qla_host_t *, uint16_t, dma_addr_t, uint16_t);
+
+extern int
+qla2x00_read_sfp(scsi_qla_host_t *, dma_addr_t, uint16_t, uint16_t, uint16_t);
+
 /*
  * Global Function Prototypes in qla_isr.c source file.
  */
@@ -254,9 +258,6 @@ extern int qla24xx_write_optrom_data(struct scsi_qla_host *, uint8_t *,
 extern void qla2100_fw_dump(scsi_qla_host_t *, int);
 extern void qla2300_fw_dump(scsi_qla_host_t *, int);
 extern void qla24xx_fw_dump(scsi_qla_host_t *, int);
-extern void qla2100_ascii_fw_dump(scsi_qla_host_t *);
-extern void qla2300_ascii_fw_dump(scsi_qla_host_t *);
-extern void qla24xx_ascii_fw_dump(scsi_qla_host_t *);
 extern void qla2x00_dump_regs(scsi_qla_host_t *);
 extern void qla2x00_dump_buffer(uint8_t *, uint32_t);
 extern void qla2x00_print_scsi_cmd(struct scsi_cmnd *);
@@ -280,13 +281,6 @@ extern void *qla24xx_prep_ms_fdmi_iocb(scsi_qla_host_t *, uint32_t, uint32_t);
 extern int qla2x00_fdmi_register(scsi_qla_host_t *);
 
 /*
- * Global Function Prototypes in qla_xioctl.c source file.
- */
-#define qla2x00_enqueue_aen(ha, cmd, mode)      do { } while (0)
-#define qla2x00_alloc_ioctl_mem(ha)             (0)
-#define qla2x00_free_ioctl_mem(ha)              do { } while (0)
-
-/*
  * Global Function Prototypes in qla_attr.c source file.
  */
 struct class_device_attribute;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 3d4487eac9b7..859649160caa 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -39,6 +39,8 @@ static int qla2x00_fabric_dev_login(scsi_qla_host_t *, fc_port_t *,
 
 static int qla2x00_restart_isp(scsi_qla_host_t *);
 
+static int qla2x00_find_new_loop_id(scsi_qla_host_t *ha, fc_port_t *dev);
+
 /****************************************************************************/
 /*                QLogic ISP2x00 Hardware Support Functions.                */
 /****************************************************************************/
@@ -89,6 +91,17 @@ qla2x00_initialize_adapter(scsi_qla_host_t *ha)
 
         ha->isp_ops.nvram_config(ha);
 
+        if (ha->flags.disable_serdes) {
+                /* Mask HBA via NVRAM settings? */
+                qla_printk(KERN_INFO, ha, "Masking HBA WWPN "
+                    "%02x%02x%02x%02x%02x%02x%02x%02x (via NVRAM).\n",
+                    ha->port_name[0], ha->port_name[1],
+                    ha->port_name[2], ha->port_name[3],
+                    ha->port_name[4], ha->port_name[5],
+                    ha->port_name[6], ha->port_name[7]);
+                return QLA_FUNCTION_FAILED;
+        }
+
         qla_printk(KERN_INFO, ha, "Verifying loaded RISC code...\n");
 
         retry = 10;
@@ -770,29 +783,104 @@ qla24xx_chip_diag(scsi_qla_host_t *ha)
         return rval;
 }
 
-static void
+void
 qla2x00_alloc_fw_dump(scsi_qla_host_t *ha)
 {
-        uint32_t dump_size = 0;
+        int rval;
+        uint32_t dump_size, fixed_size, mem_size, req_q_size, rsp_q_size,
+            eft_size;
+        dma_addr_t eft_dma;
+        void *eft;
+
+        if (ha->fw_dump) {
+                qla_printk(KERN_WARNING, ha,
+                    "Firmware dump previously allocated.\n");
+                return;
+        }
 
         ha->fw_dumped = 0;
+        fixed_size = mem_size = eft_size = 0;
         if (IS_QLA2100(ha) || IS_QLA2200(ha)) {
-                dump_size = sizeof(struct qla2100_fw_dump);
+                fixed_size = sizeof(struct qla2100_fw_dump);
         } else if (IS_QLA23XX(ha)) {
-                dump_size = sizeof(struct qla2300_fw_dump);
-                dump_size += (ha->fw_memory_size - 0x11000) * sizeof(uint16_t);
-        } else if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
-                dump_size = sizeof(struct qla24xx_fw_dump);
-                dump_size += (ha->fw_memory_size - 0x100000) * sizeof(uint32_t);
+                fixed_size = offsetof(struct qla2300_fw_dump, data_ram);
+                mem_size = (ha->fw_memory_size - 0x11000 + 1) *
+                    sizeof(uint16_t);
+        } else if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
+                fixed_size = offsetof(struct qla24xx_fw_dump, ext_mem);
+                mem_size = (ha->fw_memory_size - 0x100000 + 1) *
+                    sizeof(uint32_t);
+
+                /* Allocate memory for Extended Trace Buffer. */
+                eft = dma_alloc_coherent(&ha->pdev->dev, EFT_SIZE, &eft_dma,
+                    GFP_KERNEL);
+                if (!eft) {
+                        qla_printk(KERN_WARNING, ha, "Unable to allocate "
+                            "(%d KB) for EFT.\n", EFT_SIZE / 1024);
+                        goto cont_alloc;
+                }
+
+                rval = qla2x00_trace_control(ha, TC_ENABLE, eft_dma,
+                    EFT_NUM_BUFFERS);
+                if (rval) {
+                        qla_printk(KERN_WARNING, ha, "Unable to initialize "
+                            "EFT (%d).\n", rval);
+                        dma_free_coherent(&ha->pdev->dev, EFT_SIZE, eft,
+                            eft_dma);
+                        goto cont_alloc;
+                }
+
+                qla_printk(KERN_INFO, ha, "Allocated (%d KB) for EFT...\n",
+                    EFT_SIZE / 1024);
+
+                eft_size = EFT_SIZE;
+                memset(eft, 0, eft_size);
+                ha->eft_dma = eft_dma;
+                ha->eft = eft;
         }
+cont_alloc:
+        req_q_size = ha->request_q_length * sizeof(request_t);
+        rsp_q_size = ha->response_q_length * sizeof(response_t);
+
+        dump_size = offsetof(struct qla2xxx_fw_dump, isp);
+        dump_size += fixed_size + mem_size + req_q_size + rsp_q_size +
+            eft_size;
 
         ha->fw_dump = vmalloc(dump_size);
-        if (ha->fw_dump)
-                qla_printk(KERN_INFO, ha, "Allocated (%d KB) for firmware "
-                    "dump...\n", dump_size / 1024);
-        else
+        if (!ha->fw_dump) {
                 qla_printk(KERN_WARNING, ha, "Unable to allocate (%d KB) for "
                     "firmware dump!!!\n", dump_size / 1024);
+
+                if (ha->eft) {
+                        dma_free_coherent(&ha->pdev->dev, eft_size, ha->eft,
+                            ha->eft_dma);
+                        ha->eft = NULL;
+                        ha->eft_dma = 0;
+                }
+                return;
+        }
+
+        qla_printk(KERN_INFO, ha, "Allocated (%d KB) for firmware dump...\n",
+            dump_size / 1024);
+
+        ha->fw_dump_len = dump_size;
+        ha->fw_dump->signature[0] = 'Q';
+        ha->fw_dump->signature[1] = 'L';
+        ha->fw_dump->signature[2] = 'G';
+        ha->fw_dump->signature[3] = 'C';
+        ha->fw_dump->version = __constant_htonl(1);
+
+        ha->fw_dump->fixed_size = htonl(fixed_size);
+        ha->fw_dump->mem_size = htonl(mem_size);
+        ha->fw_dump->req_q_size = htonl(req_q_size);
+        ha->fw_dump->rsp_q_size = htonl(rsp_q_size);
+
+        ha->fw_dump->eft_size = htonl(eft_size);
+        ha->fw_dump->eft_addr_l = htonl(LSD(ha->eft_dma));
+        ha->fw_dump->eft_addr_h = htonl(MSD(ha->eft_dma));
+
+        ha->fw_dump->header_size =
+            htonl(offsetof(struct qla2xxx_fw_dump, isp));
 }
 
 /**
@@ -810,8 +898,6 @@ qla2x00_resize_request_q(scsi_qla_host_t *ha)
         dma_addr_t request_dma;
         request_t *request_ring;
 
-        qla2x00_alloc_fw_dump(ha);
-
         /* Valid only on recent ISPs. */
         if (IS_QLA2100(ha) || IS_QLA2200(ha))
                 return;
@@ -883,6 +969,9 @@ qla2x00_setup_chip(scsi_qla_host_t *ha)
                                     &ha->fw_subminor_version,
                                     &ha->fw_attributes, &ha->fw_memory_size);
                                 qla2x00_resize_request_q(ha);
+
+                                if (ql2xallocfwdump)
+                                        qla2x00_alloc_fw_dump(ha);
                         }
                 } else {
                         DEBUG2(printk(KERN_INFO
@@ -1186,8 +1275,7 @@ qla2x00_fw_ready(scsi_qla_host_t *ha)
                         rval = QLA_FUNCTION_FAILED;
 
                         if (atomic_read(&ha->loop_down_timer) &&
-                            (fw_state >= FSTATE_LOSS_OF_SYNC ||
-                                fw_state == FSTATE_WAIT_AL_PA)) {
+                            fw_state != FSTATE_READY) {
                                 /* Loop down. Timeout on min_wait for states
                                  * other than Wait for Login.
                                  */
@@ -1555,6 +1643,8 @@ qla2x00_nvram_config(scsi_qla_host_t *ha)
         /*
          * Set host adapter parameters.
          */
+        if (nv->host_p[0] & BIT_7)
+                extended_error_logging = 1;
         ha->flags.disable_risc_code_load = ((nv->host_p[0] & BIT_4) ? 1 : 0);
         /* Always load RISC code on non ISP2[12]00 chips. */
         if (!IS_QLA2100(ha) && !IS_QLA2200(ha))
@@ -1563,6 +1653,7 @@ qla2x00_nvram_config(scsi_qla_host_t *ha)
         ha->flags.enable_lip_full_login = ((nv->host_p[1] & BIT_2) ? 1 : 0);
         ha->flags.enable_target_reset = ((nv->host_p[1] & BIT_3) ? 1 : 0);
         ha->flags.enable_led_scheme = (nv->special_options[1] & BIT_4) ? 1 : 0;
+        ha->flags.disable_serdes = 0;
 
         ha->operating_mode =
             (icb->add_firmware_options[0] & (BIT_6 | BIT_5 | BIT_4)) >> 4;
@@ -1701,7 +1792,7 @@ qla2x00_rport_del(void *data)
  *
  * Returns a pointer to the allocated fcport, or NULL, if none available.
  */
-fc_port_t *
+static fc_port_t *
 qla2x00_alloc_fcport(scsi_qla_host_t *ha, gfp_t flags)
 {
         fc_port_t *fcport;
@@ -2497,7 +2588,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *ha, struct list_head *new_fcports)
  * Context:
  *      Kernel context.
  */
-int
+static int
 qla2x00_find_new_loop_id(scsi_qla_host_t *ha, fc_port_t *dev)
 {
         int     rval;
@@ -2972,6 +3063,7 @@ qla2x00_update_fcports(scsi_qla_host_t *ha)
 int
 qla2x00_abort_isp(scsi_qla_host_t *ha)
 {
+        int rval;
         unsigned long flags = 0;
         uint16_t       cnt;
         srb_t          *sp;
@@ -3028,6 +3120,16 @@ qla2x00_abort_isp(scsi_qla_host_t *ha)
 
                         ha->isp_abort_cnt = 0;
                         clear_bit(ISP_ABORT_RETRY, &ha->dpc_flags);
+
+                        if (ha->eft) {
+                                rval = qla2x00_trace_control(ha, TC_ENABLE,
+                                    ha->eft_dma, EFT_NUM_BUFFERS);
+                                if (rval) {
+                                        qla_printk(KERN_WARNING, ha,
+                                            "Unable to reinitialize EFT "
+                                            "(%d).\n", rval);
+                                }
+                        }
                 } else {        /* failed the ISP abort */
                         ha->flags.online = 1;
                         if (test_bit(ISP_ABORT_RETRY, &ha->dpc_flags)) {
@@ -3048,14 +3150,14 @@ qla2x00_abort_isp(scsi_qla_host_t *ha)
                                         ha->isp_abort_cnt--;
                                         DEBUG(printk("qla%ld: ISP abort - "
                                             "retry remaining %d\n",
-                                            ha->host_no, ha->isp_abort_cnt);)
+                                            ha->host_no, ha->isp_abort_cnt));
                                         status = 1;
                                 }
                         } else {
                                 ha->isp_abort_cnt = MAX_RETRIES_OF_ISP_ABORT;
                                 DEBUG(printk("qla2x00(%ld): ISP error recovery "
                                     "- retrying (%d) more times\n",
-                                    ha->host_no, ha->isp_abort_cnt);)
+                                    ha->host_no, ha->isp_abort_cnt));
                                 set_bit(ISP_ABORT_RETRY, &ha->dpc_flags);
                                 status = 1;
                         }
@@ -3069,7 +3171,7 @@ qla2x00_abort_isp(scsi_qla_host_t *ha)
         } else {
                 DEBUG(printk(KERN_INFO
                                 "qla2x00_abort_isp(%ld): exiting.\n",
-                                ha->host_no);)
+                                ha->host_no));
         }
 
         return(status);
@@ -3145,7 +3247,7 @@ qla2x00_restart_isp(scsi_qla_host_t *ha)
                 clear_bit(RESET_MARKER_NEEDED, &ha->dpc_flags);
                 if (!(status = qla2x00_fw_ready(ha))) {
                         DEBUG(printk("%s(): Start configure loop, "
-                            "status = %d\n", __func__, status);)
+                            "status = %d\n", __func__, status));
 
                         /* Issue a marker after FW becomes ready. */
                         qla2x00_marker(ha, 0, 0, MK_SYNC_ALL);
@@ -3169,7 +3271,7 @@ qla2x00_restart_isp(scsi_qla_host_t *ha)
 
                 DEBUG(printk("%s(): Configure loop done, status = 0x%x\n",
                                 __func__,
-                                status);)
+                                status));
         }
         return (status);
 }
@@ -3289,7 +3391,6 @@ qla24xx_nvram_config(scsi_qla_host_t *ha)
                 nv->node_name[6] = 0x55;
                 nv->node_name[7] = 0x86;
                 nv->login_retry_count = __constant_cpu_to_le16(8);
-                nv->link_down_timeout = __constant_cpu_to_le16(200);
                 nv->interrupt_delay_timer = __constant_cpu_to_le16(0);
                 nv->login_timeout = __constant_cpu_to_le16(0);
                 nv->firmware_options_1 =
@@ -3318,7 +3419,7 @@ qla24xx_nvram_config(scsi_qla_host_t *ha)
                 *dptr1++ = *dptr2++;
 
         icb->login_retry_count = nv->login_retry_count;
-        icb->link_down_timeout = nv->link_down_timeout;
+        icb->link_down_on_nos = nv->link_down_on_nos;
 
         /* Copy 2nd segment. */
         dptr1 = (uint8_t *)&icb->interrupt_delay_timer;
@@ -3373,6 +3474,7 @@ qla24xx_nvram_config(scsi_qla_host_t *ha)
         ha->flags.enable_lip_full_login = 1;
         ha->flags.enable_target_reset = 1;
         ha->flags.enable_led_scheme = 0;
+        ha->flags.disable_serdes = le32_to_cpu(nv->host_p) & BIT_5 ? 1: 0;
 
         ha->operating_mode = (le32_to_cpu(icb->firmware_options_2) &
             (BIT_6 | BIT_5 | BIT_4)) >> 4;
@@ -3472,7 +3574,7 @@ qla24xx_nvram_config(scsi_qla_host_t *ha)
         return (rval);
 }
 
-int
+static int
 qla24xx_load_risc_flash(scsi_qla_host_t *ha, uint32_t *srisc_addr)
 {
         int     rval;
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 8c769cfaa14c..c5b3c610a32a 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -15,6 +15,7 @@ static inline uint16_t qla2x00_get_cmd_direction(struct scsi_cmnd *cmd);
 static inline cont_entry_t *qla2x00_prep_cont_type0_iocb(scsi_qla_host_t *);
 static inline cont_a64_entry_t *qla2x00_prep_cont_type1_iocb(scsi_qla_host_t *);
 static request_t *qla2x00_req_pkt(scsi_qla_host_t *ha);
+static void qla2x00_isp_cmd(scsi_qla_host_t *ha);
 
 /**
  * qla2x00_get_cmd_direction() - Determine control_flag data direction.
@@ -470,6 +471,7 @@ __qla2x00_marker(scsi_qla_host_t *ha, uint16_t loop_id, uint16_t lun,
                         mrk24->nport_handle = cpu_to_le16(loop_id);
                         mrk24->lun[1] = LSB(lun);
                         mrk24->lun[2] = MSB(lun);
+                        host_to_fcp_swap(mrk24->lun, sizeof(mrk24->lun));
                 } else {
                         SET_TARGET_ID(ha, mrk->target, loop_id);
                         mrk->lun = cpu_to_le16(lun);
@@ -574,7 +576,7 @@ qla2x00_req_pkt(scsi_qla_host_t *ha)
  *
  * Note: The caller must hold the hardware lock before calling this routine.
  */
-void
+static void
 qla2x00_isp_cmd(scsi_qla_host_t *ha)
 {
         device_reg_t __iomem *reg = ha->iobase;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index b28ac0a27e25..de0613135f70 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -395,10 +395,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                 set_bit(REGISTER_FC4_NEEDED, &ha->dpc_flags);
 
                 ha->flags.management_server_logged_in = 0;
-
-                /* Update AEN queue. */
-                qla2x00_enqueue_aen(ha, MBA_LIP_OCCURRED, NULL);
-
                 break;
 
         case MBA_LOOP_UP:               /* Loop Up Event */
@@ -418,9 +414,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                     link_speed);
 
                 ha->flags.management_server_logged_in = 0;
-
-                /* Update AEN queue. */
-                qla2x00_enqueue_aen(ha, MBA_LOOP_UP, NULL);
                 break;
 
         case MBA_LOOP_DOWN:             /* Loop Down Event */
@@ -439,9 +432,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                 ha->link_data_rate = LDR_UNKNOWN;
                 if (ql2xfdmienable)
                         set_bit(REGISTER_FDMI_NEEDED, &ha->dpc_flags);
-
-                /* Update AEN queue. */
-                qla2x00_enqueue_aen(ha, MBA_LOOP_DOWN, NULL);
                 break;
 
         case MBA_LIP_RESET:             /* LIP reset occurred */
@@ -460,10 +450,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
 
                 ha->operating_mode = LOOP;
                 ha->flags.management_server_logged_in = 0;
-
-                /* Update AEN queue. */
-                qla2x00_enqueue_aen(ha, MBA_LIP_RESET, NULL);
-
                 break;
 
         case MBA_POINT_TO_POINT:        /* Point-to-Point */
@@ -545,9 +531,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
 
                 set_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags);
                 set_bit(LOCAL_LOOP_UPDATE, &ha->dpc_flags);
-
-                /* Update AEN queue. */
-                qla2x00_enqueue_aen(ha, MBA_PORT_UPDATE, NULL);
                 break;
 
         case MBA_RSCN_UPDATE:           /* State Change Registration */
@@ -584,9 +567,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
 
                 set_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags);
                 set_bit(RSCN_UPDATE, &ha->dpc_flags);
-
-                /* Update AEN queue. */
-                qla2x00_enqueue_aen(ha, MBA_RSCN_UPDATE, &mb[0]);
                 break;
 
         /* case MBA_RIO_RESPONSE: */
@@ -607,6 +587,11 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                 DEBUG2(printk("scsi(%ld): Discard RND Frame -- %04x %04x "
                     "%04x.\n", ha->host_no, mb[1], mb[2], mb[3]));
                 break;
+
+        case MBA_TRACE_NOTIFICATION:
+                DEBUG2(printk("scsi(%ld): Trace Notification -- %04x %04x.\n",
+                ha->host_no, mb[1], mb[2]));
+                break;
         }
 }
 
@@ -1452,8 +1437,8 @@ qla24xx_ms_entry(scsi_qla_host_t *ha, struct ct_entry_24xx *pkt)
         DEBUG3(printk("%s(%ld): pkt=%p pkthandle=%d.\n",
             __func__, ha->host_no, pkt, pkt->handle));
 
-        DEBUG9(printk("%s: ct pkt dump:\n", __func__);)
-        DEBUG9(qla2x00_dump_buffer((void *)pkt, sizeof(struct ct_entry_24xx));)
+        DEBUG9(printk("%s: ct pkt dump:\n", __func__));
+        DEBUG9(qla2x00_dump_buffer((void *)pkt, sizeof(struct ct_entry_24xx)));
 
         /* Validate handle. */
         if (pkt->handle < MAX_OUTSTANDING_COMMANDS)
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index d6cb3bd1a29a..879f281e2ea2 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -13,13 +13,13 @@ qla2x00_mbx_sem_timeout(unsigned long data)
 {
         struct semaphore        *sem_ptr = (struct semaphore *)data;
 
-        DEBUG11(printk("qla2x00_sem_timeout: entered.\n");)
+        DEBUG11(printk("qla2x00_sem_timeout: entered.\n"));
 
         if (sem_ptr != NULL) {
                 up(sem_ptr);
         }
 
-        DEBUG11(printk("qla2x00_mbx_sem_timeout: exiting.\n");)
+        DEBUG11(printk("qla2x00_mbx_sem_timeout: exiting.\n"));
 }
 
 /*
@@ -61,7 +61,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
         rval = QLA_SUCCESS;
         abort_active = test_bit(ABORT_ISP_ACTIVE, &ha->dpc_flags);
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         /*
          * Wait for active mailbox commands to finish by waiting at most tov
@@ -72,7 +72,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                 if (qla2x00_down_timeout(&ha->mbx_cmd_sem, mcp->tov * HZ)) {
                         /* Timeout occurred. Return error. */
                         DEBUG2_3_11(printk("%s(%ld): cmd access timeout. "
-                            "Exiting.\n", __func__, ha->host_no);)
+                            "Exiting.\n", __func__, ha->host_no));
                         return QLA_FUNCTION_TIMEOUT;
                 }
         }
@@ -86,7 +86,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                 spin_lock_irqsave(&ha->mbx_reg_lock, mbx_flags);
 
         DEBUG11(printk("scsi(%ld): prepare to issue mbox cmd=0x%x.\n",
-            ha->host_no, mcp->mb[0]);)
+            ha->host_no, mcp->mb[0]));
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
 
@@ -131,14 +131,14 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
 
         /* Unlock mbx registers and wait for interrupt */
         DEBUG11(printk("%s(%ld): going to unlock irq & waiting for interrupt. "
-            "jiffies=%lx.\n", __func__, ha->host_no, jiffies);)
+            "jiffies=%lx.\n", __func__, ha->host_no, jiffies));
 
         /* Wait for mbx cmd completion until timeout */
 
         if (!abort_active && io_lock_on) {
                 /* sleep on completion semaphore */
                 DEBUG11(printk("%s(%ld): INTERRUPT MODE. Initializing timer.\n",
-                    __func__, ha->host_no);)
+                    __func__, ha->host_no));
 
                 init_timer(&tmp_intr_timer);
                 tmp_intr_timer.data = (unsigned long)&ha->mbx_intr_sem;
@@ -147,11 +147,11 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                     (void (*)(unsigned long))qla2x00_mbx_sem_timeout;
 
                 DEBUG11(printk("%s(%ld): Adding timer.\n", __func__,
-                    ha->host_no);)
+                    ha->host_no));
                 add_timer(&tmp_intr_timer);
 
                 DEBUG11(printk("%s(%ld): going to unlock & sleep. "
-                    "time=0x%lx.\n", __func__, ha->host_no, jiffies);)
+                    "time=0x%lx.\n", __func__, ha->host_no, jiffies));
 
                 set_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
 
@@ -170,14 +170,14 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                 down(&ha->mbx_intr_sem);
 
                 DEBUG11(printk("%s(%ld): waking up. time=0x%lx\n", __func__,
-                    ha->host_no, jiffies);)
+                    ha->host_no, jiffies));
                 clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
 
                 /* delete the timer */
                 del_timer(&tmp_intr_timer);
         } else {
                 DEBUG3_11(printk("%s(%ld): cmd=%x POLLING MODE.\n", __func__,
-                    ha->host_no, command);)
+                    ha->host_no, command));
 
                 if (IS_QLA24XX(ha) || IS_QLA54XX(ha))
                         WRT_REG_DWORD(&reg->isp24.hccr, HCCRX_SET_HOST_INT);
@@ -209,7 +209,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                 uint16_t *iptr2;
 
                 DEBUG3_11(printk("%s(%ld): cmd %x completed.\n", __func__,
-                    ha->host_no, command);)
+                    ha->host_no, command));
 
                 /* Got interrupt. Clear the flag. */
                 ha->flags.mbox_int = 0;
@@ -266,7 +266,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
 
         if (!abort_active) {
                 DEBUG11(printk("%s(%ld): checking for additional resp "
-                    "interrupt.\n", __func__, ha->host_no);)
+                    "interrupt.\n", __func__, ha->host_no));
 
                 /* polling mode for non isp_abort commands. */
                 qla2x00_poll(ha);
@@ -277,9 +277,9 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                 if (!io_lock_on || (mcp->flags & IOCTL_CMD)) {
                         /* not in dpc. schedule it for dpc to take over. */
                         DEBUG(printk("%s(%ld): timeout schedule "
-                            "isp_abort_needed.\n", __func__, ha->host_no);)
+                            "isp_abort_needed.\n", __func__, ha->host_no));
                         DEBUG2_3_11(printk("%s(%ld): timeout schedule "
-                            "isp_abort_needed.\n", __func__, ha->host_no);)
+                            "isp_abort_needed.\n", __func__, ha->host_no));
                         qla_printk(KERN_WARNING, ha,
                             "Mailbox command timeout occured. Scheduling ISP "
                             "abort.\n");
@@ -288,9 +288,9 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                 } else if (!abort_active) {
                         /* call abort directly since we are in the DPC thread */
                         DEBUG(printk("%s(%ld): timeout calling abort_isp\n",
-                            __func__, ha->host_no);)
+                            __func__, ha->host_no));
                         DEBUG2_3_11(printk("%s(%ld): timeout calling "
-                            "abort_isp\n", __func__, ha->host_no);)
+                            "abort_isp\n", __func__, ha->host_no));
                         qla_printk(KERN_WARNING, ha,
                             "Mailbox command timeout occured. Issuing ISP "
                             "abort.\n");
@@ -303,9 +303,9 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
                         }
                         clear_bit(ABORT_ISP_ACTIVE, &ha->dpc_flags);
                         DEBUG(printk("%s(%ld): finished abort_isp\n", __func__,
-                            ha->host_no);)
+                            ha->host_no));
                         DEBUG2_3_11(printk("%s(%ld): finished abort_isp\n",
-                            __func__, ha->host_no);)
+                            __func__, ha->host_no));
                 }
         }
 
@@ -316,9 +316,9 @@ qla2x00_mailbox_command(scsi_qla_host_t *ha, mbx_cmd_t *mcp)
         if (rval) {
                 DEBUG2_3_11(printk("%s(%ld): **** FAILED. mbx0=%x, mbx1=%x, "
                     "mbx2=%x, cmd=%x ****\n", __func__, ha->host_no,
-                    mcp->mb[0], mcp->mb[1], mcp->mb[2], command);)
+                    mcp->mb[0], mcp->mb[1], mcp->mb[2], command));
         } else {
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
         }
 
         return rval;
@@ -394,7 +394,7 @@ qla2x00_execute_fw(scsi_qla_host_t *ha, uint32_t risc_addr)
         mbx_cmd_t mc;
         mbx_cmd_t *mcp = &mc;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         mcp->mb[0] = MBC_EXECUTE_FIRMWARE;
         mcp->out_mb = MBX_0;
@@ -424,10 +424,10 @@ qla2x00_execute_fw(scsi_qla_host_t *ha, uint32_t risc_addr)
         } else {
                 if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
                         DEBUG11(printk("%s(%ld): done exchanges=%x.\n",
-                            __func__, ha->host_no, mcp->mb[1]);)
+                            __func__, ha->host_no, mcp->mb[1]));
                 } else {
                         DEBUG11(printk("%s(%ld): done.\n", __func__,
-                            ha->host_no);)
+                            ha->host_no));
                 }
         }
 
@@ -611,7 +611,7 @@ qla2x00_mbx_reg_test(scsi_qla_host_t *ha)
         mbx_cmd_t mc;
         mbx_cmd_t *mcp = &mc;
 
-        DEBUG11(printk("qla2x00_mbx_reg_test(%ld): entered.\n", ha->host_no);)
+        DEBUG11(printk("qla2x00_mbx_reg_test(%ld): entered.\n", ha->host_no));
 
         mcp->mb[0] = MBC_MAILBOX_REGISTER_TEST;
         mcp->mb[1] = 0xAAAA;
@@ -639,11 +639,11 @@ qla2x00_mbx_reg_test(scsi_qla_host_t *ha)
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_mbx_reg_test(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_mbx_reg_test(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -671,7 +671,7 @@ qla2x00_verify_checksum(scsi_qla_host_t *ha, uint32_t risc_addr)
         mbx_cmd_t mc;
         mbx_cmd_t *mcp = &mc;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         mcp->mb[0] = MBC_VERIFY_CHECKSUM;
         mcp->out_mb = MBX_0;
@@ -694,9 +694,9 @@ qla2x00_verify_checksum(scsi_qla_host_t *ha, uint32_t risc_addr)
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("%s(%ld): failed=%x chk sum=%x.\n", __func__,
                     ha->host_no, rval, (IS_QLA24XX(ha) || IS_QLA54XX(ha) ?
-                    (mcp->mb[2] << 16) | mcp->mb[1]: mcp->mb[1]));)
+                    (mcp->mb[2] << 16) | mcp->mb[1]: mcp->mb[1])));
         } else {
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
         }
 
         return rval;
@@ -743,9 +743,9 @@ qla2x00_issue_iocb(scsi_qla_host_t *ha, void*  buffer, dma_addr_t phys_addr,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG(printk("qla2x00_issue_iocb(%ld): failed rval 0x%x\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
                 DEBUG2(printk("qla2x00_issue_iocb(%ld): failed rval 0x%x\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 sts_entry_t *sts_entry = (sts_entry_t *) buffer;
 
@@ -781,7 +781,7 @@ qla2x00_abort_command(scsi_qla_host_t *ha, srb_t *sp)
         mbx_cmd_t       mc;
         mbx_cmd_t       *mcp = &mc;
 
-        DEBUG11(printk("qla2x00_abort_command(%ld): entered.\n", ha->host_no);)
+        DEBUG11(printk("qla2x00_abort_command(%ld): entered.\n", ha->host_no));
 
         fcport = sp->fcport;
 
@@ -813,11 +813,11 @@ qla2x00_abort_command(scsi_qla_host_t *ha, srb_t *sp)
 
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("qla2x00_abort_command(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 sp->flags |= SRB_ABORT_PENDING;
                 DEBUG11(printk("qla2x00_abort_command(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -848,7 +848,7 @@ qla2x00_abort_target(fc_port_t *fcport)
         if (fcport == NULL)
                 return 0;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, fcport->ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, fcport->ha->host_no));
 
         ha = fcport->ha;
         mcp->mb[0] = MBC_ABORT_TARGET;
@@ -872,11 +872,11 @@ qla2x00_abort_target(fc_port_t *fcport)
 
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("qla2x00_abort_target(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_abort_target(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -912,7 +912,7 @@ qla2x00_get_adapter_id(scsi_qla_host_t *ha, uint16_t *id, uint8_t *al_pa,
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_get_adapter_id(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         mcp->mb[0] = MBC_GET_ADAPTER_LOOP_ID;
         mcp->out_mb = MBX_0;
@@ -933,11 +933,11 @@ qla2x00_get_adapter_id(scsi_qla_host_t *ha, uint16_t *id, uint8_t *al_pa,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_get_adapter_id(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_get_adapter_id(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -968,7 +968,7 @@ qla2x00_get_retry_cnt(scsi_qla_host_t *ha, uint8_t *retry_cnt, uint8_t *tov,
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_get_retry_cnt(%ld): entered.\n",
-                        ha->host_no);)
+                        ha->host_no));
 
         mcp->mb[0] = MBC_GET_RETRY_COUNT;
         mcp->out_mb = MBX_0;
@@ -980,7 +980,7 @@ qla2x00_get_retry_cnt(scsi_qla_host_t *ha, uint8_t *retry_cnt, uint8_t *tov,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_get_retry_cnt(%ld): failed = %x.\n",
-                    ha->host_no, mcp->mb[0]);)
+                    ha->host_no, mcp->mb[0]));
         } else {
                 /* Convert returned data and check our values. */
                 *r_a_tov = mcp->mb[3] / 2;
@@ -992,7 +992,7 @@ qla2x00_get_retry_cnt(scsi_qla_host_t *ha, uint8_t *retry_cnt, uint8_t *tov,
                 }
 
                 DEBUG11(printk("qla2x00_get_retry_cnt(%ld): done. mb3=%d "
-                    "ratov=%d.\n", ha->host_no, mcp->mb[3], ratov);)
+                    "ratov=%d.\n", ha->host_no, mcp->mb[3], ratov));
         }
 
         return rval;
@@ -1023,7 +1023,7 @@ qla2x00_init_firmware(scsi_qla_host_t *ha, uint16_t size)
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_init_firmware(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         mcp->mb[0] = MBC_INITIALIZE_FIRMWARE;
         mcp->mb[2] = MSW(ha->init_cb_dma);
@@ -1043,11 +1043,11 @@ qla2x00_init_firmware(scsi_qla_host_t *ha, uint16_t size)
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_init_firmware(%ld): failed=%x "
                     "mb0=%x.\n",
-                    ha->host_no, rval, mcp->mb[0]);)
+                    ha->host_no, rval, mcp->mb[0]));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_init_firmware(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1079,7 +1079,7 @@ qla2x00_get_port_database(scsi_qla_host_t *ha, fc_port_t *fcport, uint8_t opt)
         struct port_database_24xx *pd24;
         dma_addr_t pd_dma;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         pd24 = NULL;
         pd = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pd_dma);
@@ -1220,7 +1220,7 @@ qla2x00_get_firmware_state(scsi_qla_host_t *ha, uint16_t *dptr)
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_get_firmware_state(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         mcp->mb[0] = MBC_GET_FIRMWARE_STATE;
         mcp->out_mb = MBX_0;
@@ -1235,11 +1235,11 @@ qla2x00_get_firmware_state(scsi_qla_host_t *ha, uint16_t *dptr)
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_get_firmware_state(%ld): "
-                    "failed=%x.\n", ha->host_no, rval);)
+                    "failed=%x.\n", ha->host_no, rval));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_get_firmware_state(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1272,7 +1272,7 @@ qla2x00_get_port_name(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t *name,
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_get_port_name(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         mcp->mb[0] = MBC_GET_PORT_NAME;
         mcp->out_mb = MBX_1|MBX_0;
@@ -1292,7 +1292,7 @@ qla2x00_get_port_name(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t *name,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_get_port_name(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 if (name != NULL) {
                         /* This function returns name in big endian. */
@@ -1307,7 +1307,7 @@ qla2x00_get_port_name(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t *name,
                 }
 
                 DEBUG11(printk("qla2x00_get_port_name(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1335,7 +1335,7 @@ qla2x00_lip_reset(scsi_qla_host_t *ha)
         mbx_cmd_t mc;
         mbx_cmd_t *mcp = &mc;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
                 mcp->mb[0] = MBC_LIP_FULL_LOGIN;
@@ -1364,10 +1364,10 @@ qla2x00_lip_reset(scsi_qla_host_t *ha)
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("%s(%ld): failed=%x.\n",
-                    __func__, ha->host_no, rval);)
+                    __func__, ha->host_no, rval));
         } else {
                 /*EMPTY*/
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
         }
 
         return rval;
@@ -1400,10 +1400,10 @@ qla2x00_send_sns(scsi_qla_host_t *ha, dma_addr_t sns_phys_address,
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_send_sns(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         DEBUG11(printk("qla2x00_send_sns: retry cnt=%d ratov=%d total "
-            "tov=%d.\n", ha->retry_count, ha->login_timeout, mcp->tov);)
+            "tov=%d.\n", ha->retry_count, ha->login_timeout, mcp->tov));
 
         mcp->mb[0] = MBC_SEND_SNS_COMMAND;
         mcp->mb[1] = cmd_size;
@@ -1421,12 +1421,12 @@ qla2x00_send_sns(scsi_qla_host_t *ha, dma_addr_t sns_phys_address,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG(printk("qla2x00_send_sns(%ld): failed=%x mb[0]=%x "
-                    "mb[1]=%x.\n", ha->host_no, rval, mcp->mb[0], mcp->mb[1]);)
+                    "mb[1]=%x.\n", ha->host_no, rval, mcp->mb[0], mcp->mb[1]));
                 DEBUG2_3_11(printk("qla2x00_send_sns(%ld): failed=%x mb[0]=%x "
-                    "mb[1]=%x.\n", ha->host_no, rval, mcp->mb[0], mcp->mb[1]);)
+                    "mb[1]=%x.\n", ha->host_no, rval, mcp->mb[0], mcp->mb[1]));
         } else {
                 /*EMPTY*/
-                DEBUG11(printk("qla2x00_send_sns(%ld): done.\n", ha->host_no);)
+                DEBUG11(printk("qla2x00_send_sns(%ld): done.\n", ha->host_no));
         }
 
         return rval;
@@ -1442,7 +1442,7 @@ qla24xx_login_fabric(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         dma_addr_t      lg_dma;
         uint32_t        iop[2];
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         lg = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &lg_dma);
         if (lg == NULL) {
@@ -1458,13 +1458,15 @@ qla24xx_login_fabric(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         lg->control_flags = __constant_cpu_to_le16(LCF_COMMAND_PLOGI);
         if (opt & BIT_0)
                 lg->control_flags |= __constant_cpu_to_le16(LCF_COND_PLOGI);
+        if (opt & BIT_1)
+                lg->control_flags |= __constant_cpu_to_le16(LCF_SKIP_PRLI);
         lg->port_id[0] = al_pa;
         lg->port_id[1] = area;
         lg->port_id[2] = domain;
         rval = qla2x00_issue_iocb(ha, lg, lg_dma, 0);
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("%s(%ld): failed to issue Login IOCB "
-                    "(%x).\n", __func__, ha->host_no, rval);)
+                    "(%x).\n", __func__, ha->host_no, rval));
         } else if (lg->entry_status != 0) {
                 DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
                     "-- error status (%x).\n", __func__, ha->host_no,
@@ -1505,7 +1507,7 @@ qla24xx_login_fabric(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
                         break;
                 }
         } else {
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
 
                 iop[0] = le32_to_cpu(lg->io_parameter[0]);
 
@@ -1559,7 +1561,7 @@ qla2x00_login_fabric(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         mbx_cmd_t mc;
         mbx_cmd_t *mcp = &mc;
 
-        DEBUG11(printk("qla2x00_login_fabric(%ld): entered.\n", ha->host_no);)
+        DEBUG11(printk("qla2x00_login_fabric(%ld): entered.\n", ha->host_no));
 
         mcp->mb[0] = MBC_LOGIN_FABRIC_PORT;
         mcp->out_mb = MBX_3|MBX_2|MBX_1|MBX_0;
@@ -1604,11 +1606,11 @@ qla2x00_login_fabric(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_login_fabric(%ld): failed=%x "
                     "mb[0]=%x mb[1]=%x mb[2]=%x.\n", ha->host_no, rval,
-                    mcp->mb[0], mcp->mb[1], mcp->mb[2]);)
+                    mcp->mb[0], mcp->mb[1], mcp->mb[2]));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_login_fabric(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1643,7 +1645,7 @@ qla2x00_login_local_device(scsi_qla_host_t *ha, fc_port_t *fcport,
                     fcport->d_id.b.domain, fcport->d_id.b.area,
                     fcport->d_id.b.al_pa, mb_ret, opt);
 
-        DEBUG3(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG3(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         mcp->mb[0] = MBC_LOGIN_LOOP_PORT;
         if (HAS_EXTENDED_IDS(ha))
@@ -1677,13 +1679,13 @@ qla2x00_login_local_device(scsi_qla_host_t *ha, fc_port_t *fcport,
 
                 DEBUG(printk("%s(%ld): failed=%x mb[0]=%x mb[1]=%x "
                     "mb[6]=%x mb[7]=%x.\n", __func__, ha->host_no, rval,
-                    mcp->mb[0], mcp->mb[1], mcp->mb[6], mcp->mb[7]);)
+                    mcp->mb[0], mcp->mb[1], mcp->mb[6], mcp->mb[7]));
                 DEBUG2_3(printk("%s(%ld): failed=%x mb[0]=%x mb[1]=%x "
                     "mb[6]=%x mb[7]=%x.\n", __func__, ha->host_no, rval,
-                    mcp->mb[0], mcp->mb[1], mcp->mb[6], mcp->mb[7]);)
+                    mcp->mb[0], mcp->mb[1], mcp->mb[6], mcp->mb[7]));
         } else {
                 /*EMPTY*/
-                DEBUG3(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG3(printk("%s(%ld): done.\n", __func__, ha->host_no));
         }
 
         return (rval);
@@ -1697,7 +1699,7 @@ qla24xx_fabric_logout(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         struct logio_entry_24xx *lg;
         dma_addr_t      lg_dma;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         lg = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &lg_dma);
         if (lg == NULL) {
@@ -1718,7 +1720,7 @@ qla24xx_fabric_logout(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         rval = qla2x00_issue_iocb(ha, lg, lg_dma, 0);
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("%s(%ld): failed to issue Logout IOCB "
-                    "(%x).\n", __func__, ha->host_no, rval);)
+                    "(%x).\n", __func__, ha->host_no, rval));
         } else if (lg->entry_status != 0) {
                 DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
                     "-- error status (%x).\n", __func__, ha->host_no,
@@ -1729,10 +1731,10 @@ qla24xx_fabric_logout(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
                     "-- completion status (%x)  ioparam=%x/%x.\n", __func__,
                     ha->host_no, le16_to_cpu(lg->comp_status),
                     le32_to_cpu(lg->io_parameter[0]),
-                    le32_to_cpu(lg->io_parameter[1]));)
+                    le32_to_cpu(lg->io_parameter[1])));
         } else {
                 /*EMPTY*/
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
         }
 
         dma_pool_free(ha->s_dma_pool, lg, lg_dma);
@@ -1765,7 +1767,7 @@ qla2x00_fabric_logout(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_fabric_logout(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         mcp->mb[0] = MBC_LOGOUT_FABRIC_PORT;
         mcp->out_mb = MBX_1|MBX_0;
@@ -1785,11 +1787,11 @@ qla2x00_fabric_logout(scsi_qla_host_t *ha, uint16_t loop_id, uint8_t domain,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_fabric_logout(%ld): failed=%x "
-                    "mbx1=%x.\n", ha->host_no, rval, mcp->mb[1]);)
+                    "mbx1=%x.\n", ha->host_no, rval, mcp->mb[1]));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_fabric_logout(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1818,7 +1820,7 @@ qla2x00_full_login_lip(scsi_qla_host_t *ha)
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_full_login_lip(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         mcp->mb[0] = MBC_LIP_FULL_LOGIN;
         mcp->mb[1] = 0;
@@ -1833,11 +1835,11 @@ qla2x00_full_login_lip(scsi_qla_host_t *ha)
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_full_login_lip(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 /*EMPTY*/
                 DEBUG11(printk("qla2x00_full_login_lip(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1864,7 +1866,7 @@ qla2x00_get_id_list(scsi_qla_host_t *ha, void *id_list, dma_addr_t id_list_dma,
         mbx_cmd_t *mcp = &mc;
 
         DEBUG11(printk("qla2x00_get_id_list(%ld): entered.\n",
-            ha->host_no);)
+            ha->host_no));
 
         if (id_list == NULL)
                 return QLA_FUNCTION_FAILED;
@@ -1893,11 +1895,11 @@ qla2x00_get_id_list(scsi_qla_host_t *ha, void *id_list, dma_addr_t id_list_dma,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("qla2x00_get_id_list(%ld): failed=%x.\n",
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
         } else {
                 *entries = mcp->mb[1];
                 DEBUG11(printk("qla2x00_get_id_list(%ld): done.\n",
-                    ha->host_no);)
+                    ha->host_no));
         }
 
         return rval;
@@ -1936,7 +1938,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *ha, uint16_t *cur_xchg_cnt,
         if (rval != QLA_SUCCESS) {
                 /*EMPTY*/
                 DEBUG2_3_11(printk("%s(%ld): failed = %x.\n", __func__,
-                    ha->host_no, mcp->mb[0]);)
+                    ha->host_no, mcp->mb[0]));
         } else {
                 DEBUG11(printk("%s(%ld): done. mb1=%x mb2=%x mb3=%x mb6=%x "
                     "mb7=%x mb10=%x.\n", __func__, ha->host_no,
@@ -2045,7 +2047,7 @@ qla2x00_get_link_status(scsi_qla_host_t *ha, uint16_t loop_id,
         link_stat_t *stat_buf;
         dma_addr_t stat_buf_dma;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         stat_buf = dma_pool_alloc(ha->s_dma_pool, GFP_ATOMIC, &stat_buf_dma);
         if (stat_buf == NULL) {
@@ -2083,7 +2085,7 @@ qla2x00_get_link_status(scsi_qla_host_t *ha, uint16_t loop_id,
         if (rval == QLA_SUCCESS) {
                 if (mcp->mb[0] != MBS_COMMAND_COMPLETE) {
                         DEBUG2_3_11(printk("%s(%ld): cmd failed. mbx0=%x.\n",
-                            __func__, ha->host_no, mcp->mb[0]);)
+                            __func__, ha->host_no, mcp->mb[0]));
                         status[0] = mcp->mb[0];
                         rval = BIT_1;
                 } else {
@@ -2108,12 +2110,12 @@ qla2x00_get_link_status(scsi_qla_host_t *ha, uint16_t loop_id,
                             stat_buf->loss_sync_cnt, stat_buf->loss_sig_cnt,
                             stat_buf->prim_seq_err_cnt,
                             stat_buf->inval_xmit_word_cnt,
-                            stat_buf->inval_crc_cnt);)
+                            stat_buf->inval_crc_cnt));
                 }
         } else {
                 /* Failed. */
                 DEBUG2_3_11(printk("%s(%ld): failed=%x.\n", __func__,
-                    ha->host_no, rval);)
+                    ha->host_no, rval));
                 rval = BIT_1;
         }
 
@@ -2132,7 +2134,7 @@ qla24xx_get_isp_stats(scsi_qla_host_t *ha, uint32_t *dwbuf, uint32_t dwords,
         uint32_t *sbuf, *siter;
         dma_addr_t sbuf_dma;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         if (dwords > (DMA_POOL_SIZE / 4)) {
                 DEBUG2_3_11(printk("%s(%ld): Unabled to retrieve %d DWORDs "
@@ -2196,7 +2198,7 @@ qla24xx_abort_command(scsi_qla_host_t *ha, srb_t *sp)
         dma_addr_t      abt_dma;
         uint32_t        handle;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
 
         fcport = sp->fcport;
 
@@ -2229,7 +2231,7 @@ qla24xx_abort_command(scsi_qla_host_t *ha, srb_t *sp)
         rval = qla2x00_issue_iocb(ha, abt, abt_dma, 0);
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("%s(%ld): failed to issue IOCB (%x).\n",
-                    __func__, ha->host_no, rval);)
+                    __func__, ha->host_no, rval));
         } else if (abt->entry_status != 0) {
                 DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
                     "-- error status (%x).\n", __func__, ha->host_no,
@@ -2238,10 +2240,10 @@ qla24xx_abort_command(scsi_qla_host_t *ha, srb_t *sp)
         } else if (abt->nport_handle != __constant_cpu_to_le16(0)) {
                 DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
                     "-- completion status (%x).\n", __func__, ha->host_no,
-                    le16_to_cpu(abt->nport_handle));)
+                    le16_to_cpu(abt->nport_handle)));
                 rval = QLA_FUNCTION_FAILED;
         } else {
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
                 sp->flags |= SRB_ABORT_PENDING;
         }
 
@@ -2268,7 +2270,7 @@ qla24xx_abort_target(fc_port_t *fcport)
         if (fcport == NULL)
                 return 0;
 
-        DEBUG11(printk("%s(%ld): entered.\n", __func__, fcport->ha->host_no);)
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, fcport->ha->host_no));
 
         ha = fcport->ha;
         tsk = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &tsk_dma);
@@ -2290,7 +2292,7 @@ qla24xx_abort_target(fc_port_t *fcport)
         rval = qla2x00_issue_iocb(ha, tsk, tsk_dma, 0);
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("%s(%ld): failed to issue Target Reset IOCB "
-                    "(%x).\n", __func__, ha->host_no, rval);)
+                    "(%x).\n", __func__, ha->host_no, rval));
                 goto atarget_done;
         } else if (tsk->p.sts.entry_status != 0) {
                 DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
@@ -2302,7 +2304,7 @@ qla24xx_abort_target(fc_port_t *fcport)
             __constant_cpu_to_le16(CS_COMPLETE)) {
                 DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
                     "-- completion status (%x).\n", __func__,
-                    ha->host_no, le16_to_cpu(tsk->p.sts.comp_status));)
+                    ha->host_no, le16_to_cpu(tsk->p.sts.comp_status)));
                 rval = QLA_FUNCTION_FAILED;
                 goto atarget_done;
         }
@@ -2311,9 +2313,9 @@ qla24xx_abort_target(fc_port_t *fcport)
         rval = qla2x00_marker(ha, fcport->loop_id, 0, MK_SYNC_ID);
         if (rval != QLA_SUCCESS) {
                 DEBUG2_3_11(printk("%s(%ld): failed to issue Marker IOCB "
-                    "(%x).\n", __func__, ha->host_no, rval);)
+                    "(%x).\n", __func__, ha->host_no, rval));
         } else {
-                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no);)
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
         }
 
 atarget_done:
@@ -2460,3 +2462,81 @@ qla2x00_stop_firmware(scsi_qla_host_t *ha)
 
         return rval;
 }
+
+int
+qla2x00_trace_control(scsi_qla_host_t *ha, uint16_t ctrl, dma_addr_t eft_dma,
+    uint16_t buffers)
+{
+        int rval;
+        mbx_cmd_t mc;
+        mbx_cmd_t *mcp = &mc;
+
+        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha))
+                return QLA_FUNCTION_FAILED;
+
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
+
+        mcp->mb[0] = MBC_TRACE_CONTROL;
+        mcp->mb[1] = ctrl;
+        mcp->out_mb = MBX_1|MBX_0;
+        mcp->in_mb = MBX_1|MBX_0;
+        if (ctrl == TC_ENABLE) {
+                mcp->mb[2] = LSW(eft_dma);
+                mcp->mb[3] = MSW(eft_dma);
+                mcp->mb[4] = LSW(MSD(eft_dma));
+                mcp->mb[5] = MSW(MSD(eft_dma));
+                mcp->mb[6] = buffers;
+                mcp->mb[7] = buffers;
+                mcp->out_mb |= MBX_7|MBX_6|MBX_5|MBX_4|MBX_3|MBX_2;
+        }
+        mcp->tov = 30;
+        mcp->flags = 0;
+        rval = qla2x00_mailbox_command(ha, mcp);
+
+        if (rval != QLA_SUCCESS) {
+                DEBUG2_3_11(printk("%s(%ld): failed=%x mb[0]=%x mb[1]=%x.\n",
+                    __func__, ha->host_no, rval, mcp->mb[0], mcp->mb[1]));
+        } else {
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
+        }
+
+        return rval;
+}
+
+int
+qla2x00_read_sfp(scsi_qla_host_t *ha, dma_addr_t sfp_dma, uint16_t addr,
+    uint16_t off, uint16_t count)
+{
+        int rval;
+        mbx_cmd_t mc;
+        mbx_cmd_t *mcp = &mc;
+
+        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha))
+                return QLA_FUNCTION_FAILED;
+
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
+
+        mcp->mb[0] = MBC_READ_SFP;
+        mcp->mb[1] = addr;
+        mcp->mb[2] = MSW(sfp_dma);
+        mcp->mb[3] = LSW(sfp_dma);
+        mcp->mb[6] = MSW(MSD(sfp_dma));
+        mcp->mb[7] = LSW(MSD(sfp_dma));
+        mcp->mb[8] = count;
+        mcp->mb[9] = off;
+        mcp->mb[10] = 0;
+        mcp->out_mb = MBX_10|MBX_9|MBX_8|MBX_7|MBX_6|MBX_3|MBX_2|MBX_1|MBX_0;
+        mcp->in_mb = MBX_0;
+        mcp->tov = 30;
+        mcp->flags = 0;
+        rval = qla2x00_mailbox_command(ha, mcp);
+
+        if (rval != QLA_SUCCESS) {
+                DEBUG2_3_11(printk("%s(%ld): failed=%x (%x).\n", __func__,
+                    ha->host_no, rval, mcp->mb[0]));
+        } else {
+                DEBUG11(printk("%s(%ld): done.\n", __func__, ha->host_no));
+        }
+
+        return rval;
+}
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 93062593ebe7..65cbe2f5eea2 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -39,14 +39,14 @@ MODULE_PARM_DESC(ql2xlogintimeout,
 int qlport_down_retry = 30;
 module_param(qlport_down_retry, int, S_IRUGO|S_IRUSR);
 MODULE_PARM_DESC(qlport_down_retry,
-                "Maximum number of command retries to a port that returns"
+                "Maximum number of command retries to a port that returns "
                 "a PORT-DOWN status.");
 
 int ql2xplogiabsentdevice;
 module_param(ql2xplogiabsentdevice, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(ql2xplogiabsentdevice,
                 "Option to enable PLOGI to devices that are not present after "
-                "a Fabric scan.  This is needed for several broken switches."
+                "a Fabric scan.  This is needed for several broken switches. "
                 "Default is 0 - no PLOGI. 1 - perfom PLOGI.");
 
 int ql2xloginretrycount = 0;
@@ -54,6 +54,19 @@ module_param(ql2xloginretrycount, int, S_IRUGO|S_IRUSR);
 MODULE_PARM_DESC(ql2xloginretrycount,
                 "Specify an alternate value for the NVRAM login retry count.");
 
+int ql2xallocfwdump = 1;
+module_param(ql2xallocfwdump, int, S_IRUGO|S_IRUSR);
+MODULE_PARM_DESC(ql2xallocfwdump,
+                "Option to enable allocation of memory for a firmware dump "
+                "during HBA initialization.  Memory allocation requirements "
+                "vary by ISP type.  Default is 1 - allocate memory.");
+
+int extended_error_logging;
+module_param(extended_error_logging, int, S_IRUGO|S_IRUSR);
+MODULE_PARM_DESC(extended_error_logging,
+                "Option to enable extended error logging, "
+                "Default is 0 - no logging. 1 - log errors.");
+
 static void qla2x00_free_device(scsi_qla_host_t *);
 
 static void qla2x00_config_dma_addressing(scsi_qla_host_t *ha);
@@ -624,7 +637,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 
                 DEBUG2(printk("%s(%ld): aborting sp %p from RISC. pid=%ld.\n",
                     __func__, ha->host_no, sp, serial));
-                DEBUG3(qla2x00_print_scsi_cmd(cmd);)
+                DEBUG3(qla2x00_print_scsi_cmd(cmd));
 
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 if (ha->isp_ops.abort_command(ha, sp)) {
@@ -731,7 +744,6 @@ qla2xxx_eh_device_reset(struct scsi_cmnd *cmd)
 {
         scsi_qla_host_t *ha = to_qla_host(cmd->device->host);
         fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
-        srb_t *sp;
         int ret;
         unsigned int id, lun;
         unsigned long serial;
@@ -742,8 +754,7 @@ qla2xxx_eh_device_reset(struct scsi_cmnd *cmd)
         lun = cmd->device->lun;
         serial = cmd->serial_number;
 
-        sp = (srb_t *) CMD_SP(cmd);
-        if (!sp || !fcport)
+        if (!fcport)
                 return ret;
 
         qla_printk(KERN_INFO, ha,
@@ -766,7 +777,7 @@ qla2xxx_eh_device_reset(struct scsi_cmnd *cmd)
 #endif
         } else {
                 DEBUG2(printk(KERN_INFO
-                    "%s failed: loop not ready\n",__func__);)
+                    "%s failed: loop not ready\n",__func__));
         }
 
         if (ret == FAILED) {
@@ -862,7 +873,6 @@ qla2xxx_eh_bus_reset(struct scsi_cmnd *cmd)
 {
         scsi_qla_host_t *ha = to_qla_host(cmd->device->host);
         fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
-        srb_t *sp;
         int ret;
         unsigned int id, lun;
         unsigned long serial;
@@ -873,8 +883,7 @@ qla2xxx_eh_bus_reset(struct scsi_cmnd *cmd)
         lun = cmd->device->lun;
         serial = cmd->serial_number;
 
-        sp = (srb_t *) CMD_SP(cmd);
-        if (!sp || !fcport)
+        if (!fcport)
                 return ret;
 
         qla_printk(KERN_INFO, ha,
@@ -923,7 +932,6 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
 {
         scsi_qla_host_t *ha = to_qla_host(cmd->device->host);
         fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
-        srb_t *sp;
         int ret;
         unsigned int id, lun;
         unsigned long serial;
@@ -934,8 +942,7 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
         lun = cmd->device->lun;
         serial = cmd->serial_number;
 
-        sp = (srb_t *) CMD_SP(cmd);
-        if (!sp || !fcport)
+        if (!fcport)
                 return ret;
 
         qla_printk(KERN_INFO, ha,
@@ -1021,12 +1028,12 @@ qla2x00_loop_reset(scsi_qla_host_t *ha)
                 /* Empty */
                 DEBUG2_3(printk("%s(%ld): **** FAILED ****\n",
                                 __func__,
-                                ha->host_no);)
+                                ha->host_no));
         } else {
                 /* Empty */
                 DEBUG3(printk("%s(%ld): exiting normally.\n",
                                 __func__,
-                                ha->host_no);)
+                                ha->host_no));
         }
 
         return(status);
@@ -1324,7 +1331,8 @@ qla24xx_disable_intrs(scsi_qla_host_t *ha)
 /*
  * PCI driver interface
  */
-static int qla2x00_probe_one(struct pci_dev *pdev)
+static int __devinit
+qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         int     ret = -ENODEV;
         device_reg_t __iomem *reg;
@@ -1405,7 +1413,6 @@ static int qla2x00_probe_one(struct pci_dev *pdev)
         ha->isp_ops.read_nvram          = qla2x00_read_nvram_data;
         ha->isp_ops.write_nvram         = qla2x00_write_nvram_data;
         ha->isp_ops.fw_dump             = qla2100_fw_dump;
-        ha->isp_ops.ascii_fw_dump       = qla2100_ascii_fw_dump;
         ha->isp_ops.read_optrom         = qla2x00_read_optrom_data;
         ha->isp_ops.write_optrom        = qla2x00_write_optrom_data;
         if (IS_QLA2100(ha)) {
@@ -1432,7 +1439,6 @@ static int qla2x00_probe_one(struct pci_dev *pdev)
                 ha->isp_ops.pci_config = qla2300_pci_config;
                 ha->isp_ops.intr_handler = qla2300_intr_handler;
                 ha->isp_ops.fw_dump = qla2300_fw_dump;
-                ha->isp_ops.ascii_fw_dump = qla2300_ascii_fw_dump;
                 ha->isp_ops.beacon_on = qla2x00_beacon_on;
                 ha->isp_ops.beacon_off = qla2x00_beacon_off;
                 ha->isp_ops.beacon_blink = qla2x00_beacon_blink;
@@ -1469,7 +1475,6 @@ static int qla2x00_probe_one(struct pci_dev *pdev)
                 ha->isp_ops.read_nvram = qla24xx_read_nvram_data;
                 ha->isp_ops.write_nvram = qla24xx_write_nvram_data;
                 ha->isp_ops.fw_dump = qla24xx_fw_dump;
-                ha->isp_ops.ascii_fw_dump = qla24xx_ascii_fw_dump;
                 ha->isp_ops.read_optrom = qla24xx_read_optrom_data;
                 ha->isp_ops.write_optrom = qla24xx_write_optrom_data;
                 ha->isp_ops.beacon_on = qla24xx_beacon_on;
@@ -1640,7 +1645,8 @@ probe_out:
         return ret;
 }
 
-static void qla2x00_remove_one(struct pci_dev *pdev)
+static void __devexit
+qla2x00_remove_one(struct pci_dev *pdev)
 {
         scsi_qla_host_t *ha;
 
@@ -1678,6 +1684,9 @@ qla2x00_free_device(scsi_qla_host_t *ha)
                 kthread_stop(t);
         }
 
+        if (ha->eft)
+                qla2x00_trace_control(ha, TC_DISABLE, 0, 0);
+
         /* Stop currently executing firmware. */
         qla2x00_stop_firmware(ha);
 
@@ -1899,17 +1908,6 @@ qla2x00_mem_alloc(scsi_qla_host_t *ha)
                 }
                 memset(ha->init_cb, 0, ha->init_cb_size);
 
-                /* Allocate ioctl related memory. */
-                if (qla2x00_alloc_ioctl_mem(ha)) {
-                        qla_printk(KERN_WARNING, ha,
-                            "Memory Allocation failed - ioctl_mem\n");
-
-                        qla2x00_mem_free(ha);
-                        msleep(100);
-
-                        continue;
-                }
-
                 if (qla2x00_allocate_sp_pool(ha)) {
                         qla_printk(KERN_WARNING, ha,
                             "Memory Allocation failed - "
@@ -1972,6 +1970,26 @@ qla2x00_mem_alloc(scsi_qla_host_t *ha)
                                 continue;
                         }
                         memset(ha->ct_sns, 0, sizeof(struct ct_sns_pkt));
+
+                        if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
+                                /*
+                                 * Get consistent memory allocated for SFP
+                                 * block.
+                                 */
+                                ha->sfp_data = dma_pool_alloc(ha->s_dma_pool,
+                                    GFP_KERNEL, &ha->sfp_data_dma);
+                                if (ha->sfp_data == NULL) {
+                                        qla_printk(KERN_WARNING, ha,
+                                            "Memory Allocation failed - "
+                                            "sfp_data\n");
+
+                                        qla2x00_mem_free(ha);
+                                        msleep(100);
+
+                                        continue;
+                                }
+                                memset(ha->sfp_data, 0, SFP_BLOCK_SIZE);
+                        }
                 }
 
                 /* Done all allocations without any error. */
@@ -2006,12 +2024,16 @@ qla2x00_mem_free(scsi_qla_host_t *ha)
                 return;
         }
 
-        /* free ioctl memory */
-        qla2x00_free_ioctl_mem(ha);
-
         /* free sp pool */
         qla2x00_free_sp_pool(ha);
 
+        if (ha->fw_dump) {
+                if (ha->eft)
+                        dma_free_coherent(&ha->pdev->dev,
+                            ntohl(ha->fw_dump->eft_size), ha->eft, ha->eft_dma);
+                vfree(ha->fw_dump);
+        }
+
         if (ha->sns_cmd)
                 dma_free_coherent(&ha->pdev->dev, sizeof(struct sns_cmd_pkt),
                     ha->sns_cmd, ha->sns_cmd_dma);
@@ -2020,6 +2042,9 @@ qla2x00_mem_free(scsi_qla_host_t *ha)
                 dma_free_coherent(&ha->pdev->dev, sizeof(struct ct_sns_pkt),
                     ha->ct_sns, ha->ct_sns_dma);
 
+        if (ha->sfp_data)
+                dma_pool_free(ha->s_dma_pool, ha->sfp_data, ha->sfp_data_dma);
+
         if (ha->ms_iocb)
                 dma_pool_free(ha->s_dma_pool, ha->ms_iocb, ha->ms_iocb_dma);
 
@@ -2043,6 +2068,8 @@ qla2x00_mem_free(scsi_qla_host_t *ha)
                     (ha->request_q_length + 1) * sizeof(request_t),
                     ha->request_ring, ha->request_dma);
 
+        ha->eft = NULL;
+        ha->eft_dma = 0;
         ha->sns_cmd = NULL;
         ha->sns_cmd_dma = 0;
         ha->ct_sns = NULL;
@@ -2071,13 +2098,9 @@ qla2x00_mem_free(scsi_qla_host_t *ha)
         }
         INIT_LIST_HEAD(&ha->fcports);
 
-        vfree(ha->fw_dump);
-        vfree(ha->fw_dump_buffer);
-
         ha->fw_dump = NULL;
         ha->fw_dumped = 0;
         ha->fw_dump_reading = 0;
-        ha->fw_dump_buffer = NULL;
 
         vfree(ha->optrom_buffer);
 }
@@ -2215,9 +2238,6 @@ qla2x00_do_dpc(void *data)
 
                         next_loopid = 0;
                         list_for_each_entry(fcport, &ha->fcports, list) {
-                                if (fcport->port_type != FCT_TARGET)
-                                        continue;
-
                                 /*
                                  * If the port is not ONLINE then try to login
                                  * to it if we haven't run out of retries.
@@ -2617,40 +2637,16 @@ static struct pci_device_id qla2xxx_pci_tbl[] = {
 };
 MODULE_DEVICE_TABLE(pci, qla2xxx_pci_tbl);
 
-static int __devinit
-qla2xxx_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
-{
-        return qla2x00_probe_one(pdev);
-}
-
-static void __devexit
-qla2xxx_remove_one(struct pci_dev *pdev)
-{
-        qla2x00_remove_one(pdev);
-}
-
 static struct pci_driver qla2xxx_pci_driver = {
         .name           = QLA2XXX_DRIVER_NAME,
         .driver         = {
                 .owner          = THIS_MODULE,
         },
         .id_table       = qla2xxx_pci_tbl,
-        .probe          = qla2xxx_probe_one,
-        .remove         = __devexit_p(qla2xxx_remove_one),
+        .probe          = qla2x00_probe_one,
+        .remove         = __devexit_p(qla2x00_remove_one),
 };
 
-static inline int
-qla2x00_pci_module_init(void)
-{
-        return pci_module_init(&qla2xxx_pci_driver);
-}
-
-static inline void
-qla2x00_pci_module_exit(void)
-{
-        pci_unregister_driver(&qla2xxx_pci_driver);
-}
-
 /**
  * qla2x00_module_init - Module initialization.
  **/
@@ -2670,16 +2666,16 @@ qla2x00_module_init(void)
 
         /* Derive version string. */
         strcpy(qla2x00_version_str, QLA2XXX_VERSION);
-#if DEBUG_QLA2100
-        strcat(qla2x00_version_str, "-debug");
-#endif
+        if (extended_error_logging)
+                strcat(qla2x00_version_str, "-debug");
+
         qla2xxx_transport_template =
             fc_attach_transport(&qla2xxx_transport_functions);
         if (!qla2xxx_transport_template)
                 return -ENODEV;
 
         printk(KERN_INFO "QLogic Fibre Channel HBA Driver\n");
-        ret = qla2x00_pci_module_init();
+        ret = pci_register_driver(&qla2xxx_pci_driver);
         if (ret) {
                 kmem_cache_destroy(srb_cachep);
                 fc_release_transport(qla2xxx_transport_template);
@@ -2693,7 +2689,7 @@ qla2x00_module_init(void)
 static void __exit
 qla2x00_module_exit(void)
 {
-        qla2x00_pci_module_exit();
+        pci_unregister_driver(&qla2xxx_pci_driver);
         qla2x00_release_firmware();
         kmem_cache_destroy(srb_cachep);
         fc_release_transport(qla2xxx_transport_template);
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 6b315521bd89..971259032ef7 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,9 +7,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.01.05-k2"
+#define QLA2XXX_VERSION      "8.01.07-k1"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    1
-#define QLA_DRIVER_PATCH_VER    5
+#define QLA_DRIVER_PATCH_VER    7
 #define QLA_DRIVER_BETA_VER     0
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 69e0551a81d2..5b2f0741a55b 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -874,7 +874,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
         if (Cmnd->use_sg) {
                 int sg_count;
 
-                sg = (struct scatterlist *) Cmnd->buffer;
+                sg = (struct scatterlist *) Cmnd->request_buffer;
                 sg_count = sbus_map_sg(qpti->sdev, sg, Cmnd->use_sg, Cmnd->sc_data_direction);
 
                 ds = cmd->dataseg;
@@ -1278,7 +1278,7 @@ static struct scsi_cmnd *qlogicpti_intr_handler(struct qlogicpti *qpti)
 
                 if (Cmnd->use_sg) {
                         sbus_unmap_sg(qpti->sdev,
-                                      (struct scatterlist *)Cmnd->buffer,
+                                      (struct scatterlist *)Cmnd->request_buffer,
                                       Cmnd->use_sg,
                                       Cmnd->sc_data_direction);
                 } else {
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index 1053c7c76b7d..fa38a413d16b 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -1961,8 +1961,7 @@ comreset_retry:
         timeout = jiffies + msecs_to_jiffies(200);
         do {
                 sata_scr_read(ap, SCR_STATUS, &sstatus);
-                sstatus &= 0x3;
-                if ((sstatus == 3) || (sstatus == 0))
+                if (((sstatus & 0x3) == 3) || ((sstatus & 0x3) == 0))
                         break;
 
                 __msleep(1, can_sleep);
diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index 64631bd38952..4776f4e55839 100644
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -269,8 +269,15 @@ static const struct pci_device_id pdc_ata_pci_tbl[] = {
         { PCI_VENDOR_ID_PROMISE, 0x6629, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_20619 },
 
+/* TODO: remove all associated board_20771 code, as it completely
+ * duplicates board_2037x code, unless reason for separation can be
+ * divined.
+ */
+#if 0
         { PCI_VENDOR_ID_PROMISE, 0x3570, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_20771 },
+#endif
+
         { }     /* terminate list */
 };
 
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index 7aabb45c35e5..d0a85073ebf7 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -109,6 +109,7 @@ enum {
 };
 
 static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent);
+static int sil_pci_device_resume(struct pci_dev *pdev);
 static void sil_dev_config(struct ata_port *ap, struct ata_device *dev);
 static u32 sil_scr_read (struct ata_port *ap, unsigned int sc_reg);
 static void sil_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val);
@@ -160,6 +161,8 @@ static struct pci_driver sil_pci_driver = {
         .id_table               = sil_pci_tbl,
         .probe                  = sil_init_one,
         .remove                 = ata_pci_remove_one,
+        .suspend                = ata_pci_device_suspend,
+        .resume                 = sil_pci_device_resume,
 };
 
 static struct scsi_host_template sil_sht = {
@@ -178,6 +181,8 @@ static struct scsi_host_template sil_sht = {
         .slave_configure        = ata_scsi_slave_config,
         .slave_destroy          = ata_scsi_slave_destroy,
         .bios_param             = ata_std_bios_param,
+        .suspend                = ata_scsi_device_suspend,
+        .resume                 = ata_scsi_device_resume,
 };
 
 static const struct ata_port_operations sil_ops = {
@@ -370,7 +375,7 @@ static void sil_host_intr(struct ata_port *ap, u32 bmdma2)
                  * during hardreset makes controllers with broken SIEN
                  * repeat probing needlessly.
                  */
-                if (!(ap->flags & ATA_FLAG_FROZEN)) {
+                if (!(ap->pflags & ATA_PFLAG_FROZEN)) {
                         ata_ehi_hotplugged(&ap->eh_info);
                         ap->eh_info.serror |= serror;
                 }
@@ -561,6 +566,52 @@ static void sil_dev_config(struct ata_port *ap, struct ata_device *dev)
         }
 }
 
+static void sil_init_controller(struct pci_dev *pdev,
+                                int n_ports, unsigned long host_flags,
+                                void __iomem *mmio_base)
+{
+        u8 cls;
+        u32 tmp;
+        int i;
+
+        /* Initialize FIFO PCI bus arbitration */
+        cls = sil_get_device_cache_line(pdev);
+        if (cls) {
+                cls >>= 3;
+                cls++;  /* cls = (line_size/8)+1 */
+                for (i = 0; i < n_ports; i++)
+                        writew(cls << 8 | cls,
+                               mmio_base + sil_port[i].fifo_cfg);
+        } else
+                dev_printk(KERN_WARNING, &pdev->dev,
+                           "cache line size not set.  Driver may not function\n");
+
+        /* Apply R_ERR on DMA activate FIS errata workaround */
+        if (host_flags & SIL_FLAG_RERR_ON_DMA_ACT) {
+                int cnt;
+
+                for (i = 0, cnt = 0; i < n_ports; i++) {
+                        tmp = readl(mmio_base + sil_port[i].sfis_cfg);
+                        if ((tmp & 0x3) != 0x01)
+                                continue;
+                        if (!cnt)
+                                dev_printk(KERN_INFO, &pdev->dev,
+                                           "Applying R_ERR on DMA activate "
+                                           "FIS errata fix\n");
+                        writel(tmp & ~0x3, mmio_base + sil_port[i].sfis_cfg);
+                        cnt++;
+                }
+        }
+
+        if (n_ports == 4) {
+                /* flip the magic "make 4 ports work" bit */
+                tmp = readl(mmio_base + sil_port[2].bmdma);
+                if ((tmp & SIL_INTR_STEERING) == 0)
+                        writel(tmp | SIL_INTR_STEERING,
+                               mmio_base + sil_port[2].bmdma);
+        }
+}
+
 static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         static int printed_version;
@@ -570,8 +621,6 @@ static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         int rc;
         unsigned int i;
         int pci_dev_busy = 0;
-        u32 tmp;
-        u8 cls;
 
         if (!printed_version++)
                 dev_printk(KERN_DEBUG, &pdev->dev, "version " DRV_VERSION "\n");
@@ -630,42 +679,8 @@ static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 ata_std_ports(&probe_ent->port[i]);
         }
 
-        /* Initialize FIFO PCI bus arbitration */
-        cls = sil_get_device_cache_line(pdev);
-        if (cls) {
-                cls >>= 3;
-                cls++;  /* cls = (line_size/8)+1 */
-                for (i = 0; i < probe_ent->n_ports; i++)
-                        writew(cls << 8 | cls,
-                               mmio_base + sil_port[i].fifo_cfg);
-        } else
-                dev_printk(KERN_WARNING, &pdev->dev,
-                           "cache line size not set.  Driver may not function\n");
-
-        /* Apply R_ERR on DMA activate FIS errata workaround */
-        if (probe_ent->host_flags & SIL_FLAG_RERR_ON_DMA_ACT) {
-                int cnt;
-
-                for (i = 0, cnt = 0; i < probe_ent->n_ports; i++) {
-                        tmp = readl(mmio_base + sil_port[i].sfis_cfg);
-                        if ((tmp & 0x3) != 0x01)
-                                continue;
-                        if (!cnt)
-                                dev_printk(KERN_INFO, &pdev->dev,
-                                           "Applying R_ERR on DMA activate "
-                                           "FIS errata fix\n");
-                        writel(tmp & ~0x3, mmio_base + sil_port[i].sfis_cfg);
-                        cnt++;
-                }
-        }
-
-        if (ent->driver_data == sil_3114) {
-                /* flip the magic "make 4 ports work" bit */
-                tmp = readl(mmio_base + sil_port[2].bmdma);
-                if ((tmp & SIL_INTR_STEERING) == 0)
-                        writel(tmp | SIL_INTR_STEERING,
-                               mmio_base + sil_port[2].bmdma);
-        }
+        sil_init_controller(pdev, probe_ent->n_ports, probe_ent->host_flags,
+                            mmio_base);
 
         pci_set_master(pdev);
 
@@ -685,6 +700,18 @@ err_out:
         return rc;
 }
 
+static int sil_pci_device_resume(struct pci_dev *pdev)
+{
+        struct ata_host_set *host_set = dev_get_drvdata(&pdev->dev);
+
+        ata_pci_device_do_resume(pdev);
+        sil_init_controller(pdev, host_set->n_ports, host_set->ports[0]->flags,
+                            host_set->mmio_base);
+        ata_host_set_resume(host_set);
+
+        return 0;
+}
+
 static int __init sil_init(void)
 {
         return pci_module_init(&sil_pci_driver);
diff --git a/drivers/scsi/sata_sil24.c b/drivers/scsi/sata_sil24.c
index 07a1c6a8a414..3f368c7d3ef9 100644
--- a/drivers/scsi/sata_sil24.c
+++ b/drivers/scsi/sata_sil24.c
@@ -92,6 +92,7 @@ enum {
         HOST_CTRL_STOP          = (1 << 18), /* latched PCI STOP */
         HOST_CTRL_DEVSEL        = (1 << 19), /* latched PCI DEVSEL */
         HOST_CTRL_REQ64         = (1 << 20), /* latched PCI REQ64 */
+        HOST_CTRL_GLOBAL_RST    = (1 << 31), /* global reset */
 
         /*
          * Port registers
@@ -338,6 +339,7 @@ static int sil24_port_start(struct ata_port *ap);
 static void sil24_port_stop(struct ata_port *ap);
 static void sil24_host_stop(struct ata_host_set *host_set);
 static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+static int sil24_pci_device_resume(struct pci_dev *pdev);
 
 static const struct pci_device_id sil24_pci_tbl[] = {
         { 0x1095, 0x3124, PCI_ANY_ID, PCI_ANY_ID, 0, 0, BID_SIL3124 },
@@ -353,6 +355,8 @@ static struct pci_driver sil24_pci_driver = {
         .id_table               = sil24_pci_tbl,
         .probe                  = sil24_init_one,
         .remove                 = ata_pci_remove_one, /* safe? */
+        .suspend                = ata_pci_device_suspend,
+        .resume                 = sil24_pci_device_resume,
 };
 
 static struct scsi_host_template sil24_sht = {
@@ -372,6 +376,8 @@ static struct scsi_host_template sil24_sht = {
         .slave_configure        = ata_scsi_slave_config,
         .slave_destroy          = ata_scsi_slave_destroy,
         .bios_param             = ata_std_bios_param,
+        .suspend                = ata_scsi_device_suspend,
+        .resume                 = ata_scsi_device_resume,
 };
 
 static const struct ata_port_operations sil24_ops = {
@@ -607,7 +613,7 @@ static int sil24_hardreset(struct ata_port *ap, unsigned int *class)
         /* SStatus oscillates between zero and valid status after
          * DEV_RST, debounce it.
          */
-        rc = sata_phy_debounce(ap, sata_deb_timing_before_fsrst);
+        rc = sata_phy_debounce(ap, sata_deb_timing_long);
         if (rc) {
                 reason = "PHY debouncing failed";
                 goto err;
@@ -988,6 +994,64 @@ static void sil24_host_stop(struct ata_host_set *host_set)
         kfree(hpriv);
 }
 
+static void sil24_init_controller(struct pci_dev *pdev, int n_ports,
+                                  unsigned long host_flags,
+                                  void __iomem *host_base,
+                                  void __iomem *port_base)
+{
+        u32 tmp;
+        int i;
+
+        /* GPIO off */
+        writel(0, host_base + HOST_FLASH_CMD);
+
+        /* clear global reset & mask interrupts during initialization */
+        writel(0, host_base + HOST_CTRL);
+
+        /* init ports */
+        for (i = 0; i < n_ports; i++) {
+                void __iomem *port = port_base + i * PORT_REGS_SIZE;
+
+                /* Initial PHY setting */
+                writel(0x20c, port + PORT_PHY_CFG);
+
+                /* Clear port RST */
+                tmp = readl(port + PORT_CTRL_STAT);
+                if (tmp & PORT_CS_PORT_RST) {
+                        writel(PORT_CS_PORT_RST, port + PORT_CTRL_CLR);
+                        tmp = ata_wait_register(port + PORT_CTRL_STAT,
+                                                PORT_CS_PORT_RST,
+                                                PORT_CS_PORT_RST, 10, 100);
+                        if (tmp & PORT_CS_PORT_RST)
+                                dev_printk(KERN_ERR, &pdev->dev,
+                                           "failed to clear port RST\n");
+                }
+
+                /* Configure IRQ WoC */
+                if (host_flags & SIL24_FLAG_PCIX_IRQ_WOC)
+                        writel(PORT_CS_IRQ_WOC, port + PORT_CTRL_STAT);
+                else
+                        writel(PORT_CS_IRQ_WOC, port + PORT_CTRL_CLR);
+
+                /* Zero error counters. */
+                writel(0x8000, port + PORT_DECODE_ERR_THRESH);
+                writel(0x8000, port + PORT_CRC_ERR_THRESH);
+                writel(0x8000, port + PORT_HSHK_ERR_THRESH);
+                writel(0x0000, port + PORT_DECODE_ERR_CNT);
+                writel(0x0000, port + PORT_CRC_ERR_CNT);
+                writel(0x0000, port + PORT_HSHK_ERR_CNT);
+
+                /* Always use 64bit activation */
+                writel(PORT_CS_32BIT_ACTV, port + PORT_CTRL_CLR);
+
+                /* Clear port multiplier enable and resume bits */
+                writel(PORT_CS_PM_EN | PORT_CS_RESUME, port + PORT_CTRL_CLR);
+        }
+
+        /* Turn on interrupts */
+        writel(IRQ_STAT_4PORTS, host_base + HOST_CTRL);
+}
+
 static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         static int printed_version = 0;
@@ -1042,7 +1106,6 @@ static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         probe_ent->irq = pdev->irq;
         probe_ent->irq_flags = IRQF_SHARED;
-        probe_ent->mmio_base = port_base;
         probe_ent->private_data = hpriv;
 
         hpriv->host_base = host_base;
@@ -1076,9 +1139,6 @@ static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
-        /* GPIO off */
-        writel(0, host_base + HOST_FLASH_CMD);
-
         /* Apply workaround for completion IRQ loss on PCI-X errata */
         if (probe_ent->host_flags & SIL24_FLAG_PCIX_IRQ_WOC) {
                 tmp = readl(host_base + HOST_CTRL);
@@ -1090,56 +1150,18 @@ static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                         probe_ent->host_flags &= ~SIL24_FLAG_PCIX_IRQ_WOC;
         }
 
-        /* clear global reset & mask interrupts during initialization */
-        writel(0, host_base + HOST_CTRL);
-
         for (i = 0; i < probe_ent->n_ports; i++) {
-                void __iomem *port = port_base + i * PORT_REGS_SIZE;
-                unsigned long portu = (unsigned long)port;
+                unsigned long portu =
+                        (unsigned long)port_base + i * PORT_REGS_SIZE;
 
                 probe_ent->port[i].cmd_addr = portu;
                 probe_ent->port[i].scr_addr = portu + PORT_SCONTROL;
 
                 ata_std_ports(&probe_ent->port[i]);
-
-                /* Initial PHY setting */
-                writel(0x20c, port + PORT_PHY_CFG);
-
-                /* Clear port RST */
-                tmp = readl(port + PORT_CTRL_STAT);
-                if (tmp & PORT_CS_PORT_RST) {
-                        writel(PORT_CS_PORT_RST, port + PORT_CTRL_CLR);
-                        tmp = ata_wait_register(port + PORT_CTRL_STAT,
-                                                PORT_CS_PORT_RST,
-                                                PORT_CS_PORT_RST, 10, 100);
-                        if (tmp & PORT_CS_PORT_RST)
-                                dev_printk(KERN_ERR, &pdev->dev,
-                                           "failed to clear port RST\n");
-                }
-
-                /* Configure IRQ WoC */
-                if (probe_ent->host_flags & SIL24_FLAG_PCIX_IRQ_WOC)
-                        writel(PORT_CS_IRQ_WOC, port + PORT_CTRL_STAT);
-                else
-                        writel(PORT_CS_IRQ_WOC, port + PORT_CTRL_CLR);
-
-                /* Zero error counters. */
-                writel(0x8000, port + PORT_DECODE_ERR_THRESH);
-                writel(0x8000, port + PORT_CRC_ERR_THRESH);
-                writel(0x8000, port + PORT_HSHK_ERR_THRESH);
-                writel(0x0000, port + PORT_DECODE_ERR_CNT);
-                writel(0x0000, port + PORT_CRC_ERR_CNT);
-                writel(0x0000, port + PORT_HSHK_ERR_CNT);
-
-                /* Always use 64bit activation */
-                writel(PORT_CS_32BIT_ACTV, port + PORT_CTRL_CLR);
-
-                /* Clear port multiplier enable and resume bits */
-                writel(PORT_CS_PM_EN | PORT_CS_RESUME, port + PORT_CTRL_CLR);
         }
 
-        /* Turn on interrupts */
-        writel(IRQ_STAT_4PORTS, host_base + HOST_CTRL);
+        sil24_init_controller(pdev, probe_ent->n_ports, probe_ent->host_flags,
+                              host_base, port_base);
 
         pci_set_master(pdev);
 
@@ -1162,6 +1184,25 @@ static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return rc;
 }
 
+static int sil24_pci_device_resume(struct pci_dev *pdev)
+{
+        struct ata_host_set *host_set = dev_get_drvdata(&pdev->dev);
+        struct sil24_host_priv *hpriv = host_set->private_data;
+
+        ata_pci_device_do_resume(pdev);
+
+        if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND)
+                writel(HOST_CTRL_GLOBAL_RST, hpriv->host_base + HOST_CTRL);
+
+        sil24_init_controller(pdev, host_set->n_ports,
+                              host_set->ports[0]->flags,
+                              hpriv->host_base, hpriv->port_base);
+
+        ata_host_set_resume(host_set);
+
+        return 0;
+}
+
 static int __init sil24_init(void)
 {
         return pci_module_init(&sil24_pci_driver);
diff --git a/drivers/scsi/sata_via.c b/drivers/scsi/sata_via.c
index 03baec2191bf..a3727af8b9c1 100644
--- a/drivers/scsi/sata_via.c
+++ b/drivers/scsi/sata_via.c
@@ -74,8 +74,10 @@ enum {
 static int svia_init_one (struct pci_dev *pdev, const struct pci_device_id *ent);
 static u32 svia_scr_read (struct ata_port *ap, unsigned int sc_reg);
 static void svia_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val);
+static void vt6420_error_handler(struct ata_port *ap);
 
 static const struct pci_device_id svia_pci_tbl[] = {
+        { 0x1106, 0x0591, PCI_ANY_ID, PCI_ANY_ID, 0, 0, vt6420 },
         { 0x1106, 0x3149, PCI_ANY_ID, PCI_ANY_ID, 0, 0, vt6420 },
         { 0x1106, 0x3249, PCI_ANY_ID, PCI_ANY_ID, 0, 0, vt6421 },
 
@@ -107,7 +109,38 @@ static struct scsi_host_template svia_sht = {
         .bios_param             = ata_std_bios_param,
 };
 
-static const struct ata_port_operations svia_sata_ops = {
+static const struct ata_port_operations vt6420_sata_ops = {
+        .port_disable           = ata_port_disable,
+
+        .tf_load                = ata_tf_load,
+        .tf_read                = ata_tf_read,
+        .check_status           = ata_check_status,
+        .exec_command           = ata_exec_command,
+        .dev_select             = ata_std_dev_select,
+
+        .bmdma_setup            = ata_bmdma_setup,
+        .bmdma_start            = ata_bmdma_start,
+        .bmdma_stop             = ata_bmdma_stop,
+        .bmdma_status           = ata_bmdma_status,
+
+        .qc_prep                = ata_qc_prep,
+        .qc_issue               = ata_qc_issue_prot,
+        .data_xfer              = ata_pio_data_xfer,
+
+        .freeze                 = ata_bmdma_freeze,
+        .thaw                   = ata_bmdma_thaw,
+        .error_handler          = vt6420_error_handler,
+        .post_internal_cmd      = ata_bmdma_post_internal_cmd,
+
+        .irq_handler            = ata_interrupt,
+        .irq_clear              = ata_bmdma_irq_clear,
+
+        .port_start             = ata_port_start,
+        .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
+};
+
+static const struct ata_port_operations vt6421_sata_ops = {
         .port_disable           = ata_port_disable,
 
         .tf_load                = ata_tf_load,
@@ -141,13 +174,13 @@ static const struct ata_port_operations svia_sata_ops = {
         .host_stop              = ata_host_stop,
 };
 
-static struct ata_port_info svia_port_info = {
+static struct ata_port_info vt6420_port_info = {
         .sht            = &svia_sht,
         .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
         .pio_mask       = 0x1f,
         .mwdma_mask     = 0x07,
         .udma_mask      = 0x7f,
-        .port_ops       = &svia_sata_ops,
+        .port_ops       = &vt6420_sata_ops,
 };
 
 MODULE_AUTHOR("Jeff Garzik");
@@ -170,6 +203,81 @@ static void svia_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val)
         outl(val, ap->ioaddr.scr_addr + (4 * sc_reg));
 }
 
+/**
+ *      vt6420_prereset - prereset for vt6420
+ *      @ap: target ATA port
+ *
+ *      SCR registers on vt6420 are pieces of shit and may hang the
+ *      whole machine completely if accessed with the wrong timing.
+ *      To avoid such catastrophe, vt6420 doesn't provide generic SCR
+ *      access operations, but uses SStatus and SControl only during
+ *      boot probing in controlled way.
+ *
+ *      As the old (pre EH update) probing code is proven to work, we
+ *      strictly follow the access pattern.
+ *
+ *      LOCKING:
+ *      Kernel thread context (may sleep)
+ *
+ *      RETURNS:
+ *      0 on success, -errno otherwise.
+ */
+static int vt6420_prereset(struct ata_port *ap)
+{
+        struct ata_eh_context *ehc = &ap->eh_context;
+        unsigned long timeout = jiffies + (HZ * 5);
+        u32 sstatus, scontrol;
+        int online;
+
+        /* don't do any SCR stuff if we're not loading */
+        if (!ATA_PFLAG_LOADING)
+                goto skip_scr;
+
+        /* Resume phy.  This is the old resume sequence from
+         * __sata_phy_reset().
+         */
+        svia_scr_write(ap, SCR_CONTROL, 0x300);
+        svia_scr_read(ap, SCR_CONTROL); /* flush */
+
+        /* wait for phy to become ready, if necessary */
+        do {
+                msleep(200);
+                if ((svia_scr_read(ap, SCR_STATUS) & 0xf) != 1)
+                        break;
+        } while (time_before(jiffies, timeout));
+
+        /* open code sata_print_link_status() */
+        sstatus = svia_scr_read(ap, SCR_STATUS);
+        scontrol = svia_scr_read(ap, SCR_CONTROL);
+
+        online = (sstatus & 0xf) == 0x3;
+
+        ata_port_printk(ap, KERN_INFO,
+                        "SATA link %s 1.5 Gbps (SStatus %X SControl %X)\n",
+                        online ? "up" : "down", sstatus, scontrol);
+
+        /* SStatus is read one more time */
+        svia_scr_read(ap, SCR_STATUS);
+
+        if (!online) {
+                /* tell EH to bail */
+                ehc->i.action &= ~ATA_EH_RESET_MASK;
+                return 0;
+        }
+
+ skip_scr:
+        /* wait for !BSY */
+        ata_busy_sleep(ap, ATA_TMOUT_BOOT_QUICK, ATA_TMOUT_BOOT);
+
+        return 0;
+}
+
+static void vt6420_error_handler(struct ata_port *ap)
+{
+        return ata_bmdma_drive_eh(ap, vt6420_prereset, ata_std_softreset,
+                                  NULL, ata_std_postreset);
+}
+
 static const unsigned int svia_bar_sizes[] = {
         8, 4, 8, 4, 16, 256
 };
@@ -210,7 +318,7 @@ static void vt6421_init_addrs(struct ata_probe_ent *probe_ent,
 static struct ata_probe_ent *vt6420_init_probe_ent(struct pci_dev *pdev)
 {
         struct ata_probe_ent *probe_ent;
-        struct ata_port_info *ppi = &svia_port_info;
+        struct ata_port_info *ppi = &vt6420_port_info;
 
         probe_ent = ata_pci_init_native_mode(pdev, &ppi, ATA_PORT_PRIMARY | ATA_PORT_SECONDARY);
         if (!probe_ent)
@@ -239,7 +347,7 @@ static struct ata_probe_ent *vt6421_init_probe_ent(struct pci_dev *pdev)
 
         probe_ent->sht          = &svia_sht;
         probe_ent->host_flags   = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY;
-        probe_ent->port_ops     = &svia_sata_ops;
+        probe_ent->port_ops     = &vt6421_sata_ops;
         probe_ent->n_ports      = N_PORTS;
         probe_ent->irq          = pdev->irq;
         probe_ent->irq_flags    = IRQF_SHARED;
diff --git a/drivers/scsi/sata_vsc.c b/drivers/scsi/sata_vsc.c
index 916fe6fba756..ad37871594f5 100644
--- a/drivers/scsi/sata_vsc.c
+++ b/drivers/scsi/sata_vsc.c
@@ -297,7 +297,7 @@ static const struct ata_port_operations vsc_sata_ops = {
         .bmdma_status           = ata_bmdma_status,
         .qc_prep                = ata_qc_prep,
         .qc_issue               = ata_qc_issue_prot,
-        .data_xfer              = ata_pio_data_xfer,
+        .data_xfer              = ata_mmio_data_xfer,
         .freeze                 = ata_bmdma_freeze,
         .thaw                   = ata_bmdma_thaw,
         .error_handler          = ata_bmdma_error_handler,
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 2ab7df0dcfe8..b332caddd5b3 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -346,7 +346,7 @@ void scsi_log_send(struct scsi_cmnd *cmd)
                         if (level > 3) {
                                 printk(KERN_INFO "buffer = 0x%p, bufflen = %d,"
                                        " done = 0x%p, queuecommand 0x%p\n",
-                                        cmd->buffer, cmd->bufflen,
+                                        cmd->request_buffer, cmd->request_bufflen,
                                         cmd->done,
                                         sdev->host->hostt->queuecommand);
 
@@ -661,11 +661,6 @@ void __scsi_done(struct scsi_cmnd *cmd)
  */
 int scsi_retry_command(struct scsi_cmnd *cmd)
 {
-        /*
-         * Restore the SCSI command state.
-         */
-        scsi_setup_cmd_retry(cmd);
-
         /*
          * Zero the sense information from the last time we tried
          * this command.
@@ -711,10 +706,6 @@ void scsi_finish_command(struct scsi_cmnd *cmd)
                                 "Notifying upper driver of completion "
                                 "(result %x)\n", cmd->result));
 
-        /*
-         * We can get here with use_sg=0, causing a panic in the upper level
-         */
-        cmd->use_sg = cmd->old_use_sg;
         cmd->done(cmd);
 }
 EXPORT_SYMBOL(scsi_finish_command);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index e1168860045c..a80303c6b3fd 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -50,18 +50,22 @@
 #include "scsi_logging.h"
 #include "scsi_debug.h"
 
-#define SCSI_DEBUG_VERSION "1.75"
-static const char * scsi_debug_version_date = "20050113";
+#define SCSI_DEBUG_VERSION "1.79"
+static const char * scsi_debug_version_date = "20060604";
 
 /* Additional Sense Code (ASC) used */
-#define NO_ADDED_SENSE 0x0
+#define NO_ADDITIONAL_SENSE 0x0
+#define LOGICAL_UNIT_NOT_READY 0x4
 #define UNRECOVERED_READ_ERR 0x11
+#define PARAMETER_LIST_LENGTH_ERR 0x1a
 #define INVALID_OPCODE 0x20
 #define ADDR_OUT_OF_RANGE 0x21
 #define INVALID_FIELD_IN_CDB 0x24
+#define INVALID_FIELD_IN_PARAM_LIST 0x26
 #define POWERON_RESET 0x29
 #define SAVING_PARAMS_UNSUP 0x39
-#define THRESHHOLD_EXCEEDED 0x5d
+#define THRESHOLD_EXCEEDED 0x5d
+#define LOW_POWER_COND_ON 0x5e
 
 #define SDEBUG_TAGGED_QUEUING 0 /* 0 | MSG_SIMPLE_TAG | MSG_ORDERED_TAG */
 
@@ -80,6 +84,8 @@ static const char * scsi_debug_version_date = "20050113";
 #define DEF_SCSI_LEVEL   5    /* INQUIRY, byte2 [5->SPC-3] */
 #define DEF_PTYPE   0
 #define DEF_D_SENSE   0
+#define DEF_NO_LUN_0   0
+#define DEF_VIRTUAL_GB   0
 
 /* bit mask values for scsi_debug_opts */
 #define SCSI_DEBUG_OPT_NOISE   1
@@ -106,6 +112,7 @@ static const char * scsi_debug_version_date = "20050113";
 /* If REPORT LUNS has luns >= 256 it can choose "flat space" (value 1)
  * or "peripheral device" addressing (value 0) */
 #define SAM2_LUN_ADDRESS_METHOD 0
+#define SAM2_WLUN_REPORT_LUNS 0xc101
 
 static int scsi_debug_add_host = DEF_NUM_HOST;
 static int scsi_debug_delay = DEF_DELAY;
@@ -118,13 +125,16 @@ static int scsi_debug_opts = DEF_OPTS;
 static int scsi_debug_scsi_level = DEF_SCSI_LEVEL;
 static int scsi_debug_ptype = DEF_PTYPE; /* SCSI peripheral type (0==disk) */
 static int scsi_debug_dsense = DEF_D_SENSE;
+static int scsi_debug_no_lun_0 = DEF_NO_LUN_0;
+static int scsi_debug_virtual_gb = DEF_VIRTUAL_GB;
 
 static int scsi_debug_cmnd_count = 0;
 
 #define DEV_READONLY(TGT)      (0)
 #define DEV_REMOVEABLE(TGT)    (0)
 
-static unsigned long sdebug_store_size; /* in bytes */
+static unsigned int sdebug_store_size;  /* in bytes */
+static unsigned int sdebug_store_sectors;
 static sector_t sdebug_capacity;        /* in sectors */
 
 /* old BIOS stuff, kernel may get rid of them but some mode sense pages
@@ -149,7 +159,9 @@ struct sdebug_dev_info {
         unsigned int target;
         unsigned int lun;
         struct sdebug_host_info *sdbg_host;
+        unsigned int wlun;
         char reset;
+        char stopped;
         char used;
 };
 
@@ -193,11 +205,11 @@ static struct scsi_host_template sdebug_driver_template = {
         .bios_param =           scsi_debug_biosparam,
         .can_queue =            SCSI_DEBUG_CANQUEUE,
         .this_id =              7,
-        .sg_tablesize =         64,
-        .cmd_per_lun =          3,
-        .max_sectors =          4096,
+        .sg_tablesize =         256,
+        .cmd_per_lun =          16,
+        .max_sectors =          0xffff,
         .unchecked_isa_dma =    0,
-        .use_clustering =       DISABLE_CLUSTERING,
+        .use_clustering =       ENABLE_CLUSTERING,
         .module =               THIS_MODULE,
 };
 
@@ -225,19 +237,32 @@ static struct device_driver sdebug_driverfs_driver = {
 static const int check_condition_result =
                 (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
 
+static unsigned char ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
+                                    0, 0, 0x2, 0x4b};
+static unsigned char iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
+                                   0, 0, 0x0, 0x0};
+
 /* function declarations */
 static int resp_inquiry(struct scsi_cmnd * SCpnt, int target,
                         struct sdebug_dev_info * devip);
 static int resp_requests(struct scsi_cmnd * SCpnt,
                          struct sdebug_dev_info * devip);
+static int resp_start_stop(struct scsi_cmnd * scp,
+                           struct sdebug_dev_info * devip);
 static int resp_readcap(struct scsi_cmnd * SCpnt,
                         struct sdebug_dev_info * devip);
-static int resp_mode_sense(struct scsi_cmnd * SCpnt, int target,
+static int resp_readcap16(struct scsi_cmnd * SCpnt,
+                          struct sdebug_dev_info * devip);
+static int resp_mode_sense(struct scsi_cmnd * scp, int target,
                            struct sdebug_dev_info * devip);
-static int resp_read(struct scsi_cmnd * SCpnt, int upper_blk, int block,
-                     int num, struct sdebug_dev_info * devip);
-static int resp_write(struct scsi_cmnd * SCpnt, int upper_blk, int block,
-                      int num, struct sdebug_dev_info * devip);
+static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
+                            struct sdebug_dev_info * devip);
+static int resp_log_sense(struct scsi_cmnd * scp,
+                          struct sdebug_dev_info * devip);
+static int resp_read(struct scsi_cmnd * SCpnt, unsigned long long lba,
+                     unsigned int num, struct sdebug_dev_info * devip);
+static int resp_write(struct scsi_cmnd * SCpnt, unsigned long long lba,
+                      unsigned int num, struct sdebug_dev_info * devip);
 static int resp_report_luns(struct scsi_cmnd * SCpnt,
                             struct sdebug_dev_info * devip);
 static int fill_from_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
@@ -248,8 +273,8 @@ static void timer_intr_handler(unsigned long);
 static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev);
 static void mk_sense_buffer(struct sdebug_dev_info * devip, int key,
                             int asc, int asq);
-static int check_reset(struct scsi_cmnd * SCpnt,
-                       struct sdebug_dev_info * devip);
+static int check_readiness(struct scsi_cmnd * SCpnt, int reset_only,
+                           struct sdebug_dev_info * devip);
 static int schedule_resp(struct scsi_cmnd * cmnd,
                          struct sdebug_dev_info * devip,
                          done_funct_t done, int scsi_result, int delta_jiff);
@@ -257,9 +282,11 @@ static void __init sdebug_build_parts(unsigned char * ramp);
 static void __init init_all_queued(void);
 static void stop_all_queued(void);
 static int stop_queued_cmnd(struct scsi_cmnd * cmnd);
-static int inquiry_evpd_83(unsigned char * arr, int dev_id_num,
-                           const char * dev_id_str, int dev_id_str_len);
-static void do_create_driverfs_files(void);
+static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
+                           int dev_id_num, const char * dev_id_str,
+                           int dev_id_str_len);
+static int inquiry_evpd_88(unsigned char * arr, int target_dev_id);
+static int do_create_driverfs_files(void);
 static void do_remove_driverfs_files(void);
 
 static int sdebug_add_adapter(void);
@@ -274,18 +301,22 @@ static
 int scsi_debug_queuecommand(struct scsi_cmnd * SCpnt, done_funct_t done)
 {
         unsigned char *cmd = (unsigned char *) SCpnt->cmnd;
-        int block, upper_blk, num, k;
+        int len, k, j;
+        unsigned int num;
+        unsigned long long lba;
         int errsts = 0;
-        int target = scmd_id(SCpnt);
+        int target = SCpnt->device->id;
         struct sdebug_dev_info * devip = NULL;
         int inj_recovered = 0;
+        int delay_override = 0;
 
         if (done == NULL)
                 return 0;       /* assume mid level reprocessing command */
 
+        SCpnt->resid = 0;
         if ((SCSI_DEBUG_OPT_NOISE & scsi_debug_opts) && cmd) {
                 printk(KERN_INFO "scsi_debug: cmd ");
-                for (k = 0, num = SCpnt->cmd_len; k < num; ++k)
+                for (k = 0, len = SCpnt->cmd_len; k < len; ++k)
                         printk("%02x ", (int)cmd[k]);
                 printk("\n");
         }
@@ -296,7 +327,8 @@ int scsi_debug_queuecommand(struct scsi_cmnd * SCpnt, done_funct_t done)
                                      DID_NO_CONNECT << 16, 0);
         }
 
-        if (SCpnt->device->lun >= scsi_debug_max_luns)
+        if ((SCpnt->device->lun >= scsi_debug_max_luns) &&
+            (SCpnt->device->lun != SAM2_WLUN_REPORT_LUNS))
                 return schedule_resp(SCpnt, NULL, done,
                                      DID_NO_CONNECT << 16, 0);
         devip = devInfoReg(SCpnt->device);
@@ -315,118 +347,150 @@ int scsi_debug_queuecommand(struct scsi_cmnd * SCpnt, done_funct_t done)
                         inj_recovered = 1; /* to reads and writes below */
         }
 
+        if (devip->wlun) {
+                switch (*cmd) {
+                case INQUIRY:
+                case REQUEST_SENSE:
+                case TEST_UNIT_READY:
+                case REPORT_LUNS:
+                        break;  /* only allowable wlun commands */
+                default:
+                        if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
+                                printk(KERN_INFO "scsi_debug: Opcode: 0x%x "
+                                       "not supported for wlun\n", *cmd);
+                        mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                        INVALID_OPCODE, 0);
+                        errsts = check_condition_result;
+                        return schedule_resp(SCpnt, devip, done, errsts,
+                                             0);
+                }
+        }
+
         switch (*cmd) {
         case INQUIRY:     /* mandatory, ignore unit attention */
+                delay_override = 1;
                 errsts = resp_inquiry(SCpnt, target, devip);
                 break;
         case REQUEST_SENSE:     /* mandatory, ignore unit attention */
+                delay_override = 1;
                 errsts = resp_requests(SCpnt, devip);
                 break;
         case REZERO_UNIT:       /* actually this is REWIND for SSC */
         case START_STOP:
-                errsts = check_reset(SCpnt, devip);
+                errsts = resp_start_stop(SCpnt, devip);
                 break;
         case ALLOW_MEDIUM_REMOVAL:
-                if ((errsts = check_reset(SCpnt, devip)))
+                if ((errsts = check_readiness(SCpnt, 1, devip)))
                         break;
                 if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
                         printk(KERN_INFO "scsi_debug: Medium removal %s\n",
                                 cmd[4] ? "inhibited" : "enabled");
                 break;
         case SEND_DIAGNOSTIC:     /* mandatory */
-                errsts = check_reset(SCpnt, devip);
+                errsts = check_readiness(SCpnt, 1, devip);
                 break;
         case TEST_UNIT_READY:     /* mandatory */
-                errsts = check_reset(SCpnt, devip);
+                delay_override = 1;
+                errsts = check_readiness(SCpnt, 0, devip);
                 break;
         case RESERVE:
-                errsts = check_reset(SCpnt, devip);
+                errsts = check_readiness(SCpnt, 1, devip);
                 break;
         case RESERVE_10:
-                errsts = check_reset(SCpnt, devip);
+                errsts = check_readiness(SCpnt, 1, devip);
                 break;
         case RELEASE:
-                errsts = check_reset(SCpnt, devip);
+                errsts = check_readiness(SCpnt, 1, devip);
                 break;
         case RELEASE_10:
-                errsts = check_reset(SCpnt, devip);
+                errsts = check_readiness(SCpnt, 1, devip);
                 break;
         case READ_CAPACITY:
                 errsts = resp_readcap(SCpnt, devip);
                 break;
+        case SERVICE_ACTION_IN:
+                if (SAI_READ_CAPACITY_16 != cmd[1]) {
+                        mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                        INVALID_OPCODE, 0);
+                        errsts = check_condition_result;
+                        break;
+                }
+                errsts = resp_readcap16(SCpnt, devip);
+                break;
         case READ_16:
         case READ_12:
         case READ_10:
         case READ_6:
-                if ((errsts = check_reset(SCpnt, devip)))
+                if ((errsts = check_readiness(SCpnt, 0, devip)))
                         break;
-                upper_blk = 0;
                 if ((*cmd) == READ_16) {
-                        upper_blk = cmd[5] + (cmd[4] << 8) +
-                                    (cmd[3] << 16) + (cmd[2] << 24);
-                        block = cmd[9] + (cmd[8] << 8) +
-                                (cmd[7] << 16) + (cmd[6] << 24);
+                        for (lba = 0, j = 0; j < 8; ++j) {
+                                if (j > 0)
+                                        lba <<= 8;
+                                lba += cmd[2 + j];
+                        }
                         num = cmd[13] + (cmd[12] << 8) +
                                 (cmd[11] << 16) + (cmd[10] << 24);
                 } else if ((*cmd) == READ_12) {
-                        block = cmd[5] + (cmd[4] << 8) +
+                        lba = cmd[5] + (cmd[4] << 8) +
                                 (cmd[3] << 16) + (cmd[2] << 24);
                         num = cmd[9] + (cmd[8] << 8) +
                                 (cmd[7] << 16) + (cmd[6] << 24);
                 } else if ((*cmd) == READ_10) {
-                        block = cmd[5] + (cmd[4] << 8) +
+                        lba = cmd[5] + (cmd[4] << 8) +
                                 (cmd[3] << 16) + (cmd[2] << 24);
                         num = cmd[8] + (cmd[7] << 8);
-                } else {
-                        block = cmd[3] + (cmd[2] << 8) +
+                } else {        /* READ (6) */
+                        lba = cmd[3] + (cmd[2] << 8) +
                                 ((cmd[1] & 0x1f) << 16);
-                        num = cmd[4];
+                        num = (0 == cmd[4]) ? 256 : cmd[4];
                 }
-                errsts = resp_read(SCpnt, upper_blk, block, num, devip);
+                errsts = resp_read(SCpnt, lba, num, devip);
                 if (inj_recovered && (0 == errsts)) {
                         mk_sense_buffer(devip, RECOVERED_ERROR,
-                                        THRESHHOLD_EXCEEDED, 0);
+                                        THRESHOLD_EXCEEDED, 0);
                         errsts = check_condition_result;
                 }
                 break;
         case REPORT_LUNS:       /* mandatory, ignore unit attention */
+                delay_override = 1;
                 errsts = resp_report_luns(SCpnt, devip);
                 break;
         case VERIFY:            /* 10 byte SBC-2 command */
-                errsts = check_reset(SCpnt, devip);
+                errsts = check_readiness(SCpnt, 0, devip);
                 break;
         case WRITE_16:
         case WRITE_12:
         case WRITE_10:
         case WRITE_6:
-                if ((errsts = check_reset(SCpnt, devip)))
+                if ((errsts = check_readiness(SCpnt, 0, devip)))
                         break;
-                upper_blk = 0;
                 if ((*cmd) == WRITE_16) {
-                        upper_blk = cmd[5] + (cmd[4] << 8) +
-                                    (cmd[3] << 16) + (cmd[2] << 24);
-                        block = cmd[9] + (cmd[8] << 8) +
-                                (cmd[7] << 16) + (cmd[6] << 24);
+                        for (lba = 0, j = 0; j < 8; ++j) {
+                                if (j > 0)
+                                        lba <<= 8;
+                                lba += cmd[2 + j];
+                        }
                         num = cmd[13] + (cmd[12] << 8) +
                                 (cmd[11] << 16) + (cmd[10] << 24);
                 } else if ((*cmd) == WRITE_12) {
-                        block = cmd[5] + (cmd[4] << 8) +
+                        lba = cmd[5] + (cmd[4] << 8) +
                                 (cmd[3] << 16) + (cmd[2] << 24);
                         num = cmd[9] + (cmd[8] << 8) +
                                 (cmd[7] << 16) + (cmd[6] << 24);
                 } else if ((*cmd) == WRITE_10) {
-                        block = cmd[5] + (cmd[4] << 8) +
+                        lba = cmd[5] + (cmd[4] << 8) +
                                 (cmd[3] << 16) + (cmd[2] << 24);
                         num = cmd[8] + (cmd[7] << 8);
-                } else {
-                        block = cmd[3] + (cmd[2] << 8) +
+                } else {        /* WRITE (6) */
+                        lba = cmd[3] + (cmd[2] << 8) +
                                 ((cmd[1] & 0x1f) << 16);
-                        num = cmd[4];
+                        num = (0 == cmd[4]) ? 256 : cmd[4];
                 }
-                errsts = resp_write(SCpnt, upper_blk, block, num, devip);
+                errsts = resp_write(SCpnt, lba, num, devip);
                 if (inj_recovered && (0 == errsts)) {
                         mk_sense_buffer(devip, RECOVERED_ERROR,
-                                        THRESHHOLD_EXCEEDED, 0);
+                                        THRESHOLD_EXCEEDED, 0);
                         errsts = check_condition_result;
                 }
                 break;
@@ -434,20 +498,31 @@ int scsi_debug_queuecommand(struct scsi_cmnd * SCpnt, done_funct_t done)
         case MODE_SENSE_10:
                 errsts = resp_mode_sense(SCpnt, target, devip);
                 break;
+        case MODE_SELECT:
+                errsts = resp_mode_select(SCpnt, 1, devip);
+                break;
+        case MODE_SELECT_10:
+                errsts = resp_mode_select(SCpnt, 0, devip);
+                break;
+        case LOG_SENSE:
+                errsts = resp_log_sense(SCpnt, devip);
+                break;
         case SYNCHRONIZE_CACHE:
-                errsts = check_reset(SCpnt, devip);
+                delay_override = 1;
+                errsts = check_readiness(SCpnt, 0, devip);
                 break;
         default:
                 if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
                         printk(KERN_INFO "scsi_debug: Opcode: 0x%x not "
                                "supported\n", *cmd);
-                if ((errsts = check_reset(SCpnt, devip)))
+                if ((errsts = check_readiness(SCpnt, 1, devip)))
                         break;  /* Unit attention takes precedence */
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_OPCODE, 0);
                 errsts = check_condition_result;
                 break;
         }
-        return schedule_resp(SCpnt, devip, done, errsts, scsi_debug_delay);
+        return schedule_resp(SCpnt, devip, done, errsts,
+                             (delay_override ? 0 : scsi_debug_delay));
 }
 
 static int scsi_debug_ioctl(struct scsi_device *dev, int cmd, void __user *arg)
@@ -459,7 +534,8 @@ static int scsi_debug_ioctl(struct scsi_device *dev, int cmd, void __user *arg)
         /* return -ENOTTY; // correct return but upsets fdisk */
 }
 
-static int check_reset(struct scsi_cmnd * SCpnt, struct sdebug_dev_info * devip)
+static int check_readiness(struct scsi_cmnd * SCpnt, int reset_only,
+                           struct sdebug_dev_info * devip)
 {
         if (devip->reset) {
                 if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
@@ -469,6 +545,14 @@ static int check_reset(struct scsi_cmnd * SCpnt, struct sdebug_dev_info * devip)
                 mk_sense_buffer(devip, UNIT_ATTENTION, POWERON_RESET, 0);
                 return check_condition_result;
         }
+        if ((0 == reset_only) && devip->stopped) {
+                if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
+                        printk(KERN_INFO "scsi_debug: Reporting Not "
+                               "ready: initializing command required\n");
+                mk_sense_buffer(devip, NOT_READY, LOGICAL_UNIT_NOT_READY,
+                                0x2);
+                return check_condition_result;
+        }
         return 0;
 }
 
@@ -492,7 +576,10 @@ static int fill_from_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
                 req_len = scp->request_bufflen;
                 act_len = (req_len < arr_len) ? req_len : arr_len;
                 memcpy(scp->request_buffer, arr, act_len);
-                scp->resid = req_len - act_len;
+                if (scp->resid)
+                        scp->resid -= act_len;
+                else
+                        scp->resid = req_len - act_len;
                 return 0;
         }
         sgpnt = (struct scatterlist *)scp->request_buffer;
@@ -515,7 +602,10 @@ static int fill_from_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
                 }
                 req_len += sgpnt->length;
         }
-        scp->resid = req_len - act_len;
+        if (scp->resid)
+                scp->resid -= act_len;
+        else
+                scp->resid = req_len - act_len;
         return 0;
 }
 
@@ -566,12 +656,14 @@ static const char * inq_vendor_id = "Linux   ";
 static const char * inq_product_id = "scsi_debug      ";
 static const char * inq_product_rev = "0004";
 
-static int inquiry_evpd_83(unsigned char * arr, int dev_id_num,
-                           const char * dev_id_str, int dev_id_str_len)
+static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
+                           int dev_id_num, const char * dev_id_str,
+                           int dev_id_str_len)
 {
-        int num;
+        int num, port_a;
+        char b[32];
 
-        /* Two identification descriptors: */
+        port_a = target_dev_id + 1;
         /* T10 vendor identifier field format (faked) */
         arr[0] = 0x2;   /* ASCII */
         arr[1] = 0x1;
@@ -582,25 +674,246 @@ static int inquiry_evpd_83(unsigned char * arr, int dev_id_num,
         num = 8 + 16 + dev_id_str_len;
         arr[3] = num;
         num += 4;
-        /* NAA IEEE registered identifier (faked) */
-        arr[num] = 0x1; /* binary */
-        arr[num + 1] = 0x3;
-        arr[num + 2] = 0x0;
-        arr[num + 3] = 0x8;
-        arr[num + 4] = 0x51;    /* ieee company id=0x123456 (faked) */
-        arr[num + 5] = 0x23;
-        arr[num + 6] = 0x45;
-        arr[num + 7] = 0x60;
-        arr[num + 8] = (dev_id_num >> 24);
-        arr[num + 9] = (dev_id_num >> 16) & 0xff;
-        arr[num + 10] = (dev_id_num >> 8) & 0xff;
-        arr[num + 11] = dev_id_num & 0xff;
-        return num + 12;
+        if (dev_id_num >= 0) {
+                /* NAA-5, Logical unit identifier (binary) */
+                arr[num++] = 0x1;       /* binary (not necessarily sas) */
+                arr[num++] = 0x3;       /* PIV=0, lu, naa */
+                arr[num++] = 0x0;
+                arr[num++] = 0x8;
+                arr[num++] = 0x53;  /* naa-5 ieee company id=0x333333 (fake) */
+                arr[num++] = 0x33;
+                arr[num++] = 0x33;
+                arr[num++] = 0x30;
+                arr[num++] = (dev_id_num >> 24);
+                arr[num++] = (dev_id_num >> 16) & 0xff;
+                arr[num++] = (dev_id_num >> 8) & 0xff;
+                arr[num++] = dev_id_num & 0xff;
+                /* Target relative port number */
+                arr[num++] = 0x61;      /* proto=sas, binary */
+                arr[num++] = 0x94;      /* PIV=1, target port, rel port */
+                arr[num++] = 0x0;       /* reserved */
+                arr[num++] = 0x4;       /* length */
+                arr[num++] = 0x0;       /* reserved */
+                arr[num++] = 0x0;       /* reserved */
+                arr[num++] = 0x0;
+                arr[num++] = 0x1;       /* relative port A */
+        }
+        /* NAA-5, Target port identifier */
+        arr[num++] = 0x61;      /* proto=sas, binary */
+        arr[num++] = 0x93;      /* piv=1, target port, naa */
+        arr[num++] = 0x0;
+        arr[num++] = 0x8;
+        arr[num++] = 0x52;      /* naa-5, company id=0x222222 (fake) */
+        arr[num++] = 0x22;
+        arr[num++] = 0x22;
+        arr[num++] = 0x20;
+        arr[num++] = (port_a >> 24);
+        arr[num++] = (port_a >> 16) & 0xff;
+        arr[num++] = (port_a >> 8) & 0xff;
+        arr[num++] = port_a & 0xff;
+        /* NAA-5, Target device identifier */
+        arr[num++] = 0x61;      /* proto=sas, binary */
+        arr[num++] = 0xa3;      /* piv=1, target device, naa */
+        arr[num++] = 0x0;
+        arr[num++] = 0x8;
+        arr[num++] = 0x52;      /* naa-5, company id=0x222222 (fake) */
+        arr[num++] = 0x22;
+        arr[num++] = 0x22;
+        arr[num++] = 0x20;
+        arr[num++] = (target_dev_id >> 24);
+        arr[num++] = (target_dev_id >> 16) & 0xff;
+        arr[num++] = (target_dev_id >> 8) & 0xff;
+        arr[num++] = target_dev_id & 0xff;
+        /* SCSI name string: Target device identifier */
+        arr[num++] = 0x63;      /* proto=sas, UTF-8 */
+        arr[num++] = 0xa8;      /* piv=1, target device, SCSI name string */
+        arr[num++] = 0x0;
+        arr[num++] = 24;
+        memcpy(arr + num, "naa.52222220", 12);
+        num += 12;
+        snprintf(b, sizeof(b), "%08X", target_dev_id);
+        memcpy(arr + num, b, 8);
+        num += 8;
+        memset(arr + num, 0, 4);
+        num += 4;
+        return num;
+}
+
+
+static unsigned char vpd84_data[] = {
+/* from 4th byte */ 0x22,0x22,0x22,0x0,0xbb,0x0,
+    0x22,0x22,0x22,0x0,0xbb,0x1,
+    0x22,0x22,0x22,0x0,0xbb,0x2,
+};
+
+static int inquiry_evpd_84(unsigned char * arr)
+{
+        memcpy(arr, vpd84_data, sizeof(vpd84_data));
+        return sizeof(vpd84_data);
+}
+
+static int inquiry_evpd_85(unsigned char * arr)
+{
+        int num = 0;
+        const char * na1 = "https://www.kernel.org/config";
+        const char * na2 = "http://www.kernel.org/log";
+        int plen, olen;
+
+        arr[num++] = 0x1;       /* lu, storage config */
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x0;
+        olen = strlen(na1);
+        plen = olen + 1;
+        if (plen % 4)
+                plen = ((plen / 4) + 1) * 4;
+        arr[num++] = plen;      /* length, null termianted, padded */
+        memcpy(arr + num, na1, olen);
+        memset(arr + num + olen, 0, plen - olen);
+        num += plen;
+
+        arr[num++] = 0x4;       /* lu, logging */
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x0;
+        olen = strlen(na2);
+        plen = olen + 1;
+        if (plen % 4)
+                plen = ((plen / 4) + 1) * 4;
+        arr[num++] = plen;      /* length, null terminated, padded */
+        memcpy(arr + num, na2, olen);
+        memset(arr + num + olen, 0, plen - olen);
+        num += plen;
+
+        return num;
+}
+
+/* SCSI ports VPD page */
+static int inquiry_evpd_88(unsigned char * arr, int target_dev_id)
+{
+        int num = 0;
+        int port_a, port_b;
+
+        port_a = target_dev_id + 1;
+        port_b = port_a + 1;
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x0;
+        arr[num++] = 0x1;       /* relative port 1 (primary) */
+        memset(arr + num, 0, 6);
+        num += 6;
+        arr[num++] = 0x0;
+        arr[num++] = 12;        /* length tp descriptor */
+        /* naa-5 target port identifier (A) */
+        arr[num++] = 0x61;      /* proto=sas, binary */
+        arr[num++] = 0x93;      /* PIV=1, target port, NAA */
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x8;       /* length */
+        arr[num++] = 0x52;      /* NAA-5, company_id=0x222222 (fake) */
+        arr[num++] = 0x22;
+        arr[num++] = 0x22;
+        arr[num++] = 0x20;
+        arr[num++] = (port_a >> 24);
+        arr[num++] = (port_a >> 16) & 0xff;
+        arr[num++] = (port_a >> 8) & 0xff;
+        arr[num++] = port_a & 0xff;
+
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x0;
+        arr[num++] = 0x2;       /* relative port 2 (secondary) */
+        memset(arr + num, 0, 6);
+        num += 6;
+        arr[num++] = 0x0;
+        arr[num++] = 12;        /* length tp descriptor */
+        /* naa-5 target port identifier (B) */
+        arr[num++] = 0x61;      /* proto=sas, binary */
+        arr[num++] = 0x93;      /* PIV=1, target port, NAA */
+        arr[num++] = 0x0;       /* reserved */
+        arr[num++] = 0x8;       /* length */
+        arr[num++] = 0x52;      /* NAA-5, company_id=0x222222 (fake) */
+        arr[num++] = 0x22;
+        arr[num++] = 0x22;
+        arr[num++] = 0x20;
+        arr[num++] = (port_b >> 24);
+        arr[num++] = (port_b >> 16) & 0xff;
+        arr[num++] = (port_b >> 8) & 0xff;
+        arr[num++] = port_b & 0xff;
+
+        return num;
+}
+
+
+static unsigned char vpd89_data[] = {
+/* from 4th byte */ 0,0,0,0,
+'l','i','n','u','x',' ',' ',' ',
+'S','A','T',' ','s','c','s','i','_','d','e','b','u','g',' ',' ',
+'1','2','3','4',
+0x34,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,
+0xec,0,0,0,
+0x5a,0xc,0xff,0x3f,0x37,0xc8,0x10,0,0,0,0,0,0x3f,0,0,0,
+0,0,0,0,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x20,0x20,0x20,0x20,
+0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0,0,0,0x40,0x4,0,0x2e,0x33,
+0x38,0x31,0x20,0x20,0x20,0x20,0x54,0x53,0x38,0x33,0x30,0x30,0x33,0x31,
+0x53,0x41,
+0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
+0x20,0x20,
+0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
+0x10,0x80,
+0,0,0,0x2f,0,0,0,0x2,0,0x2,0x7,0,0xff,0xff,0x1,0,
+0x3f,0,0xc1,0xff,0x3e,0,0x10,0x1,0xb0,0xf8,0x50,0x9,0,0,0x7,0,
+0x3,0,0x78,0,0x78,0,0xf0,0,0x78,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0x2,0,0,0,0,0,0,0,
+0x7e,0,0x1b,0,0x6b,0x34,0x1,0x7d,0x3,0x40,0x69,0x34,0x1,0x3c,0x3,0x40,
+0x7f,0x40,0,0,0,0,0xfe,0xfe,0,0,0,0,0,0xfe,0,0,
+0,0,0,0,0,0,0,0,0xb0,0xf8,0x50,0x9,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0x1,0,0xb0,0xf8,0x50,0x9,0xb0,0xf8,0x50,0x9,0x20,0x20,0x2,0,0xb6,0x42,
+0,0x80,0x8a,0,0x6,0x3c,0xa,0x3c,0xff,0xff,0xc6,0x7,0,0x1,0,0x8,
+0xf0,0xf,0,0x10,0x2,0,0x30,0,0,0,0,0,0,0,0x6,0xfe,
+0,0,0x2,0,0x50,0,0x8a,0,0x4f,0x95,0,0,0x21,0,0xb,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0xa5,0x51,
+};
+
+static int inquiry_evpd_89(unsigned char * arr)
+{
+        memcpy(arr, vpd89_data, sizeof(vpd89_data));
+        return sizeof(vpd89_data);
+}
+
+
+static unsigned char vpdb0_data[] = {
+        /* from 4th byte */ 0,0,0,4,
+        0,0,0x4,0,
+        0,0,0,64,
+};
+
+static int inquiry_evpd_b0(unsigned char * arr)
+{
+        memcpy(arr, vpdb0_data, sizeof(vpdb0_data));
+        if (sdebug_store_sectors > 0x400) {
+                arr[4] = (sdebug_store_sectors >> 24) & 0xff;
+                arr[5] = (sdebug_store_sectors >> 16) & 0xff;
+                arr[6] = (sdebug_store_sectors >> 8) & 0xff;
+                arr[7] = sdebug_store_sectors & 0xff;
+        }
+        return sizeof(vpdb0_data);
 }
 
 
 #define SDEBUG_LONG_INQ_SZ 96
-#define SDEBUG_MAX_INQ_ARR_SZ 128
+#define SDEBUG_MAX_INQ_ARR_SZ 584
 
 static int resp_inquiry(struct scsi_cmnd * scp, int target,
                         struct sdebug_dev_info * devip)
@@ -608,64 +921,113 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
         unsigned char pq_pdt;
         unsigned char arr[SDEBUG_MAX_INQ_ARR_SZ];
         unsigned char *cmd = (unsigned char *)scp->cmnd;
-        int alloc_len;
+        int alloc_len, n;
 
         alloc_len = (cmd[3] << 8) + cmd[4];
         memset(arr, 0, SDEBUG_MAX_INQ_ARR_SZ);
-        pq_pdt = (scsi_debug_ptype & 0x1f);
+        if (devip->wlun)
+                pq_pdt = 0x1e;  /* present, wlun */
+        else if (scsi_debug_no_lun_0 && (0 == devip->lun))
+                pq_pdt = 0x7f;  /* not present, no device type */
+        else
+                pq_pdt = (scsi_debug_ptype & 0x1f);
         arr[0] = pq_pdt;
         if (0x2 & cmd[1]) {  /* CMDDT bit set */
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
                                 0);
                 return check_condition_result;
         } else if (0x1 & cmd[1]) {  /* EVPD bit set */
-                int dev_id_num, len;
-                char dev_id_str[6];
+                int lu_id_num, target_dev_id, len;
+                char lu_id_str[6];
+                int host_no = devip->sdbg_host->shost->host_no;
                 
-                dev_id_num = ((devip->sdbg_host->shost->host_no + 1) * 2000) +
-                             (devip->target * 1000) + devip->lun;
-                len = scnprintf(dev_id_str, 6, "%d", dev_id_num);
+                lu_id_num = devip->wlun ? -1 : (((host_no + 1) * 2000) +
+                            (devip->target * 1000) + devip->lun);
+                target_dev_id = ((host_no + 1) * 2000) +
+                                 (devip->target * 1000) - 3;
+                len = scnprintf(lu_id_str, 6, "%d", lu_id_num);
                 if (0 == cmd[2]) { /* supported vital product data pages */
-                        arr[3] = 3;
-                        arr[4] = 0x0; /* this page */
-                        arr[5] = 0x80; /* unit serial number */
-                        arr[6] = 0x83; /* device identification */
+                        arr[1] = cmd[2];        /*sanity */
+                        n = 4;
+                        arr[n++] = 0x0;   /* this page */
+                        arr[n++] = 0x80;  /* unit serial number */
+                        arr[n++] = 0x83;  /* device identification */
+                        arr[n++] = 0x84;  /* software interface ident. */
+                        arr[n++] = 0x85;  /* management network addresses */
+                        arr[n++] = 0x86;  /* extended inquiry */
+                        arr[n++] = 0x87;  /* mode page policy */
+                        arr[n++] = 0x88;  /* SCSI ports */
+                        arr[n++] = 0x89;  /* ATA information */
+                        arr[n++] = 0xb0;  /* Block limits (SBC) */
+                        arr[3] = n - 4;   /* number of supported VPD pages */
                 } else if (0x80 == cmd[2]) { /* unit serial number */
-                        arr[1] = 0x80;
+                        arr[1] = cmd[2];        /*sanity */
                         arr[3] = len;
-                        memcpy(&arr[4], dev_id_str, len);
+                        memcpy(&arr[4], lu_id_str, len);
                 } else if (0x83 == cmd[2]) { /* device identification */
-                        arr[1] = 0x83;
-                        arr[3] = inquiry_evpd_83(&arr[4], dev_id_num,
-                                                 dev_id_str, len);
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = inquiry_evpd_83(&arr[4], target_dev_id,
+                                                 lu_id_num, lu_id_str, len);
+                } else if (0x84 == cmd[2]) { /* Software interface ident. */
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = inquiry_evpd_84(&arr[4]);
+                } else if (0x85 == cmd[2]) { /* Management network addresses */
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = inquiry_evpd_85(&arr[4]);
+                } else if (0x86 == cmd[2]) { /* extended inquiry */
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = 0x3c;  /* number of following entries */
+                        arr[4] = 0x0;   /* no protection stuff */
+                        arr[5] = 0x7;   /* head of q, ordered + simple q's */
+                } else if (0x87 == cmd[2]) { /* mode page policy */
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = 0x8;   /* number of following entries */
+                        arr[4] = 0x2;   /* disconnect-reconnect mp */
+                        arr[6] = 0x80;  /* mlus, shared */
+                        arr[8] = 0x18;   /* protocol specific lu */
+                        arr[10] = 0x82;  /* mlus, per initiator port */
+                } else if (0x88 == cmd[2]) { /* SCSI Ports */
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = inquiry_evpd_88(&arr[4], target_dev_id);
+                } else if (0x89 == cmd[2]) { /* ATA information */
+                        arr[1] = cmd[2];        /*sanity */
+                        n = inquiry_evpd_89(&arr[4]);
+                        arr[2] = (n >> 8);
+                        arr[3] = (n & 0xff);
+                } else if (0xb0 == cmd[2]) { /* Block limits (SBC) */
+                        arr[1] = cmd[2];        /*sanity */
+                        arr[3] = inquiry_evpd_b0(&arr[4]);
                 } else {
                         /* Illegal request, invalid field in cdb */
                         mk_sense_buffer(devip, ILLEGAL_REQUEST,
                                         INVALID_FIELD_IN_CDB, 0);
                         return check_condition_result;
                 }
+                len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
                 return fill_from_dev_buffer(scp, arr,
-                            min(alloc_len, SDEBUG_MAX_INQ_ARR_SZ));
+                            min(len, SDEBUG_MAX_INQ_ARR_SZ));
         }
         /* drops through here for a standard inquiry */
         arr[1] = DEV_REMOVEABLE(target) ? 0x80 : 0;     /* Removable disk */
         arr[2] = scsi_debug_scsi_level;
         arr[3] = 2;    /* response_data_format==2 */
         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
-        arr[6] = 0x1; /* claim: ADDR16 */
+        arr[6] = 0x10; /* claim: MultiP */
         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
-        arr[7] = 0x3a; /* claim: WBUS16, SYNC, LINKED + CMDQUE */
+        arr[7] = 0xa; /* claim: LINKED + CMDQUE */
         memcpy(&arr[8], inq_vendor_id, 8);
         memcpy(&arr[16], inq_product_id, 16);
         memcpy(&arr[32], inq_product_rev, 4);
         /* version descriptors (2 bytes each) follow */
-        arr[58] = 0x0; arr[59] = 0x40; /* SAM-2 */
-        arr[60] = 0x3; arr[61] = 0x0;  /* SPC-3 */
+        arr[58] = 0x0; arr[59] = 0x77; /* SAM-3 ANSI */
+        arr[60] = 0x3; arr[61] = 0x14;  /* SPC-3 ANSI */
+        n = 62;
         if (scsi_debug_ptype == 0) {
-                arr[62] = 0x1; arr[63] = 0x80; /* SBC */
+                arr[n++] = 0x3; arr[n++] = 0x3d; /* SBC-2 ANSI */
         } else if (scsi_debug_ptype == 1) {
-                arr[62] = 0x2; arr[63] = 0x00; /* SSC */
+                arr[n++] = 0x3; arr[n++] = 0x60; /* SSC-2 no version */
         }
+        arr[n++] = 0xc; arr[n++] = 0xf;  /* SAS-1.1 rev 10 */
         return fill_from_dev_buffer(scp, arr,
                             min(alloc_len, SDEBUG_LONG_INQ_SZ));
 }
@@ -676,46 +1038,141 @@ static int resp_requests(struct scsi_cmnd * scp,
         unsigned char * sbuff;
         unsigned char *cmd = (unsigned char *)scp->cmnd;
         unsigned char arr[SDEBUG_SENSE_LEN];
+        int want_dsense;
         int len = 18;
 
-        memset(arr, 0, SDEBUG_SENSE_LEN);
+        memset(arr, 0, sizeof(arr));
         if (devip->reset == 1)
-                mk_sense_buffer(devip, 0, NO_ADDED_SENSE, 0);
+                mk_sense_buffer(devip, 0, NO_ADDITIONAL_SENSE, 0);
+        want_dsense = !!(cmd[1] & 1) || scsi_debug_dsense;
         sbuff = devip->sense_buff;
-        if ((cmd[1] & 1) && (! scsi_debug_dsense)) {
-                /* DESC bit set and sense_buff in fixed format */
-                arr[0] = 0x72;
-                arr[1] = sbuff[2];     /* sense key */
-                arr[2] = sbuff[12];    /* asc */
-                arr[3] = sbuff[13];    /* ascq */
-                len = 8;
-        } else
+        if ((iec_m_pg[2] & 0x4) && (6 == (iec_m_pg[3] & 0xf))) {
+                if (want_dsense) {
+                        arr[0] = 0x72;
+                        arr[1] = 0x0;           /* NO_SENSE in sense_key */
+                        arr[2] = THRESHOLD_EXCEEDED;
+                        arr[3] = 0xff;          /* TEST set and MRIE==6 */
+                } else {
+                        arr[0] = 0x70;
+                        arr[2] = 0x0;           /* NO_SENSE in sense_key */
+                        arr[7] = 0xa;           /* 18 byte sense buffer */
+                        arr[12] = THRESHOLD_EXCEEDED;
+                        arr[13] = 0xff;         /* TEST set and MRIE==6 */
+                }
+        } else if (devip->stopped) {
+                if (want_dsense) {
+                        arr[0] = 0x72;
+                        arr[1] = 0x0;           /* NO_SENSE in sense_key */
+                        arr[2] = LOW_POWER_COND_ON;
+                        arr[3] = 0x0;           /* TEST set and MRIE==6 */
+                } else {
+                        arr[0] = 0x70;
+                        arr[2] = 0x0;           /* NO_SENSE in sense_key */
+                        arr[7] = 0xa;           /* 18 byte sense buffer */
+                        arr[12] = LOW_POWER_COND_ON;
+                        arr[13] = 0x0;          /* TEST set and MRIE==6 */
+                }
+        } else {
                 memcpy(arr, sbuff, SDEBUG_SENSE_LEN);
-        mk_sense_buffer(devip, 0, NO_ADDED_SENSE, 0);
+                if ((cmd[1] & 1) && (! scsi_debug_dsense)) {
+                        /* DESC bit set and sense_buff in fixed format */
+                        memset(arr, 0, sizeof(arr));
+                        arr[0] = 0x72;
+                        arr[1] = sbuff[2];     /* sense key */
+                        arr[2] = sbuff[12];    /* asc */
+                        arr[3] = sbuff[13];    /* ascq */
+                        len = 8;
+                }
+        }
+        mk_sense_buffer(devip, 0, NO_ADDITIONAL_SENSE, 0);
         return fill_from_dev_buffer(scp, arr, len);
 }
 
+static int resp_start_stop(struct scsi_cmnd * scp,
+                           struct sdebug_dev_info * devip)
+{
+        unsigned char *cmd = (unsigned char *)scp->cmnd;
+        int power_cond, errsts, start;
+
+        if ((errsts = check_readiness(scp, 1, devip)))
+                return errsts;
+        power_cond = (cmd[4] & 0xf0) >> 4;
+        if (power_cond) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
+                                0);
+                return check_condition_result;
+        }
+        start = cmd[4] & 1;
+        if (start == devip->stopped)
+                devip->stopped = !start;
+        return 0;
+}
+
 #define SDEBUG_READCAP_ARR_SZ 8
 static int resp_readcap(struct scsi_cmnd * scp,
                         struct sdebug_dev_info * devip)
 {
         unsigned char arr[SDEBUG_READCAP_ARR_SZ];
-        unsigned long capac;
+        unsigned int capac;
         int errsts;
 
-        if ((errsts = check_reset(scp, devip)))
+        if ((errsts = check_readiness(scp, 1, devip)))
                 return errsts;
+        /* following just in case virtual_gb changed */
+        if (scsi_debug_virtual_gb > 0) {
+                sdebug_capacity = 2048 * 1024;
+                sdebug_capacity *= scsi_debug_virtual_gb;
+        } else
+                sdebug_capacity = sdebug_store_sectors;
         memset(arr, 0, SDEBUG_READCAP_ARR_SZ);
-        capac = (unsigned long)sdebug_capacity - 1;
-        arr[0] = (capac >> 24);
-        arr[1] = (capac >> 16) & 0xff;
-        arr[2] = (capac >> 8) & 0xff;
-        arr[3] = capac & 0xff;
+        if (sdebug_capacity < 0xffffffff) {
+                capac = (unsigned int)sdebug_capacity - 1;
+                arr[0] = (capac >> 24);
+                arr[1] = (capac >> 16) & 0xff;
+                arr[2] = (capac >> 8) & 0xff;
+                arr[3] = capac & 0xff;
+        } else {
+                arr[0] = 0xff;
+                arr[1] = 0xff;
+                arr[2] = 0xff;
+                arr[3] = 0xff;
+        }
         arr[6] = (SECT_SIZE_PER(target) >> 8) & 0xff;
         arr[7] = SECT_SIZE_PER(target) & 0xff;
         return fill_from_dev_buffer(scp, arr, SDEBUG_READCAP_ARR_SZ);
 }
 
+#define SDEBUG_READCAP16_ARR_SZ 32
+static int resp_readcap16(struct scsi_cmnd * scp,
+                          struct sdebug_dev_info * devip)
+{
+        unsigned char *cmd = (unsigned char *)scp->cmnd;
+        unsigned char arr[SDEBUG_READCAP16_ARR_SZ];
+        unsigned long long capac;
+        int errsts, k, alloc_len;
+
+        if ((errsts = check_readiness(scp, 1, devip)))
+                return errsts;
+        alloc_len = ((cmd[10] << 24) + (cmd[11] << 16) + (cmd[12] << 8)
+                     + cmd[13]);
+        /* following just in case virtual_gb changed */
+        if (scsi_debug_virtual_gb > 0) {
+                sdebug_capacity = 2048 * 1024;
+                sdebug_capacity *= scsi_debug_virtual_gb;
+        } else
+                sdebug_capacity = sdebug_store_sectors;
+        memset(arr, 0, SDEBUG_READCAP16_ARR_SZ);
+        capac = sdebug_capacity - 1;
+        for (k = 0; k < 8; ++k, capac >>= 8)
+                arr[7 - k] = capac & 0xff;
+        arr[8] = (SECT_SIZE_PER(target) >> 24) & 0xff;
+        arr[9] = (SECT_SIZE_PER(target) >> 16) & 0xff;
+        arr[10] = (SECT_SIZE_PER(target) >> 8) & 0xff;
+        arr[11] = SECT_SIZE_PER(target) & 0xff;
+        return fill_from_dev_buffer(scp, arr,
+                                    min(alloc_len, SDEBUG_READCAP16_ARR_SZ));
+}
+
 /* <<Following mode page info copied from ST318451LW>> */
 
 static int resp_err_recov_pg(unsigned char * p, int pcontrol, int target)
@@ -771,27 +1228,98 @@ static int resp_caching_pg(unsigned char * p, int pcontrol, int target)
 
 static int resp_ctrl_m_pg(unsigned char * p, int pcontrol, int target)
 {       /* Control mode page for mode_sense */
-        unsigned char ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
+        unsigned char ch_ctrl_m_pg[] = {/* 0xa, 10, */ 0x6, 0, 0, 0, 0, 0,
+                                        0, 0, 0, 0};
+        unsigned char d_ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
                                      0, 0, 0x2, 0x4b};
 
         if (scsi_debug_dsense)
                 ctrl_m_pg[2] |= 0x4;
+        else
+                ctrl_m_pg[2] &= ~0x4;
         memcpy(p, ctrl_m_pg, sizeof(ctrl_m_pg));
         if (1 == pcontrol)
-                memset(p + 2, 0, sizeof(ctrl_m_pg) - 2);
+                memcpy(p + 2, ch_ctrl_m_pg, sizeof(ch_ctrl_m_pg));
+        else if (2 == pcontrol)
+                memcpy(p, d_ctrl_m_pg, sizeof(d_ctrl_m_pg));
         return sizeof(ctrl_m_pg);
 }
 
+
 static int resp_iec_m_pg(unsigned char * p, int pcontrol, int target)
 {       /* Informational Exceptions control mode page for mode_sense */
-        unsigned char iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
-                                    0, 0, 0x0, 0x0};
+        unsigned char ch_iec_m_pg[] = {/* 0x1c, 0xa, */ 0x4, 0xf, 0, 0, 0, 0,
+                                       0, 0, 0x0, 0x0};
+        unsigned char d_iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
+                                      0, 0, 0x0, 0x0};
+
         memcpy(p, iec_m_pg, sizeof(iec_m_pg));
         if (1 == pcontrol)
-                memset(p + 2, 0, sizeof(iec_m_pg) - 2);
+                memcpy(p + 2, ch_iec_m_pg, sizeof(ch_iec_m_pg));
+        else if (2 == pcontrol)
+                memcpy(p, d_iec_m_pg, sizeof(d_iec_m_pg));
         return sizeof(iec_m_pg);
 }
 
+static int resp_sas_sf_m_pg(unsigned char * p, int pcontrol, int target)
+{       /* SAS SSP mode page - short format for mode_sense */
+        unsigned char sas_sf_m_pg[] = {0x19, 0x6,
+                0x6, 0x0, 0x7, 0xd0, 0x0, 0x0};
+
+        memcpy(p, sas_sf_m_pg, sizeof(sas_sf_m_pg));
+        if (1 == pcontrol)
+                memset(p + 2, 0, sizeof(sas_sf_m_pg) - 2);
+        return sizeof(sas_sf_m_pg);
+}
+
+
+static int resp_sas_pcd_m_spg(unsigned char * p, int pcontrol, int target,
+                              int target_dev_id)
+{       /* SAS phy control and discover mode page for mode_sense */
+        unsigned char sas_pcd_m_pg[] = {0x59, 0x1, 0, 0x64, 0, 0x6, 0, 2,
+                    0, 0, 0, 0, 0x10, 0x9, 0x8, 0x0,
+                    0x52, 0x22, 0x22, 0x20, 0x0, 0x0, 0x0, 0x0,
+                    0x51, 0x11, 0x11, 0x10, 0x0, 0x0, 0x0, 0x1,
+                    0x2, 0, 0, 0, 0, 0, 0, 0,
+                    0x88, 0x99, 0, 0, 0, 0, 0, 0,
+                    0, 0, 0, 0, 0, 0, 0, 0,
+                    0, 1, 0, 0, 0x10, 0x9, 0x8, 0x0,
+                    0x52, 0x22, 0x22, 0x20, 0x0, 0x0, 0x0, 0x0,
+                    0x51, 0x11, 0x11, 0x10, 0x0, 0x0, 0x0, 0x1,
+                    0x3, 0, 0, 0, 0, 0, 0, 0,
+                    0x88, 0x99, 0, 0, 0, 0, 0, 0,
+                    0, 0, 0, 0, 0, 0, 0, 0,
+                };
+        int port_a, port_b;
+
+        port_a = target_dev_id + 1;
+        port_b = port_a + 1;
+        memcpy(p, sas_pcd_m_pg, sizeof(sas_pcd_m_pg));
+        p[20] = (port_a >> 24);
+        p[21] = (port_a >> 16) & 0xff;
+        p[22] = (port_a >> 8) & 0xff;
+        p[23] = port_a & 0xff;
+        p[48 + 20] = (port_b >> 24);
+        p[48 + 21] = (port_b >> 16) & 0xff;
+        p[48 + 22] = (port_b >> 8) & 0xff;
+        p[48 + 23] = port_b & 0xff;
+        if (1 == pcontrol)
+                memset(p + 4, 0, sizeof(sas_pcd_m_pg) - 4);
+        return sizeof(sas_pcd_m_pg);
+}
+
+static int resp_sas_sha_m_spg(unsigned char * p, int pcontrol)
+{       /* SAS SSP shared protocol specific port mode subpage */
+        unsigned char sas_sha_m_pg[] = {0x59, 0x2, 0, 0xc, 0, 0x6, 0x10, 0,
+                    0, 0, 0, 0, 0, 0, 0, 0,
+                };
+
+        memcpy(p, sas_sha_m_pg, sizeof(sas_sha_m_pg));
+        if (1 == pcontrol)
+                memset(p + 4, 0, sizeof(sas_sha_m_pg) - 4);
+        return sizeof(sas_sha_m_pg);
+}
+
 #define SDEBUG_MAX_MSENSE_SZ 256
 
 static int resp_mode_sense(struct scsi_cmnd * scp, int target,
@@ -800,12 +1328,12 @@ static int resp_mode_sense(struct scsi_cmnd * scp, int target,
         unsigned char dbd;
         int pcontrol, pcode, subpcode;
         unsigned char dev_spec;
-        int alloc_len, msense_6, offset, len, errsts;
+        int alloc_len, msense_6, offset, len, errsts, target_dev_id;
         unsigned char * ap;
         unsigned char arr[SDEBUG_MAX_MSENSE_SZ];
         unsigned char *cmd = (unsigned char *)scp->cmnd;
 
-        if ((errsts = check_reset(scp, devip)))
+        if ((errsts = check_readiness(scp, 1, devip)))
                 return errsts;
         dbd = cmd[1] & 0x8;
         pcontrol = (cmd[2] & 0xc0) >> 6;
@@ -819,6 +1347,8 @@ static int resp_mode_sense(struct scsi_cmnd * scp, int target,
                                 0);
                 return check_condition_result;
         }
+        target_dev_id = ((devip->sdbg_host->shost->host_no + 1) * 2000) +
+                        (devip->target * 1000) - 3;
         dev_spec = DEV_READONLY(target) ? 0x80 : 0x0;
         if (msense_6) {
                 arr[2] = dev_spec;
@@ -829,7 +1359,8 @@ static int resp_mode_sense(struct scsi_cmnd * scp, int target,
         }
         ap = arr + offset;
 
-        if (0 != subpcode) { /* TODO: Control Extension page */
+        if ((subpcode > 0x0) && (subpcode < 0xff) && (0x19 != pcode)) {
+                /* TODO: Control Extension page */
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
                                 0);
                 return check_condition_result;
@@ -855,17 +1386,45 @@ static int resp_mode_sense(struct scsi_cmnd * scp, int target,
                 len = resp_ctrl_m_pg(ap, pcontrol, target);
                 offset += len;
                 break;
+        case 0x19:      /* if spc==1 then sas phy, control+discover */
+                if ((subpcode > 0x2) && (subpcode < 0xff)) {
+                        mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                        INVALID_FIELD_IN_CDB, 0);
+                        return check_condition_result;
+                }
+                len = 0;
+                if ((0x0 == subpcode) || (0xff == subpcode))
+                        len += resp_sas_sf_m_pg(ap + len, pcontrol, target);
+                if ((0x1 == subpcode) || (0xff == subpcode))
+                        len += resp_sas_pcd_m_spg(ap + len, pcontrol, target,
+                                                  target_dev_id);
+                if ((0x2 == subpcode) || (0xff == subpcode))
+                        len += resp_sas_sha_m_spg(ap + len, pcontrol);
+                offset += len;
+                break;
         case 0x1c:      /* Informational Exceptions Mode page, all devices */
                 len = resp_iec_m_pg(ap, pcontrol, target);
                 offset += len;
                 break;
         case 0x3f:      /* Read all Mode pages */
-                len = resp_err_recov_pg(ap, pcontrol, target);
-                len += resp_disconnect_pg(ap + len, pcontrol, target);
-                len += resp_format_pg(ap + len, pcontrol, target);
-                len += resp_caching_pg(ap + len, pcontrol, target);
-                len += resp_ctrl_m_pg(ap + len, pcontrol, target);
-                len += resp_iec_m_pg(ap + len, pcontrol, target);
+                if ((0 == subpcode) || (0xff == subpcode)) {
+                        len = resp_err_recov_pg(ap, pcontrol, target);
+                        len += resp_disconnect_pg(ap + len, pcontrol, target);
+                        len += resp_format_pg(ap + len, pcontrol, target);
+                        len += resp_caching_pg(ap + len, pcontrol, target);
+                        len += resp_ctrl_m_pg(ap + len, pcontrol, target);
+                        len += resp_sas_sf_m_pg(ap + len, pcontrol, target);
+                        if (0xff == subpcode) {
+                                len += resp_sas_pcd_m_spg(ap + len, pcontrol,
+                                                  target, target_dev_id);
+                                len += resp_sas_sha_m_spg(ap + len, pcontrol);
+                        }
+                        len += resp_iec_m_pg(ap + len, pcontrol, target);
+                } else {
+                        mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                        INVALID_FIELD_IN_CDB, 0);
+                        return check_condition_result;
+                }
                 offset += len;
                 break;
         default:
@@ -882,71 +1441,274 @@ static int resp_mode_sense(struct scsi_cmnd * scp, int target,
         return fill_from_dev_buffer(scp, arr, min(alloc_len, offset));
 }
 
-static int resp_read(struct scsi_cmnd * SCpnt, int upper_blk, int block,
-                     int num, struct sdebug_dev_info * devip)
+#define SDEBUG_MAX_MSELECT_SZ 512
+
+static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
+                            struct sdebug_dev_info * devip)
+{
+        int pf, sp, ps, md_len, bd_len, off, spf, pg_len;
+        int param_len, res, errsts, mpage;
+        unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
+        unsigned char *cmd = (unsigned char *)scp->cmnd;
+
+        if ((errsts = check_readiness(scp, 1, devip)))
+                return errsts;
+        memset(arr, 0, sizeof(arr));
+        pf = cmd[1] & 0x10;
+        sp = cmd[1] & 0x1;
+        param_len = mselect6 ? cmd[4] : ((cmd[7] << 8) + cmd[8]);
+        if ((0 == pf) || sp || (param_len > SDEBUG_MAX_MSELECT_SZ)) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                INVALID_FIELD_IN_CDB, 0);
+                return check_condition_result;
+        }
+        res = fetch_to_dev_buffer(scp, arr, param_len);
+        if (-1 == res)
+                return (DID_ERROR << 16);
+        else if ((res < param_len) &&
+                 (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
+                printk(KERN_INFO "scsi_debug: mode_select: cdb indicated=%d, "
+                       " IO sent=%d bytes\n", param_len, res);
+        md_len = mselect6 ? (arr[0] + 1) : ((arr[0] << 8) + arr[1] + 2);
+        bd_len = mselect6 ? arr[3] : ((arr[6] << 8) + arr[7]);
+        if ((md_len > 2) || (0 != bd_len)) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                INVALID_FIELD_IN_PARAM_LIST, 0);
+                return check_condition_result;
+        }
+        off = bd_len + (mselect6 ? 4 : 8);
+        mpage = arr[off] & 0x3f;
+        ps = !!(arr[off] & 0x80);
+        if (ps) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                INVALID_FIELD_IN_PARAM_LIST, 0);
+                return check_condition_result;
+        }
+        spf = !!(arr[off] & 0x40);
+        pg_len = spf ? ((arr[off + 2] << 8) + arr[off + 3] + 4) :
+                       (arr[off + 1] + 2);
+        if ((pg_len + off) > param_len) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                PARAMETER_LIST_LENGTH_ERR, 0);
+                return check_condition_result;
+        }
+        switch (mpage) {
+        case 0xa:      /* Control Mode page */
+                if (ctrl_m_pg[1] == arr[off + 1]) {
+                        memcpy(ctrl_m_pg + 2, arr + off + 2,
+                               sizeof(ctrl_m_pg) - 2);
+                        scsi_debug_dsense = !!(ctrl_m_pg[2] & 0x4);
+                        return 0;
+                }
+                break;
+        case 0x1c:      /* Informational Exceptions Mode page */
+                if (iec_m_pg[1] == arr[off + 1]) {
+                        memcpy(iec_m_pg + 2, arr + off + 2,
+                               sizeof(iec_m_pg) - 2);
+                        return 0;
+                }
+                break;
+        default:
+                break;
+        }
+        mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                        INVALID_FIELD_IN_PARAM_LIST, 0);
+        return check_condition_result;
+}
+
+static int resp_temp_l_pg(unsigned char * arr)
+{
+        unsigned char temp_l_pg[] = {0x0, 0x0, 0x3, 0x2, 0x0, 38,
+                                     0x0, 0x1, 0x3, 0x2, 0x0, 65,
+                };
+
+        memcpy(arr, temp_l_pg, sizeof(temp_l_pg));
+        return sizeof(temp_l_pg);
+}
+
+static int resp_ie_l_pg(unsigned char * arr)
+{
+        unsigned char ie_l_pg[] = {0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 38,
+                };
+
+        memcpy(arr, ie_l_pg, sizeof(ie_l_pg));
+        if (iec_m_pg[2] & 0x4) {        /* TEST bit set */
+                arr[4] = THRESHOLD_EXCEEDED;
+                arr[5] = 0xff;
+        }
+        return sizeof(ie_l_pg);
+}
+
+#define SDEBUG_MAX_LSENSE_SZ 512
+
+static int resp_log_sense(struct scsi_cmnd * scp,
+                          struct sdebug_dev_info * devip)
+{
+        int ppc, sp, pcontrol, pcode, alloc_len, errsts, len, n;
+        unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
+        unsigned char *cmd = (unsigned char *)scp->cmnd;
+
+        if ((errsts = check_readiness(scp, 1, devip)))
+                return errsts;
+        memset(arr, 0, sizeof(arr));
+        ppc = cmd[1] & 0x2;
+        sp = cmd[1] & 0x1;
+        if (ppc || sp) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                INVALID_FIELD_IN_CDB, 0);
+                return check_condition_result;
+        }
+        pcontrol = (cmd[2] & 0xc0) >> 6;
+        pcode = cmd[2] & 0x3f;
+        alloc_len = (cmd[7] << 8) + cmd[8];
+        arr[0] = pcode;
+        switch (pcode) {
+        case 0x0:       /* Supported log pages log page */
+                n = 4;
+                arr[n++] = 0x0;         /* this page */
+                arr[n++] = 0xd;         /* Temperature */
+                arr[n++] = 0x2f;        /* Informational exceptions */
+                arr[3] = n - 4;
+                break;
+        case 0xd:       /* Temperature log page */
+                arr[3] = resp_temp_l_pg(arr + 4);
+                break;
+        case 0x2f:      /* Informational exceptions log page */
+                arr[3] = resp_ie_l_pg(arr + 4);
+                break;
+        default:
+                mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                INVALID_FIELD_IN_CDB, 0);
+                return check_condition_result;
+        }
+        len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
+        return fill_from_dev_buffer(scp, arr,
+                    min(len, SDEBUG_MAX_INQ_ARR_SZ));
+}
+
+static int resp_read(struct scsi_cmnd * SCpnt, unsigned long long lba,
+                     unsigned int num, struct sdebug_dev_info * devip)
 {
         unsigned long iflags;
+        unsigned int block, from_bottom;
+        unsigned long long u;
         int ret;
 
-        if (upper_blk || (block + num > sdebug_capacity)) {
+        if (lba + num > sdebug_capacity) {
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, ADDR_OUT_OF_RANGE,
                                 0);
                 return check_condition_result;
         }
+        /* transfer length excessive (tie in to block limits VPD page) */
+        if (num > sdebug_store_sectors) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
+                                0);
+                return check_condition_result;
+        }
         if ((SCSI_DEBUG_OPT_MEDIUM_ERR & scsi_debug_opts) &&
-            (block <= OPT_MEDIUM_ERR_ADDR) &&
-            ((block + num) > OPT_MEDIUM_ERR_ADDR)) {
+            (lba <= OPT_MEDIUM_ERR_ADDR) &&
+            ((lba + num) > OPT_MEDIUM_ERR_ADDR)) {
+                /* claim unrecoverable read error */
                 mk_sense_buffer(devip, MEDIUM_ERROR, UNRECOVERED_READ_ERR,
                                 0);
-                /* claim unrecoverable read error */
+                /* set info field and valid bit for fixed descriptor */
+                if (0x70 == (devip->sense_buff[0] & 0x7f)) {
+                        devip->sense_buff[0] |= 0x80;   /* Valid bit */
+                        ret = OPT_MEDIUM_ERR_ADDR;
+                        devip->sense_buff[3] = (ret >> 24) & 0xff;
+                        devip->sense_buff[4] = (ret >> 16) & 0xff;
+                        devip->sense_buff[5] = (ret >> 8) & 0xff;
+                        devip->sense_buff[6] = ret & 0xff;
+                }
                 return check_condition_result;
         }
         read_lock_irqsave(&atomic_rw, iflags);
-        ret = fill_from_dev_buffer(SCpnt, fake_storep + (block * SECT_SIZE),
-                                   num * SECT_SIZE);
+        if ((lba + num) <= sdebug_store_sectors)
+                ret = fill_from_dev_buffer(SCpnt,
+                                           fake_storep + (lba * SECT_SIZE),
+                                           num * SECT_SIZE);
+        else {
+                /* modulo when one arg is 64 bits needs do_div() */
+                u = lba;
+                block = do_div(u, sdebug_store_sectors);
+                from_bottom = 0;
+                if ((block + num) > sdebug_store_sectors)
+                        from_bottom = (block + num) - sdebug_store_sectors;
+                ret = fill_from_dev_buffer(SCpnt,
+                                           fake_storep + (block * SECT_SIZE),
+                                           (num - from_bottom) * SECT_SIZE);
+                if ((0 == ret) && (from_bottom > 0))
+                        ret = fill_from_dev_buffer(SCpnt, fake_storep,
+                                                   from_bottom * SECT_SIZE);
+        }
         read_unlock_irqrestore(&atomic_rw, iflags);
         return ret;
 }
 
-static int resp_write(struct scsi_cmnd * SCpnt, int upper_blk, int block,
-                      int num, struct sdebug_dev_info * devip)
+static int resp_write(struct scsi_cmnd * SCpnt, unsigned long long lba,
+                      unsigned int num, struct sdebug_dev_info * devip)
 {
         unsigned long iflags;
+        unsigned int block, to_bottom;
+        unsigned long long u;
         int res;
 
-        if (upper_blk || (block + num > sdebug_capacity)) {
+        if (lba + num > sdebug_capacity) {
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, ADDR_OUT_OF_RANGE,
                                 0);
                 return check_condition_result;
         }
+        /* transfer length excessive (tie in to block limits VPD page) */
+        if (num > sdebug_store_sectors) {
+                mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
+                                0);
+                return check_condition_result;
+        }
 
         write_lock_irqsave(&atomic_rw, iflags);
-        res = fetch_to_dev_buffer(SCpnt, fake_storep + (block * SECT_SIZE),
-                                  num * SECT_SIZE);
+        if ((lba + num) <= sdebug_store_sectors)
+                res = fetch_to_dev_buffer(SCpnt,
+                                          fake_storep + (lba * SECT_SIZE),
+                                          num * SECT_SIZE);
+        else {
+                /* modulo when one arg is 64 bits needs do_div() */
+                u = lba;
+                block = do_div(u, sdebug_store_sectors);
+                to_bottom = 0;
+                if ((block + num) > sdebug_store_sectors)
+                        to_bottom = (block + num) - sdebug_store_sectors;
+                res = fetch_to_dev_buffer(SCpnt,
+                                          fake_storep + (block * SECT_SIZE),
+                                          (num - to_bottom) * SECT_SIZE);
+                if ((0 == res) && (to_bottom > 0))
+                        res = fetch_to_dev_buffer(SCpnt, fake_storep,
+                                                  to_bottom * SECT_SIZE);
+        }
         write_unlock_irqrestore(&atomic_rw, iflags);
         if (-1 == res)
                 return (DID_ERROR << 16);
         else if ((res < (num * SECT_SIZE)) &&
                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
-                printk(KERN_INFO "scsi_debug: write: cdb indicated=%d, "
+                printk(KERN_INFO "scsi_debug: write: cdb indicated=%u, "
                        " IO sent=%d bytes\n", num * SECT_SIZE, res);
         return 0;
 }
 
-#define SDEBUG_RLUN_ARR_SZ 128
+#define SDEBUG_RLUN_ARR_SZ 256
 
 static int resp_report_luns(struct scsi_cmnd * scp,
                             struct sdebug_dev_info * devip)
 {
         unsigned int alloc_len;
-        int lun_cnt, i, upper;
+        int lun_cnt, i, upper, num, n, wlun, lun;
         unsigned char *cmd = (unsigned char *)scp->cmnd;
         int select_report = (int)cmd[2];
         struct scsi_lun *one_lun;
         unsigned char arr[SDEBUG_RLUN_ARR_SZ];
+        unsigned char * max_addr;
 
         alloc_len = cmd[9] + (cmd[8] << 8) + (cmd[7] << 16) + (cmd[6] << 24);
-        if ((alloc_len < 16) || (select_report > 2)) {
+        if ((alloc_len < 4) || (select_report > 2)) {
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
                                 0);
                 return check_condition_result;
@@ -954,18 +1716,37 @@ static int resp_report_luns(struct scsi_cmnd * scp,
         /* can produce response with up to 16k luns (lun 0 to lun 16383) */
         memset(arr, 0, SDEBUG_RLUN_ARR_SZ);
         lun_cnt = scsi_debug_max_luns;
-        arr[2] = ((sizeof(struct scsi_lun) * lun_cnt) >> 8) & 0xff;
-        arr[3] = (sizeof(struct scsi_lun) * lun_cnt) & 0xff;
-        lun_cnt = min((int)((SDEBUG_RLUN_ARR_SZ - 8) /
-                            sizeof(struct scsi_lun)), lun_cnt);
+        if (1 == select_report)
+                lun_cnt = 0;
+        else if (scsi_debug_no_lun_0 && (lun_cnt > 0))
+                --lun_cnt;
+        wlun = (select_report > 0) ? 1 : 0;
+        num = lun_cnt + wlun;
+        arr[2] = ((sizeof(struct scsi_lun) * num) >> 8) & 0xff;
+        arr[3] = (sizeof(struct scsi_lun) * num) & 0xff;
+        n = min((int)((SDEBUG_RLUN_ARR_SZ - 8) /
+                            sizeof(struct scsi_lun)), num);
+        if (n < num) {
+                wlun = 0;
+                lun_cnt = n;
+        }
         one_lun = (struct scsi_lun *) &arr[8];
-        for (i = 0; i < lun_cnt; i++) {
-                upper = (i >> 8) & 0x3f;
+        max_addr = arr + SDEBUG_RLUN_ARR_SZ;
+        for (i = 0, lun = (scsi_debug_no_lun_0 ? 1 : 0);
+             ((i < lun_cnt) && ((unsigned char *)(one_lun + i) < max_addr));
+             i++, lun++) {
+                upper = (lun >> 8) & 0x3f;
                 if (upper)
                         one_lun[i].scsi_lun[0] =
                             (upper | (SAM2_LUN_ADDRESS_METHOD << 6));
-                one_lun[i].scsi_lun[1] = i & 0xff;
+                one_lun[i].scsi_lun[1] = lun & 0xff;
         }
+        if (wlun) {
+                one_lun[i].scsi_lun[0] = (SAM2_WLUN_REPORT_LUNS >> 8) & 0xff;
+                one_lun[i].scsi_lun[1] = SAM2_WLUN_REPORT_LUNS & 0xff;
+                i++;
+        }
+        alloc_len = (unsigned char *)(one_lun + i) - arr;
         return fill_from_dev_buffer(scp, arr,
                                     min((int)alloc_len, SDEBUG_RLUN_ARR_SZ));
 }
@@ -1001,7 +1782,8 @@ static void timer_intr_handler(unsigned long indx)
 static int scsi_debug_slave_alloc(struct scsi_device * sdp)
 {
         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
-                sdev_printk(KERN_INFO, sdp, "scsi_debug: slave_alloc\n");
+                printk(KERN_INFO "scsi_debug: slave_alloc <%u %u %u %u>\n",
+                       sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
         return 0;
 }
 
@@ -1010,7 +1792,8 @@ static int scsi_debug_slave_configure(struct scsi_device * sdp)
         struct sdebug_dev_info * devip;
 
         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
-                sdev_printk(KERN_INFO, sdp, "scsi_debug: slave_configure\n");
+                printk(KERN_INFO "scsi_debug: slave_configure <%u %u %u %u>\n",
+                       sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
         if (sdp->host->max_cmd_len != SCSI_DEBUG_MAX_CMD_LEN)
                 sdp->host->max_cmd_len = SCSI_DEBUG_MAX_CMD_LEN;
         devip = devInfoReg(sdp);
@@ -1018,6 +1801,7 @@ static int scsi_debug_slave_configure(struct scsi_device * sdp)
         if (sdp->host->cmd_per_lun)
                 scsi_adjust_queue_depth(sdp, SDEBUG_TAGGED_QUEUING,
                                         sdp->host->cmd_per_lun);
+        blk_queue_max_segment_size(sdp->request_queue, 256 * 1024);
         return 0;
 }
 
@@ -1027,7 +1811,8 @@ static void scsi_debug_slave_destroy(struct scsi_device * sdp)
                                 (struct sdebug_dev_info *)sdp->hostdata;
 
         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
-                sdev_printk(KERN_INFO, sdp, "scsi_debug: slave_destroy\n");
+                printk(KERN_INFO "scsi_debug: slave_destroy <%u %u %u %u>\n",
+                       sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
         if (devip) {
                 /* make this slot avaliable for re-use */
                 devip->used = 0;
@@ -1084,6 +1869,8 @@ static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
                         open_devip->sense_buff[0] = 0x70;
                         open_devip->sense_buff[7] = 0xa;
                 }
+                if (sdev->lun == SAM2_WLUN_REPORT_LUNS)
+                        open_devip->wlun = SAM2_WLUN_REPORT_LUNS & 0xff;
                 return open_devip;
         }
         return NULL;
@@ -1272,7 +2059,7 @@ static void __init sdebug_build_parts(unsigned char * ramp)
                 printk(KERN_WARNING "scsi_debug:build_parts: reducing "
                                     "partitions to %d\n", SDEBUG_MAX_PARTS);
         }
-        num_sectors = (int)(sdebug_store_size / SECT_SIZE);
+        num_sectors = (int)sdebug_store_sectors;
         sectors_per_part = (num_sectors - sdebug_sectors_per)
                            / scsi_debug_num_parts;
         heads_by_sects = sdebug_heads * sdebug_sectors_per;
@@ -1315,9 +2102,9 @@ static int schedule_resp(struct scsi_cmnd * cmnd,
                 if (scsi_result) {
                         struct scsi_device * sdp = cmnd->device;
 
-                        sdev_printk(KERN_INFO, sdp,
-                                "non-zero result=0x%x\n",
-                                scsi_result);
+                        printk(KERN_INFO "scsi_debug:    <%u %u %u %u> "
+                               "non-zero result=0x%x\n", sdp->host->host_no,
+                               sdp->channel, sdp->id, sdp->lun, scsi_result);
                 }
         }
         if (cmnd && devip) {
@@ -1364,21 +2151,19 @@ static int schedule_resp(struct scsi_cmnd * cmnd,
         }
 }
 
-/* Set 'perm' (4th argument) to 0 to disable module_param's definition
- * of sysfs parameters (which module_param doesn't yet support).
- * Sysfs parameters defined explicitly below.
- */
-module_param_named(add_host, scsi_debug_add_host, int, 0); /* perm=0644 */
-module_param_named(delay, scsi_debug_delay, int, 0); /* perm=0644 */
-module_param_named(dev_size_mb, scsi_debug_dev_size_mb, int, 0);
-module_param_named(dsense, scsi_debug_dsense, int, 0);
-module_param_named(every_nth, scsi_debug_every_nth, int, 0);
-module_param_named(max_luns, scsi_debug_max_luns, int, 0);
-module_param_named(num_parts, scsi_debug_num_parts, int, 0);
-module_param_named(num_tgts, scsi_debug_num_tgts, int, 0);
-module_param_named(opts, scsi_debug_opts, int, 0); /* perm=0644 */
-module_param_named(ptype, scsi_debug_ptype, int, 0);
-module_param_named(scsi_level, scsi_debug_scsi_level, int, 0);
+module_param_named(add_host, scsi_debug_add_host, int, S_IRUGO | S_IWUSR);
+module_param_named(delay, scsi_debug_delay, int, S_IRUGO | S_IWUSR);
+module_param_named(dev_size_mb, scsi_debug_dev_size_mb, int, S_IRUGO);
+module_param_named(dsense, scsi_debug_dsense, int, S_IRUGO | S_IWUSR);
+module_param_named(every_nth, scsi_debug_every_nth, int, S_IRUGO | S_IWUSR);
+module_param_named(max_luns, scsi_debug_max_luns, int, S_IRUGO | S_IWUSR);
+module_param_named(no_lun_0, scsi_debug_no_lun_0, int, S_IRUGO | S_IWUSR);
+module_param_named(num_parts, scsi_debug_num_parts, int, S_IRUGO);
+module_param_named(num_tgts, scsi_debug_num_tgts, int, S_IRUGO | S_IWUSR);
+module_param_named(opts, scsi_debug_opts, int, S_IRUGO | S_IWUSR);
+module_param_named(ptype, scsi_debug_ptype, int, S_IRUGO | S_IWUSR);
+module_param_named(scsi_level, scsi_debug_scsi_level, int, S_IRUGO);
+module_param_named(virtual_gb, scsi_debug_virtual_gb, int, S_IRUGO | S_IWUSR);
 
 MODULE_AUTHOR("Eric Youngdale + Douglas Gilbert");
 MODULE_DESCRIPTION("SCSI debug adapter driver");
@@ -1387,15 +2172,17 @@ MODULE_VERSION(SCSI_DEBUG_VERSION);
 
 MODULE_PARM_DESC(add_host, "0..127 hosts allowed(def=1)");
 MODULE_PARM_DESC(delay, "# of jiffies to delay response(def=1)");
-MODULE_PARM_DESC(dev_size_mb, "size in MB of ram shared by devs");
-MODULE_PARM_DESC(dsense, "use descriptor sense format(def: fixed)");
+MODULE_PARM_DESC(dev_size_mb, "size in MB of ram shared by devs(def=8)");
+MODULE_PARM_DESC(dsense, "use descriptor sense format(def=0 -> fixed)");
 MODULE_PARM_DESC(every_nth, "timeout every nth command(def=100)");
-MODULE_PARM_DESC(max_luns, "number of SCSI LUNs per target to simulate");
+MODULE_PARM_DESC(max_luns, "number of LUNs per target to simulate(def=1)");
+MODULE_PARM_DESC(no_lun_0, "no LU number 0 (def=0 -> have lun 0)");
 MODULE_PARM_DESC(num_parts, "number of partitions(def=0)");
-MODULE_PARM_DESC(num_tgts, "number of SCSI targets per host to simulate");
-MODULE_PARM_DESC(opts, "1->noise, 2->medium_error, 4->...");
+MODULE_PARM_DESC(num_tgts, "number of targets per host to simulate(def=1)");
+MODULE_PARM_DESC(opts, "1->noise, 2->medium_error, 4->... (def=0)");
 MODULE_PARM_DESC(ptype, "SCSI peripheral type(def=0[disk])");
 MODULE_PARM_DESC(scsi_level, "SCSI level to simulate(def=5[SPC-3])");
+MODULE_PARM_DESC(virtual_gb, "virtual gigabyte size (def=0 -> use dev_size_mb)");
 
 
 static char sdebug_info[256];
@@ -1547,6 +2334,24 @@ static ssize_t sdebug_dsense_store(struct device_driver * ddp,
 DRIVER_ATTR(dsense, S_IRUGO | S_IWUSR, sdebug_dsense_show,
             sdebug_dsense_store);
 
+static ssize_t sdebug_no_lun_0_show(struct device_driver * ddp, char * buf)
+{
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_no_lun_0);
+}
+static ssize_t sdebug_no_lun_0_store(struct device_driver * ddp,
+                                     const char * buf, size_t count)
+{
+        int n;
+
+        if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
+                scsi_debug_no_lun_0 = n;
+                return count;
+        }
+        return -EINVAL;
+}
+DRIVER_ATTR(no_lun_0, S_IRUGO | S_IWUSR, sdebug_no_lun_0_show,
+            sdebug_no_lun_0_store);
+
 static ssize_t sdebug_num_tgts_show(struct device_driver * ddp, char * buf)
 {
         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_tgts);
@@ -1622,6 +2427,29 @@ static ssize_t sdebug_scsi_level_show(struct device_driver * ddp, char * buf)
 }
 DRIVER_ATTR(scsi_level, S_IRUGO, sdebug_scsi_level_show, NULL);
 
+static ssize_t sdebug_virtual_gb_show(struct device_driver * ddp, char * buf)
+{
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_virtual_gb);
+}
+static ssize_t sdebug_virtual_gb_store(struct device_driver * ddp,
+                                       const char * buf, size_t count)
+{
+        int n;
+
+        if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
+                scsi_debug_virtual_gb = n;
+                if (scsi_debug_virtual_gb > 0) {
+                        sdebug_capacity = 2048 * 1024;
+                        sdebug_capacity *= scsi_debug_virtual_gb;
+                } else
+                        sdebug_capacity = sdebug_store_sectors;
+                return count;
+        }
+        return -EINVAL;
+}
+DRIVER_ATTR(virtual_gb, S_IRUGO | S_IWUSR, sdebug_virtual_gb_show,
+            sdebug_virtual_gb_store);
+
 static ssize_t sdebug_add_host_show(struct device_driver * ddp, char * buf)
 {
         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_add_host);
@@ -1659,19 +2487,22 @@ static ssize_t sdebug_add_host_store(struct device_driver * ddp,
 DRIVER_ATTR(add_host, S_IRUGO | S_IWUSR, sdebug_add_host_show, 
             sdebug_add_host_store);
 
-static void do_create_driverfs_files(void)
+static int do_create_driverfs_files(void)
 {
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_add_host);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_delay);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_dev_size_mb);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_dsense);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_every_nth);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_max_luns);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_tgts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_parts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_ptype);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_opts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_scsi_level);
+        int ret;
+
+        ret = driver_create_file(&sdebug_driverfs_driver, &driver_attr_add_host);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_delay);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dev_size_mb);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dsense);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_every_nth);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_max_luns);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_tgts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_parts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_ptype);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_opts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_scsi_level);
+        return ret;
 }
 
 static void do_remove_driverfs_files(void)
@@ -1691,14 +2522,20 @@ static void do_remove_driverfs_files(void)
 
 static int __init scsi_debug_init(void)
 {
-        unsigned long sz;
+        unsigned int sz;
         int host_to_add;
         int k;
+        int ret;
 
         if (scsi_debug_dev_size_mb < 1)
                 scsi_debug_dev_size_mb = 1;  /* force minimum 1 MB ramdisk */
-        sdebug_store_size = (unsigned long)scsi_debug_dev_size_mb * 1048576;
-        sdebug_capacity = sdebug_store_size / SECT_SIZE;
+        sdebug_store_size = (unsigned int)scsi_debug_dev_size_mb * 1048576;
+        sdebug_store_sectors = sdebug_store_size / SECT_SIZE;
+        if (scsi_debug_virtual_gb > 0) {
+                sdebug_capacity = 2048 * 1024;
+                sdebug_capacity *= scsi_debug_virtual_gb;
+        } else
+                sdebug_capacity = sdebug_store_sectors;
 
         /* play around with geometry, don't waste too much on track 0 */
         sdebug_heads = 8;
@@ -1727,12 +2564,32 @@ static int __init scsi_debug_init(void)
         if (scsi_debug_num_parts > 0)
                 sdebug_build_parts(fake_storep);
 
-        init_all_queued();
+        ret = device_register(&pseudo_primary);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: device_register error: %d\n",
+                        ret);
+                goto free_vm;
+        }
+        ret = bus_register(&pseudo_lld_bus);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: bus_register error: %d\n",
+                        ret);
+                goto dev_unreg;
+        }
+        ret = driver_register(&sdebug_driverfs_driver);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: driver_register error: %d\n",
+                        ret);
+                goto bus_unreg;
+        }
+        ret = do_create_driverfs_files();
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: driver_create_file error: %d\n",
+                        ret);
+                goto del_files;
+        }
 
-        device_register(&pseudo_primary);
-        bus_register(&pseudo_lld_bus);
-        driver_register(&sdebug_driverfs_driver);
-        do_create_driverfs_files();
+        init_all_queued();
 
         sdebug_driver_template.proc_name = (char *)sdebug_proc_name;
 
@@ -1752,6 +2609,18 @@ static int __init scsi_debug_init(void)
                        scsi_debug_add_host);
         }
         return 0;
+
+del_files:
+        do_remove_driverfs_files();
+        driver_unregister(&sdebug_driverfs_driver);
+bus_unreg:
+        bus_unregister(&pseudo_lld_bus);
+dev_unreg:
+        device_unregister(&pseudo_primary);
+free_vm:
+        vfree(fake_storep);
+
+        return ret;
 }
 
 static void __exit scsi_debug_exit(void)
@@ -1812,7 +2681,7 @@ static int sdebug_add_adapter(void)
         struct sdebug_dev_info *sdbg_devinfo;
         struct list_head *lh, *lh_sf;
 
-        sdbg_host = kzalloc(sizeof(*sdbg_host), GFP_KERNEL);
+        sdbg_host = kzalloc(sizeof(*sdbg_host),GFP_KERNEL);
 
         if (NULL == sdbg_host) {
                 printk(KERN_ERR "%s: out of memory at line %d\n",
@@ -1824,7 +2693,7 @@ static int sdebug_add_adapter(void)
 
         devs_per_host = scsi_debug_num_tgts * scsi_debug_max_luns;
         for (k = 0; k < devs_per_host; k++) {
-                sdbg_devinfo = kzalloc(sizeof(*sdbg_devinfo), GFP_KERNEL);
+                sdbg_devinfo = kzalloc(sizeof(*sdbg_devinfo),GFP_KERNEL);
                 if (NULL == sdbg_devinfo) {
                         printk(KERN_ERR "%s: out of memory at line %d\n",
                                __FUNCTION__, __LINE__);
@@ -1905,7 +2774,7 @@ static int sdebug_driver_probe(struct device * dev)
                 hpnt->max_id = scsi_debug_num_tgts + 1;
         else
                 hpnt->max_id = scsi_debug_num_tgts;
-        hpnt->max_lun = scsi_debug_max_luns;
+        hpnt->max_lun = SAM2_WLUN_REPORT_LUNS;  /* = scsi_debug_max_luns; */
 
         error = scsi_add_host(hpnt, &sdbg_host->dev);
         if (error) {
@@ -1959,7 +2828,7 @@ static void sdebug_max_tgts_luns(void)
                         hpnt->max_id = scsi_debug_num_tgts + 1;
                 else
                         hpnt->max_id = scsi_debug_num_tgts;
-                hpnt->max_lun = scsi_debug_max_luns;
+                hpnt->max_lun = SAM2_WLUN_REPORT_LUNS; /* scsi_debug_max_luns; */
         }
         spin_unlock(&sdebug_host_list_lock);
 }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index fb5cb4c9ac65..3d0429bc14ab 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -162,7 +162,7 @@ static struct {
         {"HITACHI", "DISK-SUBSYSTEM", "*", BLIST_ATTACH_PQ3 | BLIST_SPARSELUN | BLIST_LARGELUN},
         {"HITACHI", "OPEN-E", "*", BLIST_ATTACH_PQ3 | BLIST_SPARSELUN | BLIST_LARGELUN},
         {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN},       /* HP VA7400 */
-        {"HP", "OPEN-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP XP Arrays */
+        {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */
         {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN},
         {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD},
         {"HP", "C1557A", NULL, BLIST_FORCELUN},
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 6a7a60fc0a4e..3d355d054612 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -460,19 +460,71 @@ static void scsi_eh_done(struct scsi_cmnd *scmd)
  * Return value:
  *    SUCCESS or FAILED or NEEDS_RETRY
  **/
-static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
+static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd,
+                             int cmnd_size, int timeout, int copy_sense)
 {
         struct scsi_device *sdev = scmd->device;
         struct Scsi_Host *shost = sdev->host;
-        DECLARE_COMPLETION(done);
+        int old_result = scmd->result;
+        DECLARE_COMPLETION_ONSTACK(done);
         unsigned long timeleft;
         unsigned long flags;
+        unsigned char old_cmnd[MAX_COMMAND_SIZE];
+        enum dma_data_direction old_data_direction;
+        unsigned short old_use_sg;
+        unsigned char old_cmd_len;
+        unsigned old_bufflen;
+        void *old_buffer;
         int rtn;
 
+        /*
+         * We need saved copies of a number of fields - this is because
+         * error handling may need to overwrite these with different values
+         * to run different commands, and once error handling is complete,
+         * we will need to restore these values prior to running the actual
+         * command.
+         */
+        old_buffer = scmd->request_buffer;
+        old_bufflen = scmd->request_bufflen;
+        memcpy(old_cmnd, scmd->cmnd, sizeof(scmd->cmnd));
+        old_data_direction = scmd->sc_data_direction;
+        old_cmd_len = scmd->cmd_len;
+        old_use_sg = scmd->use_sg;
+
+        memset(scmd->cmnd, 0, sizeof(scmd->cmnd));
+        memcpy(scmd->cmnd, cmnd, cmnd_size);
+
+        if (copy_sense) {
+                int gfp_mask = GFP_ATOMIC;
+
+                if (shost->hostt->unchecked_isa_dma)
+                        gfp_mask |= __GFP_DMA;
+
+                scmd->sc_data_direction = DMA_FROM_DEVICE;
+                scmd->request_bufflen = 252;
+                scmd->request_buffer = kzalloc(scmd->request_bufflen, gfp_mask);
+                if (!scmd->request_buffer)
+                        return FAILED;
+        } else {
+                scmd->request_buffer = NULL;
+                scmd->request_bufflen = 0;
+                scmd->sc_data_direction = DMA_NONE;
+        }
+
+        scmd->underflow = 0;
+        scmd->use_sg = 0;
+        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
+
         if (sdev->scsi_level <= SCSI_2)
                 scmd->cmnd[1] = (scmd->cmnd[1] & 0x1f) |
                         (sdev->lun << 5 & 0xe0);
 
+        /*
+         * Zero the sense buffer.  The scsi spec mandates that any
+         * untransferred sense data should be interpreted as being zero.
+         */
+        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
+
         shost->eh_action = &done;
 
         spin_lock_irqsave(shost->host_lock, flags);
@@ -522,6 +574,29 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
                 rtn = FAILED;
         }
 
+
+        /*
+         * Last chance to have valid sense data.
+         */
+        if (copy_sense) {
+                if (!SCSI_SENSE_VALID(scmd)) {
+                        memcpy(scmd->sense_buffer, scmd->request_buffer,
+                               sizeof(scmd->sense_buffer));
+                }
+                kfree(scmd->request_buffer);
+        }
+
+
+        /*
+         * Restore original data
+         */
+        scmd->request_buffer = old_buffer;
+        scmd->request_bufflen = old_bufflen;
+        memcpy(scmd->cmnd, old_cmnd, sizeof(scmd->cmnd));
+        scmd->sc_data_direction = old_data_direction;
+        scmd->cmd_len = old_cmd_len;
+        scmd->use_sg = old_use_sg;
+        scmd->result = old_result;
         return rtn;
 }
 
@@ -537,56 +612,9 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
 static int scsi_request_sense(struct scsi_cmnd *scmd)
 {
         static unsigned char generic_sense[6] =
-        {REQUEST_SENSE, 0, 0, 0, 252, 0};
-        unsigned char *scsi_result;
-        int saved_result;
-        int rtn;
-
-        memcpy(scmd->cmnd, generic_sense, sizeof(generic_sense));
-
-        scsi_result = kmalloc(252, GFP_ATOMIC | ((scmd->device->host->hostt->unchecked_isa_dma) ? __GFP_DMA : 0));
+                {REQUEST_SENSE, 0, 0, 0, 252, 0};
 
-
-        if (unlikely(!scsi_result)) {
-                printk(KERN_ERR "%s: cannot allocate scsi_result.\n",
-                       __FUNCTION__);
-                return FAILED;
-        }
-
-        /*
-         * zero the sense buffer.  some host adapters automatically always
-         * request sense, so it is not a good idea that
-         * scmd->request_buffer and scmd->sense_buffer point to the same
-         * address (db).  0 is not a valid sense code. 
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        memset(scsi_result, 0, 252);
-
-        saved_result = scmd->result;
-        scmd->request_buffer = scsi_result;
-        scmd->request_bufflen = 252;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->sc_data_direction = DMA_FROM_DEVICE;
-        scmd->underflow = 0;
-
-        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT);
-
-        /* last chance to have valid sense data */
-        if(!SCSI_SENSE_VALID(scmd)) {
-                memcpy(scmd->sense_buffer, scmd->request_buffer,
-                       sizeof(scmd->sense_buffer));
-        }
-
-        kfree(scsi_result);
-
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        return rtn;
+        return scsi_send_eh_cmnd(scmd, generic_sense, 6, SENSE_TIMEOUT, 1);
 }
 
 /**
@@ -605,12 +633,6 @@ void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
 {
         scmd->device->host->host_failed--;
         scmd->eh_eflags = 0;
-
-        /*
-         * set this back so that the upper level can correctly free up
-         * things.
-         */
-        scsi_setup_cmd_retry(scmd);
         list_move_tail(&scmd->eh_entry, done_q);
 }
 EXPORT_SYMBOL(scsi_eh_finish_cmd);
@@ -715,47 +737,23 @@ static int scsi_eh_tur(struct scsi_cmnd *scmd)
 {
         static unsigned char tur_command[6] = {TEST_UNIT_READY, 0, 0, 0, 0, 0};
         int retry_cnt = 1, rtn;
-        int saved_result;
 
 retry_tur:
-        memcpy(scmd->cmnd, tur_command, sizeof(tur_command));
-
-        /*
-         * zero the sense buffer.  the scsi spec mandates that any
-         * untransferred sense data should be interpreted as being zero.
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
+        rtn = scsi_send_eh_cmnd(scmd, tur_command, 6, SENSE_TIMEOUT, 0);
 
-        saved_result = scmd->result;
-        scmd->request_buffer = NULL;
-        scmd->request_bufflen = 0;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->underflow = 0;
-        scmd->sc_data_direction = DMA_NONE;
-
-        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT);
-
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-
-        /*
-         * hey, we are done.  let's look to see what happened.
-         */
         SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
                 __FUNCTION__, scmd, rtn));
-        if (rtn == SUCCESS)
-                return 0;
-        else if (rtn == NEEDS_RETRY) {
+
+        switch (rtn) {
+        case NEEDS_RETRY:
                 if (retry_cnt--)
                         goto retry_tur;
+                /*FALLTHRU*/
+        case SUCCESS:
                 return 0;
+        default:
+                return 1;
         }
-        return 1;
 }
 
 /**
@@ -837,44 +835,16 @@ static int scsi_try_bus_device_reset(struct scsi_cmnd *scmd)
 static int scsi_eh_try_stu(struct scsi_cmnd *scmd)
 {
         static unsigned char stu_command[6] = {START_STOP, 0, 0, 0, 1, 0};
-        int rtn;
-        int saved_result;
-
-        if (!scmd->device->allow_restart)
-                return 1;
 
-        memcpy(scmd->cmnd, stu_command, sizeof(stu_command));
-
-        /*
-         * zero the sense buffer.  the scsi spec mandates that any
-         * untransferred sense data should be interpreted as being zero.
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-
-        saved_result = scmd->result;
-        scmd->request_buffer = NULL;
-        scmd->request_bufflen = 0;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->underflow = 0;
-        scmd->sc_data_direction = DMA_NONE;
+        if (scmd->device->allow_restart) {
+                int rtn;
 
-        rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT);
-
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
+                rtn = scsi_send_eh_cmnd(scmd, stu_command, 6,
+                                        START_UNIT_TIMEOUT, 0);
+                if (rtn == SUCCESS)
+                        return 0;
+        }
 
-        /*
-         * hey, we are done.  let's look to see what happened.
-         */
-        SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
-                __FUNCTION__, scmd, rtn));
-        if (rtn == SUCCESS)
-                return 0;
         return 1;
 }
 
@@ -1672,7 +1642,9 @@ int
 scsi_reset_provider(struct scsi_device *dev, int flag)
 {
         struct scsi_cmnd *scmd = scsi_get_command(dev, GFP_KERNEL);
+        struct Scsi_Host *shost = dev->host;
         struct request req;
+        unsigned long flags;
         int rtn;
 
         scmd->request = &req;
@@ -1682,8 +1654,6 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
     
         scmd->scsi_done         = scsi_reset_provider_done_command;
         scmd->done                      = NULL;
-        scmd->buffer                    = NULL;
-        scmd->bufflen                   = 0;
         scmd->request_buffer            = NULL;
         scmd->request_bufflen           = 0;
 
@@ -1699,6 +1669,10 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
          */
         scmd->pid                       = 0;
 
+        spin_lock_irqsave(shost->host_lock, flags);
+        shost->tmf_in_progress = 1;
+        spin_unlock_irqrestore(shost->host_lock, flags);
+
         switch (flag) {
         case SCSI_TRY_RESET_DEVICE:
                 rtn = scsi_try_bus_device_reset(scmd);
@@ -1717,6 +1691,22 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
                 rtn = FAILED;
         }
 
+        spin_lock_irqsave(shost->host_lock, flags);
+        shost->tmf_in_progress = 0;
+        spin_unlock_irqrestore(shost->host_lock, flags);
+
+        /*
+         * be sure to wake up anyone who was sleeping or had their queue
+         * suspended while we performed the TMF.
+         */
+        SCSI_LOG_ERROR_RECOVERY(3,
+                printk("%s: waking up host to restart after TMF\n",
+                __FUNCTION__));
+
+        wake_up(&shost->host_wait);
+
+        scsi_run_host_queues(shost);
+
         scsi_next_command(scmd);
         return rtn;
 }
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index a89c4115cfba..32293f451669 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -110,11 +110,8 @@ static int ioctl_internal_command(struct scsi_device *sdev, char *cmd,
                                        sshdr.asc, sshdr.ascq);
                         break;
                 case NOT_READY: /* This happens if there is no disc in drive */
-                        if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) {
-                                printk(KERN_INFO "Device not ready. Make sure"
-                                       " there is a disc in the drive.\n");
+                        if (sdev->removable)
                                 break;
-                        }
                 case UNIT_ATTENTION:
                         if (sdev->removable) {
                                 sdev->changed = 1;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 3d04a9f386ac..077c1c691210 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -436,60 +436,16 @@ EXPORT_SYMBOL_GPL(scsi_execute_async);
  *
  * Arguments:   cmd     - command that is ready to be queued.
  *
- * Returns:     Nothing
- *
  * Notes:       This function has the job of initializing a number of
  *              fields related to error handling.   Typically this will
  *              be called once for each command, as required.
  */
-static int scsi_init_cmd_errh(struct scsi_cmnd *cmd)
+static void scsi_init_cmd_errh(struct scsi_cmnd *cmd)
 {
         cmd->serial_number = 0;
-
         memset(cmd->sense_buffer, 0, sizeof cmd->sense_buffer);
-
         if (cmd->cmd_len == 0)
                 cmd->cmd_len = COMMAND_SIZE(cmd->cmnd[0]);
-
-        /*
-         * We need saved copies of a number of fields - this is because
-         * error handling may need to overwrite these with different values
-         * to run different commands, and once error handling is complete,
-         * we will need to restore these values prior to running the actual
-         * command.
-         */
-        cmd->old_use_sg = cmd->use_sg;
-        cmd->old_cmd_len = cmd->cmd_len;
-        cmd->sc_old_data_direction = cmd->sc_data_direction;
-        cmd->old_underflow = cmd->underflow;
-        memcpy(cmd->data_cmnd, cmd->cmnd, sizeof(cmd->cmnd));
-        cmd->buffer = cmd->request_buffer;
-        cmd->bufflen = cmd->request_bufflen;
-
-        return 1;
-}
-
-/*
- * Function:   scsi_setup_cmd_retry()
- *
- * Purpose:    Restore the command state for a retry
- *
- * Arguments:  cmd      - command to be restored
- *
- * Returns:    Nothing
- *
- * Notes:      Immediately prior to retrying a command, we need
- *             to restore certain fields that we saved above.
- */
-void scsi_setup_cmd_retry(struct scsi_cmnd *cmd)
-{
-        memcpy(cmd->cmnd, cmd->data_cmnd, sizeof(cmd->data_cmnd));
-        cmd->request_buffer = cmd->buffer;
-        cmd->request_bufflen = cmd->bufflen;
-        cmd->use_sg = cmd->old_use_sg;
-        cmd->cmd_len = cmd->old_cmd_len;
-        cmd->sc_data_direction = cmd->sc_old_data_direction;
-        cmd->underflow = cmd->old_underflow;
 }
 
 void scsi_device_unbusy(struct scsi_device *sdev)
@@ -807,22 +763,13 @@ static void scsi_free_sgtable(struct scatterlist *sgl, int index)
  */
 static void scsi_release_buffers(struct scsi_cmnd *cmd)
 {
-        struct request *req = cmd->request;
-
-        /*
-         * Free up any indirection buffers we allocated for DMA purposes. 
-         */
         if (cmd->use_sg)
                 scsi_free_sgtable(cmd->request_buffer, cmd->sglist_len);
-        else if (cmd->request_buffer != req->buffer)
-                kfree(cmd->request_buffer);
 
         /*
          * Zero these out.  They now point to freed memory, and it is
          * dangerous to hang onto the pointers.
          */
-        cmd->buffer  = NULL;
-        cmd->bufflen = 0;
         cmd->request_buffer = NULL;
         cmd->request_bufflen = 0;
 }
@@ -855,11 +802,10 @@ static void scsi_release_buffers(struct scsi_cmnd *cmd)
  *              b) We can just use scsi_requeue_command() here.  This would
  *                 be used if we just wanted to retry, for example.
  */
-void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
-                        unsigned int block_bytes)
+void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 {
         int result = cmd->result;
-        int this_count = cmd->bufflen;
+        int this_count = cmd->request_bufflen;
         request_queue_t *q = cmd->device->request_queue;
         struct request *req = cmd->request;
         int clear_errors = 1;
@@ -867,28 +813,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
         int sense_valid = 0;
         int sense_deferred = 0;
 
-        /*
-         * Free up any indirection buffers we allocated for DMA purposes. 
-         * For the case of a READ, we need to copy the data out of the
-         * bounce buffer and into the real buffer.
-         */
-        if (cmd->use_sg)
-                scsi_free_sgtable(cmd->buffer, cmd->sglist_len);
-        else if (cmd->buffer != req->buffer) {
-                if (rq_data_dir(req) == READ) {
-                        unsigned long flags;
-                        char *to = bio_kmap_irq(req->bio, &flags);
-                        memcpy(to, cmd->buffer, cmd->bufflen);
-                        bio_kunmap_irq(to, &flags);
-                }
-                kfree(cmd->buffer);
-        }
+        scsi_release_buffers(cmd);
 
         if (result) {
                 sense_valid = scsi_command_normalize_sense(cmd, &sshdr);
                 if (sense_valid)
                         sense_deferred = scsi_sense_is_deferred(&sshdr);
         }
+
         if (blk_pc_request(req)) { /* SG_IO ioctl from block level */
                 req->errors = result;
                 if (result) {
@@ -909,99 +841,73 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
         }
 
         /*
-         * Zero these out.  They now point to freed memory, and it is
-         * dangerous to hang onto the pointers.
-         */
-        cmd->buffer  = NULL;
-        cmd->bufflen = 0;
-        cmd->request_buffer = NULL;
-        cmd->request_bufflen = 0;
-
-        /*
          * Next deal with any sectors which we were able to correctly
          * handle.
          */
-        if (good_bytes >= 0) {
-                SCSI_LOG_HLCOMPLETE(1, printk("%ld sectors total, %d bytes done.\n",
-                                              req->nr_sectors, good_bytes));
-                SCSI_LOG_HLCOMPLETE(1, printk("use_sg is %d\n", cmd->use_sg));
+        SCSI_LOG_HLCOMPLETE(1, printk("%ld sectors total, "
+                                      "%d bytes done.\n",
+                                      req->nr_sectors, good_bytes));
+        SCSI_LOG_HLCOMPLETE(1, printk("use_sg is %d\n", cmd->use_sg));
 
-                if (clear_errors)
-                        req->errors = 0;
-                /*
-                 * If multiple sectors are requested in one buffer, then
-                 * they will have been finished off by the first command.
-                 * If not, then we have a multi-buffer command.
-                 *
-                 * If block_bytes != 0, it means we had a medium error
-                 * of some sort, and that we want to mark some number of
-                 * sectors as not uptodate.  Thus we want to inhibit
-                 * requeueing right here - we will requeue down below
-                 * when we handle the bad sectors.
-                 */
+        if (clear_errors)
+                req->errors = 0;
 
-                /*
-                 * If the command completed without error, then either
-                 * finish off the rest of the command, or start a new one.
-                 */
-                if (scsi_end_request(cmd, 1, good_bytes, result == 0) == NULL)
-                        return;
-        }
-        /*
-         * Now, if we were good little boys and girls, Santa left us a request
-         * sense buffer.  We can extract information from this, so we
-         * can choose a block to remap, etc.
+        /* A number of bytes were successfully read.  If there
+         * are leftovers and there is some kind of error
+         * (result != 0), retry the rest.
+         */
+        if (scsi_end_request(cmd, 1, good_bytes, result == 0) == NULL)
+                return;
+
+        /* good_bytes = 0, or (inclusive) there were leftovers and
+         * result = 0, so scsi_end_request couldn't retry.
          */
         if (sense_valid && !sense_deferred) {
                 switch (sshdr.sense_key) {
                 case UNIT_ATTENTION:
                         if (cmd->device->removable) {
-                                /* detected disc change.  set a bit 
+                                /* Detected disc change.  Set a bit
                                  * and quietly refuse further access.
                                  */
                                 cmd->device->changed = 1;
-                                scsi_end_request(cmd, 0,
-                                                this_count, 1);
+                                scsi_end_request(cmd, 0, this_count, 1);
                                 return;
                         } else {
-                                /*
-                                * Must have been a power glitch, or a
-                                * bus reset.  Could not have been a
-                                * media change, so we just retry the
-                                * request and see what happens.  
-                                */
+                                /* Must have been a power glitch, or a
+                                 * bus reset.  Could not have been a
+                                 * media change, so we just retry the
+                                 * request and see what happens.
+                                 */
                                 scsi_requeue_command(q, cmd);
                                 return;
                         }
                         break;
                 case ILLEGAL_REQUEST:
-                        /*
-                        * If we had an ILLEGAL REQUEST returned, then we may
-                        * have performed an unsupported command.  The only
-                        * thing this should be would be a ten byte read where
-                        * only a six byte read was supported.  Also, on a
-                        * system where READ CAPACITY failed, we may have read
-                        * past the end of the disk.
-                        */
+                        /* If we had an ILLEGAL REQUEST returned, then
+                         * we may have performed an unsupported
+                         * command.  The only thing this should be
+                         * would be a ten byte read where only a six
+                         * byte read was supported.  Also, on a system
+                         * where READ CAPACITY failed, we may have
+                         * read past the end of the disk.
+                         */
                         if ((cmd->device->use_10_for_rw &&
                             sshdr.asc == 0x20 && sshdr.ascq == 0x00) &&
                             (cmd->cmnd[0] == READ_10 ||
                              cmd->cmnd[0] == WRITE_10)) {
                                 cmd->device->use_10_for_rw = 0;
-                                /*
-                                 * This will cause a retry with a 6-byte
-                                 * command.
+                                /* This will cause a retry with a
+                                 * 6-byte command.
                                  */
                                 scsi_requeue_command(q, cmd);
-                                result = 0;
+                                return;
                         } else {
                                 scsi_end_request(cmd, 0, this_count, 1);
                                 return;
                         }
                         break;
                 case NOT_READY:
-                        /*
-                         * If the device is in the process of becoming
+                        /* If the device is in the process of becoming
                          * ready, or has a temporary blockage, retry.
                          */
                         if (sshdr.asc == 0x04) {
@@ -1021,7 +927,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                         }
                         if (!(req->flags & REQ_QUIET)) {
                                 scmd_printk(KERN_INFO, cmd,
-                                           "Device not ready: ");
+                                            "Device not ready: ");
                                 scsi_print_sense_hdr("", &sshdr);
                         }
                         scsi_end_request(cmd, 0, this_count, 1);
@@ -1029,21 +935,21 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
                 case VOLUME_OVERFLOW:
                         if (!(req->flags & REQ_QUIET)) {
                                 scmd_printk(KERN_INFO, cmd,
-                                           "Volume overflow, CDB: ");
-                                __scsi_print_command(cmd->data_cmnd);
+                                            "Volume overflow, CDB: ");
+                                __scsi_print_command(cmd->cmnd);
                                 scsi_print_sense("", cmd);
                         }
-                        scsi_end_request(cmd, 0, block_bytes, 1);
+                        /* See SSC3rXX or current. */
+                        scsi_end_request(cmd, 0, this_count, 1);
                         return;
                 default:
                         break;
                 }
-        }                       /* driver byte != 0 */
+        }
         if (host_byte(result) == DID_RESET) {
-                /*
-                 * Third party bus reset or reset for error
-                 * recovery reasons.  Just retry the request
-                 * and see what happens.  
+                /* Third party bus reset or reset for error recovery
+                 * reasons.  Just retry the request and see what
+                 * happens.
                  */
                 scsi_requeue_command(q, cmd);
                 return;
@@ -1051,21 +957,13 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes,
         if (result) {
                 if (!(req->flags & REQ_QUIET)) {
                         scmd_printk(KERN_INFO, cmd,
-                                   "SCSI error: return code = 0x%x\n", result);
-
+                                    "SCSI error: return code = 0x%08x\n",
+                                    result);
                         if (driver_byte(result) & DRIVER_SENSE)
                                 scsi_print_sense("", cmd);
                 }
-                /*
-                 * Mark a single buffer as not uptodate.  Queue the remainder.
-                 * We sometimes get this cruft in the event that a medium error
-                 * isn't properly reported.
-                 */
-                block_bytes = req->hard_cur_sectors << 9;
-                if (!block_bytes)
-                        block_bytes = req->data_len;
-                scsi_end_request(cmd, 0, block_bytes, 1);
         }
+        scsi_end_request(cmd, 0, this_count, !result);
 }
 EXPORT_SYMBOL(scsi_io_completion);
 
@@ -1169,7 +1067,7 @@ static void scsi_blk_pc_done(struct scsi_cmnd *cmd)
          * successfully. Since this is a REQ_BLOCK_PC command the
          * caller should check the request's errors value
          */
-        scsi_io_completion(cmd, cmd->bufflen, 0);
+        scsi_io_completion(cmd, cmd->request_bufflen);
 }
 
 static void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd)
@@ -2050,6 +1948,7 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
                 switch (oldstate) {
                 case SDEV_CREATED:
                 case SDEV_RUNNING:
+                case SDEV_QUIESCE:
                 case SDEV_OFFLINE:
                 case SDEV_BLOCK:
                         break;
@@ -2060,6 +1959,9 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
 
         case SDEV_DEL:
                 switch (oldstate) {
+                case SDEV_CREATED:
+                case SDEV_RUNNING:
+                case SDEV_OFFLINE:
                 case SDEV_CANCEL:
                         break;
                 default:
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 015c90cf3abc..ae24c85aaeea 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -57,7 +57,6 @@ extern int scsi_eh_scmd_add(struct scsi_cmnd *, int);
 
 /* scsi_lib.c */
 extern int scsi_maybe_unblock_host(struct scsi_device *sdev);
-extern void scsi_setup_cmd_retry(struct scsi_cmnd *cmd);
 extern void scsi_device_unbusy(struct scsi_device *sdev);
 extern int scsi_queue_insert(struct scsi_cmnd *cmd, int reason);
 extern void scsi_next_command(struct scsi_cmnd *cmd);
@@ -116,7 +115,7 @@ extern struct bus_type scsi_bus_type;
  * classes.
  */
 
-#define SCSI_DEVICE_BLOCK_MAX_TIMEOUT   (HZ*60)
+#define SCSI_DEVICE_BLOCK_MAX_TIMEOUT   600     /* units in seconds */
 extern int scsi_internal_device_block(struct scsi_device *sdev);
 extern int scsi_internal_device_unblock(struct scsi_device *sdev);
 
diff --git a/drivers/scsi/scsi_sas_internal.h b/drivers/scsi/scsi_sas_internal.h
index d76e6e3d8ca5..e1edab45a37b 100644
--- a/drivers/scsi/scsi_sas_internal.h
+++ b/drivers/scsi/scsi_sas_internal.h
@@ -2,7 +2,8 @@
 #define _SCSI_SAS_INTERNAL_H
 
 #define SAS_HOST_ATTRS          0
-#define SAS_PORT_ATTRS          17
+#define SAS_PHY_ATTRS           17
+#define SAS_PORT_ATTRS          1
 #define SAS_RPORT_ATTRS         7
 #define SAS_END_DEV_ATTRS       3
 #define SAS_EXPANDER_ATTRS      7
@@ -13,12 +14,14 @@ struct sas_internal {
         struct sas_domain_function_template *dft;
 
         struct class_device_attribute private_host_attrs[SAS_HOST_ATTRS];
-        struct class_device_attribute private_phy_attrs[SAS_PORT_ATTRS];
+        struct class_device_attribute private_phy_attrs[SAS_PHY_ATTRS];
+        struct class_device_attribute private_port_attrs[SAS_PORT_ATTRS];
         struct class_device_attribute private_rphy_attrs[SAS_RPORT_ATTRS];
         struct class_device_attribute private_end_dev_attrs[SAS_END_DEV_ATTRS];
         struct class_device_attribute private_expander_attrs[SAS_EXPANDER_ATTRS];
 
         struct transport_container phy_attr_cont;
+        struct transport_container port_attr_cont;
         struct transport_container rphy_attr_cont;
         struct transport_container end_dev_attr_cont;
         struct transport_container expander_attr_cont;
@@ -28,7 +31,8 @@ struct sas_internal {
          * needed by scsi_sysfs.c
          */
         struct class_device_attribute *host_attrs[SAS_HOST_ATTRS + 1];
-        struct class_device_attribute *phy_attrs[SAS_PORT_ATTRS + 1];
+        struct class_device_attribute *phy_attrs[SAS_PHY_ATTRS + 1];
+        struct class_device_attribute *port_attrs[SAS_PORT_ATTRS + 1];
         struct class_device_attribute *rphy_attrs[SAS_RPORT_ATTRS + 1];
         struct class_device_attribute *end_dev_attrs[SAS_END_DEV_ATTRS + 1];
         struct class_device_attribute *expander_attrs[SAS_EXPANDER_ATTRS + 1];
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 1341608e9e3b..1bd92b9b46d9 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -809,6 +809,7 @@ static int scsi_add_lun(struct scsi_device *sdev, char *inq_result, int *bflags)
 
 static inline void scsi_destroy_sdev(struct scsi_device *sdev)
 {
+        scsi_device_set_state(sdev, SDEV_DEL);
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(&sdev->sdev_gendev);
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index f2db7a41cf1d..b03aa85108e5 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -368,7 +368,7 @@ static DECLARE_TRANSPORT_CLASS(fc_rport_class,
  *   should insulate the loss of a remote port.
  *   The maximum will be capped by the value of SCSI_DEVICE_BLOCK_MAX_TIMEOUT.
  */
-static unsigned int fc_dev_loss_tmo = SCSI_DEVICE_BLOCK_MAX_TIMEOUT;
+static unsigned int fc_dev_loss_tmo = 60;               /* seconds */
 
 module_param_named(dev_loss_tmo, fc_dev_loss_tmo, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(dev_loss_tmo,
@@ -1284,7 +1284,9 @@ EXPORT_SYMBOL(fc_release_transport);
  * @work:       Work to queue for execution.
  *
  * Return value:
- *      0 on success / != 0 for error
+ *      1 - work queued for execution
+ *      0 - work is already queued
+ *      -EINVAL - work queue doesn't exist
  **/
 static int
 fc_queue_work(struct Scsi_Host *shost, struct work_struct *work)
@@ -1434,8 +1436,6 @@ fc_starget_delete(void *data)
         struct Scsi_Host *shost = rport_to_shost(rport);
         unsigned long flags;
 
-        scsi_target_unblock(&rport->dev);
-
         spin_lock_irqsave(shost->host_lock, flags);
         if (rport->flags & FC_RPORT_DEVLOSS_PENDING) {
                 spin_unlock_irqrestore(shost->host_lock, flags);
@@ -1476,7 +1476,8 @@ fc_rport_final_delete(void *data)
         transport_remove_device(dev);
         device_del(dev);
         transport_destroy_device(dev);
-        put_device(&shost->shost_gendev);
+        put_device(&shost->shost_gendev);       /* for fc_host->rport list */
+        put_device(dev);                        /* for self-reference */
 }
 
 
@@ -1537,13 +1538,13 @@ fc_rport_create(struct Scsi_Host *shost, int channel,
         else
                 rport->scsi_target_id = -1;
         list_add_tail(&rport->peers, &fc_host->rports);
-        get_device(&shost->shost_gendev);
+        get_device(&shost->shost_gendev);       /* for fc_host->rport list */
 
         spin_unlock_irqrestore(shost->host_lock, flags);
 
         dev = &rport->dev;
-        device_initialize(dev);
-        dev->parent = get_device(&shost->shost_gendev);
+        device_initialize(dev);                 /* takes self reference */
+        dev->parent = get_device(&shost->shost_gendev); /* parent reference */
         dev->release = fc_rport_dev_release;
         sprintf(dev->bus_id, "rport-%d:%d-%d",
                 shost->host_no, channel, rport->number);
@@ -1567,10 +1568,9 @@ fc_rport_create(struct Scsi_Host *shost, int channel,
 
 delete_rport:
         transport_destroy_device(dev);
-        put_device(dev->parent);
         spin_lock_irqsave(shost->host_lock, flags);
         list_del(&rport->peers);
-        put_device(&shost->shost_gendev);
+        put_device(&shost->shost_gendev);       /* for fc_host->rport list */
         spin_unlock_irqrestore(shost->host_lock, flags);
         put_device(dev->parent);
         kfree(rport);
@@ -1707,6 +1707,8 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
 
                                 spin_unlock_irqrestore(shost->host_lock, flags);
 
+                                scsi_target_unblock(&rport->dev);
+
                                 return rport;
                         }
                 }
@@ -1762,9 +1764,10 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                                 /* initiate a scan of the target */
                                 rport->flags |= FC_RPORT_SCAN_PENDING;
                                 scsi_queue_work(shost, &rport->scan_work);
-                        }
-
-                        spin_unlock_irqrestore(shost->host_lock, flags);
+                                spin_unlock_irqrestore(shost->host_lock, flags);
+                                scsi_target_unblock(&rport->dev);
+                        } else
+                                spin_unlock_irqrestore(shost->host_lock, flags);
 
                         return rport;
                 }
@@ -1938,6 +1941,7 @@ fc_remote_port_rolechg(struct fc_rport  *rport, u32 roles)
                 rport->flags |= FC_RPORT_SCAN_PENDING;
                 scsi_queue_work(shost, &rport->scan_work);
                 spin_unlock_irqrestore(shost->host_lock, flags);
+                scsi_target_unblock(&rport->dev);
         }
 }
 EXPORT_SYMBOL(fc_remote_port_rolechg);
@@ -1970,8 +1974,9 @@ fc_timeout_deleted_rport(void  *data)
                 dev_printk(KERN_ERR, &rport->dev,
                         "blocked FC remote port time out: no longer"
                         " a FCP target, removing starget\n");
-                fc_queue_work(shost, &rport->stgt_delete_work);
                 spin_unlock_irqrestore(shost->host_lock, flags);
+                scsi_target_unblock(&rport->dev);
+                fc_queue_work(shost, &rport->stgt_delete_work);
                 return;
         }
 
@@ -2035,17 +2040,15 @@ fc_timeout_deleted_rport(void  *data)
          * went away and didn't come back - we'll remove
          * all attached scsi devices.
          */
-        fc_queue_work(shost, &rport->stgt_delete_work);
-
         spin_unlock_irqrestore(shost->host_lock, flags);
+
+        scsi_target_unblock(&rport->dev);
+        fc_queue_work(shost, &rport->stgt_delete_work);
 }
 
 /**
  * fc_scsi_scan_rport - called to perform a scsi scan on a remote port.
  *
- * Will unblock the target (in case it went away and has now come back),
- * then invoke a scan.
- *
  * @data:       remote port to be scanned.
  **/
 static void
@@ -2057,7 +2060,6 @@ fc_scsi_scan_rport(void *data)
 
         if ((rport->port_state == FC_PORTSTATE_ONLINE) &&
             (rport->roles & FC_RPORT_ROLE_FCP_TARGET)) {
-                scsi_target_unblock(&rport->dev);
                 scsi_scan_target(&rport->dev, rport->channel,
                         rport->scsi_target_id, SCAN_WILD_CARD, 1);
         }
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 5569fdcfd621..2ecd14188574 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -34,6 +34,7 @@
 #define ISCSI_SESSION_ATTRS 11
 #define ISCSI_CONN_ATTRS 11
 #define ISCSI_HOST_ATTRS 0
+#define ISCSI_TRANSPORT_VERSION "1.1-646"
 
 struct iscsi_internal {
         int daemon_pid;
@@ -228,14 +229,11 @@ static struct iscsi_cls_conn *iscsi_conn_lookup(uint32_t sid, uint32_t cid)
 static void iscsi_session_release(struct device *dev)
 {
         struct iscsi_cls_session *session = iscsi_dev_to_session(dev);
-        struct iscsi_transport *transport = session->transport;
         struct Scsi_Host *shost;
 
         shost = iscsi_session_to_shost(session);
         scsi_host_put(shost);
-        kfree(session->targetname);
         kfree(session);
-        module_put(transport->owner);
 }
 
 static int iscsi_is_session_dev(const struct device *dev)
@@ -251,10 +249,9 @@ static int iscsi_user_scan(struct Scsi_Host *shost, uint channel,
 
         mutex_lock(&ihost->mutex);
         list_for_each_entry(session, &ihost->sessions, host_list) {
-                if ((channel == SCAN_WILD_CARD ||
-                     channel == session->channel) &&
+                if ((channel == SCAN_WILD_CARD || channel == 0) &&
                     (id == SCAN_WILD_CARD || id == session->target_id))
-                        scsi_scan_target(&session->dev, session->channel,
+                        scsi_scan_target(&session->dev, 0,
                                          session->target_id, lun, 1);
         }
         mutex_unlock(&ihost->mutex);
@@ -291,80 +288,92 @@ void iscsi_block_session(struct iscsi_cls_session *session)
 }
 EXPORT_SYMBOL_GPL(iscsi_block_session);
 
-/**
- * iscsi_create_session - create iscsi class session
- * @shost: scsi host
- * @transport: iscsi transport
- *
- * This can be called from a LLD or iscsi_transport.
- **/
 struct iscsi_cls_session *
-iscsi_create_session(struct Scsi_Host *shost,
-                     struct iscsi_transport *transport, int channel)
+iscsi_alloc_session(struct Scsi_Host *shost,
+                    struct iscsi_transport *transport)
 {
-        struct iscsi_host *ihost;
         struct iscsi_cls_session *session;
-        int err;
-
-        if (!try_module_get(transport->owner))
-                return NULL;
 
         session = kzalloc(sizeof(*session) + transport->sessiondata_size,
                           GFP_KERNEL);
         if (!session)
-                goto module_put;
+                return NULL;
+
         session->transport = transport;
         session->recovery_tmo = 120;
         INIT_WORK(&session->recovery_work, session_recovery_timedout, session);
         INIT_LIST_HEAD(&session->host_list);
         INIT_LIST_HEAD(&session->sess_list);
 
+        /* this is released in the dev's release function */
+        scsi_host_get(shost);
+        session->dev.parent = &shost->shost_gendev;
+        session->dev.release = iscsi_session_release;
+        device_initialize(&session->dev);
         if (transport->sessiondata_size)
                 session->dd_data = &session[1];
+        return session;
+}
+EXPORT_SYMBOL_GPL(iscsi_alloc_session);
 
-        /* this is released in the dev's release function */
-        scsi_host_get(shost);
-        ihost = shost->shost_data;
+int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
+{
+        struct Scsi_Host *shost = iscsi_session_to_shost(session);
+        struct iscsi_host *ihost;
+        int err;
 
+        ihost = shost->shost_data;
         session->sid = iscsi_session_nr++;
-        session->channel = channel;
-        session->target_id = ihost->next_target_id++;
+        session->target_id = target_id;
 
         snprintf(session->dev.bus_id, BUS_ID_SIZE, "session%u",
                  session->sid);
-        session->dev.parent = &shost->shost_gendev;
-        session->dev.release = iscsi_session_release;
-        err = device_register(&session->dev);
+        err = device_add(&session->dev);
         if (err) {
                 dev_printk(KERN_ERR, &session->dev, "iscsi: could not "
                            "register session's dev\n");
-                goto free_session;
+                goto release_host;
         }
         transport_register_device(&session->dev);
 
         mutex_lock(&ihost->mutex);
         list_add(&session->host_list, &ihost->sessions);
         mutex_unlock(&ihost->mutex);
+        return 0;
 
-        return session;
-
-free_session:
-        kfree(session);
-module_put:
-        module_put(transport->owner);
-        return NULL;
+release_host:
+        scsi_host_put(shost);
+        return err;
 }
-
-EXPORT_SYMBOL_GPL(iscsi_create_session);
+EXPORT_SYMBOL_GPL(iscsi_add_session);
 
 /**
- * iscsi_destroy_session - destroy iscsi session
- * @session: iscsi_session
+ * iscsi_create_session - create iscsi class session
+ * @shost: scsi host
+ * @transport: iscsi transport
  *
- * Can be called by a LLD or iscsi_transport. There must not be
- * any running connections.
+ * This can be called from a LLD or iscsi_transport.
  **/
-int iscsi_destroy_session(struct iscsi_cls_session *session)
+struct iscsi_cls_session *
+iscsi_create_session(struct Scsi_Host *shost,
+                     struct iscsi_transport *transport,
+                     unsigned int target_id)
+{
+        struct iscsi_cls_session *session;
+
+        session = iscsi_alloc_session(shost, transport);
+        if (!session)
+                return NULL;
+
+        if (iscsi_add_session(session, target_id)) {
+                iscsi_free_session(session);
+                return NULL;
+        }
+        return session;
+}
+EXPORT_SYMBOL_GPL(iscsi_create_session);
+
+void iscsi_remove_session(struct iscsi_cls_session *session)
 {
         struct Scsi_Host *shost = iscsi_session_to_shost(session);
         struct iscsi_host *ihost = shost->shost_data;
@@ -376,19 +385,88 @@ int iscsi_destroy_session(struct iscsi_cls_session *session)
         list_del(&session->host_list);
         mutex_unlock(&ihost->mutex);
 
+        scsi_remove_target(&session->dev);
+
         transport_unregister_device(&session->dev);
-        device_unregister(&session->dev);
-        return 0;
+        device_del(&session->dev);
+}
+EXPORT_SYMBOL_GPL(iscsi_remove_session);
+
+void iscsi_free_session(struct iscsi_cls_session *session)
+{
+        put_device(&session->dev);
 }
 
+EXPORT_SYMBOL_GPL(iscsi_free_session);
+
+/**
+ * iscsi_destroy_session - destroy iscsi session
+ * @session: iscsi_session
+ *
+ * Can be called by a LLD or iscsi_transport. There must not be
+ * any running connections.
+ **/
+int iscsi_destroy_session(struct iscsi_cls_session *session)
+{
+        iscsi_remove_session(session);
+        iscsi_free_session(session);
+        return 0;
+}
 EXPORT_SYMBOL_GPL(iscsi_destroy_session);
 
+static void mempool_zone_destroy(struct mempool_zone *zp)
+{
+        mempool_destroy(zp->pool);
+        kfree(zp);
+}
+
+static void*
+mempool_zone_alloc_skb(gfp_t gfp_mask, void *pool_data)
+{
+        struct mempool_zone *zone = pool_data;
+
+        return alloc_skb(zone->size, gfp_mask);
+}
+
+static void
+mempool_zone_free_skb(void *element, void *pool_data)
+{
+        kfree_skb(element);
+}
+
+static struct mempool_zone *
+mempool_zone_init(unsigned max, unsigned size, unsigned hiwat)
+{
+        struct mempool_zone *zp;
+
+        zp = kzalloc(sizeof(*zp), GFP_KERNEL);
+        if (!zp)
+                return NULL;
+
+        zp->size = size;
+        zp->hiwat = hiwat;
+        INIT_LIST_HEAD(&zp->freequeue);
+        spin_lock_init(&zp->freelock);
+        atomic_set(&zp->allocated, 0);
+
+        zp->pool = mempool_create(max, mempool_zone_alloc_skb,
+                                  mempool_zone_free_skb, zp);
+        if (!zp->pool) {
+                kfree(zp);
+                return NULL;
+        }
+
+        return zp;
+}
+
 static void iscsi_conn_release(struct device *dev)
 {
         struct iscsi_cls_conn *conn = iscsi_dev_to_conn(dev);
         struct device *parent = conn->dev.parent;
 
-        kfree(conn->persistent_address);
+        mempool_zone_destroy(conn->z_pdu);
+        mempool_zone_destroy(conn->z_error);
+
         kfree(conn);
         put_device(parent);
 }
@@ -398,6 +476,31 @@ static int iscsi_is_conn_dev(const struct device *dev)
         return dev->release == iscsi_conn_release;
 }
 
+static int iscsi_create_event_pools(struct iscsi_cls_conn *conn)
+{
+        conn->z_pdu = mempool_zone_init(Z_MAX_PDU,
+                        NLMSG_SPACE(sizeof(struct iscsi_uevent) +
+                                    sizeof(struct iscsi_hdr) +
+                                    DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH),
+                        Z_HIWAT_PDU);
+        if (!conn->z_pdu) {
+                dev_printk(KERN_ERR, &conn->dev, "iscsi: can not allocate "
+                           "pdu zone for new conn\n");
+                return -ENOMEM;
+        }
+
+        conn->z_error = mempool_zone_init(Z_MAX_ERROR,
+                        NLMSG_SPACE(sizeof(struct iscsi_uevent)),
+                        Z_HIWAT_ERROR);
+        if (!conn->z_error) {
+                dev_printk(KERN_ERR, &conn->dev, "iscsi: can not allocate "
+                           "error zone for new conn\n");
+                mempool_zone_destroy(conn->z_pdu);
+                return -ENOMEM;
+        }
+        return 0;
+}
+
 /**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
@@ -430,9 +533,12 @@ iscsi_create_conn(struct iscsi_cls_session *session, uint32_t cid)
         conn->transport = transport;
         conn->cid = cid;
 
+        if (iscsi_create_event_pools(conn))
+                goto free_conn;
+
         /* this is released in the dev's release function */
         if (!get_device(&session->dev))
-                goto free_conn;
+                goto free_conn_pools;
 
         snprintf(conn->dev.bus_id, BUS_ID_SIZE, "connection%d:%u",
                  session->sid, cid);
@@ -449,6 +555,8 @@ iscsi_create_conn(struct iscsi_cls_session *session, uint32_t cid)
 
 release_parent_ref:
         put_device(&session->dev);
+free_conn_pools:
+
 free_conn:
         kfree(conn);
         return NULL;
@@ -496,20 +604,6 @@ static inline struct list_head *skb_to_lh(struct sk_buff *skb)
         return (struct list_head *)&skb->cb;
 }
 
-static void*
-mempool_zone_alloc_skb(gfp_t gfp_mask, void *pool_data)
-{
-        struct mempool_zone *zone = pool_data;
-
-        return alloc_skb(zone->size, gfp_mask);
-}
-
-static void
-mempool_zone_free_skb(void *element, void *pool_data)
-{
-        kfree_skb(element);
-}
-
 static void
 mempool_zone_complete(struct mempool_zone *zone)
 {
@@ -529,37 +623,6 @@ mempool_zone_complete(struct mempool_zone *zone)
         spin_unlock_irqrestore(&zone->freelock, flags);
 }
 
-static struct mempool_zone *
-mempool_zone_init(unsigned max, unsigned size, unsigned hiwat)
-{
-        struct mempool_zone *zp;
-
-        zp = kzalloc(sizeof(*zp), GFP_KERNEL);
-        if (!zp)
-                return NULL;
-
-        zp->size = size;
-        zp->hiwat = hiwat;
-        INIT_LIST_HEAD(&zp->freequeue);
-        spin_lock_init(&zp->freelock);
-        atomic_set(&zp->allocated, 0);
-
-        zp->pool = mempool_create(max, mempool_zone_alloc_skb,
-                                  mempool_zone_free_skb, zp);
-        if (!zp->pool) {
-                kfree(zp);
-                return NULL;
-        }
-
-        return zp;
-}
-
-static void mempool_zone_destroy(struct mempool_zone *zp)
-{
-        mempool_destroy(zp->pool);
-        kfree(zp);
-}
-
 static struct sk_buff*
 mempool_zone_get_skb(struct mempool_zone *zone)
 {
@@ -572,6 +635,27 @@ mempool_zone_get_skb(struct mempool_zone *zone)
 }
 
 static int
+iscsi_broadcast_skb(struct mempool_zone *zone, struct sk_buff *skb, gfp_t gfp)
+{
+        unsigned long flags;
+        int rc;
+
+        skb_get(skb);
+        rc = netlink_broadcast(nls, skb, 0, 1, gfp);
+        if (rc < 0) {
+                mempool_free(skb, zone->pool);
+                printk(KERN_ERR "iscsi: can not broadcast skb (%d)\n", rc);
+                return rc;
+        }
+
+        spin_lock_irqsave(&zone->freelock, flags);
+        INIT_LIST_HEAD(skb_to_lh(skb));
+        list_add(skb_to_lh(skb), &zone->freequeue);
+        spin_unlock_irqrestore(&zone->freelock, flags);
+        return 0;
+}
+
+static int
 iscsi_unicast_skb(struct mempool_zone *zone, struct sk_buff *skb, int pid)
 {
         unsigned long flags;
@@ -666,7 +750,7 @@ void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error)
         ev->r.connerror.cid = conn->cid;
         ev->r.connerror.sid = iscsi_conn_get_sid(conn);
 
-        iscsi_unicast_skb(conn->z_error, skb, priv->daemon_pid);
+        iscsi_broadcast_skb(conn->z_error, skb, GFP_ATOMIC);
 
         dev_printk(KERN_INFO, &conn->dev, "iscsi: detected conn error (%d)\n",
                    error);
@@ -767,6 +851,131 @@ iscsi_if_get_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh)
         return err;
 }
 
+/**
+ * iscsi_if_destroy_session_done - send session destr. completion event
+ * @conn: last connection for session
+ *
+ * This is called by HW iscsi LLDs to notify userpsace that its HW has
+ * removed a session.
+ **/
+int iscsi_if_destroy_session_done(struct iscsi_cls_conn *conn)
+{
+        struct iscsi_internal *priv;
+        struct iscsi_cls_session *session;
+        struct Scsi_Host *shost;
+        struct iscsi_uevent *ev;
+        struct sk_buff  *skb;
+        struct nlmsghdr *nlh;
+        unsigned long flags;
+        int rc, len = NLMSG_SPACE(sizeof(*ev));
+
+        priv = iscsi_if_transport_lookup(conn->transport);
+        if (!priv)
+                return -EINVAL;
+
+        session = iscsi_dev_to_session(conn->dev.parent);
+        shost = iscsi_session_to_shost(session);
+
+        mempool_zone_complete(conn->z_pdu);
+
+        skb = mempool_zone_get_skb(conn->z_pdu);
+        if (!skb) {
+                dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
+                          "session creation event\n");
+                return -ENOMEM;
+        }
+
+        nlh = __nlmsg_put(skb, priv->daemon_pid, 0, 0, (len - sizeof(*nlh)), 0);
+        ev = NLMSG_DATA(nlh);
+        ev->transport_handle = iscsi_handle(conn->transport);
+        ev->type = ISCSI_KEVENT_DESTROY_SESSION;
+        ev->r.d_session.host_no = shost->host_no;
+        ev->r.d_session.sid = session->sid;
+
+        /*
+         * this will occur if the daemon is not up, so we just warn
+         * the user and when the daemon is restarted it will handle it
+         */
+        rc = iscsi_broadcast_skb(conn->z_pdu, skb, GFP_KERNEL);
+        if (rc < 0)
+                dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
+                          "session destruction event. Check iscsi daemon\n");
+
+        spin_lock_irqsave(&sesslock, flags);
+        list_del(&session->sess_list);
+        spin_unlock_irqrestore(&sesslock, flags);
+
+        spin_lock_irqsave(&connlock, flags);
+        conn->active = 0;
+        list_del(&conn->conn_list);
+        spin_unlock_irqrestore(&connlock, flags);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(iscsi_if_destroy_session_done);
+
+/**
+ * iscsi_if_create_session_done - send session creation completion event
+ * @conn: leading connection for session
+ *
+ * This is called by HW iscsi LLDs to notify userpsace that its HW has
+ * created a session or a existing session is back in the logged in state.
+ **/
+int iscsi_if_create_session_done(struct iscsi_cls_conn *conn)
+{
+        struct iscsi_internal *priv;
+        struct iscsi_cls_session *session;
+        struct Scsi_Host *shost;
+        struct iscsi_uevent *ev;
+        struct sk_buff  *skb;
+        struct nlmsghdr *nlh;
+        unsigned long flags;
+        int rc, len = NLMSG_SPACE(sizeof(*ev));
+
+        priv = iscsi_if_transport_lookup(conn->transport);
+        if (!priv)
+                return -EINVAL;
+
+        session = iscsi_dev_to_session(conn->dev.parent);
+        shost = iscsi_session_to_shost(session);
+
+        mempool_zone_complete(conn->z_pdu);
+
+        skb = mempool_zone_get_skb(conn->z_pdu);
+        if (!skb) {
+                dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
+                          "session creation event\n");
+                return -ENOMEM;
+        }
+
+        nlh = __nlmsg_put(skb, priv->daemon_pid, 0, 0, (len - sizeof(*nlh)), 0);
+        ev = NLMSG_DATA(nlh);
+        ev->transport_handle = iscsi_handle(conn->transport);
+        ev->type = ISCSI_UEVENT_CREATE_SESSION;
+        ev->r.c_session_ret.host_no = shost->host_no;
+        ev->r.c_session_ret.sid = session->sid;
+
+        /*
+         * this will occur if the daemon is not up, so we just warn
+         * the user and when the daemon is restarted it will handle it
+         */
+        rc = iscsi_broadcast_skb(conn->z_pdu, skb, GFP_KERNEL);
+        if (rc < 0)
+                dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
+                          "session creation event. Check iscsi daemon\n");
+
+        spin_lock_irqsave(&sesslock, flags);
+        list_add(&session->sess_list, &sesslist);
+        spin_unlock_irqrestore(&sesslock, flags);
+
+        spin_lock_irqsave(&connlock, flags);
+        list_add(&conn->conn_list, &connlist);
+        conn->active = 1;
+        spin_unlock_irqrestore(&connlock, flags);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(iscsi_if_create_session_done);
+
 static int
 iscsi_if_create_session(struct iscsi_internal *priv, struct iscsi_uevent *ev)
 {
@@ -812,26 +1021,6 @@ iscsi_if_create_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev)
                 return -ENOMEM;
         }
 
-        conn->z_pdu = mempool_zone_init(Z_MAX_PDU,
-                        NLMSG_SPACE(sizeof(struct iscsi_uevent) +
-                                    sizeof(struct iscsi_hdr) +
-                                    DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH),
-                        Z_HIWAT_PDU);
-        if (!conn->z_pdu) {
-                dev_printk(KERN_ERR, &conn->dev, "iscsi: can not allocate "
-                           "pdu zone for new conn\n");
-                goto destroy_conn;
-        }
-
-        conn->z_error = mempool_zone_init(Z_MAX_ERROR,
-                        NLMSG_SPACE(sizeof(struct iscsi_uevent)),
-                        Z_HIWAT_ERROR);
-        if (!conn->z_error) {
-                dev_printk(KERN_ERR, &conn->dev, "iscsi: can not allocate "
-                           "error zone for new conn\n");
-                goto free_pdu_pool;
-        }
-
         ev->r.c_conn_ret.sid = session->sid;
         ev->r.c_conn_ret.cid = conn->cid;
 
@@ -841,13 +1030,6 @@ iscsi_if_create_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev)
         spin_unlock_irqrestore(&connlock, flags);
 
         return 0;
-
-free_pdu_pool:
-        mempool_zone_destroy(conn->z_pdu);
-destroy_conn:
-        if (transport->destroy_conn)
-                transport->destroy_conn(conn->dd_data);
-        return -ENOMEM;
 }
 
 static int
@@ -855,7 +1037,6 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev
 {
         unsigned long flags;
         struct iscsi_cls_conn *conn;
-        struct mempool_zone *z_error, *z_pdu;
 
         conn = iscsi_conn_lookup(ev->u.d_conn.sid, ev->u.d_conn.cid);
         if (!conn)
@@ -865,35 +1046,18 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev
         list_del(&conn->conn_list);
         spin_unlock_irqrestore(&connlock, flags);
 
-        z_pdu = conn->z_pdu;
-        z_error = conn->z_error;
-
         if (transport->destroy_conn)
                 transport->destroy_conn(conn);
-
-        mempool_zone_destroy(z_pdu);
-        mempool_zone_destroy(z_error);
-
         return 0;
 }
 
-static void
-iscsi_copy_param(struct iscsi_uevent *ev, uint32_t *value, char *data)
-{
-        if (ev->u.set_param.len != sizeof(uint32_t))
-                BUG();
-        memcpy(value, data, min_t(uint32_t, sizeof(uint32_t),
-                ev->u.set_param.len));
-}
-
 static int
 iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 {
         char *data = (char*)ev + sizeof(*ev);
         struct iscsi_cls_conn *conn;
         struct iscsi_cls_session *session;
-        int err = 0;
-        uint32_t value = 0;
+        int err = 0, value = 0;
 
         session = iscsi_session_lookup(ev->u.set_param.sid);
         conn = iscsi_conn_lookup(ev->u.set_param.sid, ev->u.set_param.cid);
@@ -902,42 +1066,13 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 
         switch (ev->u.set_param.param) {
         case ISCSI_PARAM_SESS_RECOVERY_TMO:
-                iscsi_copy_param(ev, &value, data);
+                sscanf(data, "%d", &value);
                 if (value != 0)
                         session->recovery_tmo = value;
                 break;
-        case ISCSI_PARAM_TARGET_NAME:
-                /* this should not change between logins */
-                if (session->targetname)
-                        return 0;
-
-                session->targetname = kstrdup(data, GFP_KERNEL);
-                if (!session->targetname)
-                        return -ENOMEM;
-                break;
-        case ISCSI_PARAM_TPGT:
-                iscsi_copy_param(ev, &value, data);
-                session->tpgt = value;
-                break;
-        case ISCSI_PARAM_PERSISTENT_PORT:
-                iscsi_copy_param(ev, &value, data);
-                conn->persistent_port = value;
-                break;
-        case ISCSI_PARAM_PERSISTENT_ADDRESS:
-                /*
-                 * this is the address returned in discovery so it should
-                 * not change between logins.
-                 */
-                if (conn->persistent_address)
-                        return 0;
-
-                conn->persistent_address = kstrdup(data, GFP_KERNEL);
-                if (!conn->persistent_address)
-                        return -ENOMEM;
-                break;
         default:
-                iscsi_copy_param(ev, &value, data);
-                err = transport->set_param(conn, ev->u.set_param.param, value);
+                err = transport->set_param(conn, ev->u.set_param.param,
+                                           data, ev->u.set_param.len);
         }
 
         return err;
@@ -978,6 +1113,21 @@ iscsi_if_transport_ep(struct iscsi_transport *transport,
 }
 
 static int
+iscsi_tgt_dscvr(struct iscsi_transport *transport,
+                struct iscsi_uevent *ev)
+{
+        struct sockaddr *dst_addr;
+
+        if (!transport->tgt_dscvr)
+                return -EINVAL;
+
+        dst_addr = (struct sockaddr *)((char*)ev + sizeof(*ev));
+        return transport->tgt_dscvr(ev->u.tgt_dscvr.type,
+                                    ev->u.tgt_dscvr.host_no,
+                                    ev->u.tgt_dscvr.enable, dst_addr);
+}
+
+static int
 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         int err = 0;
@@ -1065,6 +1215,9 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT:
                 err = iscsi_if_transport_ep(transport, ev, nlh->nlmsg_type);
                 break;
+        case ISCSI_UEVENT_TGT_DSCVR:
+                err = iscsi_tgt_dscvr(transport, ev);
+                break;
         default:
                 err = -EINVAL;
                 break;
@@ -1147,49 +1300,31 @@ struct class_device_attribute class_device_attr_##_prefix##_##_name =	\
 /*
  * iSCSI connection attrs
  */
-#define iscsi_conn_int_attr_show(param, format)                         \
-static ssize_t                                                          \
-show_conn_int_param_##param(struct class_device *cdev, char *buf)       \
-{                                                                       \
-        uint32_t value = 0;                                             \
-        struct iscsi_cls_conn *conn = iscsi_cdev_to_conn(cdev);         \
-        struct iscsi_transport *t = conn->transport;                    \
-                                                                        \
-        t->get_conn_param(conn, param, &value);                         \
-        return snprintf(buf, 20, format"\n", value);                    \
-}
-
-#define iscsi_conn_int_attr(field, param, format)                       \
-        iscsi_conn_int_attr_show(param, format)                         \
-static ISCSI_CLASS_ATTR(conn, field, S_IRUGO, show_conn_int_param_##param, \
-                        NULL);
-
-iscsi_conn_int_attr(max_recv_dlength, ISCSI_PARAM_MAX_RECV_DLENGTH, "%u");
-iscsi_conn_int_attr(max_xmit_dlength, ISCSI_PARAM_MAX_XMIT_DLENGTH, "%u");
-iscsi_conn_int_attr(header_digest, ISCSI_PARAM_HDRDGST_EN, "%d");
-iscsi_conn_int_attr(data_digest, ISCSI_PARAM_DATADGST_EN, "%d");
-iscsi_conn_int_attr(ifmarker, ISCSI_PARAM_IFMARKER_EN, "%d");
-iscsi_conn_int_attr(ofmarker, ISCSI_PARAM_OFMARKER_EN, "%d");
-iscsi_conn_int_attr(persistent_port, ISCSI_PARAM_PERSISTENT_PORT, "%d");
-iscsi_conn_int_attr(port, ISCSI_PARAM_CONN_PORT, "%d");
-iscsi_conn_int_attr(exp_statsn, ISCSI_PARAM_EXP_STATSN, "%u");
-
-#define iscsi_conn_str_attr_show(param)                                 \
+#define iscsi_conn_attr_show(param)                                     \
 static ssize_t                                                          \
-show_conn_str_param_##param(struct class_device *cdev, char *buf)       \
+show_conn_param_##param(struct class_device *cdev, char *buf)           \
 {                                                                       \
         struct iscsi_cls_conn *conn = iscsi_cdev_to_conn(cdev);         \
         struct iscsi_transport *t = conn->transport;                    \
-        return t->get_conn_str_param(conn, param, buf);                 \
+        return t->get_conn_param(conn, param, buf);                     \
 }
 
-#define iscsi_conn_str_attr(field, param)                               \
-        iscsi_conn_str_attr_show(param)                                 \
-static ISCSI_CLASS_ATTR(conn, field, S_IRUGO, show_conn_str_param_##param, \
+#define iscsi_conn_attr(field, param)                                   \
+        iscsi_conn_attr_show(param)                                     \
+static ISCSI_CLASS_ATTR(conn, field, S_IRUGO, show_conn_param_##param,  \
                         NULL);
 
-iscsi_conn_str_attr(persistent_address, ISCSI_PARAM_PERSISTENT_ADDRESS);
-iscsi_conn_str_attr(address, ISCSI_PARAM_CONN_ADDRESS);
+iscsi_conn_attr(max_recv_dlength, ISCSI_PARAM_MAX_RECV_DLENGTH);
+iscsi_conn_attr(max_xmit_dlength, ISCSI_PARAM_MAX_XMIT_DLENGTH);
+iscsi_conn_attr(header_digest, ISCSI_PARAM_HDRDGST_EN);
+iscsi_conn_attr(data_digest, ISCSI_PARAM_DATADGST_EN);
+iscsi_conn_attr(ifmarker, ISCSI_PARAM_IFMARKER_EN);
+iscsi_conn_attr(ofmarker, ISCSI_PARAM_OFMARKER_EN);
+iscsi_conn_attr(persistent_port, ISCSI_PARAM_PERSISTENT_PORT);
+iscsi_conn_attr(port, ISCSI_PARAM_CONN_PORT);
+iscsi_conn_attr(exp_statsn, ISCSI_PARAM_EXP_STATSN);
+iscsi_conn_attr(persistent_address, ISCSI_PARAM_PERSISTENT_ADDRESS);
+iscsi_conn_attr(address, ISCSI_PARAM_CONN_ADDRESS);
 
 #define iscsi_cdev_to_session(_cdev) \
         iscsi_dev_to_session(_cdev->dev)
@@ -1197,61 +1332,36 @@ iscsi_conn_str_attr(address, ISCSI_PARAM_CONN_ADDRESS);
 /*
  * iSCSI session attrs
  */
-#define iscsi_session_int_attr_show(param, format)                      \
-static ssize_t                                                          \
-show_session_int_param_##param(struct class_device *cdev, char *buf)    \
-{                                                                       \
-        uint32_t value = 0;                                             \
-        struct iscsi_cls_session *session = iscsi_cdev_to_session(cdev);        \
-        struct iscsi_transport *t = session->transport;                 \
-                                                                        \
-        t->get_session_param(session, param, &value);                   \
-        return snprintf(buf, 20, format"\n", value);                    \
-}
-
-#define iscsi_session_int_attr(field, param, format)                    \
-        iscsi_session_int_attr_show(param, format)                      \
-static ISCSI_CLASS_ATTR(sess, field, S_IRUGO, show_session_int_param_##param, \
-                        NULL);
-
-iscsi_session_int_attr(initial_r2t, ISCSI_PARAM_INITIAL_R2T_EN, "%d");
-iscsi_session_int_attr(max_outstanding_r2t, ISCSI_PARAM_MAX_R2T, "%hu");
-iscsi_session_int_attr(immediate_data, ISCSI_PARAM_IMM_DATA_EN, "%d");
-iscsi_session_int_attr(first_burst_len, ISCSI_PARAM_FIRST_BURST, "%u");
-iscsi_session_int_attr(max_burst_len, ISCSI_PARAM_MAX_BURST, "%u");
-iscsi_session_int_attr(data_pdu_in_order, ISCSI_PARAM_PDU_INORDER_EN, "%d");
-iscsi_session_int_attr(data_seq_in_order, ISCSI_PARAM_DATASEQ_INORDER_EN, "%d");
-iscsi_session_int_attr(erl, ISCSI_PARAM_ERL, "%d");
-iscsi_session_int_attr(tpgt, ISCSI_PARAM_TPGT, "%d");
-
-#define iscsi_session_str_attr_show(param)                              \
+#define iscsi_session_attr_show(param)                                  \
 static ssize_t                                                          \
-show_session_str_param_##param(struct class_device *cdev, char *buf)    \
+show_session_param_##param(struct class_device *cdev, char *buf)        \
 {                                                                       \
         struct iscsi_cls_session *session = iscsi_cdev_to_session(cdev); \
         struct iscsi_transport *t = session->transport;                 \
-        return t->get_session_str_param(session, param, buf);           \
+        return t->get_session_param(session, param, buf);               \
 }
 
-#define iscsi_session_str_attr(field, param)                            \
-        iscsi_session_str_attr_show(param)                              \
-static ISCSI_CLASS_ATTR(sess, field, S_IRUGO, show_session_str_param_##param, \
+#define iscsi_session_attr(field, param)                                \
+        iscsi_session_attr_show(param)                                  \
+static ISCSI_CLASS_ATTR(sess, field, S_IRUGO, show_session_param_##param, \
                         NULL);
 
-iscsi_session_str_attr(targetname, ISCSI_PARAM_TARGET_NAME);
+iscsi_session_attr(targetname, ISCSI_PARAM_TARGET_NAME);
+iscsi_session_attr(initial_r2t, ISCSI_PARAM_INITIAL_R2T_EN);
+iscsi_session_attr(max_outstanding_r2t, ISCSI_PARAM_MAX_R2T);
+iscsi_session_attr(immediate_data, ISCSI_PARAM_IMM_DATA_EN);
+iscsi_session_attr(first_burst_len, ISCSI_PARAM_FIRST_BURST);
+iscsi_session_attr(max_burst_len, ISCSI_PARAM_MAX_BURST);
+iscsi_session_attr(data_pdu_in_order, ISCSI_PARAM_PDU_INORDER_EN);
+iscsi_session_attr(data_seq_in_order, ISCSI_PARAM_DATASEQ_INORDER_EN);
+iscsi_session_attr(erl, ISCSI_PARAM_ERL);
+iscsi_session_attr(tpgt, ISCSI_PARAM_TPGT);
 
-/*
- * Private session and conn attrs. userspace uses several iscsi values
- * to identify each session between reboots. Some of these values may not
- * be present in the iscsi_transport/LLD driver becuase userspace handles
- * login (and failback for login redirect) so for these type of drivers
- * the class manages the attrs and values for the iscsi_transport/LLD
- */
 #define iscsi_priv_session_attr_show(field, format)                     \
 static ssize_t                                                          \
-show_priv_session_##field(struct class_device *cdev, char *buf) \
+show_priv_session_##field(struct class_device *cdev, char *buf)         \
 {                                                                       \
-        struct iscsi_cls_session *session = iscsi_cdev_to_session(cdev); \
+        struct iscsi_cls_session *session = iscsi_cdev_to_session(cdev);\
         return sprintf(buf, format"\n", session->field);                \
 }
 
@@ -1259,31 +1369,15 @@ show_priv_session_##field(struct class_device *cdev, char *buf)	\
         iscsi_priv_session_attr_show(field, format)                     \
 static ISCSI_CLASS_ATTR(priv_sess, field, S_IRUGO, show_priv_session_##field, \
                         NULL)
-iscsi_priv_session_attr(targetname, "%s");
-iscsi_priv_session_attr(tpgt, "%d");
 iscsi_priv_session_attr(recovery_tmo, "%d");
 
-#define iscsi_priv_conn_attr_show(field, format)                        \
-static ssize_t                                                          \
-show_priv_conn_##field(struct class_device *cdev, char *buf)            \
-{                                                                       \
-        struct iscsi_cls_conn *conn = iscsi_cdev_to_conn(cdev);         \
-        return sprintf(buf, format"\n", conn->field);                   \
-}
-
-#define iscsi_priv_conn_attr(field, format)                             \
-        iscsi_priv_conn_attr_show(field, format)                        \
-static ISCSI_CLASS_ATTR(priv_conn, field, S_IRUGO, show_priv_conn_##field, \
-                        NULL)
-iscsi_priv_conn_attr(persistent_address, "%s");
-iscsi_priv_conn_attr(persistent_port, "%d");
-
 #define SETUP_PRIV_SESSION_RD_ATTR(field)                               \
 do {                                                                    \
         priv->session_attrs[count] = &class_device_attr_priv_sess_##field; \
         count++;                                                        \
 } while (0)
 
+
 #define SETUP_SESSION_RD_ATTR(field, param_flag)                        \
 do {                                                                    \
         if (tt->param_mask & param_flag) {                              \
@@ -1292,12 +1386,6 @@ do {									\
         }                                                               \
 } while (0)
 
-#define SETUP_PRIV_CONN_RD_ATTR(field)                                  \
-do {                                                                    \
-        priv->conn_attrs[count] = &class_device_attr_priv_conn_##field; \
-        count++;                                                        \
-} while (0)
-
 #define SETUP_CONN_RD_ATTR(field, param_flag)                           \
 do {                                                                    \
         if (tt->param_mask & param_flag) {                              \
@@ -1388,6 +1476,7 @@ iscsi_register_transport(struct iscsi_transport *tt)
         if (!priv)
                 return NULL;
         INIT_LIST_HEAD(&priv->list);
+        priv->daemon_pid = -1;
         priv->iscsi_transport = tt;
         priv->t.user_scan = iscsi_user_scan;
 
@@ -1424,16 +1513,8 @@ iscsi_register_transport(struct iscsi_transport *tt)
         SETUP_CONN_RD_ATTR(address, ISCSI_CONN_ADDRESS);
         SETUP_CONN_RD_ATTR(port, ISCSI_CONN_PORT);
         SETUP_CONN_RD_ATTR(exp_statsn, ISCSI_EXP_STATSN);
-
-        if (tt->param_mask & ISCSI_PERSISTENT_ADDRESS)
-                SETUP_CONN_RD_ATTR(persistent_address, ISCSI_PERSISTENT_ADDRESS);
-        else
-                SETUP_PRIV_CONN_RD_ATTR(persistent_address);
-
-        if (tt->param_mask & ISCSI_PERSISTENT_PORT)
-                SETUP_CONN_RD_ATTR(persistent_port, ISCSI_PERSISTENT_PORT);
-        else
-                SETUP_PRIV_CONN_RD_ATTR(persistent_port);
+        SETUP_CONN_RD_ATTR(persistent_address, ISCSI_PERSISTENT_ADDRESS);
+        SETUP_CONN_RD_ATTR(persistent_port, ISCSI_PERSISTENT_PORT);
 
         BUG_ON(count > ISCSI_CONN_ATTRS);
         priv->conn_attrs[count] = NULL;
@@ -1453,18 +1534,10 @@ iscsi_register_transport(struct iscsi_transport *tt)
         SETUP_SESSION_RD_ATTR(data_pdu_in_order, ISCSI_PDU_INORDER_EN);
         SETUP_SESSION_RD_ATTR(data_seq_in_order, ISCSI_DATASEQ_INORDER_EN);
         SETUP_SESSION_RD_ATTR(erl, ISCSI_ERL);
+        SETUP_SESSION_RD_ATTR(targetname, ISCSI_TARGET_NAME);
+        SETUP_SESSION_RD_ATTR(tpgt, ISCSI_TPGT);
         SETUP_PRIV_SESSION_RD_ATTR(recovery_tmo);
 
-        if (tt->param_mask & ISCSI_TARGET_NAME)
-                SETUP_SESSION_RD_ATTR(targetname, ISCSI_TARGET_NAME);
-        else
-                SETUP_PRIV_SESSION_RD_ATTR(targetname);
-
-        if (tt->param_mask & ISCSI_TPGT)
-                SETUP_SESSION_RD_ATTR(tpgt, ISCSI_TPGT);
-        else
-                SETUP_PRIV_SESSION_RD_ATTR(tpgt);
-
         BUG_ON(count > ISCSI_SESSION_ATTRS);
         priv->session_attrs[count] = NULL;
 
@@ -1541,6 +1614,9 @@ static __init int iscsi_transport_init(void)
 {
         int err;
 
+        printk(KERN_INFO "Loading iSCSI transport class v%s.",
+                ISCSI_TRANSPORT_VERSION);
+
         err = class_register(&iscsi_transport_class);
         if (err)
                 return err;
@@ -1606,3 +1682,4 @@ MODULE_AUTHOR("Mike Christie <michaelc@cs.wisc.edu>, "
               "Alex Aizman <itn780@yahoo.com>");
 MODULE_DESCRIPTION("iSCSI Transport Interface");
 MODULE_LICENSE("GPL");
+MODULE_VERSION(ISCSI_TRANSPORT_VERSION);
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 1fe6b2d01853..5a625c3fddae 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -41,6 +41,7 @@ struct sas_host_attrs {
         struct mutex lock;
         u32 next_target_id;
         u32 next_expander_id;
+        int next_port_id;
 };
 #define to_sas_host_attrs(host) ((struct sas_host_attrs *)(host)->shost_data)
 
@@ -146,6 +147,7 @@ static int sas_host_setup(struct transport_container *tc, struct device *dev,
         mutex_init(&sas_host->lock);
         sas_host->next_target_id = 0;
         sas_host->next_expander_id = 0;
+        sas_host->next_port_id = 0;
         return 0;
 }
 
@@ -174,12 +176,29 @@ static int sas_host_match(struct attribute_container *cont,
 
 static int do_sas_phy_delete(struct device *dev, void *data)
 {
-        if (scsi_is_sas_phy(dev))
+        int pass = (int)(unsigned long)data;
+
+        if (pass == 0 && scsi_is_sas_port(dev))
+                sas_port_delete(dev_to_sas_port(dev));
+        else if (pass == 1 && scsi_is_sas_phy(dev))
                 sas_phy_delete(dev_to_phy(dev));
         return 0;
 }
 
 /**
+ * sas_remove_children  --  tear down a devices SAS data structures
+ * @dev:        device belonging to the sas object
+ *
+ * Removes all SAS PHYs and remote PHYs for a given object
+ */
+void sas_remove_children(struct device *dev)
+{
+        device_for_each_child(dev, (void *)0, do_sas_phy_delete);
+        device_for_each_child(dev, (void *)1, do_sas_phy_delete);
+}
+EXPORT_SYMBOL(sas_remove_children);
+
+/**
  * sas_remove_host  --  tear down a Scsi_Host's SAS data structures
  * @shost:      Scsi Host that is torn down
  *
@@ -188,13 +207,13 @@ static int do_sas_phy_delete(struct device *dev, void *data)
  */
 void sas_remove_host(struct Scsi_Host *shost)
 {
-        device_for_each_child(&shost->shost_gendev, NULL, do_sas_phy_delete);
+        sas_remove_children(&shost->shost_gendev);
 }
 EXPORT_SYMBOL(sas_remove_host);
 
 
 /*
- * SAS Port attributes
+ * SAS Phy attributes
  */
 
 #define sas_phy_show_simple(field, name, format_string, cast)           \
@@ -310,7 +329,7 @@ sas_phy_protocol_attr(identify.target_port_protocols,
 sas_phy_simple_attr(identify.sas_address, sas_address, "0x%016llx\n",
                 unsigned long long);
 sas_phy_simple_attr(identify.phy_identifier, phy_identifier, "%d\n", u8);
-sas_phy_simple_attr(port_identifier, port_identifier, "%d\n", u8);
+//sas_phy_simple_attr(port_identifier, port_identifier, "%d\n", int);
 sas_phy_linkspeed_attr(negotiated_linkrate);
 sas_phy_linkspeed_attr(minimum_linkrate_hw);
 sas_phy_linkspeed_attr(minimum_linkrate);
@@ -378,9 +397,10 @@ struct sas_phy *sas_phy_alloc(struct device *parent, int number)
         device_initialize(&phy->dev);
         phy->dev.parent = get_device(parent);
         phy->dev.release = sas_phy_release;
+        INIT_LIST_HEAD(&phy->port_siblings);
         if (scsi_is_sas_expander_device(parent)) {
                 struct sas_rphy *rphy = dev_to_rphy(parent);
-                sprintf(phy->dev.bus_id, "phy-%d-%d:%d", shost->host_no,
+                sprintf(phy->dev.bus_id, "phy-%d:%d:%d", shost->host_no,
                         rphy->scsi_target_id, number);
         } else
                 sprintf(phy->dev.bus_id, "phy-%d:%d", shost->host_no, number);
@@ -440,8 +460,8 @@ sas_phy_delete(struct sas_phy *phy)
 {
         struct device *dev = &phy->dev;
 
-        if (phy->rphy)
-                sas_rphy_delete(phy->rphy);
+        /* this happens if the phy is still part of a port when deleted */
+        BUG_ON(!list_empty(&phy->port_siblings));
 
         transport_remove_device(dev);
         device_del(dev);
@@ -464,6 +484,310 @@ int scsi_is_sas_phy(const struct device *dev)
 EXPORT_SYMBOL(scsi_is_sas_phy);
 
 /*
+ * SAS Port attributes
+ */
+#define sas_port_show_simple(field, name, format_string, cast)          \
+static ssize_t                                                          \
+show_sas_port_##name(struct class_device *cdev, char *buf)              \
+{                                                                       \
+        struct sas_port *port = transport_class_to_sas_port(cdev);      \
+                                                                        \
+        return snprintf(buf, 20, format_string, cast port->field);      \
+}
+
+#define sas_port_simple_attr(field, name, format_string, type)          \
+        sas_port_show_simple(field, name, format_string, (type))        \
+static CLASS_DEVICE_ATTR(name, S_IRUGO, show_sas_port_##name, NULL)
+
+sas_port_simple_attr(num_phys, num_phys, "%d\n", int);
+
+static DECLARE_TRANSPORT_CLASS(sas_port_class,
+                               "sas_port", NULL, NULL, NULL);
+
+static int sas_port_match(struct attribute_container *cont, struct device *dev)
+{
+        struct Scsi_Host *shost;
+        struct sas_internal *i;
+
+        if (!scsi_is_sas_port(dev))
+                return 0;
+        shost = dev_to_shost(dev->parent);
+
+        if (!shost->transportt)
+                return 0;
+        if (shost->transportt->host_attrs.ac.class !=
+                        &sas_host_class.class)
+                return 0;
+
+        i = to_sas_internal(shost->transportt);
+        return &i->port_attr_cont.ac == cont;
+}
+
+
+static void sas_port_release(struct device *dev)
+{
+        struct sas_port *port = dev_to_sas_port(dev);
+
+        BUG_ON(!list_empty(&port->phy_list));
+
+        put_device(dev->parent);
+        kfree(port);
+}
+
+static void sas_port_create_link(struct sas_port *port,
+                                 struct sas_phy *phy)
+{
+        sysfs_create_link(&port->dev.kobj, &phy->dev.kobj, phy->dev.bus_id);
+        sysfs_create_link(&phy->dev.kobj, &port->dev.kobj, "port");
+}
+
+static void sas_port_delete_link(struct sas_port *port,
+                                 struct sas_phy *phy)
+{
+        sysfs_remove_link(&port->dev.kobj, phy->dev.bus_id);
+        sysfs_remove_link(&phy->dev.kobj, "port");
+}
+
+/** sas_port_alloc - allocate and initialize a SAS port structure
+ *
+ * @parent:     parent device
+ * @port_id:    port number
+ *
+ * Allocates a SAS port structure.  It will be added to the device tree
+ * below the device specified by @parent which must be either a Scsi_Host
+ * or a sas_expander_device.
+ *
+ * Returns %NULL on error
+ */
+struct sas_port *sas_port_alloc(struct device *parent, int port_id)
+{
+        struct Scsi_Host *shost = dev_to_shost(parent);
+        struct sas_port *port;
+
+        port = kzalloc(sizeof(*port), GFP_KERNEL);
+        if (!port)
+                return NULL;
+
+        port->port_identifier = port_id;
+
+        device_initialize(&port->dev);
+
+        port->dev.parent = get_device(parent);
+        port->dev.release = sas_port_release;
+
+        mutex_init(&port->phy_list_mutex);
+        INIT_LIST_HEAD(&port->phy_list);
+
+        if (scsi_is_sas_expander_device(parent)) {
+                struct sas_rphy *rphy = dev_to_rphy(parent);
+                sprintf(port->dev.bus_id, "port-%d:%d:%d", shost->host_no,
+                        rphy->scsi_target_id, port->port_identifier);
+        } else
+                sprintf(port->dev.bus_id, "port-%d:%d", shost->host_no,
+                        port->port_identifier);
+
+        transport_setup_device(&port->dev);
+
+        return port;
+}
+EXPORT_SYMBOL(sas_port_alloc);
+
+/** sas_port_alloc_num - allocate and initialize a SAS port structure
+ *
+ * @parent:     parent device
+ *
+ * Allocates a SAS port structure and a number to go with it.  This
+ * interface is really for adapters where the port number has no
+ * meansing, so the sas class should manage them.  It will be added to
+ * the device tree below the device specified by @parent which must be
+ * either a Scsi_Host or a sas_expander_device.
+ *
+ * Returns %NULL on error
+ */
+struct sas_port *sas_port_alloc_num(struct device *parent)
+{
+        int index;
+        struct Scsi_Host *shost = dev_to_shost(parent);
+        struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
+
+        /* FIXME: use idr for this eventually */
+        mutex_lock(&sas_host->lock);
+        if (scsi_is_sas_expander_device(parent)) {
+                struct sas_rphy *rphy = dev_to_rphy(parent);
+                struct sas_expander_device *exp = rphy_to_expander_device(rphy);
+
+                index = exp->next_port_id++;
+        } else
+                index = sas_host->next_port_id++;
+        mutex_unlock(&sas_host->lock);
+        return sas_port_alloc(parent, index);
+}
+EXPORT_SYMBOL(sas_port_alloc_num);
+
+/**
+ * sas_port_add - add a SAS port to the device hierarchy
+ *
+ * @port:       port to be added
+ *
+ * publishes a port to the rest of the system
+ */
+int sas_port_add(struct sas_port *port)
+{
+        int error;
+
+        /* No phys should be added until this is made visible */
+        BUG_ON(!list_empty(&port->phy_list));
+
+        error = device_add(&port->dev);
+
+        if (error)
+                return error;
+
+        transport_add_device(&port->dev);
+        transport_configure_device(&port->dev);
+
+        return 0;
+}
+EXPORT_SYMBOL(sas_port_add);
+
+/**
+ * sas_port_free  --  free a SAS PORT
+ * @port:       SAS PORT to free
+ *
+ * Frees the specified SAS PORT.
+ *
+ * Note:
+ *   This function must only be called on a PORT that has not
+ *   sucessfully been added using sas_port_add().
+ */
+void sas_port_free(struct sas_port *port)
+{
+        transport_destroy_device(&port->dev);
+        put_device(&port->dev);
+}
+EXPORT_SYMBOL(sas_port_free);
+
+/**
+ * sas_port_delete  --  remove SAS PORT
+ * @port:       SAS PORT to remove
+ *
+ * Removes the specified SAS PORT.  If the SAS PORT has an
+ * associated phys, unlink them from the port as well.
+ */
+void sas_port_delete(struct sas_port *port)
+{
+        struct device *dev = &port->dev;
+        struct sas_phy *phy, *tmp_phy;
+
+        if (port->rphy) {
+                sas_rphy_delete(port->rphy);
+                port->rphy = NULL;
+        }
+
+        mutex_lock(&port->phy_list_mutex);
+        list_for_each_entry_safe(phy, tmp_phy, &port->phy_list,
+                                 port_siblings) {
+                sas_port_delete_link(port, phy);
+                list_del_init(&phy->port_siblings);
+        }
+        mutex_unlock(&port->phy_list_mutex);
+
+        if (port->is_backlink) {
+                struct device *parent = port->dev.parent;
+
+                sysfs_remove_link(&port->dev.kobj, parent->bus_id);
+                port->is_backlink = 0;
+        }
+
+        transport_remove_device(dev);
+        device_del(dev);
+        transport_destroy_device(dev);
+        put_device(dev);
+}
+EXPORT_SYMBOL(sas_port_delete);
+
+/**
+ * scsi_is_sas_port --  check if a struct device represents a SAS port
+ * @dev:        device to check
+ *
+ * Returns:
+ *      %1 if the device represents a SAS Port, %0 else
+ */
+int scsi_is_sas_port(const struct device *dev)
+{
+        return dev->release == sas_port_release;
+}
+EXPORT_SYMBOL(scsi_is_sas_port);
+
+/**
+ * sas_port_add_phy - add another phy to a port to form a wide port
+ * @port:       port to add the phy to
+ * @phy:        phy to add
+ *
+ * When a port is initially created, it is empty (has no phys).  All
+ * ports must have at least one phy to operated, and all wide ports
+ * must have at least two.  The current code makes no difference
+ * between ports and wide ports, but the only object that can be
+ * connected to a remote device is a port, so ports must be formed on
+ * all devices with phys if they're connected to anything.
+ */
+void sas_port_add_phy(struct sas_port *port, struct sas_phy *phy)
+{
+        mutex_lock(&port->phy_list_mutex);
+        if (unlikely(!list_empty(&phy->port_siblings))) {
+                /* make sure we're already on this port */
+                struct sas_phy *tmp;
+
+                list_for_each_entry(tmp, &port->phy_list, port_siblings)
+                        if (tmp == phy)
+                                break;
+                /* If this trips, you added a phy that was already
+                 * part of a different port */
+                if (unlikely(tmp != phy)) {
+                        dev_printk(KERN_ERR, &port->dev, "trying to add phy %s fails: it's already part of another port\n", phy->dev.bus_id);
+                        BUG();
+                }
+        } else {
+                sas_port_create_link(port, phy);
+                list_add_tail(&phy->port_siblings, &port->phy_list);
+                port->num_phys++;
+        }
+        mutex_unlock(&port->phy_list_mutex);
+}
+EXPORT_SYMBOL(sas_port_add_phy);
+
+/**
+ * sas_port_delete_phy - remove a phy from a port or wide port
+ * @port:       port to remove the phy from
+ * @phy:        phy to remove
+ *
+ * This operation is used for tearing down ports again.  It must be
+ * done to every port or wide port before calling sas_port_delete.
+ */
+void sas_port_delete_phy(struct sas_port *port, struct sas_phy *phy)
+{
+        mutex_lock(&port->phy_list_mutex);
+        sas_port_delete_link(port, phy);
+        list_del_init(&phy->port_siblings);
+        port->num_phys--;
+        mutex_unlock(&port->phy_list_mutex);
+}
+EXPORT_SYMBOL(sas_port_delete_phy);
+
+void sas_port_mark_backlink(struct sas_port *port)
+{
+        struct device *parent = port->dev.parent->parent->parent;
+
+        if (port->is_backlink)
+                return;
+        port->is_backlink = 1;
+        sysfs_create_link(&port->dev.kobj, &parent->kobj,
+                          parent->bus_id);
+
+}
+EXPORT_SYMBOL(sas_port_mark_backlink);
+
+/*
  * SAS remote PHY attributes.
  */
 
@@ -767,7 +1091,7 @@ static void sas_rphy_initialize(struct sas_rphy *rphy)
  * Returns:
  *      SAS PHY allocated or %NULL if the allocation failed.
  */
-struct sas_rphy *sas_end_device_alloc(struct sas_phy *parent)
+struct sas_rphy *sas_end_device_alloc(struct sas_port *parent)
 {
         struct Scsi_Host *shost = dev_to_shost(&parent->dev);
         struct sas_end_device *rdev;
@@ -780,8 +1104,13 @@ struct sas_rphy *sas_end_device_alloc(struct sas_phy *parent)
         device_initialize(&rdev->rphy.dev);
         rdev->rphy.dev.parent = get_device(&parent->dev);
         rdev->rphy.dev.release = sas_end_device_release;
-        sprintf(rdev->rphy.dev.bus_id, "end_device-%d:%d-%d",
-                shost->host_no, parent->port_identifier, parent->number);
+        if (scsi_is_sas_expander_device(parent->dev.parent)) {
+                struct sas_rphy *rphy = dev_to_rphy(parent->dev.parent);
+                sprintf(rdev->rphy.dev.bus_id, "end_device-%d:%d:%d",
+                        shost->host_no, rphy->scsi_target_id, parent->port_identifier);
+        } else
+                sprintf(rdev->rphy.dev.bus_id, "end_device-%d:%d",
+                        shost->host_no, parent->port_identifier);
         rdev->rphy.identify.device_type = SAS_END_DEVICE;
         sas_rphy_initialize(&rdev->rphy);
         transport_setup_device(&rdev->rphy.dev);
@@ -798,7 +1127,7 @@ EXPORT_SYMBOL(sas_end_device_alloc);
  * Returns:
  *      SAS PHY allocated or %NULL if the allocation failed.
  */
-struct sas_rphy *sas_expander_alloc(struct sas_phy *parent,
+struct sas_rphy *sas_expander_alloc(struct sas_port *parent,
                                     enum sas_device_type type)
 {
         struct Scsi_Host *shost = dev_to_shost(&parent->dev);
@@ -837,7 +1166,7 @@ EXPORT_SYMBOL(sas_expander_alloc);
  */
 int sas_rphy_add(struct sas_rphy *rphy)
 {
-        struct sas_phy *parent = dev_to_phy(rphy->dev.parent);
+        struct sas_port *parent = dev_to_sas_port(rphy->dev.parent);
         struct Scsi_Host *shost = dev_to_shost(parent->dev.parent);
         struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
         struct sas_identify *identify = &rphy->identify;
@@ -865,7 +1194,7 @@ int sas_rphy_add(struct sas_rphy *rphy)
 
         if (identify->device_type == SAS_END_DEVICE &&
             rphy->scsi_target_id != -1) {
-                scsi_scan_target(&rphy->dev, parent->port_identifier,
+                scsi_scan_target(&rphy->dev, 0,
                                 rphy->scsi_target_id, ~0, 0);
         }
 
@@ -910,7 +1239,7 @@ void
 sas_rphy_delete(struct sas_rphy *rphy)
 {
         struct device *dev = &rphy->dev;
-        struct sas_phy *parent = dev_to_phy(dev->parent);
+        struct sas_port *parent = dev_to_sas_port(dev->parent);
         struct Scsi_Host *shost = dev_to_shost(parent->dev.parent);
         struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
 
@@ -920,7 +1249,7 @@ sas_rphy_delete(struct sas_rphy *rphy)
                 break;
         case SAS_EDGE_EXPANDER_DEVICE:
         case SAS_FANOUT_EXPANDER_DEVICE:
-                device_for_each_child(dev, NULL, do_sas_phy_delete);
+                sas_remove_children(dev);
                 break;
         default:
                 break;
@@ -967,15 +1296,13 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
 
         mutex_lock(&sas_host->lock);
         list_for_each_entry(rphy, &sas_host->rphy_list, list) {
-                struct sas_phy *parent = dev_to_phy(rphy->dev.parent);
-
                 if (rphy->identify.device_type != SAS_END_DEVICE ||
                     rphy->scsi_target_id == -1)
                         continue;
 
-                if ((channel == SCAN_WILD_CARD || channel == parent->port_identifier) &&
+                if ((channel == SCAN_WILD_CARD || channel == 0) &&
                     (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) {
-                        scsi_scan_target(&rphy->dev, parent->port_identifier,
+                        scsi_scan_target(&rphy->dev, 0,
                                          rphy->scsi_target_id, lun, 1);
                 }
         }
@@ -1003,16 +1330,19 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
 #define SETUP_OPTIONAL_RPORT_ATTRIBUTE(field, func)                     \
         SETUP_TEMPLATE(rphy_attrs, field, S_IRUGO, i->f->func)
 
-#define SETUP_PORT_ATTRIBUTE(field)                                     \
+#define SETUP_PHY_ATTRIBUTE(field)                                      \
         SETUP_TEMPLATE(phy_attrs, field, S_IRUGO, 1)
 
-#define SETUP_OPTIONAL_PORT_ATTRIBUTE(field, func)                      \
+#define SETUP_PORT_ATTRIBUTE(field)                                     \
+        SETUP_TEMPLATE(port_attrs, field, S_IRUGO, 1)
+
+#define SETUP_OPTIONAL_PHY_ATTRIBUTE(field, func)                       \
         SETUP_TEMPLATE(phy_attrs, field, S_IRUGO, i->f->func)
 
-#define SETUP_PORT_ATTRIBUTE_WRONLY(field)                              \
+#define SETUP_PHY_ATTRIBUTE_WRONLY(field)                               \
         SETUP_TEMPLATE(phy_attrs, field, S_IWUGO, 1)
 
-#define SETUP_OPTIONAL_PORT_ATTRIBUTE_WRONLY(field, func)               \
+#define SETUP_OPTIONAL_PHY_ATTRIBUTE_WRONLY(field, func)                \
         SETUP_TEMPLATE(phy_attrs, field, S_IWUGO, i->f->func)
 
 #define SETUP_END_DEV_ATTRIBUTE(field)                                  \
@@ -1048,6 +1378,11 @@ sas_attach_transport(struct sas_function_template *ft)
         i->phy_attr_cont.ac.match = sas_phy_match;
         transport_container_register(&i->phy_attr_cont);
 
+        i->port_attr_cont.ac.class = &sas_port_class.class;
+        i->port_attr_cont.ac.attrs = &i->port_attrs[0];
+        i->port_attr_cont.ac.match = sas_port_match;
+        transport_container_register(&i->port_attr_cont);
+
         i->rphy_attr_cont.ac.class = &sas_rphy_class.class;
         i->rphy_attr_cont.ac.attrs = &i->rphy_attrs[0];
         i->rphy_attr_cont.ac.match = sas_rphy_match;
@@ -1066,30 +1401,35 @@ sas_attach_transport(struct sas_function_template *ft)
         i->f = ft;
 
         count = 0;
+        SETUP_PORT_ATTRIBUTE(num_phys);
         i->host_attrs[count] = NULL;
 
         count = 0;
-        SETUP_PORT_ATTRIBUTE(initiator_port_protocols);
-        SETUP_PORT_ATTRIBUTE(target_port_protocols);
-        SETUP_PORT_ATTRIBUTE(device_type);
-        SETUP_PORT_ATTRIBUTE(sas_address);
-        SETUP_PORT_ATTRIBUTE(phy_identifier);
-        SETUP_PORT_ATTRIBUTE(port_identifier);
-        SETUP_PORT_ATTRIBUTE(negotiated_linkrate);
-        SETUP_PORT_ATTRIBUTE(minimum_linkrate_hw);
-        SETUP_PORT_ATTRIBUTE(minimum_linkrate);
-        SETUP_PORT_ATTRIBUTE(maximum_linkrate_hw);
-        SETUP_PORT_ATTRIBUTE(maximum_linkrate);
-
-        SETUP_PORT_ATTRIBUTE(invalid_dword_count);
-        SETUP_PORT_ATTRIBUTE(running_disparity_error_count);
-        SETUP_PORT_ATTRIBUTE(loss_of_dword_sync_count);
-        SETUP_PORT_ATTRIBUTE(phy_reset_problem_count);
-        SETUP_OPTIONAL_PORT_ATTRIBUTE_WRONLY(link_reset, phy_reset);
-        SETUP_OPTIONAL_PORT_ATTRIBUTE_WRONLY(hard_reset, phy_reset);
+        SETUP_PHY_ATTRIBUTE(initiator_port_protocols);
+        SETUP_PHY_ATTRIBUTE(target_port_protocols);
+        SETUP_PHY_ATTRIBUTE(device_type);
+        SETUP_PHY_ATTRIBUTE(sas_address);
+        SETUP_PHY_ATTRIBUTE(phy_identifier);
+        //SETUP_PHY_ATTRIBUTE(port_identifier);
+        SETUP_PHY_ATTRIBUTE(negotiated_linkrate);
+        SETUP_PHY_ATTRIBUTE(minimum_linkrate_hw);
+        SETUP_PHY_ATTRIBUTE(minimum_linkrate);
+        SETUP_PHY_ATTRIBUTE(maximum_linkrate_hw);
+        SETUP_PHY_ATTRIBUTE(maximum_linkrate);
+
+        SETUP_PHY_ATTRIBUTE(invalid_dword_count);
+        SETUP_PHY_ATTRIBUTE(running_disparity_error_count);
+        SETUP_PHY_ATTRIBUTE(loss_of_dword_sync_count);
+        SETUP_PHY_ATTRIBUTE(phy_reset_problem_count);
+        SETUP_OPTIONAL_PHY_ATTRIBUTE_WRONLY(link_reset, phy_reset);
+        SETUP_OPTIONAL_PHY_ATTRIBUTE_WRONLY(hard_reset, phy_reset);
         i->phy_attrs[count] = NULL;
 
         count = 0;
+        SETUP_PORT_ATTRIBUTE(num_phys);
+        i->port_attrs[count] = NULL;
+
+        count = 0;
         SETUP_RPORT_ATTRIBUTE(rphy_initiator_port_protocols);
         SETUP_RPORT_ATTRIBUTE(rphy_target_port_protocols);
         SETUP_RPORT_ATTRIBUTE(rphy_device_type);
@@ -1131,6 +1471,7 @@ void sas_release_transport(struct scsi_transport_template *t)
 
         transport_container_unregister(&i->t.host_attrs);
         transport_container_unregister(&i->phy_attr_cont);
+        transport_container_unregister(&i->port_attr_cont);
         transport_container_unregister(&i->rphy_attr_cont);
         transport_container_unregister(&i->end_dev_attr_cont);
         transport_container_unregister(&i->expander_attr_cont);
@@ -1149,9 +1490,12 @@ static __init int sas_transport_init(void)
         error = transport_class_register(&sas_phy_class);
         if (error)
                 goto out_unregister_transport;
-        error = transport_class_register(&sas_rphy_class);
+        error = transport_class_register(&sas_port_class);
         if (error)
                 goto out_unregister_phy;
+        error = transport_class_register(&sas_rphy_class);
+        if (error)
+                goto out_unregister_port;
         error = transport_class_register(&sas_end_dev_class);
         if (error)
                 goto out_unregister_rphy;
@@ -1165,6 +1509,8 @@ static __init int sas_transport_init(void)
         transport_class_unregister(&sas_end_dev_class);
  out_unregister_rphy:
         transport_class_unregister(&sas_rphy_class);
+ out_unregister_port:
+        transport_class_unregister(&sas_port_class);
  out_unregister_phy:
         transport_class_unregister(&sas_phy_class);
  out_unregister_transport:
@@ -1178,6 +1524,7 @@ static void __exit sas_transport_exit(void)
 {
         transport_class_unregister(&sas_host_class);
         transport_class_unregister(&sas_phy_class);
+        transport_class_unregister(&sas_port_class);
         transport_class_unregister(&sas_rphy_class);
         transport_class_unregister(&sas_end_dev_class);
         transport_class_unregister(&sas_expander_class);
diff --git a/drivers/scsi/scsicam.c b/drivers/scsi/scsicam.c
index b78354fc4b17..cd68a66c7bb3 100644
--- a/drivers/scsi/scsicam.c
+++ b/drivers/scsi/scsicam.c
@@ -57,6 +57,7 @@ EXPORT_SYMBOL(scsi_bios_ptable);
 int scsicam_bios_param(struct block_device *bdev, sector_t capacity, int *ip)
 {
         unsigned char *p;
+        u64 capacity64 = capacity;      /* Suppress gcc warning */
         int ret;
 
         p = scsi_bios_ptable(bdev);
@@ -68,7 +69,7 @@ int scsicam_bios_param(struct block_device *bdev, sector_t capacity, int *ip)
                                (unsigned int *)ip + 0, (unsigned int *)ip + 1);
         kfree(p);
 
-        if (ret == -1) {
+        if (ret == -1 && capacity64 < (1ULL << 32)) {
                 /* pick some standard mapping with at most 1024 cylinders,
                    and at most 62 sectors per track - this works up to
                    7905 MB */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index ea38757d12e5..98bd3aab9739 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -207,6 +207,23 @@ static ssize_t sd_store_cache_type(struct class_device *cdev, const char *buf,
         return count;
 }
 
+static ssize_t sd_store_allow_restart(struct class_device *cdev, const char *buf,
+                                      size_t count)
+{
+        struct scsi_disk *sdkp = to_scsi_disk(cdev);
+        struct scsi_device *sdp = sdkp->device;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
+
+        if (sdp->type != TYPE_DISK)
+                return -EINVAL;
+
+        sdp->allow_restart = simple_strtoul(buf, NULL, 10);
+
+        return count;
+}
+
 static ssize_t sd_show_cache_type(struct class_device *cdev, char *buf)
 {
         struct scsi_disk *sdkp = to_scsi_disk(cdev);
@@ -222,10 +239,19 @@ static ssize_t sd_show_fua(struct class_device *cdev, char *buf)
         return snprintf(buf, 20, "%u\n", sdkp->DPOFUA);
 }
 
+static ssize_t sd_show_allow_restart(struct class_device *cdev, char *buf)
+{
+        struct scsi_disk *sdkp = to_scsi_disk(cdev);
+
+        return snprintf(buf, 40, "%d\n", sdkp->device->allow_restart);
+}
+
 static struct class_device_attribute sd_disk_attrs[] = {
         __ATTR(cache_type, S_IRUGO|S_IWUSR, sd_show_cache_type,
                sd_store_cache_type),
         __ATTR(FUA, S_IRUGO, sd_show_fua, NULL),
+        __ATTR(allow_restart, S_IRUGO|S_IWUSR, sd_show_allow_restart,
+               sd_store_allow_restart),
         __ATTR_NULL,
 };
 
@@ -476,8 +502,7 @@ static int sd_init_command(struct scsi_cmnd * SCpnt)
                 SCpnt->cmnd[4] = (unsigned char) this_count;
                 SCpnt->cmnd[5] = 0;
         }
-        SCpnt->request_bufflen = SCpnt->bufflen =
-                        this_count * sdp->sector_size;
+        SCpnt->request_bufflen = this_count * sdp->sector_size;
 
         /*
          * We shouldn't disconnect in the middle of a sector, so with a dumb
@@ -890,11 +915,10 @@ static struct block_device_operations sd_fops = {
 static void sd_rw_intr(struct scsi_cmnd * SCpnt)
 {
         int result = SCpnt->result;
-        int this_count = SCpnt->request_bufflen;
-        int good_bytes = (result == 0 ? this_count : 0);
-        sector_t block_sectors = 1;
-        u64 first_err_block;
-        sector_t error_sector;
+        unsigned int xfer_size = SCpnt->request_bufflen;
+        unsigned int good_bytes = result ? 0 : xfer_size;
+        u64 start_lba = SCpnt->request->sector;
+        u64 bad_lba;
         struct scsi_sense_hdr sshdr;
         int sense_valid = 0;
         int sense_deferred = 0;
@@ -905,7 +929,6 @@ static void sd_rw_intr(struct scsi_cmnd * SCpnt)
                 if (sense_valid)
                         sense_deferred = scsi_sense_is_deferred(&sshdr);
         }
-
 #ifdef CONFIG_SCSI_LOGGING
         SCSI_LOG_HLCOMPLETE(1, printk("sd_rw_intr: %s: res=0x%x\n", 
                                 SCpnt->request->rq_disk->disk_name, result));
@@ -915,89 +938,72 @@ static void sd_rw_intr(struct scsi_cmnd * SCpnt)
                                 sshdr.sense_key, sshdr.asc, sshdr.ascq));
         }
 #endif
-        /*
-           Handle MEDIUM ERRORs that indicate partial success.  Since this is a
-           relatively rare error condition, no care is taken to avoid
-           unnecessary additional work such as memcpy's that could be avoided.
-         */
-        if (driver_byte(result) != 0 &&
-                 sense_valid && !sense_deferred) {
-                switch (sshdr.sense_key) {
-                case MEDIUM_ERROR:
-                        if (!blk_fs_request(SCpnt->request))
-                                break;
-                        info_valid = scsi_get_sense_info_fld(
-                                SCpnt->sense_buffer, SCSI_SENSE_BUFFERSIZE,
-                                &first_err_block);
-                        /*
-                         * May want to warn and skip if following cast results
-                         * in actual truncation (if sector_t < 64 bits)
-                         */
-                        error_sector = (sector_t)first_err_block;
-                        if (SCpnt->request->bio != NULL)
-                                block_sectors = bio_sectors(SCpnt->request->bio);
-                        switch (SCpnt->device->sector_size) {
-                        case 1024:
-                                error_sector <<= 1;
-                                if (block_sectors < 2)
-                                        block_sectors = 2;
-                                break;
-                        case 2048:
-                                error_sector <<= 2;
-                                if (block_sectors < 4)
-                                        block_sectors = 4;
-                                break;
-                        case 4096:
-                                error_sector <<=3;
-                                if (block_sectors < 8)
-                                        block_sectors = 8;
-                                break;
-                        case 256:
-                                error_sector >>= 1;
-                                break;
-                        default:
-                                break;
-                        }
+        if (driver_byte(result) != DRIVER_SENSE &&
+            (!sense_valid || sense_deferred))
+                goto out;
 
-                        error_sector &= ~(block_sectors - 1);
-                        good_bytes = (error_sector - SCpnt->request->sector) << 9;
-                        if (good_bytes < 0 || good_bytes >= this_count)
-                                good_bytes = 0;
+        switch (sshdr.sense_key) {
+        case HARDWARE_ERROR:
+        case MEDIUM_ERROR:
+                if (!blk_fs_request(SCpnt->request))
+                        goto out;
+                info_valid = scsi_get_sense_info_fld(SCpnt->sense_buffer,
+                                                     SCSI_SENSE_BUFFERSIZE,
+                                                     &bad_lba);
+                if (!info_valid)
+                        goto out;
+                if (xfer_size <= SCpnt->device->sector_size)
+                        goto out;
+                switch (SCpnt->device->sector_size) {
+                case 256:
+                        start_lba <<= 1;
                         break;
-
-                case RECOVERED_ERROR: /* an error occurred, but it recovered */
-                case NO_SENSE: /* LLDD got sense data */
-                        /*
-                         * Inform the user, but make sure that it's not treated
-                         * as a hard error.
-                         */
-                        scsi_print_sense("sd", SCpnt);
-                        SCpnt->result = 0;
-                        memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
-                        good_bytes = this_count;
+                case 512:
                         break;
-
-                case ILLEGAL_REQUEST:
-                        if (SCpnt->device->use_10_for_rw &&
-                            (SCpnt->cmnd[0] == READ_10 ||
-                             SCpnt->cmnd[0] == WRITE_10))
-                                SCpnt->device->use_10_for_rw = 0;
-                        if (SCpnt->device->use_10_for_ms &&
-                            (SCpnt->cmnd[0] == MODE_SENSE_10 ||
-                             SCpnt->cmnd[0] == MODE_SELECT_10))
-                                SCpnt->device->use_10_for_ms = 0;
+                case 1024:
+                        start_lba >>= 1;
+                        break;
+                case 2048:
+                        start_lba >>= 2;
+                        break;
+                case 4096:
+                        start_lba >>= 3;
                         break;
-
                 default:
+                        /* Print something here with limiting frequency. */
+                        goto out;
                         break;
                 }
+                /* This computation should always be done in terms of
+                 * the resolution of the device's medium.
+                 */
+                good_bytes = (bad_lba - start_lba)*SCpnt->device->sector_size;
+                break;
+        case RECOVERED_ERROR:
+        case NO_SENSE:
+                /* Inform the user, but make sure that it's not treated
+                 * as a hard error.
+                 */
+                scsi_print_sense("sd", SCpnt);
+                SCpnt->result = 0;
+                memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                good_bytes = xfer_size;
+                break;
+        case ILLEGAL_REQUEST:
+                if (SCpnt->device->use_10_for_rw &&
+                    (SCpnt->cmnd[0] == READ_10 ||
+                     SCpnt->cmnd[0] == WRITE_10))
+                        SCpnt->device->use_10_for_rw = 0;
+                if (SCpnt->device->use_10_for_ms &&
+                    (SCpnt->cmnd[0] == MODE_SENSE_10 ||
+                     SCpnt->cmnd[0] == MODE_SELECT_10))
+                        SCpnt->device->use_10_for_ms = 0;
+                break;
+        default:
+                break;
         }
-        /*
-         * This calls the generic completion function, now that we know
-         * how many actual sectors finished, and how many sectors we need
-         * to say have failed.
-         */
-        scsi_io_completion(SCpnt, good_bytes, block_sectors << 9);
+ out:
+        scsi_io_completion(SCpnt, good_bytes);
 }
 
 static int media_not_present(struct scsi_disk *sdkp,
diff --git a/drivers/scsi/seagate.c b/drivers/scsi/seagate.c
index 3f312a84c6a7..2679ea8bff1a 100644
--- a/drivers/scsi/seagate.c
+++ b/drivers/scsi/seagate.c
@@ -1002,7 +1002,7 @@ connect_loop:
                         }
 #endif
 
-                        buffer = (struct scatterlist *) SCint->buffer;
+                        buffer = (struct scatterlist *) SCint->request_buffer;
                         len = buffer->length;
                         data = page_address(buffer->page) + buffer->offset;
                 } else {
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 4e607d3065bc..34f9343ed0af 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -18,8 +18,8 @@
  *
  */
 
-static int sg_version_num = 30533;      /* 2 digits for each component */
-#define SG_VERSION_STR "3.5.33"
+static int sg_version_num = 30534;      /* 2 digits for each component */
+#define SG_VERSION_STR "3.5.34"
 
 /*
  *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
@@ -60,7 +60,7 @@ static int sg_version_num = 30533;	/* 2 digits for each component */
 
 #ifdef CONFIG_SCSI_PROC_FS
 #include <linux/proc_fs.h>
-static char *sg_version_date = "20050908";
+static char *sg_version_date = "20060818";
 
 static int sg_proc_init(void);
 static void sg_proc_cleanup(void);
@@ -1164,7 +1164,7 @@ sg_vma_nopage(struct vm_area_struct *vma, unsigned long addr, int *type)
                 len = vma->vm_end - sa;
                 len = (len < sg->length) ? len : sg->length;
                 if (offset < len) {
-                        page = sg->page;
+                        page = virt_to_page(page_address(sg->page) + offset);
                         get_page(page); /* increment page count */
                         break;
                 }
@@ -1401,6 +1401,7 @@ sg_add(struct class_device *cl_dev, struct class_interface *cl_intf)
         Sg_device *sdp = NULL;
         struct cdev * cdev = NULL;
         int error, k;
+        unsigned long iflags;
 
         disk = alloc_disk(1);
         if (!disk) {
@@ -1428,7 +1429,7 @@ sg_add(struct class_device *cl_dev, struct class_interface *cl_intf)
 
         error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, k), 1);
         if (error)
-                goto out;
+                goto cdev_add_err;
 
         sdp->cdev = cdev;
         if (sg_sysfs_valid) {
@@ -1455,6 +1456,13 @@ sg_add(struct class_device *cl_dev, struct class_interface *cl_intf)
 
         return 0;
 
+cdev_add_err:
+        write_lock_irqsave(&sg_dev_arr_lock, iflags);
+        kfree(sg_dev_arr[k]);
+        sg_dev_arr[k] = NULL;
+        sg_nr_dev--;
+        write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
+
 out:
         put_disk(disk);
         if (cdev)
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index ebf6579ed698..fae6e95a6298 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -292,7 +292,7 @@ static void rw_intr(struct scsi_cmnd * SCpnt)
          * how many actual sectors finished, and how many sectors we need
          * to say have failed.
          */
-        scsi_io_completion(SCpnt, good_bytes, block_sectors << 9);
+        scsi_io_completion(SCpnt, good_bytes);
 }
 
 static int sr_init_command(struct scsi_cmnd * SCpnt)
@@ -360,7 +360,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
                                 "mismatch count %d, bytes %d\n",
                                 size, SCpnt->request_bufflen);
                         if (SCpnt->request_bufflen > size)
-                                SCpnt->request_bufflen = SCpnt->bufflen = size;
+                                SCpnt->request_bufflen = size;
                 }
         }
 
@@ -387,8 +387,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
 
         if (this_count > 0xffff) {
                 this_count = 0xffff;
-                SCpnt->request_bufflen = SCpnt->bufflen =
-                                this_count * s_size;
+                SCpnt->request_bufflen = this_count * s_size;
         }
 
         SCpnt->cmnd[2] = (unsigned char) (block >> 24) & 0xff;
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index b5218fc0ac86..7f669b600677 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -368,7 +368,7 @@ static int st_chk_result(struct scsi_tape *STp, struct st_request * SRpnt)
                        SRpnt->cmd[0], SRpnt->cmd[1], SRpnt->cmd[2],
                        SRpnt->cmd[3], SRpnt->cmd[4], SRpnt->cmd[5]);
                 if (cmdstatp->have_sense)
-                         __scsi_print_sense("st", SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
+                         __scsi_print_sense(name, SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
         } ) /* end DEB */
         if (!debugging) { /* Abnormal conditions for tape */
                 if (!cmdstatp->have_sense)
@@ -384,9 +384,8 @@ static int st_chk_result(struct scsi_tape *STp, struct st_request * SRpnt)
                          scode != VOLUME_OVERFLOW &&
                          SRpnt->cmd[0] != MODE_SENSE &&
                          SRpnt->cmd[0] != TEST_UNIT_READY) {
-                                printk(KERN_WARNING "%s: Error with sense data: ", name);
-                                __scsi_print_sense("st", SRpnt->sense,
-                                                   SCSI_SENSE_BUFFERSIZE);
+
+                        __scsi_print_sense(name, SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
                 }
         }
 
@@ -3599,7 +3598,6 @@ static struct st_buffer *
         tb->use_sg = max_sg;
         tb->frp = (struct st_buf_fragment *)(&(tb->sg[0]) + max_sg);
 
-        tb->in_use = 1;
         tb->dma = need_dma;
         tb->buffer_size = got;
 
diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h
index 411209048d74..05a5cae126ec 100644
--- a/drivers/scsi/st.h
+++ b/drivers/scsi/st.h
@@ -31,7 +31,6 @@ struct st_request {
 
 /* The tape buffer descriptor. */
 struct st_buffer {
-        unsigned char in_use;
         unsigned char dma;      /* DMA-able buffer */
         unsigned char do_dio;   /* direct i/o set up? */
         int buffer_size;
diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
index 2ebe0d663899..2f8073b73bf3 100644
--- a/drivers/scsi/sun3_NCR5380.c
+++ b/drivers/scsi/sun3_NCR5380.c
@@ -517,7 +517,7 @@ static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
      */
 
     if (cmd->use_sg) {
-        cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+        cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
         cmd->SCp.buffers_residual = cmd->use_sg - 1;
         cmd->SCp.ptr = (char *) SGADDR(cmd->SCp.buffer);
         cmd->SCp.this_residual = cmd->SCp.buffer->length;
diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
index 1f328cae5c05..6b60536ac92b 100644
--- a/drivers/scsi/sun3x_esp.c
+++ b/drivers/scsi/sun3x_esp.c
@@ -347,7 +347,7 @@ static void dma_mmu_release_scsi_one (struct NCR_ESP *esp, Scsi_Cmnd *sp)
 static void dma_mmu_release_scsi_sgl (struct NCR_ESP *esp, Scsi_Cmnd *sp)
 {
     int sz = sp->use_sg - 1;
-    struct scatterlist *sg = (struct scatterlist *)sp->buffer;
+    struct scatterlist *sg = (struct scatterlist *)sp->request_buffer;
                         
     while(sz >= 0) {
         dvma_unmap((char *)sg[sz].dma_address);
diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
index 8c505076c0eb..739d3ef46a40 100644
--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
@@ -2084,7 +2084,7 @@ static struct pci_device_id sym2_id_table[] __devinitdata = {
         { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_NCR_53C860,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
         { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_53C1510,
-          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+          PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_SCSI<<8,  0xffff00, 0UL },
         { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_NCR_53C896,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
         { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_NCR_53C895,
diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
index 680f38ab60d8..2083454db511 100644
--- a/drivers/scsi/wd33c93.c
+++ b/drivers/scsi/wd33c93.c
@@ -373,7 +373,7 @@ wd33c93_queuecommand(struct scsi_cmnd *cmd,
  */
 
         if (cmd->use_sg) {
-                cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+                cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
                 cmd->SCp.buffers_residual = cmd->use_sg - 1;
                 cmd->SCp.ptr = page_address(cmd->SCp.buffer->page) +
                     cmd->SCp.buffer->offset;
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 0995430e4cf1..0ae9ced00ed4 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -299,6 +299,7 @@ static inline int map_8250_out_reg(struct uart_8250_port *up, int offset)
 
 static unsigned int serial_in(struct uart_8250_port *up, int offset)
 {
+        unsigned int tmp;
         offset = map_8250_in_reg(up, offset) << up->port.regshift;
 
         switch (up->port.iotype) {
@@ -317,6 +318,13 @@ static unsigned int serial_in(struct uart_8250_port *up, int offset)
                 return __raw_readl(up->port.membase + offset);
 #endif
 
+        case UPIO_TSI:
+                if (offset == UART_IIR) {
+                        tmp = readl((u32 *)(up->port.membase + UART_RX));
+                        return (cpu_to_le32(tmp) >> 8) & 0xff;
+                } else
+                        return readb(up->port.membase + offset);
+
         default:
                 return inb(up->port.iobase + offset);
         }
@@ -346,6 +354,10 @@ serial_out(struct uart_8250_port *up, int offset, int value)
                 __raw_writel(value, up->port.membase + offset);
                 break;
 #endif
+        case UPIO_TSI:
+                if (!((offset == UART_IER) && (value & UART_IER_UUE)))
+                        writeb(value, up->port.membase + offset);
+                break;
 
         default:
                 outb(value, up->port.iobase + offset);
@@ -2240,10 +2252,14 @@ serial8250_console_write(struct console *co, const char *s, unsigned int count)
 
         touch_nmi_watchdog();
 
-        if (oops_in_progress) {
-                locked = spin_trylock_irqsave(&up->port.lock, flags);
+        local_irq_save(flags);
+        if (up->port.sysrq) {
+                /* serial8250_handle_port() already took the lock */
+                locked = 0;
+        } else if (oops_in_progress) {
+                locked = spin_trylock(&up->port.lock);
         } else
-                spin_lock_irqsave(&up->port.lock, flags);
+                spin_lock(&up->port.lock);
 
         /*
          *      First save the IER then disable the interrupts
@@ -2265,7 +2281,8 @@ serial8250_console_write(struct console *co, const char *s, unsigned int count)
         serial_out(up, UART_IER, ier);
 
         if (locked)
-                spin_unlock_irqrestore(&up->port.lock, flags);
+                spin_unlock(&up->port.lock);
+        local_irq_restore(flags);
 }
 
 static int serial8250_console_setup(struct console *co, char *options)
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 864ef859be56..851e4839d6d9 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -134,7 +134,7 @@ afavlab_setup(struct serial_private *priv, struct pciserial_board *board,
  * and Keystone have one Diva chip with 3 UARTs.  Some later machines have
  * one Diva chip, but it has been expanded to 5 UARTs.
  */
-static int __devinit pci_hp_diva_init(struct pci_dev *dev)
+static int pci_hp_diva_init(struct pci_dev *dev)
 {
         int rc = 0;
 
@@ -194,7 +194,7 @@ pci_hp_diva_setup(struct serial_private *priv, struct pciserial_board *board,
 /*
  * Added for EKF Intel i960 serial boards
  */
-static int __devinit pci_inteli960ni_init(struct pci_dev *dev)
+static int pci_inteli960ni_init(struct pci_dev *dev)
 {
         unsigned long oldval;
 
@@ -216,7 +216,7 @@ static int __devinit pci_inteli960ni_init(struct pci_dev *dev)
  * seems to be mainly needed on card using the PLX which also use I/O
  * mapped memory.
  */
-static int __devinit pci_plx9050_init(struct pci_dev *dev)
+static int pci_plx9050_init(struct pci_dev *dev)
 {
         u8 irq_config;
         void __iomem *p;
@@ -314,7 +314,7 @@ sbs_setup(struct serial_private *priv, struct pciserial_board *board,
 /* global control register offset for SBS PMC-OctalPro */
 #define OCT_REG_CR_OFF          0x500
 
-static int __devinit sbs_init(struct pci_dev *dev)
+static int sbs_init(struct pci_dev *dev)
 {
         u8 __iomem *p;
 
@@ -458,11 +458,11 @@ static int pci_siig_setup(struct serial_private *priv,
  * growing *huge*, we use this function to collapse some 70 entries
  * in the PCI table into one, for sanity's and compactness's sake.
  */
-static unsigned short timedia_single_port[] = {
+static const unsigned short timedia_single_port[] = {
         0x4025, 0x4027, 0x4028, 0x5025, 0x5027, 0
 };
 
-static unsigned short timedia_dual_port[] = {
+static const unsigned short timedia_dual_port[] = {
         0x0002, 0x4036, 0x4037, 0x4038, 0x4078, 0x4079, 0x4085,
         0x4088, 0x4089, 0x5037, 0x5078, 0x5079, 0x5085, 0x6079, 
         0x7079, 0x8079, 0x8137, 0x8138, 0x8237, 0x8238, 0x9079, 
@@ -470,35 +470,34 @@ static unsigned short timedia_dual_port[] = {
         0xD079, 0
 };
 
-static unsigned short timedia_quad_port[] = {
+static const unsigned short timedia_quad_port[] = {
         0x4055, 0x4056, 0x4095, 0x4096, 0x5056, 0x8156, 0x8157, 
         0x8256, 0x8257, 0x9056, 0x9156, 0x9157, 0x9158, 0x9159, 
         0x9256, 0x9257, 0xA056, 0xA157, 0xA158, 0xA159, 0xB056,
         0xB157, 0
 };
 
-static unsigned short timedia_eight_port[] = {
+static const unsigned short timedia_eight_port[] = {
         0x4065, 0x4066, 0x5065, 0x5066, 0x8166, 0x9066, 0x9166, 
         0x9167, 0x9168, 0xA066, 0xA167, 0xA168, 0
 };
 
 static const struct timedia_struct {
         int num;
-        unsigned short *ids;
+        const unsigned short *ids;
 } timedia_data[] = {
         { 1, timedia_single_port },
         { 2, timedia_dual_port },
         { 4, timedia_quad_port },
-        { 8, timedia_eight_port },
-        { 0, NULL }
+        { 8, timedia_eight_port }
 };
 
-static int __devinit pci_timedia_init(struct pci_dev *dev)
+static int pci_timedia_init(struct pci_dev *dev)
 {
-        unsigned short *ids;
+        const unsigned short *ids;
         int i, j;
 
-        for (i = 0; timedia_data[i].num; i++) {
+        for (i = 0; i < ARRAY_SIZE(timedia_data); i++) {
                 ids = timedia_data[i].ids;
                 for (j = 0; ids[j]; j++)
                         if (dev->subsystem_device == ids[j])
@@ -566,13 +565,13 @@ titan_400l_800l_setup(struct serial_private *priv,
         return setup_port(priv, port, bar, offset, board->reg_shift);
 }
 
-static int __devinit pci_xircom_init(struct pci_dev *dev)
+static int pci_xircom_init(struct pci_dev *dev)
 {
         msleep(100);
         return 0;
 }
 
-static int __devinit pci_netmos_init(struct pci_dev *dev)
+static int pci_netmos_init(struct pci_dev *dev)
 {
         /* subdevice 0x00PS means <P> parallel, <S> serial */
         unsigned int num_serial = dev->subsystem_device & 0xf;
@@ -622,7 +621,7 @@ pci_default_setup(struct serial_private *priv, struct pciserial_board *board,
  */
 static struct pci_serial_quirk pci_serial_quirks[] = {
         /*
-         * AFAVLAB cards.
+         * AFAVLAB cards - these may be called via parport_serial
          *  It is not clear whether this applies to all products.
          */
         {
@@ -754,7 +753,7 @@ static struct pci_serial_quirk pci_serial_quirks[] = {
                 .exit           = __devexit_p(sbs_exit),
         },
         /*
-         * SIIG cards.
+         * SIIG cards - these may be called via parport_serial
          */
         {
                 .vendor         = PCI_VENDOR_ID_SIIG,
@@ -811,7 +810,7 @@ static struct pci_serial_quirk pci_serial_quirks[] = {
                 .setup          = pci_default_setup,
         },
         /*
-         * Netmos cards
+         * Netmos cards - these may be called via parport_serial
          */
         {
                 .vendor         = PCI_VENDOR_ID_NETMOS,
@@ -936,6 +935,7 @@ enum pci_board_num_t {
         pbn_b1_8_1382400,
 
         pbn_b2_1_115200,
+        pbn_b2_2_115200,
         pbn_b2_8_115200,
 
         pbn_b2_1_460800,
@@ -1243,6 +1243,12 @@ static struct pciserial_board pci_boards[] __devinitdata = {
                 .base_baud      = 115200,
                 .uart_offset    = 8,
         },
+        [pbn_b2_2_115200] = {
+                .flags          = FL_BASE2,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+        },
         [pbn_b2_8_115200] = {
                 .flags          = FL_BASE2,
                 .num_ports      = 8,
@@ -2340,6 +2346,13 @@ static struct pci_device_id serial_pci_tbl[] = {
                 pbn_b0_1_115200 },
 
         /*
+         * IntaShield IS-200
+         */
+        {       PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS200,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,   /* 135a.0811 */
+                pbn_b2_2_115200 },
+
+        /*
          * These entries match devices with class COMMUNICATION_SERIAL,
          * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
          */
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index 739bc84f91e9..632f62d6ec7e 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -431,6 +431,8 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
 #endif
 
         port.flags |= UPF_SKIP_TEST | UPF_BOOT_AUTOCONF;
+        if (pnp_irq_flags(dev, 0) & IORESOURCE_IRQ_SHAREABLE)
+                port.flags |= UPF_SHARE_IRQ;
         port.uartclk = 1843200;
         port.dev = &dev->dev;
 
diff --git a/drivers/serial/at91_serial.c b/drivers/serial/at91_serial.c
index a7d664383dae..54c6b2adf7b7 100644
--- a/drivers/serial/at91_serial.c
+++ b/drivers/serial/at91_serial.c
@@ -41,6 +41,7 @@
 #include <asm/mach/serial_at91.h>
 #include <asm/arch/board.h>
 #include <asm/arch/system.h>
+#include <asm/arch/gpio.h>
 
 #if defined(CONFIG_SERIAL_AT91_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
 #define SUPPORT_SYSRQ
@@ -140,9 +141,9 @@ static void at91_set_mctrl(struct uart_port *port, u_int mctrl)
                  */
                 if (port->mapbase == AT91_BASE_US0) {
                         if (mctrl & TIOCM_RTS)
-                                at91_sys_write(AT91_PIOA + PIO_CODR, AT91_PA21_RTS0);
+                                at91_set_gpio_value(AT91_PIN_PA21, 0);
                         else
-                                at91_sys_write(AT91_PIOA + PIO_SODR, AT91_PA21_RTS0);
+                                at91_set_gpio_value(AT91_PIN_PA21, 1);
                 }
         }
 
diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
index d119c8296a78..8a98aae80e22 100644
--- a/drivers/serial/dz.c
+++ b/drivers/serial/dz.c
@@ -673,7 +673,7 @@ static void dz_reset(struct dz_port *dport)
 }
 
 #ifdef CONFIG_SERIAL_DZ_CONSOLE
-static void dz_console_putchar(struct uart_port *port, int ch)
+static void dz_console_putchar(struct uart_port *uport, int ch)
 {
         struct dz_port *dport = (struct dz_port *)uport;
         unsigned long flags;
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index 342042889f6e..5ff269fb604c 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -1143,9 +1143,8 @@ static void __init ip22zilog_prepare(void)
                 up[(chip * 2) + 1].port.fifosize = 1;
                 up[(chip * 2) + 1].port.ops = &ip22zilog_pops;
                 up[(chip * 2) + 1].port.type = PORT_IP22ZILOG;
-                up[(chip * 2) + 1].port.flags |= IP22ZILOG_FLAG_IS_CHANNEL_A;
                 up[(chip * 2) + 1].port.line = (chip * 2) + 1;
-                up[(chip * 2) + 1].flags = 0;
+                up[(chip * 2) + 1].flags |= IP22ZILOG_FLAG_IS_CHANNEL_A;
         }
 }
 
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 48eb22d3a63e..7708e5dd3656 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -726,8 +726,7 @@ mpc52xx_uart_probe(struct platform_device *dev)
 
         spin_lock_init(&port->lock);
         port->uartclk   = __res.bi_ipbfreq / 2; /* Look at CTLR doc */
-        port->fifosize  = 255; /* Should be 512 ! But it can't be */
-                               /* stored in a unsigned char       */
+        port->fifosize  = 512;
         port->iotype    = UPIO_MEM;
         port->flags     = UPF_BOOT_AUTOCONF |
                           ( uart_console(port) ? 0 : UPF_IOREMAP );
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 459c0231aef3..bfd2a22759eb 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -1443,8 +1443,8 @@ static int __init pmz_init_port(struct uart_pmac_port *uap)
                         uap->flags &= ~PMACZILOG_FLAG_HAS_DMA;
                         goto no_dma;
                 }
-                uap->tx_dma_irq = np->intrs[1].line;
-                uap->rx_dma_irq = np->intrs[2].line;
+                uap->tx_dma_irq = irq_of_parse_and_map(np, 1);
+                uap->rx_dma_irq = irq_of_parse_and_map(np, 2);
         }
 no_dma:
 
@@ -1491,7 +1491,7 @@ no_dma:
          * Init remaining bits of "port" structure
          */
         uap->port.iotype = UPIO_MEM;
-        uap->port.irq = np->intrs[0].line;
+        uap->port.irq = irq_of_parse_and_map(np, 0);
         uap->port.uartclk = ZS_CLOCK;
         uap->port.fifosize = 1;
         uap->port.ops = &pmz_pops;
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index c54af8774393..372e47f7d596 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -49,6 +49,12 @@
  */
 static DEFINE_MUTEX(port_mutex);
 
+/*
+ * lockdep: port->lock is initialized in two places, but we
+ *          want only one lock-class:
+ */
+static struct lock_class_key port_lock_key;
+
 #define HIGH_BITS_OFFSET        ((sizeof(long)-sizeof(int))*8)
 
 #define uart_users(state)       ((state)->count + ((state)->info ? (state)->info->blocked_open : 0))
@@ -690,7 +696,8 @@ static int uart_set_info(struct uart_state *state,
                     (new_serial.baud_base != port->uartclk / 16) ||
                     (close_delay != state->close_delay) ||
                     (closing_wait != state->closing_wait) ||
-                    (new_serial.xmit_fifo_size != port->fifosize) ||
+                    (new_serial.xmit_fifo_size &&
+                     new_serial.xmit_fifo_size != port->fifosize) ||
                     (((new_flags ^ old_flags) & ~UPF_USR_MASK) != 0))
                         goto exit;
                 port->flags = ((port->flags & ~UPF_USR_MASK) |
@@ -795,7 +802,8 @@ static int uart_set_info(struct uart_state *state,
         port->custom_divisor   = new_serial.custom_divisor;
         state->close_delay     = close_delay;
         state->closing_wait    = closing_wait;
-        port->fifosize         = new_serial.xmit_fifo_size;
+        if (new_serial.xmit_fifo_size)
+                port->fifosize = new_serial.xmit_fifo_size;
         if (state->info->tty)
                 state->info->tty->low_latency =
                         (port->flags & UPF_LOW_LATENCY) ? 1 : 0;
@@ -1865,6 +1873,7 @@ uart_set_options(struct uart_port *port, struct console *co,
          * early.
          */
         spin_lock_init(&port->lock);
+        lockdep_set_class(&port->lock, &port_lock_key);
 
         memset(&termios, 0, sizeof(struct termios));
 
@@ -2027,6 +2036,7 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
         case UPIO_MEM:
         case UPIO_MEM32:
         case UPIO_AU:
+        case UPIO_TSI:
                 snprintf(address, sizeof(address),
                          "MMIO 0x%lx", port->mapbase);
                 break;
@@ -2247,8 +2257,10 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *port)
          * If this port is a console, then the spinlock is already
          * initialised.
          */
-        if (!(uart_console(port) && (port->cons->flags & CON_ENABLED)))
+        if (!(uart_console(port) && (port->cons->flags & CON_ENABLED))) {
                 spin_lock_init(&port->lock);
+                lockdep_set_class(&port->lock, &port_lock_key);
+        }
 
         uart_configure_port(drv, state, port);
 
@@ -2365,6 +2377,9 @@ int uart_match_port(struct uart_port *port1, struct uart_port *port2)
                 return (port1->iobase == port2->iobase) &&
                        (port1->hub6   == port2->hub6);
         case UPIO_MEM:
+        case UPIO_MEM32:
+        case UPIO_AU:
+        case UPIO_TSI:
                 return (port1->mapbase == port2->mapbase);
         }
         return 0;
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 301573373c30..cbede06cac27 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -1579,7 +1579,7 @@ static int __init serial_console_setup(struct console *co, char *options)
         h8300_sci_enable(port, sci_enable);
 #endif
 #elif defined(CONFIG_SUPERH64)
-        port->uartclk = current_cpu_info.module_clock * 16;
+        port->uartclk = current_cpu_data.module_clock * 16;
 #else
         {
                 struct clk *clk = clk_get("module_clk");
@@ -1720,7 +1720,7 @@ static int __init sci_init(void)
 #if defined(__H8300H__) || defined(__H8300S__)
                         sciport->port.uartclk = CONFIG_CPU_CLOCK;
 #elif defined(CONFIG_SUPERH64)
-                        sciport->port.uartclk = current_cpu_info.module_clock * 16;
+                        sciport->port.uartclk = current_cpu_data.module_clock * 16;
 #else
                         struct clk *clk = clk_get("module_clk");
                         sciport->port.uartclk = clk_get_rate(clk) * 16;
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 0dbd4df44c05..cfe20f730436 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -886,6 +886,15 @@ static int sunsab_console_setup(struct console *con, char *options)
         unsigned long flags;
         unsigned int baud, quot;
 
+        /*
+         * The console framework calls us for each and every port
+         * registered. Defer the console setup until the requested
+         * port has been properly discovered. A bit of a hack,
+         * though...
+         */
+        if (up->port.type != PORT_SUNSAB)
+                return -1;
+
         printk("Console: ttyS%d (SAB82532)\n",
                (sunsab_reg.minor - 64) + con->index);
 
@@ -1047,12 +1056,13 @@ static int __devinit sab_probe(struct of_device *op, const struct of_device_id *
         up = &sunsab_ports[inst * 2];
 
         err = sunsab_init_one(&up[0], op,
-                              sizeof(union sab82532_async_regs),
+                              0,
                               (inst * 2) + 0);
         if (err)
                 return err;
 
-        err = sunsab_init_one(&up[0], op, 0,
+        err = sunsab_init_one(&up[1], op,
+                              sizeof(union sab82532_async_regs),
                               (inst * 2) + 1);
         if (err) {
                 of_iounmap(up[0].port.membase,
@@ -1117,7 +1127,7 @@ static int __init sunsab_init(void)
         int err;
 
         num_channels = 0;
-        for_each_node_by_name(dp, "su")
+        for_each_node_by_name(dp, "se")
                 num_channels += 2;
         for_each_node_by_name(dp, "serial") {
                 if (of_device_is_compatible(dp, "sab82532"))
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index f9013baba05b..d3a5aeee73a3 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1200,6 +1200,11 @@ static int __init sunsu_kbd_ms_init(struct uart_sunsu_port *up)
         if (up->port.type == PORT_UNKNOWN)
                 return -ENODEV;
 
+        printk("%s: %s port at %lx, irq %u\n",
+               to_of_device(up->port.dev)->node->full_name,
+               (up->su_type == SU_PORT_KBD) ? "Keyboard" : "Mouse",
+               up->port.mapbase, up->port.irq);
+
 #ifdef CONFIG_SERIO
         serio = &up->serio;
         serio->port_data = up;
@@ -1406,25 +1411,35 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
         struct device_node *dp = op->node;
         struct uart_sunsu_port *up;
         struct resource *rp;
+        enum su_type type;
         int err;
 
-        if (inst >= UART_NR)
-                return -EINVAL;
+        type = su_get_type(dp);
+        if (type == SU_PORT_PORT) {
+                if (inst >= UART_NR)
+                        return -EINVAL;
+                up = &sunsu_ports[inst];
+        } else {
+                up = kzalloc(sizeof(*up), GFP_KERNEL);
+                if (!up)
+                        return -ENOMEM;
+        }
 
-        up = &sunsu_ports[inst];
         up->port.line = inst;
 
         spin_lock_init(&up->port.lock);
 
-        up->su_type = su_get_type(dp);
+        up->su_type = type;
 
         rp = &op->resource[0];
-        up->port.mapbase = op->resource[0].start;
-
+        up->port.mapbase = rp->start;
         up->reg_size = (rp->end - rp->start) + 1;
         up->port.membase = of_ioremap(rp, 0, up->reg_size, "su");
-        if (!up->port.membase)
+        if (!up->port.membase) {
+                if (type != SU_PORT_PORT)
+                        kfree(up);
                 return -ENOMEM;
+        }
 
         up->port.irq = op->irqs[0];
 
@@ -1436,8 +1451,11 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
         err = 0;
         if (up->su_type == SU_PORT_KBD || up->su_type == SU_PORT_MS) {
                 err = sunsu_kbd_ms_init(up);
-                if (err)
+                if (err) {
+                        kfree(up);
                         goto out_unmap;
+                }
+                dev_set_drvdata(&op->dev, up);
 
                 return 0;
         }
@@ -1476,8 +1494,12 @@ static int __devexit su_remove(struct of_device *dev)
 #ifdef CONFIG_SERIO
                 serio_unregister_port(&up->serio);
 #endif
-        } else if (up->port.type != PORT_UNKNOWN)
+                kfree(up);
+        } else if (up->port.type != PORT_UNKNOWN) {
                 uart_remove_one_port(&sunsu_reg, &up->port);
+        }
+
+        dev_set_drvdata(&dev->dev, NULL);
 
         return 0;
 }
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index a1456d9352cb..d34f336d53d8 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -68,9 +68,6 @@ static int num_sunzilog;
 #define NUM_SUNZILOG    num_sunzilog
 #define NUM_CHANNELS    (NUM_SUNZILOG * 2)
 
-#define KEYBOARD_LINE 0x2
-#define MOUSE_LINE    0x3
-
 #define ZS_CLOCK                4915200 /* Zilog input clock rate. */
 #define ZS_CLOCK_DIVISOR        16      /* Divisor this driver uses. */
 
@@ -1149,6 +1146,9 @@ static int __init sunzilog_console_setup(struct console *con, char *options)
         unsigned long flags;
         int baud, brg;
 
+        if (up->port.type != PORT_SUNZILOG)
+                return -1;
+
         printk(KERN_INFO "Console: ttyS%d (SunZilog zs%d)\n",
                (sunzilog_reg.minor - 64) + con->index, con->index);
 
@@ -1225,12 +1225,10 @@ static void __init sunzilog_init_kbdms(struct uart_sunzilog_port *up, int channe
 {
         int baud, brg;
 
-        if (channel == KEYBOARD_LINE) {
-                up->flags |= SUNZILOG_FLAG_CONS_KEYB;
+        if (up->flags & SUNZILOG_FLAG_CONS_KEYB) {
                 up->cflag = B1200 | CS8 | CLOCAL | CREAD;
                 baud = 1200;
         } else {
-                up->flags |= SUNZILOG_FLAG_CONS_MOUSE;
                 up->cflag = B4800 | CS8 | CLOCAL | CREAD;
                 baud = 4800;
         }
@@ -1243,14 +1241,14 @@ static void __init sunzilog_init_kbdms(struct uart_sunzilog_port *up, int channe
 }
 
 #ifdef CONFIG_SERIO
-static void __init sunzilog_register_serio(struct uart_sunzilog_port *up, int channel)
+static void __init sunzilog_register_serio(struct uart_sunzilog_port *up)
 {
         struct serio *serio = &up->serio;
 
         serio->port_data = up;
 
         serio->id.type = SERIO_RS232;
-        if (channel == KEYBOARD_LINE) {
+        if (up->flags & SUNZILOG_FLAG_CONS_KEYB) {
                 serio->id.proto = SERIO_SUNKBD;
                 strlcpy(serio->name, "zskbd", sizeof(serio->name));
         } else {
@@ -1259,7 +1257,8 @@ static void __init sunzilog_register_serio(struct uart_sunzilog_port *up, int ch
                 strlcpy(serio->name, "zsms", sizeof(serio->name));
         }
         strlcpy(serio->phys,
-                (channel == KEYBOARD_LINE ? "zs/serio0" : "zs/serio1"),
+                ((up->flags & SUNZILOG_FLAG_CONS_KEYB) ?
+                 "zs/serio0" : "zs/serio1"),
                 sizeof(serio->phys));
 
         serio->write = sunzilog_serio_write;
@@ -1286,8 +1285,8 @@ static void __init sunzilog_init_hw(struct uart_sunzilog_port *up)
                 (void) read_zsreg(channel, R0);
         }
 
-        if (up->port.line == KEYBOARD_LINE ||
-            up->port.line == MOUSE_LINE) {
+        if (up->flags & (SUNZILOG_FLAG_CONS_KEYB |
+                         SUNZILOG_FLAG_CONS_MOUSE)) {
                 sunzilog_init_kbdms(up, up->port.line);
                 up->curregs[R9] |= (NV | MIE);
                 write_zsreg(channel, R9, up->curregs[R9]);
@@ -1313,37 +1312,26 @@ static void __init sunzilog_init_hw(struct uart_sunzilog_port *up)
         spin_unlock_irqrestore(&up->port.lock, flags);
 
 #ifdef CONFIG_SERIO
-        if (up->port.line == KEYBOARD_LINE || up->port.line == MOUSE_LINE)
-                sunzilog_register_serio(up, up->port.line);
+        if (up->flags & (SUNZILOG_FLAG_CONS_KEYB |
+                         SUNZILOG_FLAG_CONS_MOUSE))
+                sunzilog_register_serio(up);
 #endif
 }
 
-static int __devinit zs_get_instance(struct device_node *dp)
-{
-        int ret;
-
-        ret = of_getintprop_default(dp, "slave", -1);
-        if (ret != -1)
-                return ret;
-
-        if (of_find_property(dp, "keyboard", NULL))
-                ret = 1;
-        else
-                ret = 0;
-
-        return ret;
-}
-
 static int zilog_irq = -1;
 
-static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *match)
+static int __devinit zs_probe(struct of_device *op, const struct of_device_id *match)
 {
-        struct of_device *op = to_of_device(&dev->dev);
+        static int inst;
         struct uart_sunzilog_port *up;
         struct zilog_layout __iomem *rp;
-        int inst = zs_get_instance(dev->node);
+        int keyboard_mouse;
         int err;
 
+        keyboard_mouse = 0;
+        if (of_find_property(op->node, "keyboard", NULL))
+                keyboard_mouse = 1;
+
         sunzilog_chip_regs[inst] = of_ioremap(&op->resource[0], 0,
                                               sizeof(struct zilog_layout),
                                               "zs");
@@ -1352,16 +1340,8 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
 
         rp = sunzilog_chip_regs[inst];
 
-        if (zilog_irq == -1) {
+        if (zilog_irq == -1)
                 zilog_irq = op->irqs[0];
-                err = request_irq(zilog_irq, sunzilog_interrupt, IRQF_SHARED,
-                                  "zs", sunzilog_irq_chain);
-                if (err) {
-                        of_iounmap(rp, sizeof(struct zilog_layout));
-
-                        return err;
-                }
-        }
 
         up = &sunzilog_port_table[inst * 2];
 
@@ -1378,7 +1358,7 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
         up[0].port.line = (inst * 2) + 0;
         up[0].port.dev = &op->dev;
         up[0].flags |= SUNZILOG_FLAG_IS_CHANNEL_A;
-        if (inst == 1)
+        if (keyboard_mouse)
                 up[0].flags |= SUNZILOG_FLAG_CONS_KEYB;
         sunzilog_init_hw(&up[0]);
 
@@ -1395,11 +1375,11 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
         up[1].port.line = (inst * 2) + 1;
         up[1].port.dev = &op->dev;
         up[1].flags |= 0;
-        if (inst == 1)
+        if (keyboard_mouse)
                 up[1].flags |= SUNZILOG_FLAG_CONS_MOUSE;
         sunzilog_init_hw(&up[1]);
 
-        if (inst != 1) {
+        if (!keyboard_mouse) {
                 err = uart_add_one_port(&sunzilog_reg, &up[0].port);
                 if (err) {
                         of_iounmap(rp, sizeof(struct zilog_layout));
@@ -1411,9 +1391,18 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
                         of_iounmap(rp, sizeof(struct zilog_layout));
                         return err;
                 }
+        } else {
+                printk(KERN_INFO "%s: Keyboard at MMIO %lx (irq = %d) "
+                       "is a zs\n",
+                       op->dev.bus_id, up[0].port.mapbase, op->irqs[0]);
+                printk(KERN_INFO "%s: Mouse at MMIO %lx (irq = %d) "
+                       "is a zs\n",
+                       op->dev.bus_id, up[1].port.mapbase, op->irqs[0]);
         }
 
-        dev_set_drvdata(&dev->dev, &up[0]);
+        dev_set_drvdata(&op->dev, &up[0]);
+
+        inst++;
 
         return 0;
 }
@@ -1462,36 +1451,65 @@ static struct of_platform_driver zs_driver = {
 static int __init sunzilog_init(void)
 {
         struct device_node *dp;
-        int err;
+        int err, uart_count;
+        int num_keybms;
 
         NUM_SUNZILOG = 0;
-        for_each_node_by_name(dp, "zs")
+        num_keybms = 0;
+        for_each_node_by_name(dp, "zs") {
                 NUM_SUNZILOG++;
+                if (of_find_property(dp, "keyboard", NULL))
+                        num_keybms++;
+        }
 
+        uart_count = 0;
         if (NUM_SUNZILOG) {
                 int uart_count;
 
                 err = sunzilog_alloc_tables();
                 if (err)
-                        return err;
+                        goto out;
 
-                /* Subtract 1 for keyboard, 1 for mouse.  */
-                uart_count = (NUM_SUNZILOG * 2) - 2;
+                uart_count = (NUM_SUNZILOG * 2) - (2 * num_keybms);
 
                 sunzilog_reg.nr = uart_count;
                 sunzilog_reg.minor = sunserial_current_minor;
                 err = uart_register_driver(&sunzilog_reg);
-                if (err) {
-                        sunzilog_free_tables();
-                        return err;
-                }
+                if (err)
+                        goto out_free_tables;
+
                 sunzilog_reg.tty_driver->name_base = sunzilog_reg.minor - 64;
                 sunzilog_reg.cons = SUNZILOG_CONSOLE();
 
                 sunserial_current_minor += uart_count;
         }
 
-        return of_register_driver(&zs_driver, &of_bus_type);
+        err = of_register_driver(&zs_driver, &of_bus_type);
+        if (err)
+                goto out_unregister_uart;
+
+        if (zilog_irq != -1) {
+                err = request_irq(zilog_irq, sunzilog_interrupt, IRQF_SHARED,
+                                  "zs", sunzilog_irq_chain);
+                if (err)
+                        goto out_unregister_driver;
+        }
+
+out:
+        return err;
+
+out_unregister_driver:
+        of_unregister_driver(&zs_driver);
+
+out_unregister_uart:
+        if (NUM_SUNZILOG) {
+                uart_unregister_driver(&sunzilog_reg);
+                sunzilog_reg.cons = NULL;
+        }
+
+out_free_tables:
+        sunzilog_free_tables();
+        goto out;
 }
 
 static void __exit sunzilog_exit(void)
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index e93d0edc2e08..6c8b0ea83c3c 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -38,6 +38,7 @@
 #include <linux/tty_flip.h>
 
 #include <asm/io.h>
+#include <asm/vr41xx/irq.h>
 #include <asm/vr41xx/siu.h>
 #include <asm/vr41xx/vr41xx.h>
 
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ed1cdf6ac8f3..146298ad7371 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -510,7 +510,7 @@ static void spi_complete(void *arg)
  */
 int spi_sync(struct spi_device *spi, struct spi_message *message)
 {
-        DECLARE_COMPLETION(done);
+        DECLARE_COMPLETION_ONSTACK(done);
         int status;
 
         message->complete = spi_complete;
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 7fdbc5dad5fd..005043197527 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -23,7 +23,8 @@ config USB_ARCH_HAS_OHCI
         default y if ARCH_LH7A404
         default y if ARCH_S3C2410
         default y if PXA27x
-        default y if ARCH_AT91RM9200
+        default y if ARCH_EP93XX
+        default y if (ARCH_AT91RM9200 || ARCH_AT91SAM9261)
         # PPC:
         default y if STB03xxx
         default y if PPC_MPC52xx
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index c7123bf71c58..4710eb02ed64 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -48,7 +48,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)        += serial/
 
 obj-$(CONFIG_USB_AUERSWALD)     += misc/
-obj-$(CONFIG_USB_CY7C63)        += misc/
+obj-$(CONFIG_USB_CYPRESS_CY7C63)+= misc/
 obj-$(CONFIG_USB_CYTHERM)       += misc/
 obj-$(CONFIG_USB_EMI26)         += misc/
 obj-$(CONFIG_USB_EMI62)         += misc/
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 3670d77e912c..ca90326f2f5c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -291,13 +291,13 @@ static void acm_read_bulk(struct urb *urb, struct pt_regs *regs)
         struct acm_ru *rcv = urb->context;
         struct acm *acm = rcv->instance;
         int status = urb->status;
-        dbg("Entering acm_read_bulk with status %d\n", urb->status);
+        dbg("Entering acm_read_bulk with status %d", urb->status);
 
         if (!ACM_READY(acm))
                 return;
 
         if (status)
-                dev_dbg(&acm->data->dev, "bulk rx status %d\n", status);
+                dev_dbg(&acm->data->dev, "bulk rx status %d", status);
 
         buf = rcv->buffer;
         buf->size = urb->actual_length;
@@ -343,7 +343,7 @@ next_buffer:
         list_del(&buf->list);
         spin_unlock(&acm->read_lock);
 
-        dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d\n", buf, buf->size);
+        dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d", buf, buf->size);
 
         tty_buffer_request_room(tty, buf->size);
         if (!acm->throttle)
@@ -394,7 +394,7 @@ urbs:
                 rcv->urb->transfer_dma = buf->dma;
                 rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
-                dbg("acm_rx_tasklet: sending urb 0x%p, rcv 0x%p, buf 0x%p\n", rcv->urb, rcv, buf);
+                dbg("acm_rx_tasklet: sending urb 0x%p, rcv 0x%p, buf 0x%p", rcv->urb, rcv, buf);
 
                 /* This shouldn't kill the driver as unsuccessful URBs are returned to the
                    free-urbs-pool and resubmited ASAP */
@@ -413,7 +413,7 @@ static void acm_write_bulk(struct urb *urb, struct pt_regs *regs)
 {
         struct acm *acm = (struct acm *)urb->context;
 
-        dbg("Entering acm_write_bulk with status %d\n", urb->status);
+        dbg("Entering acm_write_bulk with status %d", urb->status);
 
         acm_write_done(acm);
         acm_write_start(acm);
@@ -424,7 +424,7 @@ static void acm_write_bulk(struct urb *urb, struct pt_regs *regs)
 static void acm_softint(void *private)
 {
         struct acm *acm = private;
-        dbg("Entering acm_softint.\n");
+        dbg("Entering acm_softint.");
         
         if (!ACM_READY(acm))
                 return;
@@ -440,7 +440,7 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
         struct acm *acm;
         int rv = -EINVAL;
         int i;
-        dbg("Entering acm_tty_open.\n");
+        dbg("Entering acm_tty_open.");
 
         mutex_lock(&open_mutex);
 
@@ -541,7 +541,7 @@ static int acm_tty_write(struct tty_struct *tty, const unsigned char *buf, int c
         int wbn;
         struct acm_wb *wb;
 
-        dbg("Entering acm_tty_write to write %d bytes,\n", count);
+        dbg("Entering acm_tty_write to write %d bytes,", count);
 
         if (!ACM_READY(acm))
                 return -EINVAL;
@@ -793,7 +793,7 @@ static int acm_probe (struct usb_interface *intf,
 
         if (!buflen) {
                 if (intf->cur_altsetting->endpoint->extralen && intf->cur_altsetting->endpoint->extra) {
-                        dev_dbg(&intf->dev,"Seeking extra descriptors on endpoint\n");
+                        dev_dbg(&intf->dev,"Seeking extra descriptors on endpoint");
                         buflen = intf->cur_altsetting->endpoint->extralen;
                         buffer = intf->cur_altsetting->endpoint->extra;
                 } else {
@@ -842,24 +842,24 @@ next_desc:
 
         if (!union_header) {
                 if (call_interface_num > 0) {
-                        dev_dbg(&intf->dev,"No union descriptor, using call management descriptor\n");
+                        dev_dbg(&intf->dev,"No union descriptor, using call management descriptor");
                         data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
                         control_interface = intf;
                 } else {
-                        dev_dbg(&intf->dev,"No union descriptor, giving up\n");
+                        dev_dbg(&intf->dev,"No union descriptor, giving up");
                         return -ENODEV;
                 }
         } else {
                 control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
                 data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
                 if (!control_interface || !data_interface) {
-                        dev_dbg(&intf->dev,"no interfaces\n");
+                        dev_dbg(&intf->dev,"no interfaces");
                         return -ENODEV;
                 }
         }
         
         if (data_interface_num != call_interface_num)
-                dev_dbg(&intf->dev,"Seperate call control interface. That is not fully supported.\n");
+                dev_dbg(&intf->dev,"Seperate call control interface. That is not fully supported.");
 
 skip_normal_probe:
 
@@ -867,7 +867,7 @@ skip_normal_probe:
         if (data_interface->cur_altsetting->desc.bInterfaceClass != CDC_DATA_INTERFACE_TYPE) {
                 if (control_interface->cur_altsetting->desc.bInterfaceClass == CDC_DATA_INTERFACE_TYPE) {
                         struct usb_interface *t;
-                        dev_dbg(&intf->dev,"Your device has switched interfaces.\n");
+                        dev_dbg(&intf->dev,"Your device has switched interfaces.");
 
                         t = control_interface;
                         control_interface = data_interface;
@@ -878,7 +878,7 @@ skip_normal_probe:
         }
         
         if (usb_interface_claimed(data_interface)) { /* valid in this context */
-                dev_dbg(&intf->dev,"The data interface isn't available\n");
+                dev_dbg(&intf->dev,"The data interface isn't available");
                 return -EBUSY;
         }
 
@@ -895,7 +895,7 @@ skip_normal_probe:
         if ((epread->bEndpointAddress & USB_DIR_IN) != USB_DIR_IN) {
                 /* descriptors are swapped */
                 struct usb_endpoint_descriptor *t;
-                dev_dbg(&intf->dev,"The data interface has switched endpoints\n");
+                dev_dbg(&intf->dev,"The data interface has switched endpoints");
                 
                 t = epread;
                 epread = epwrite;
@@ -910,7 +910,7 @@ skip_normal_probe:
         }
 
         if (!(acm = kzalloc(sizeof(struct acm), GFP_KERNEL))) {
-                dev_dbg(&intf->dev, "out of memory (acm kzalloc)\n");
+                dev_dbg(&intf->dev, "out of memory (acm kzalloc)");
                 goto alloc_fail;
         }
 
@@ -936,26 +936,26 @@ skip_normal_probe:
 
         buf = usb_buffer_alloc(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
         if (!buf) {
-                dev_dbg(&intf->dev, "out of memory (ctrl buffer alloc)\n");
+                dev_dbg(&intf->dev, "out of memory (ctrl buffer alloc)");
                 goto alloc_fail2;
         }
         acm->ctrl_buffer = buf;
 
         if (acm_write_buffers_alloc(acm) < 0) {
-                dev_dbg(&intf->dev, "out of memory (write buffer alloc)\n");
+                dev_dbg(&intf->dev, "out of memory (write buffer alloc)");
                 goto alloc_fail4;
         }
 
         acm->ctrlurb = usb_alloc_urb(0, GFP_KERNEL);
         if (!acm->ctrlurb) {
-                dev_dbg(&intf->dev, "out of memory (ctrlurb kmalloc)\n");
+                dev_dbg(&intf->dev, "out of memory (ctrlurb kmalloc)");
                 goto alloc_fail5;
         }
         for (i = 0; i < num_rx_buf; i++) {
                 struct acm_ru *rcv = &(acm->ru[i]);
 
                 if (!(rcv->urb = usb_alloc_urb(0, GFP_KERNEL))) {
-                        dev_dbg(&intf->dev, "out of memory (read urbs usb_alloc_urb)\n");
+                        dev_dbg(&intf->dev, "out of memory (read urbs usb_alloc_urb)");
                         goto alloc_fail7;
                 }
 
@@ -966,13 +966,13 @@ skip_normal_probe:
                 struct acm_rb *buf = &(acm->rb[i]);
 
                 if (!(buf->base = usb_buffer_alloc(acm->dev, readsize, GFP_KERNEL, &buf->dma))) {
-                        dev_dbg(&intf->dev, "out of memory (read bufs usb_buffer_alloc)\n");
+                        dev_dbg(&intf->dev, "out of memory (read bufs usb_buffer_alloc)");
                         goto alloc_fail7;
                 }
         }
         acm->writeurb = usb_alloc_urb(0, GFP_KERNEL);
         if (!acm->writeurb) {
-                dev_dbg(&intf->dev, "out of memory (writeurb kmalloc)\n");
+                dev_dbg(&intf->dev, "out of memory (writeurb kmalloc)");
                 goto alloc_fail7;
         }
 
@@ -1086,6 +1086,9 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0ace, 0x1608), /* ZyDAS 56K USB MODEM */
         .driver_info = SINGLE_RX_URB, /* firmware bug */
         },
+        { USB_DEVICE(0x0ace, 0x1611), /* ZyDAS 56K USB MODEM - new version */
+        .driver_info = SINGLE_RX_URB, /* firmware bug */
+        },
         /* control interfaces with various AT-command sets */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
                 USB_CDC_ACM_PROTO_AT_V25TER) },
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index a08787e253aa..6e3b5358a760 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -31,9 +31,6 @@ config USB_DEVICEFS
           For the format of the various /proc/bus/usb/ files, please read
           <file:Documentation/usb/proc_usb_info.txt>.
 
-          Please note that this code is completely unrelated to devfs, the
-          "/dev file system support".
-
           Most users want to say Y here.
 
 config USB_BANDWIDTH
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index f7bdd94b3aa8..218621b9958e 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -517,19 +517,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsig
 
 static struct usb_device *usbdev_lookup_minor(int minor)
 {
-        struct device *device;
-        struct usb_device *udev = NULL;
+        struct class_device *class_dev;
+        struct usb_device *dev = NULL;
 
         down(&usb_device_class->sem);
-        list_for_each_entry(device, &usb_device_class->devices, node) {
-                if (device->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
-                        udev = device->platform_data;
+        list_for_each_entry(class_dev, &usb_device_class->children, node) {
+                if (class_dev->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
+                        dev = class_dev->class_data;
                         break;
                 }
         }
         up(&usb_device_class->sem);
 
-        return udev;
+        return dev;
 };
 
 /*
@@ -1580,16 +1580,16 @@ static void usbdev_add(struct usb_device *dev)
 {
         int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
 
-        dev->usbfs_dev = device_create(usb_device_class, &dev->dev,
-                                MKDEV(USB_DEVICE_MAJOR, minor),
+        dev->class_dev = class_device_create(usb_device_class, NULL,
+                                MKDEV(USB_DEVICE_MAJOR, minor), &dev->dev,
                                 "usbdev%d.%d", dev->bus->busnum, dev->devnum);
 
-        dev->usbfs_dev->platform_data = dev;
+        dev->class_dev->class_data = dev;
 }
 
 static void usbdev_remove(struct usb_device *dev)
 {
-        device_unregister(dev->usbfs_dev);
+        class_device_unregister(dev->class_dev);
 }
 
 static int usbdev_notify(struct notifier_block *self, unsigned long action,
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index abee0f5b6a66..8de4f8c99d61 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -194,13 +194,14 @@ int usb_register_dev(struct usb_interface *intf,
                 ++temp;
         else
                 temp = name;
-        intf->usb_dev = device_create(usb_class->class, &intf->dev,
-                                      MKDEV(USB_MAJOR, minor), "%s", temp);
-        if (IS_ERR(intf->usb_dev)) {
+        intf->class_dev = class_device_create(usb_class->class, NULL,
+                                              MKDEV(USB_MAJOR, minor),
+                                              &intf->dev, "%s", temp);
+        if (IS_ERR(intf->class_dev)) {
                 spin_lock (&minor_lock);
                 usb_minors[intf->minor] = NULL;
                 spin_unlock (&minor_lock);
-                retval = PTR_ERR(intf->usb_dev);
+                retval = PTR_ERR(intf->class_dev);
         }
 exit:
         return retval;
@@ -241,8 +242,8 @@ void usb_deregister_dev(struct usb_interface *intf,
         spin_unlock (&minor_lock);
 
         snprintf(name, BUS_ID_SIZE, class_driver->name, intf->minor - minor_base);
-        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
-        intf->usb_dev = NULL;
+        class_device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
+        intf->class_dev = NULL;
         intf->minor = -1;
         destroy_usb_class();
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 875596e98e42..26c8cb5f3e67 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1790,7 +1790,10 @@ static int finish_device_resume(struct usb_device *udev)
          * and device drivers will know about any resume quirks.
          */
         status = usb_get_status(udev, USB_RECIP_DEVICE, 0, &devstatus);
-        if (status < 2)
+        if (status >= 0)
+                status = (status == 2 ? 0 : -ENODEV);
+
+        if (status)
                 dev_dbg(&udev->dev,
                         "gone after usb resume? status %d\n",
                         status);
@@ -1879,7 +1882,12 @@ hub_port_resume(struct usb_hub *hub, int port1, struct usb_device *udev)
                         dev_dbg(hub->intfdev,
                                 "port %d status %04x.%04x after resume, %d\n",
                                 port1, portchange, devstatus, status);
+                        if (status >= 0)
+                                status = -ENODEV;
                 } else {
+                        if (portchange & USB_PORT_STAT_C_SUSPEND)
+                                clear_port_feature(hub->hdev, port1,
+                                                USB_PORT_FEAT_C_SUSPEND);
                         /* TRSMRCY = 10 msec */
                         msleep(10);
                         if (udev)
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index e47e3a8ed6e4..3182c2224ba2 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -200,7 +200,7 @@ static void update_sb(struct super_block *sb)
         if (!root)
                 return;
 
-        mutex_lock(&root->d_inode->i_mutex);
+        mutex_lock_nested(&root->d_inode->i_mutex, I_MUTEX_PARENT);
 
         list_for_each_entry(bus, &root->d_subdirs, d_u.d_child) {
                 if (bus->d_inode) {
@@ -527,7 +527,7 @@ static void fs_remove_file (struct dentry *dentry)
         if (!parent || !parent->d_inode)
                 return;
 
-        mutex_lock(&parent->d_inode->i_mutex);
+        mutex_lock_nested(&parent->d_inode->i_mutex, I_MUTEX_PARENT);
         if (usbfs_positive(dentry)) {
                 if (dentry->d_inode) {
                         if (S_ISDIR(dentry->d_inode->i_mode))
@@ -695,7 +695,7 @@ static void usbfs_remove_device(struct usb_device *dev)
                 wake_up_all(&ds->wait);
                 list_del_init(&ds->list);
                 if (ds->discsignr) {
-                        sinfo.si_signo = SIGPIPE;
+                        sinfo.si_signo = ds->discsignr;
                         sinfo.si_errno = EPIPE;
                         sinfo.si_code = SI_ASYNCIO;
                         sinfo.si_addr = ds->disccontext;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 363b2ad74ae6..1a32d96774b4 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -207,7 +207,7 @@ config USB_AT91
 
 config USB_GADGET_DUMMY_HCD
         boolean "Dummy HCD (DEVELOPMENT)"
-        depends on USB && EXPERIMENTAL
+        depends on (USB=y || (USB=m && USB_GADGET=m)) && EXPERIMENTAL
         select USB_GADGET_DUALSPEED
         help
           This host controller driver emulates USB, looping all data transfer
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 1c459ff037ce..cfebca05ead5 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -57,19 +57,23 @@
 
 /*
  * This controller is simple and PIO-only.  It's used in many AT91-series
- * ARMv4T controllers, including the at91rm9200 (arm920T, with MMU),
- * at91sam9261 (arm926ejs, with MMU), and several no-mmu versions.
+ * full speed USB controllers, including the at91rm9200 (arm920T, with MMU),
+ * at91sam926x (arm926ejs, with MMU), and several no-mmu versions.
  *
  * This driver expects the board has been wired with two GPIOs suppporting
  * a VBUS sensing IRQ, and a D+ pullup.  (They may be omitted, but the
- * testing hasn't covered such cases.)  The pullup is most important; it
+ * testing hasn't covered such cases.)
+ *
+ * The pullup is most important (so it's integrated on sam926x parts).  It
  * provides software control over whether the host enumerates the device.
+ *
  * The VBUS sensing helps during enumeration, and allows both USB clocks
  * (and the transceiver) to stay gated off until they're necessary, saving
- * power.  During USB suspend, the 48 MHz clock is gated off.
+ * power.  During USB suspend, the 48 MHz clock is gated off in hardware;
+ * it may also be gated off by software during some Linux sleep states.
  */
 
-#define DRIVER_VERSION  "8 March 2005"
+#define DRIVER_VERSION  "3 May 2006"
 
 static const char driver_name [] = "at91_udc";
 static const char ep0name[] = "ep0";
@@ -316,9 +320,15 @@ static void done(struct at91_ep *ep, struct at91_request *req, int status)
  *
  * There are also state bits like FORCESTALL, EPEDS, DIR, and EPTYPE
  * that shouldn't normally be changed.
+ *
+ * NOTE at91sam9260 docs mention synch between UDPCK and MCK clock domains,
+ * implying a need to wait for one write to complete (test relevant bits)
+ * before starting the next write.  This shouldn't be an issue given how
+ * infrequently we write, except maybe for write-then-read idioms.
  */
 #define SET_FX  (AT91_UDP_TXPKTRDY)
-#define CLR_FX  (RX_DATA_READY | AT91_UDP_RXSETUP | AT91_UDP_STALLSENT | AT91_UDP_TXCOMP)
+#define CLR_FX  (RX_DATA_READY | AT91_UDP_RXSETUP \
+                | AT91_UDP_STALLSENT | AT91_UDP_TXCOMP)
 
 /* pull OUT packet data from the endpoint's fifo */
 static int read_fifo (struct at91_ep *ep, struct at91_request *req)
@@ -472,7 +482,8 @@ static void nuke(struct at91_ep *ep, int status)
 
 /*-------------------------------------------------------------------------*/
 
-static int at91_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
+static int at91_ep_enable(struct usb_ep *_ep,
+                                const struct usb_endpoint_descriptor *desc)
 {
         struct at91_ep  *ep = container_of(_ep, struct at91_ep, ep);
         struct at91_udc *dev = ep->udc;
@@ -582,11 +593,12 @@ static int at91_ep_disable (struct usb_ep * _ep)
  * interesting for request or buffer allocation.
  */
 
-static struct usb_request *at91_ep_alloc_request (struct usb_ep *_ep, unsigned int gfp_flags)
+static struct usb_request *
+at91_ep_alloc_request(struct usb_ep *_ep, unsigned int gfp_flags)
 {
         struct at91_request *req;
 
-        req = kcalloc(1, sizeof (struct at91_request), SLAB_KERNEL);
+        req = kcalloc(1, sizeof (struct at91_request), gfp_flags);
         if (!req)
                 return NULL;
 
@@ -862,6 +874,7 @@ static void stop_activity(struct at91_udc *udc)
         if (udc->gadget.speed == USB_SPEED_UNKNOWN)
                 driver = NULL;
         udc->gadget.speed = USB_SPEED_UNKNOWN;
+        udc->suspended = 0;
 
         for (i = 0; i < NUM_ENDPOINTS; i++) {
                 struct at91_ep *ep = &udc->ep[i];
@@ -889,8 +902,8 @@ static void clk_off(struct at91_udc *udc)
                 return;
         udc->clocked = 0;
         udc->gadget.speed = USB_SPEED_UNKNOWN;
-        clk_disable(udc->iclk);
         clk_disable(udc->fclk);
+        clk_disable(udc->iclk);
 }
 
 /*
@@ -911,9 +924,6 @@ static void pullup(struct at91_udc *udc, int is_on)
                 at91_udp_write(AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
                 at91_set_gpio_value(udc->board.pullup_pin, 0);
                 clk_off(udc);
-
-                // REVISIT:  with transceiver disabled, will D- float
-                // so that a host would falsely detect a device?
         }
 }
 
@@ -1290,7 +1300,8 @@ static void handle_ep0(struct at91_udc *udc)
                         if (udc->wait_for_addr_ack) {
                                 u32     tmp;
 
-                                at91_udp_write(AT91_UDP_FADDR, AT91_UDP_FEN | udc->addr);
+                                at91_udp_write(AT91_UDP_FADDR,
+                                                AT91_UDP_FEN | udc->addr);
                                 tmp = at91_udp_read(AT91_UDP_GLB_STAT);
                                 tmp &= ~AT91_UDP_FADDEN;
                                 if (udc->addr)
@@ -1361,9 +1372,10 @@ static irqreturn_t at91_udc_irq (int irq, void *_udc, struct pt_regs *r)
         u32                     rescans = 5;
 
         while (rescans--) {
-                u32     status = at91_udp_read(AT91_UDP_ISR);
+                u32 status;
 
-                status &= at91_udp_read(AT91_UDP_IMR);
+                status = at91_udp_read(AT91_UDP_ISR)
+                        & at91_udp_read(AT91_UDP_IMR);
                 if (!status)
                         break;
 
@@ -1379,18 +1391,17 @@ static irqreturn_t at91_udc_irq (int irq, void *_udc, struct pt_regs *r)
                         stop_activity(udc);
 
                         /* enable ep0 */
-                        at91_udp_write(AT91_UDP_CSR(0), AT91_UDP_EPEDS | AT91_UDP_EPTYPE_CTRL);
+                        at91_udp_write(AT91_UDP_CSR(0),
+                                        AT91_UDP_EPEDS | AT91_UDP_EPTYPE_CTRL);
                         udc->gadget.speed = USB_SPEED_FULL;
                         udc->suspended = 0;
                         at91_udp_write(AT91_UDP_IER, AT91_UDP_EP(0));
 
                         /*
                          * NOTE:  this driver keeps clocks off unless the
-                         * USB host is present.  That saves power, and also
-                         * eliminates IRQs (reset, resume, suspend) that can
-                         * otherwise flood from the controller.  If your
-                         * board doesn't support VBUS detection, suspend and
-                         * resume irq logic may need more attention...
+                         * USB host is present.  That saves power, but for
+                         * boards that don't support VBUS detection, both
+                         * clocks need to be active most of the time.
                          */
 
                 /* host initiated suspend (3+ms bus idle) */
@@ -1452,13 +1463,19 @@ static irqreturn_t at91_udc_irq (int irq, void *_udc, struct pt_regs *r)
 
 /*-------------------------------------------------------------------------*/
 
+static void nop_release(struct device *dev)
+{
+        /* nothing to free */
+}
+
 static struct at91_udc controller = {
         .gadget = {
-                .ops = &at91_udc_ops,
-                .ep0 = &controller.ep[0].ep,
-                .name = driver_name,
-                .dev = {
-                        .bus_id = "gadget"
+                .ops    = &at91_udc_ops,
+                .ep0    = &controller.ep[0].ep,
+                .name   = driver_name,
+                .dev    = {
+                        .bus_id = "gadget",
+                        .release = nop_release,
                 }
         },
         .ep[0] = {
@@ -1468,7 +1485,8 @@ static struct at91_udc controller = {
                 },
                 .udc            = &controller,
                 .maxpacket      = 8,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(0)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(0)),
                 .int_mask       = 1 << 0,
         },
         .ep[1] = {
@@ -1479,7 +1497,8 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 64,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(1)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(1)),
                 .int_mask       = 1 << 1,
         },
         .ep[2] = {
@@ -1490,7 +1509,8 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 64,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(2)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(2)),
                 .int_mask       = 1 << 2,
         },
         .ep[3] = {
@@ -1501,7 +1521,8 @@ static struct at91_udc controller = {
                 },
                 .udc            = &controller,
                 .maxpacket      = 8,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(3)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(3)),
                 .int_mask       = 1 << 3,
         },
         .ep[4] = {
@@ -1512,7 +1533,8 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 256,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(4)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(4)),
                 .int_mask       = 1 << 4,
         },
         .ep[5] = {
@@ -1523,10 +1545,11 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 256,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(5)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(5)),
                 .int_mask       = 1 << 5,
         },
-        /* ep6 and ep7 are also reserved */
+        /* ep6 and ep7 are also reserved (custom silicon might use them) */
 };
 
 static irqreturn_t at91_vbus_irq(int irq, void *_udc, struct pt_regs *r)
@@ -1593,6 +1616,7 @@ int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
 
         local_irq_disable();
         udc->enabled = 0;
+        at91_udp_write(AT91_UDP_IDR, ~0);
         pullup(udc, 0);
         local_irq_enable();
 
@@ -1624,6 +1648,16 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        if (pdev->num_resources != 2) {
+                DBG("invalid num_resources");
+                return -ENODEV;
+        }
+        if ((pdev->resource[0].flags != IORESOURCE_MEM)
+                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+                DBG("invalid resource type");
+                return -ENODEV;
+        }
+
         if (!request_mem_region(AT91_BASE_UDP, SZ_16K, driver_name)) {
                 DBG("someone's using UDC memory\n");
                 return -EBUSY;
@@ -1649,19 +1683,26 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
         if (retval < 0)
                 goto fail0;
 
-        /* disable everything until there's a gadget driver and vbus */
-        pullup(udc, 0);
+        /* don't do anything until we have both gadget driver and VBUS */
+        clk_enable(udc->iclk);
+        at91_udp_write(AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
+        at91_udp_write(AT91_UDP_IDR, 0xffffffff);
+        clk_disable(udc->iclk);
 
         /* request UDC and maybe VBUS irqs */
-        if (request_irq(AT91_ID_UDP, at91_udc_irq, IRQF_DISABLED, driver_name, udc)) {
-                DBG("request irq %d failed\n", AT91_ID_UDP);
+        udc->udp_irq = platform_get_irq(pdev, 0);
+        if (request_irq(udc->udp_irq, at91_udc_irq,
+                        IRQF_DISABLED, driver_name, udc)) {
+                DBG("request irq %d failed\n", udc->udp_irq);
                 retval = -EBUSY;
                 goto fail1;
         }
         if (udc->board.vbus_pin > 0) {
-                if (request_irq(udc->board.vbus_pin, at91_vbus_irq, IRQF_DISABLED, driver_name, udc)) {
-                        DBG("request vbus irq %d failed\n", udc->board.vbus_pin);
-                        free_irq(AT91_ID_UDP, udc);
+                if (request_irq(udc->board.vbus_pin, at91_vbus_irq,
+                                IRQF_DISABLED, driver_name, udc)) {
+                        DBG("request vbus irq %d failed\n",
+                                        udc->board.vbus_pin);
+                        free_irq(udc->udp_irq, udc);
                         retval = -EBUSY;
                         goto fail1;
                 }
@@ -1670,6 +1711,7 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
                 udc->vbus = 1;
         }
         dev_set_drvdata(dev, udc);
+        device_init_wakeup(dev, 1);
         create_debug_file(udc);
 
         INFO("%s version %s\n", driver_name, DRIVER_VERSION);
@@ -1678,14 +1720,14 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
 fail1:
         device_unregister(&udc->gadget.dev);
 fail0:
-        release_mem_region(AT91_VA_BASE_UDP, SZ_16K);
+        release_mem_region(AT91_BASE_UDP, SZ_16K);
         DBG("%s probe failed, %d\n", driver_name, retval);
         return retval;
 }
 
-static int __devexit at91udc_remove(struct platform_device *dev)
+static int __devexit at91udc_remove(struct platform_device *pdev)
 {
-        struct at91_udc *udc = platform_get_drvdata(dev);
+        struct at91_udc *udc = platform_get_drvdata(pdev);
 
         DBG("remove\n");
 
@@ -1694,10 +1736,11 @@ static int __devexit at91udc_remove(struct platform_device *dev)
         if (udc->driver != 0)
                 usb_gadget_unregister_driver(udc->driver);
 
+        device_init_wakeup(&pdev->dev, 0);
         remove_debug_file(udc);
         if (udc->board.vbus_pin > 0)
                 free_irq(udc->board.vbus_pin, udc);
-        free_irq(AT91_ID_UDP, udc);
+        free_irq(udc->udp_irq, udc);
         device_unregister(&udc->gadget.dev);
         release_mem_region(AT91_BASE_UDP, SZ_16K);
 
@@ -1708,31 +1751,36 @@ static int __devexit at91udc_remove(struct platform_device *dev)
 }
 
 #ifdef CONFIG_PM
-static int at91udc_suspend(struct platform_device *dev, pm_message_t mesg)
+static int at91udc_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-        struct at91_udc *udc = platform_get_drvdata(dev);
+        struct at91_udc *udc = platform_get_drvdata(pdev);
+        int             wake = udc->driver && device_may_wakeup(&pdev->dev);
 
-        /*
-         * The "safe" suspend transitions are opportunistic ... e.g. when
-         * the USB link is suspended (48MHz clock autogated off), or when
-         * it's disconnected (programmatically gated off, elsewhere).
-         * Then we can suspend, and the chip can enter slow clock mode.
-         *
-         * The problem case is some component (user mode?) suspending this
-         * device while it's active, with the 48 MHz clock in use.  There
-         * are two basic approaches:  (a) veto suspend levels involving slow
-         * clock mode, (b) disconnect, so 48 MHz will no longer be in use
-         * and we can enter slow clock mode.  This uses (b) for now, since
-         * it's simplest until AT91 PM exists and supports the other option.
+        /* Unless we can act normally to the host (letting it wake us up
+         * whenever it has work for us) force disconnect.  Wakeup requires
+         * PLLB for USB events (signaling for reset, wakeup, or incoming
+         * tokens) and VBUS irqs (on systems which support them).
          */
-        if (udc->vbus && !udc->suspended)
+        if ((!udc->suspended && udc->addr)
+                        || !wake
+                        || at91_suspend_entering_slow_clock()) {
                 pullup(udc, 0);
+                disable_irq_wake(udc->udp_irq);
+        } else
+                enable_irq_wake(udc->udp_irq);
+
+        if (udc->board.vbus_pin > 0) {
+                if (wake)
+                        enable_irq_wake(udc->board.vbus_pin);
+                else
+                        disable_irq_wake(udc->board.vbus_pin);
+        }
         return 0;
 }
 
-static int at91udc_resume(struct platform_device *dev)
+static int at91udc_resume(struct platform_device *pdev)
 {
-        struct at91_udc *udc = platform_get_drvdata(dev);
+        struct at91_udc *udc = platform_get_drvdata(pdev);
 
         /* maybe reconnect to host; if so, clocks on */
         pullup(udc, 1);
@@ -1748,7 +1796,7 @@ static struct platform_driver at91_udc = {
         .remove         = __devexit_p(at91udc_remove),
         .shutdown       = at91udc_shutdown,
         .suspend        = at91udc_suspend,
-        .resume         = at91udc_resume,
+        .resume         = at91udc_resume,
         .driver         = {
                 .name   = (char *) driver_name,
                 .owner  = THIS_MODULE,
@@ -1767,6 +1815,6 @@ static void __devexit udc_exit_module(void)
 }
 module_exit(udc_exit_module);
 
-MODULE_DESCRIPTION("AT91RM9200 udc driver");
+MODULE_DESCRIPTION("AT91 udc driver");
 MODULE_AUTHOR("Thomas Rathbone, David Brownell");
 MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/at91_udc.h b/drivers/usb/gadget/at91_udc.h
index 5a4799cedd19..882af42e86cc 100644
--- a/drivers/usb/gadget/at91_udc.h
+++ b/drivers/usb/gadget/at91_udc.h
@@ -141,6 +141,7 @@ struct at91_udc {
         struct clk                      *iclk, *fclk;
         struct platform_device          *pdev;
         struct proc_dir_entry           *pde;
+        int                             udp_irq;
 };
 
 static inline struct at91_udc *to_udc(struct usb_gadget *g)
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 4be47195bd38..7d1c22c34957 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -609,7 +609,8 @@ static int dummy_dequeue (struct usb_ep *_ep, struct usb_request *_req)
         if (!dum->driver)
                 return -ESHUTDOWN;
 
-        spin_lock_irqsave (&dum->lock, flags);
+        local_irq_save (flags);
+        spin_lock (&dum->lock);
         list_for_each_entry (req, &ep->queue, queue) {
                 if (&req->req == _req) {
                         list_del_init (&req->queue);
@@ -618,7 +619,7 @@ static int dummy_dequeue (struct usb_ep *_ep, struct usb_request *_req)
                         break;
                 }
         }
-        spin_unlock_irqrestore (&dum->lock, flags);
+        spin_unlock (&dum->lock);
 
         if (retval == 0) {
                 dev_dbg (udc_dev(dum),
@@ -626,6 +627,7 @@ static int dummy_dequeue (struct usb_ep *_ep, struct usb_request *_req)
                                 req, _ep->name, _req->length, _req->buf);
                 _req->complete (_ep, _req);
         }
+        local_irq_restore (flags);
         return retval;
 }
 
diff --git a/drivers/usb/gadget/epautoconf.c b/drivers/usb/gadget/epautoconf.c
index f7c6d758e1b0..53d584589c26 100644
--- a/drivers/usb/gadget/epautoconf.c
+++ b/drivers/usb/gadget/epautoconf.c
@@ -34,12 +34,12 @@
 
 
 /* we must assign addresses for configurable endpoints (like net2280) */
-static __initdata unsigned epnum;
+static __devinitdata unsigned epnum;
 
 // #define MANY_ENDPOINTS
 #ifdef MANY_ENDPOINTS
 /* more than 15 configurable endpoints */
-static __initdata unsigned in_epnum;
+static __devinitdata unsigned in_epnum;
 #endif
 
 
@@ -59,7 +59,7 @@ static __initdata unsigned in_epnum;
  * NOTE:  each endpoint is unidirectional, as specified by its USB
  * descriptor; and isn't specific to a configuration or altsetting.
  */
-static int __init
+static int __devinit
 ep_matches (
         struct usb_gadget               *gadget,
         struct usb_ep                   *ep,
@@ -73,7 +73,7 @@ ep_matches (
         /* endpoint already claimed? */
         if (0 != ep->driver_data)
                 return 0;
-                
+
         /* only support ep0 for portable CONTROL traffic */
         type = desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
         if (USB_ENDPOINT_XFER_CONTROL == type)
@@ -186,7 +186,7 @@ ep_matches (
         return 1;
 }
 
-static struct usb_ep * __init
+static struct usb_ep * __devinit
 find_ep (struct usb_gadget *gadget, const char *name)
 {
         struct usb_ep   *ep;
@@ -228,7 +228,7 @@ find_ep (struct usb_gadget *gadget, const char *name)
  *
  * On failure, this returns a null endpoint descriptor.
  */
-struct usb_ep * __init usb_ep_autoconfig (
+struct usb_ep * __devinit usb_ep_autoconfig (
         struct usb_gadget               *gadget,
         struct usb_endpoint_descriptor  *desc
 )
@@ -276,7 +276,7 @@ struct usb_ep * __init usb_ep_autoconfig (
                         return ep;
         }
 
-        /* Second, look at endpoints until an unclaimed one looks usable */ 
+        /* Second, look at endpoints until an unclaimed one looks usable */
         list_for_each_entry (ep, &gadget->ep_list, ep_list) {
                 if (ep_matches (gadget, ep, desc))
                         return ep;
@@ -295,7 +295,7 @@ struct usb_ep * __init usb_ep_autoconfig (
  * state such as ep->driver_data and the record of assigned endpoints
  * used by usb_ep_autoconfig().
  */
-void __init usb_ep_autoconfig_reset (struct usb_gadget *gadget)
+void __devinit usb_ep_autoconfig_reset (struct usb_gadget *gadget)
 {
         struct usb_ep   *ep;
 
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 8320fcef0425..30299c620d97 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -117,6 +117,8 @@ struct eth_dev {
         struct usb_ep           *in_ep, *out_ep, *status_ep;
         const struct usb_endpoint_descriptor
                                 *in, *out, *status;
+
+        spinlock_t              req_lock;
         struct list_head        tx_reqs, rx_reqs;
 
         struct net_device       *net;
@@ -1066,21 +1068,31 @@ static void eth_reset_config (struct eth_dev *dev)
          */
         if (dev->in) {
                 usb_ep_disable (dev->in_ep);
+                spin_lock(&dev->req_lock);
                 while (likely (!list_empty (&dev->tx_reqs))) {
                         req = container_of (dev->tx_reqs.next,
                                                 struct usb_request, list);
                         list_del (&req->list);
+
+                        spin_unlock(&dev->req_lock);
                         usb_ep_free_request (dev->in_ep, req);
+                        spin_lock(&dev->req_lock);
                 }
+                spin_unlock(&dev->req_lock);
         }
         if (dev->out) {
                 usb_ep_disable (dev->out_ep);
+                spin_lock(&dev->req_lock);
                 while (likely (!list_empty (&dev->rx_reqs))) {
                         req = container_of (dev->rx_reqs.next,
                                                 struct usb_request, list);
                         list_del (&req->list);
+
+                        spin_unlock(&dev->req_lock);
                         usb_ep_free_request (dev->out_ep, req);
+                        spin_lock(&dev->req_lock);
                 }
+                spin_unlock(&dev->req_lock);
         }
 
         if (dev->status) {
@@ -1659,9 +1671,9 @@ enomem:
         if (retval) {
                 DEBUG (dev, "rx submit --> %d\n", retval);
                 dev_kfree_skb_any (skb);
-                spin_lock (&dev->lock);
+                spin_lock(&dev->req_lock);
                 list_add (&req->list, &dev->rx_reqs);
-                spin_unlock (&dev->lock);
+                spin_unlock(&dev->req_lock);
         }
         return retval;
 }
@@ -1730,8 +1742,9 @@ quiesce:
                 dev_kfree_skb_any (skb);
         if (!netif_running (dev->net)) {
 clean:
-                /* nobody reading rx_reqs, so no dev->lock */
+                spin_lock(&dev->req_lock);
                 list_add (&req->list, &dev->rx_reqs);
+                spin_unlock(&dev->req_lock);
                 req = NULL;
         }
         if (req)
@@ -1782,15 +1795,18 @@ static int alloc_requests (struct eth_dev *dev, unsigned n, gfp_t gfp_flags)
 {
         int status;
 
+        spin_lock(&dev->req_lock);
         status = prealloc (&dev->tx_reqs, dev->in_ep, n, gfp_flags);
         if (status < 0)
                 goto fail;
         status = prealloc (&dev->rx_reqs, dev->out_ep, n, gfp_flags);
         if (status < 0)
                 goto fail;
-        return 0;
+        goto done;
 fail:
         DEBUG (dev, "can't alloc requests\n");
+done:
+        spin_unlock(&dev->req_lock);
         return status;
 }
 
@@ -1800,21 +1816,21 @@ static void rx_fill (struct eth_dev *dev, gfp_t gfp_flags)
         unsigned long           flags;
 
         /* fill unused rxq slots with some skb */
-        spin_lock_irqsave (&dev->lock, flags);
+        spin_lock_irqsave(&dev->req_lock, flags);
         while (!list_empty (&dev->rx_reqs)) {
                 req = container_of (dev->rx_reqs.next,
                                 struct usb_request, list);
                 list_del_init (&req->list);
-                spin_unlock_irqrestore (&dev->lock, flags);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
 
                 if (rx_submit (dev, req, gfp_flags) < 0) {
                         defer_kevent (dev, WORK_RX_MEMORY);
                         return;
                 }
 
-                spin_lock_irqsave (&dev->lock, flags);
+                spin_lock_irqsave(&dev->req_lock, flags);
         }
-        spin_unlock_irqrestore (&dev->lock, flags);
+        spin_unlock_irqrestore(&dev->req_lock, flags);
 }
 
 static void eth_work (void *_dev)
@@ -1848,9 +1864,9 @@ static void tx_complete (struct usb_ep *ep, struct usb_request *req)
         }
         dev->stats.tx_packets++;
 
-        spin_lock (&dev->lock);
+        spin_lock(&dev->req_lock);
         list_add (&req->list, &dev->tx_reqs);
-        spin_unlock (&dev->lock);
+        spin_unlock(&dev->req_lock);
         dev_kfree_skb_any (skb);
 
         atomic_dec (&dev->tx_qlen);
@@ -1896,12 +1912,12 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
                 /* ignores USB_CDC_PACKET_TYPE_DIRECTED */
         }
 
-        spin_lock_irqsave (&dev->lock, flags);
+        spin_lock_irqsave(&dev->req_lock, flags);
         req = container_of (dev->tx_reqs.next, struct usb_request, list);
         list_del (&req->list);
         if (list_empty (&dev->tx_reqs))
                 netif_stop_queue (net);
-        spin_unlock_irqrestore (&dev->lock, flags);
+        spin_unlock_irqrestore(&dev->req_lock, flags);
 
         /* no buffer copies needed, unless the network stack did it
          * or the hardware can't use skb buffers.
@@ -1955,11 +1971,11 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
 drop:
                 dev->stats.tx_dropped++;
                 dev_kfree_skb_any (skb);
-                spin_lock_irqsave (&dev->lock, flags);
+                spin_lock_irqsave(&dev->req_lock, flags);
                 if (list_empty (&dev->tx_reqs))
                         netif_start_queue (net);
                 list_add (&req->list, &dev->tx_reqs);
-                spin_unlock_irqrestore (&dev->lock, flags);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
         }
         return 0;
 }
@@ -2131,7 +2147,7 @@ eth_req_free (struct usb_ep *ep, struct usb_request *req)
 }
 
 
-static void __exit
+static void /* __init_or_exit */
 eth_unbind (struct usb_gadget *gadget)
 {
         struct eth_dev          *dev = get_gadget_data (gadget);
@@ -2158,7 +2174,7 @@ eth_unbind (struct usb_gadget *gadget)
         set_gadget_data (gadget, NULL);
 }
 
-static u8 __init nibble (unsigned char c)
+static u8 __devinit nibble (unsigned char c)
 {
         if (likely (isdigit (c)))
                 return c - '0';
@@ -2168,7 +2184,7 @@ static u8 __init nibble (unsigned char c)
         return 0;
 }
 
-static int __init get_ether_addr(const char *str, u8 *dev_addr)
+static int __devinit get_ether_addr(const char *str, u8 *dev_addr)
 {
         if (str) {
                 unsigned        i;
@@ -2189,7 +2205,7 @@ static int __init get_ether_addr(const char *str, u8 *dev_addr)
         return 1;
 }
 
-static int __init
+static int __devinit
 eth_bind (struct usb_gadget *gadget)
 {
         struct eth_dev          *dev;
@@ -2378,6 +2394,7 @@ autoconf_fail:
                 return status;
         dev = netdev_priv(net);
         spin_lock_init (&dev->lock);
+        spin_lock_init (&dev->req_lock);
         INIT_WORK (&dev->work, eth_work, dev);
         INIT_LIST_HEAD (&dev->tx_reqs);
         INIT_LIST_HEAD (&dev->rx_reqs);
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index b1a9cf06f3e6..8d7f1e84cd7b 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -3691,7 +3691,7 @@ static void lun_release(struct device *dev)
         kref_put(&fsg->ref, fsg_release);
 }
 
-static void __exit fsg_unbind(struct usb_gadget *gadget)
+static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
 {
         struct fsg_dev          *fsg = get_gadget_data(gadget);
         int                     i;
diff --git a/drivers/usb/gadget/lh7a40x_udc.c b/drivers/usb/gadget/lh7a40x_udc.c
index bb22b7e82877..36db72579377 100644
--- a/drivers/usb/gadget/lh7a40x_udc.c
+++ b/drivers/usb/gadget/lh7a40x_udc.c
@@ -2143,7 +2143,7 @@ static int lh7a40x_udc_remove(struct platform_device *pdev)
 
 static struct platform_driver udc_driver = {
         .probe = lh7a40x_udc_probe,
-        .remove = lh7a40x_udc_remove
+        .remove = lh7a40x_udc_remove,
             /* FIXME power management support */
             /* .suspend = ... disable UDC */
             /* .resume = ... re-enable UDC */
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 354670d12308..408c3380d602 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1398,7 +1398,7 @@ static struct proc_dir_entry *rndis_connect_state [RNDIS_MAX_CONFIGS];
 #endif  /* CONFIG_USB_GADGET_DEBUG_FILES */
 
 
-int __init rndis_init (void)
+int __devinit rndis_init (void)
 {
         u8 i;
 
diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
index 2956608be751..4c3c7259f019 100644
--- a/drivers/usb/gadget/rndis.h
+++ b/drivers/usb/gadget/rndis.h
@@ -264,7 +264,7 @@ int  rndis_signal_disconnect (int configNr);
 int  rndis_state (int configNr);
 extern void rndis_set_host_mac (int configNr, const u8 *addr);
 
-int __init rndis_init (void);
+int __devinit rndis_init (void);
 void rndis_exit (void);
 
 #endif  /* _LINUX_RNDIS_H */
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 30d7664d449d..e762aa19ab0a 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1473,7 +1473,7 @@ autoconf_fail:
  * Called on module unload.  Frees the control request and device
  * structure.
  */
-static void __exit gs_unbind(struct usb_gadget *gadget)
+static void /* __init_or_exit */ gs_unbind(struct usb_gadget *gadget)
 {
         struct gs_dev *dev = get_gadget_data(gadget);
 
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 3a08a7ab4ce0..b7018ee487ea 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -1121,7 +1121,7 @@ zero_autoresume (unsigned long _dev)
 
 /*-------------------------------------------------------------------------*/
 
-static void __exit
+static void /* __init_or_exit */
 zero_unbind (struct usb_gadget *gadget)
 {
         struct zero_dev         *dev = get_gadget_data (gadget);
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index d66867aa527e..26ed757d22a6 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -41,8 +41,6 @@
 #endif
 #define USBH_DISABLE      (USB_MCFG_EBMEN | USB_MCFG_EMEMEN)
 
-#endif                          /* Au1200 */
-
 extern int usb_disabled(void);
 
 /*-------------------------------------------------------------------------*/
@@ -107,9 +105,9 @@ int usb_ehci_au1xxx_probe(const struct hc_driver *driver,
 
         /* Au1200 AB USB does not support coherent memory */
         if (!(read_c0_prid() & 0xff)) {
-                pr_info("%s: this is chip revision AB!\n", dev->dev.name);
+                pr_info("%s: this is chip revision AB!\n", dev->name);
                 pr_info("%s: update your board or re-configure the kernel\n",
-                        dev->dev.name);
+                        dev->name);
                 return -ENODEV;
         }
 #endif
@@ -228,9 +226,8 @@ static const struct hc_driver ehci_au1xxx_hc_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int ehci_hcd_au1xxx_drv_probe(struct device *dev)
+static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
         struct usb_hcd *hcd = NULL;
         int ret;
 
@@ -243,10 +240,9 @@ static int ehci_hcd_au1xxx_drv_probe(struct device *dev)
         return ret;
 }
 
-static int ehci_hcd_au1xxx_drv_remove(struct device *dev)
+static int ehci_hcd_au1xxx_drv_remove(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
 
         usb_ehci_au1xxx_remove(hcd, pdev);
         return 0;
@@ -269,12 +265,13 @@ static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
 }
 */
 MODULE_ALIAS("au1xxx-ehci");
-/* FIXME use "struct platform_driver" */
-static struct device_driver ehci_hcd_au1xxx_driver = {
-        .name = "au1xxx-ehci",
-        .bus = &platform_bus_type,
+static struct platform_driver ehci_hcd_au1xxx_driver = {
         .probe = ehci_hcd_au1xxx_drv_probe,
         .remove = ehci_hcd_au1xxx_drv_remove,
         /*.suspend      = ehci_hcd_au1xxx_drv_suspend, */
         /*.resume       = ehci_hcd_au1xxx_drv_resume, */
+        .driver = {
+                .name = "au1xxx-ehci",
+                .bus = &platform_bus_type
+        }
 };
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index cee6f538de0a..d63177a8eaea 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -625,10 +625,11 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd, struct pt_regs *regs)
                         writel (status | CMD_RUN, &ehci->regs->command);
 
                 while (i--) {
-                        status = readl (&ehci->regs->port_status [i]);
-                        if (status & PORT_OWNER)
+                        int pstatus = readl (&ehci->regs->port_status [i]);
+
+                        if (pstatus & PORT_OWNER)
                                 continue;
-                        if (!(status & PORT_RESUME)
+                        if (!(pstatus & PORT_RESUME)
                                         || ehci->reset_done [i] != 0)
                                 continue;
 
@@ -891,7 +892,7 @@ MODULE_LICENSE ("GPL");
 #define PCI_DRIVER              ehci_pci_driver
 #endif
 
-#ifdef CONFIG_PPC_83xx
+#ifdef CONFIG_MPC834x
 #include "ehci-fsl.c"
 #define PLATFORM_DRIVER         ehci_fsl_driver
 #endif
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index cdbafb710000..85cc059705a6 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -4,7 +4,7 @@
  *  Copyright (C) 2004 SAN People (Pty) Ltd.
  *  Copyright (C) 2005 Thibaut VARENE <varenet@parisc-linux.org>
  *
- * AT91RM9200 Bus Glue
+ * AT91 Bus Glue
  *
  * Based on fragments of 2.4 driver by Rick Bronson.
  * Based on ohci-omap.c
@@ -19,12 +19,13 @@
 #include <asm/hardware.h>
 #include <asm/arch/board.h>
 
-#ifndef CONFIG_ARCH_AT91RM9200
-#error "CONFIG_ARCH_AT91RM9200 must be defined."
+#ifndef CONFIG_ARCH_AT91
+#error "CONFIG_ARCH_AT91 must be defined."
 #endif
 
 /* interface and function clocks */
 static struct clk *iclk, *fclk;
+static int clocked;
 
 extern int usb_disabled(void);
 
@@ -35,13 +36,14 @@ static void at91_start_hc(struct platform_device *pdev)
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct ohci_regs __iomem *regs = hcd->regs;
 
-        dev_dbg(&pdev->dev, "starting AT91RM9200 OHCI USB Controller\n");
+        dev_dbg(&pdev->dev, "start\n");
 
         /*
          * Start the USB clocks.
          */
         clk_enable(iclk);
         clk_enable(fclk);
+        clocked = 1;
 
         /*
          * The USB host controller must remain in reset.
@@ -54,7 +56,7 @@ static void at91_stop_hc(struct platform_device *pdev)
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct ohci_regs __iomem *regs = hcd->regs;
 
-        dev_dbg(&pdev->dev, "stopping AT91RM9200 OHCI USB Controller\n");
+        dev_dbg(&pdev->dev, "stop\n");
 
         /*
          * Put the USB host controller into reset.
@@ -66,6 +68,7 @@ static void at91_stop_hc(struct platform_device *pdev)
          */
         clk_disable(fclk);
         clk_disable(iclk);
+        clocked = 0;
 }
 
 
@@ -78,14 +81,15 @@ static int usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
 
 
 /**
- * usb_hcd_at91_probe - initialize AT91RM9200-based HCDs
+ * usb_hcd_at91_probe - initialize AT91-based HCDs
  * Context: !in_interrupt()
  *
  * Allocates basic resources for this USB host controller, and
  * then invokes the start() method for the HCD associated with it
  * through the hotplug entry's driver_data.
  */
-int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *pdev)
+static int usb_hcd_at91_probe(const struct hc_driver *driver,
+                        struct platform_device *pdev)
 {
         int retval;
         struct usb_hcd *hcd = NULL;
@@ -95,12 +99,13 @@ int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *
                 return -ENODEV;
         }
 
-        if ((pdev->resource[0].flags != IORESOURCE_MEM) || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+        if ((pdev->resource[0].flags != IORESOURCE_MEM)
+                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
                 pr_debug("hcd probe: invalid resource type\n");
                 return -ENODEV;
         }
 
-        hcd = usb_create_hcd(driver, &pdev->dev, "at91rm9200");
+        hcd = usb_create_hcd(driver, &pdev->dev, "at91");
         if (!hcd)
                 return -ENOMEM;
         hcd->rsrc_start = pdev->resource[0].start;
@@ -149,21 +154,23 @@ int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *
 /* may be called with controller, bus, and devices active */
 
 /**
- * usb_hcd_at91_remove - shutdown processing for AT91RM9200-based HCDs
+ * usb_hcd_at91_remove - shutdown processing for AT91-based HCDs
  * @dev: USB Host Controller being removed
  * Context: !in_interrupt()
  *
  * Reverses the effect of usb_hcd_at91_probe(), first invoking
  * the HCD's stop() method.  It is always called from a thread
- * context, normally "rmmod", "apmd", or something similar.
+ * context, "rmmod" or something similar.
  *
  */
-static int usb_hcd_at91_remove (struct usb_hcd *hcd, struct platform_device *pdev)
+static int usb_hcd_at91_remove(struct usb_hcd *hcd,
+                                struct platform_device *pdev)
 {
         usb_remove_hcd(hcd);
         at91_stop_hc(pdev);
         iounmap(hcd->regs);
         release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        disable_irq_wake(hcd->irq);
 
         clk_put(fclk);
         clk_put(iclk);
@@ -178,19 +185,21 @@ static int usb_hcd_at91_remove (struct usb_hcd *hcd, struct platform_device *pde
 static int __devinit
 ohci_at91_start (struct usb_hcd *hcd)
 {
-//      struct at91_ohci_data   *board = hcd->self.controller->platform_data;
+        struct at91_usbh_data   *board = hcd->self.controller->platform_data;
         struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
+        struct usb_device       *root = hcd->self.root_hub;
         int                     ret;
 
         if ((ret = ohci_init(ohci)) < 0)
                 return ret;
 
+        root->maxchild = board->ports;
+
         if ((ret = ohci_run(ohci)) < 0) {
                 err("can't start %s", hcd->self.bus_name);
                 ohci_stop(hcd);
                 return ret;
         }
-//      hcd->self.root_hub->maxchild = board->ports;
         return 0;
 }
 
@@ -198,7 +207,7 @@ ohci_at91_start (struct usb_hcd *hcd)
 
 static const struct hc_driver ohci_at91_hc_driver = {
         .description =          hcd_name,
-        .product_desc =         "AT91RM9200 OHCI",
+        .product_desc =         "AT91 OHCI",
         .hcd_priv_size =        sizeof(struct ohci_hcd),
 
         /*
@@ -240,33 +249,54 @@ static const struct hc_driver ohci_at91_hc_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int ohci_hcd_at91_drv_probe(struct platform_device *dev)
+static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
 {
-        return usb_hcd_at91_probe(&ohci_at91_hc_driver, dev);
+        device_init_wakeup(&pdev->dev, 1);
+        return usb_hcd_at91_probe(&ohci_at91_hc_driver, pdev);
 }
 
-static int ohci_hcd_at91_drv_remove(struct platform_device *dev)
+static int ohci_hcd_at91_drv_remove(struct platform_device *pdev)
 {
-        return usb_hcd_at91_remove(platform_get_drvdata(dev), dev);
+        device_init_wakeup(&pdev->dev, 0);
+        return usb_hcd_at91_remove(platform_get_drvdata(pdev), pdev);
 }
 
 #ifdef CONFIG_PM
 
-/* REVISIT suspend/resume look "too" simple here */
-
 static int
-ohci_hcd_at91_drv_suspend(struct platform_device *dev, pm_message_t mesg)
+ohci_hcd_at91_drv_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-        clk_disable(fclk);
-        clk_disable(iclk);
+        struct usb_hcd  *hcd = platform_get_drvdata(pdev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+
+        if (device_may_wakeup(&pdev->dev))
+                enable_irq_wake(hcd->irq);
+        else
+                disable_irq_wake(hcd->irq);
+
+        /*
+         * The integrated transceivers seem unable to notice disconnect,
+         * reconnect, or wakeup without the 48 MHz clock active.  so for
+         * correctness, always discard connection state (using reset).
+         *
+         * REVISIT: some boards will be able to turn VBUS off...
+         */
+        if (at91_suspend_entering_slow_clock()) {
+                ohci_usb_reset (ohci);
+                clk_disable(fclk);
+                clk_disable(iclk);
+                clocked = 0;
+        }
 
         return 0;
 }
 
-static int ohci_hcd_at91_drv_resume(struct platform_device *dev)
+static int ohci_hcd_at91_drv_resume(struct platform_device *pdev)
 {
-        clk_enable(iclk);
-        clk_enable(fclk);
+        if (!clocked) {
+                clk_enable(iclk);
+                clk_enable(fclk);
+        }
 
         return 0;
 }
@@ -275,7 +305,7 @@ static int ohci_hcd_at91_drv_resume(struct platform_device *dev)
 #define ohci_hcd_at91_drv_resume  NULL
 #endif
 
-MODULE_ALIAS("at91rm9200-ohci");
+MODULE_ALIAS("at91_ohci");
 
 static struct platform_driver ohci_hcd_at91_driver = {
         .probe          = ohci_hcd_at91_drv_probe,
@@ -283,7 +313,7 @@ static struct platform_driver ohci_hcd_at91_driver = {
         .suspend        = ohci_hcd_at91_drv_suspend,
         .resume         = ohci_hcd_at91_drv_resume,
         .driver         = {
-                .name   = "at91rm9200-ohci",
+                .name   = "at91_ohci",
                 .owner  = THIS_MODULE,
         },
 };
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index 689261e44018..f7a975d5db09 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -101,9 +101,11 @@ static void au1xxx_start_ohc(struct platform_device *dev)
 
 #endif  /* Au1200 */
 
+#ifndef CONFIG_SOC_AU1200
         /* wait for reset complete (read register twice; see au1500 errata) */
         while (au_readl(USB_HOST_CONFIG),
                 !(au_readl(USB_HOST_CONFIG) & USBH_ENABLE_RD))
+#endif
                 udelay(1000);
 
         printk(KERN_DEBUG __FILE__
@@ -157,9 +159,9 @@ static int usb_ohci_au1xxx_probe(const struct hc_driver *driver,
         /* Au1200 AB USB does not support coherent memory */
         if (!(read_c0_prid() & 0xff)) {
                 pr_info("%s: this is chip revision AB !!\n",
-                        dev->dev.name);
+                        dev->name);
                 pr_info("%s: update your board or re-configure the kernel\n",
-                        dev->dev.name);
+                        dev->name);
                 return -ENODEV;
         }
 #endif
diff --git a/drivers/usb/host/ohci-ep93xx.c b/drivers/usb/host/ohci-ep93xx.c
new file mode 100644
index 000000000000..6531c4d26527
--- /dev/null
+++ b/drivers/usb/host/ohci-ep93xx.c
@@ -0,0 +1,225 @@
+/*
+ * OHCI HCD (Host Controller Driver) for USB.
+ *
+ * (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
+ * (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
+ * (C) Copyright 2002 Hewlett-Packard Company
+ *
+ * Bus Glue for ep93xx.
+ *
+ * Written by Christopher Hoover <ch@hpl.hp.com>
+ * Based on fragments of previous driver by Russell King et al.
+ *
+ * Modified for LH7A404 from ohci-sa1111.c
+ *  by Durgesh Pattamatta <pattamattad@sharpsec.com>
+ *
+ * Modified for pxa27x from ohci-lh7a404.c
+ *  by Nick Bane <nick@cecomputing.co.uk> 26-8-2004
+ *
+ * Modified for ep93xx from ohci-pxa27x.c
+ *  by Lennert Buytenhek <buytenh@wantstofly.org> 28-2-2006
+ *  Based on an earlier driver by Ray Lehtiniemi
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/signal.h>
+#include <linux/platform_device.h>
+
+#include <asm/mach-types.h>
+#include <asm/hardware.h>
+
+static struct clk *usb_host_clock;
+
+static void ep93xx_start_hc(struct device *dev)
+{
+        clk_enable(usb_host_clock);
+}
+
+static void ep93xx_stop_hc(struct device *dev)
+{
+        clk_disable(usb_host_clock);
+}
+
+static int usb_hcd_ep93xx_probe(const struct hc_driver *driver,
+                         struct platform_device *pdev)
+{
+        int retval;
+        struct usb_hcd *hcd;
+
+        if (pdev->resource[1].flags != IORESOURCE_IRQ) {
+                pr_debug("resource[1] is not IORESOURCE_IRQ");
+                return -ENOMEM;
+        }
+
+        hcd = usb_create_hcd(driver, &pdev->dev, "ep93xx");
+        if (hcd == NULL)
+                return -ENOMEM;
+
+        hcd->rsrc_start = pdev->resource[0].start;
+        hcd->rsrc_len = pdev->resource[0].end - pdev->resource[0].start + 1;
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                usb_put_hcd(hcd);
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (hcd->regs == NULL) {
+                pr_debug("ioremap failed");
+                retval = -ENOMEM;
+                goto err2;
+        }
+
+        usb_host_clock = clk_get(&pdev->dev, "usb_host");
+        ep93xx_start_hc(&pdev->dev);
+
+        ohci_hcd_init(hcd_to_ohci(hcd));
+
+        retval = usb_add_hcd(hcd, pdev->resource[1].start, SA_INTERRUPT);
+        if (retval == 0)
+                return retval;
+
+        ep93xx_stop_hc(&pdev->dev);
+        iounmap(hcd->regs);
+err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err1:
+        usb_put_hcd(hcd);
+
+        return retval;
+}
+
+static void usb_hcd_ep93xx_remove(struct usb_hcd *hcd,
+                        struct platform_device *pdev)
+{
+        usb_remove_hcd(hcd);
+        ep93xx_stop_hc(&pdev->dev);
+        clk_put(usb_host_clock);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+}
+
+static int __devinit ohci_ep93xx_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int ret;
+
+        if ((ret = ohci_init(ohci)) < 0)
+                return ret;
+
+        if ((ret = ohci_run(ohci)) < 0) {
+                err("can't start %s", hcd->self.bus_name);
+                ohci_stop(hcd);
+                return ret;
+        }
+
+        return 0;
+}
+
+static struct hc_driver ohci_ep93xx_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "EP93xx OHCI",
+        .hcd_priv_size          = sizeof(struct ohci_hcd),
+        .irq                    = ohci_irq,
+        .flags                  = HCD_USB11 | HCD_MEMORY,
+        .start                  = ohci_ep93xx_start,
+        .stop                   = ohci_stop,
+        .urb_enqueue            = ohci_urb_enqueue,
+        .urb_dequeue            = ohci_urb_dequeue,
+        .endpoint_disable       = ohci_endpoint_disable,
+        .get_frame_number       = ohci_get_frame,
+        .hub_status_data        = ohci_hub_status_data,
+        .hub_control            = ohci_hub_control,
+#ifdef CONFIG_PM
+        .bus_suspend            = ohci_bus_suspend,
+        .bus_resume             = ohci_bus_resume,
+#endif
+        .start_port_reset       = ohci_start_port_reset,
+};
+
+extern int usb_disabled(void);
+
+static int ohci_hcd_ep93xx_drv_probe(struct platform_device *pdev)
+{
+        int ret;
+
+        ret = -ENODEV;
+        if (!usb_disabled())
+                ret = usb_hcd_ep93xx_probe(&ohci_ep93xx_hc_driver, pdev);
+
+        return ret;
+}
+
+static int ohci_hcd_ep93xx_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_hcd_ep93xx_remove(hcd, pdev);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int ohci_hcd_ep93xx_drv_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct ochi_hcd *ohci = hcd_to_ohci(hcd);
+
+        if (time_before(jiffies, ohci->next_statechange))
+                msleep(5);
+        ohci->next_statechange = jiffies;
+
+        ep93xx_stop_hc(&pdev->dev);
+        hcd->state = HC_STATE_SUSPENDED;
+        pdev->dev.power.power_state = PMSG_SUSPEND;
+
+        return 0;
+}
+
+static int ohci_hcd_ep93xx_drv_resume(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int status;
+
+        if (time_before(jiffies, ohci->next_statechange))
+                msleep(5);
+        ohci->next_statechange = jiffies;
+
+        ep93xx_start_hc(&pdev->dev);
+        pdev->dev.power.power_state = PMSG_ON;
+        usb_hcd_resume_root_hub(hcd);
+
+        return 0;
+}
+#endif
+
+
+static struct platform_driver ohci_hcd_ep93xx_driver = {
+        .probe          = ohci_hcd_ep93xx_drv_probe,
+        .remove         = ohci_hcd_ep93xx_drv_remove,
+#ifdef CONFIG_PM
+        .suspend        = ohci_hcd_ep93xx_drv_suspend,
+        .resume         = ohci_hcd_ep93xx_drv_resume,
+#endif
+        .driver         = {
+                .name   = "ep93xx-ohci",
+        },
+};
+
+static int __init ohci_hcd_ep93xx_init(void)
+{
+        return platform_driver_register(&ohci_hcd_ep93xx_driver);
+}
+
+static void __exit ohci_hcd_ep93xx_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_ep93xx_driver);
+}
+
+module_init(ohci_hcd_ep93xx_init);
+module_exit(ohci_hcd_ep93xx_cleanup);
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 8fb842ed5f6e..94d8cf4b36c1 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -901,6 +901,10 @@ MODULE_LICENSE ("GPL");
 #include "ohci-pxa27x.c"
 #endif
 
+#ifdef CONFIG_ARCH_EP93XX
+#include "ohci-ep93xx.c"
+#endif
+
 #ifdef CONFIG_SOC_AU1X00
 #include "ohci-au1xxx.c"
 #endif
@@ -909,7 +913,7 @@ MODULE_LICENSE ("GPL");
 #include "ohci-ppc-soc.c"
 #endif
 
-#ifdef CONFIG_ARCH_AT91RM9200
+#if defined(CONFIG_ARCH_AT91RM9200) || defined(CONFIG_ARCH_AT91SAM9261)
 #include "ohci-at91.c"
 #endif
 
@@ -919,9 +923,11 @@ MODULE_LICENSE ("GPL");
       || defined(CONFIG_ARCH_OMAP) \
       || defined (CONFIG_ARCH_LH7A404) \
       || defined (CONFIG_PXA27x) \
+      || defined (CONFIG_ARCH_EP93XX) \
       || defined (CONFIG_SOC_AU1X00) \
       || defined (CONFIG_USB_OHCI_HCD_PPC_SOC) \
       || defined (CONFIG_ARCH_AT91RM9200) \
+      || defined (CONFIG_ARCH_AT91SAM9261) \
         )
 #error "missing bus glue for ohci-hcd"
 #endif
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 0bb972b58336..5b0a23fd798b 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -581,14 +581,14 @@ static int ohci_hub_control (
                 break;
         case GetHubStatus:
                 temp = roothub_status (ohci) & ~(RH_HS_CRWE | RH_HS_DRWE);
-                *(__le32 *) buf = cpu_to_le32 (temp);
+                put_unaligned(cpu_to_le32 (temp), (__le32 *) buf);
                 break;
         case GetPortStatus:
                 if (!wIndex || wIndex > ports)
                         goto error;
                 wIndex--;
                 temp = roothub_portstatus (ohci, wIndex);
-                *(__le32 *) buf = cpu_to_le32 (temp);
+                put_unaligned(cpu_to_le32 (temp), (__le32 *) buf);
 
 #ifndef OHCI_VERBOSE_DEBUG
         if (*(u16*)(buf+2))     /* only if wPortChange is interesting */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index dff60568b4a1..20861650905e 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -167,8 +167,6 @@ static int __devinit mmio_resource_enabled(struct pci_dev *pdev, int idx)
 static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
 {
         void __iomem *base;
-        int wait_time;
-        u32 control;
 
         if (!mmio_resource_enabled(pdev, 0))
                 return;
@@ -179,9 +177,10 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
 
 /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
 #ifndef __hppa__
-        control = readl(base + OHCI_CONTROL);
+{
+        u32 control = readl(base + OHCI_CONTROL);
         if (control & OHCI_CTRL_IR) {
-                wait_time = 500; /* arbitrary; 5 seconds */
+                int wait_time = 500; /* arbitrary; 5 seconds */
                 writel(OHCI_INTR_OC, base + OHCI_INTRENABLE);
                 writel(OHCI_OCR, base + OHCI_CMDSTATUS);
                 while (wait_time > 0 &&
@@ -198,6 +197,7 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
                 /* reset controller, preserving RWC */
                 writel(control & OHCI_CTRL_RWC, base + OHCI_CONTROL);
         }
+}
 #endif
 
         /*
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index c9d72ac0a1d7..431e8f31f1a9 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -372,7 +372,7 @@ static void uhci_fixup_toggles(struct uhci_qh *qh, int skip_first)
                  * need to change any toggles in this URB */
                 td = list_entry(urbp->td_list.next, struct uhci_td, list);
                 if (toggle > 1 || uhci_toggle(td_token(td)) == toggle) {
-                        td = list_entry(urbp->td_list.next, struct uhci_td,
+                        td = list_entry(urbp->td_list.prev, struct uhci_td,
                                         list);
                         toggle = uhci_toggle(td_token(td)) ^ 1;
 
@@ -943,7 +943,9 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
                         /* We received a short packet */
                         if (urb->transfer_flags & URB_SHORT_NOT_OK)
                                 ret = -EREMOTEIO;
-                        else if (ctrlstat & TD_CTRL_SPD)
+
+                        /* Fixup needed only if this isn't the URB's last TD */
+                        else if (&td->list != urbp->td_list.prev)
                                 ret = 1;
                 }
 
@@ -1346,7 +1348,7 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
                 }
 
                 uhci_giveback_urb(uhci, qh, urb, regs);
-                if (status < 0)
+                if (status < 0 && qh->type != USB_ENDPOINT_XFER_ISOC)
                         break;
         }
 
diff --git a/drivers/usb/input/appletouch.c b/drivers/usb/input/appletouch.c
index 9e3f13903371..044faa07e297 100644
--- a/drivers/usb/input/appletouch.c
+++ b/drivers/usb/input/appletouch.c
@@ -597,9 +597,9 @@ static void atp_disconnect(struct usb_interface *iface)
         if (dev) {
                 usb_kill_urb(dev->urb);
                 input_unregister_device(dev->input);
-                usb_free_urb(dev->urb);
                 usb_buffer_free(dev->udev, dev->datalen,
                                 dev->data, dev->urb->transfer_dma);
+                usb_free_urb(dev->urb);
                 kfree(dev);
         }
         printk(KERN_INFO "input: appletouch disconnected\n");
diff --git a/drivers/usb/input/ati_remote.c b/drivers/usb/input/ati_remote.c
index 05d2d6012eb2..3719fcb04b8f 100644
--- a/drivers/usb/input/ati_remote.c
+++ b/drivers/usb/input/ati_remote.c
@@ -111,14 +111,28 @@
 #define NAME_BUFSIZE      80    /* size of product name, path buffers */
 #define DATA_BUFSIZE      63    /* size of URB data buffers */
 
+/*
+ * Duplicate event filtering time.
+ * Sequential, identical KIND_FILTERED inputs with less than
+ * FILTER_TIME milliseconds between them are considered as repeat
+ * events. The hardware generates 5 events for the first keypress
+ * and we have to take this into account for an accurate repeat
+ * behaviour.
+ */
+#define FILTER_TIME     60 /* msec */
+
 static unsigned long channel_mask;
-module_param(channel_mask, ulong, 0444);
+module_param(channel_mask, ulong, 0644);
 MODULE_PARM_DESC(channel_mask, "Bitmask of remote control channels to ignore");
 
 static int debug;
-module_param(debug, int, 0444);
+module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Enable extra debug messages and information");
 
+static int repeat_filter = FILTER_TIME;
+module_param(repeat_filter, int, 0644);
+MODULE_PARM_DESC(repeat_filter, "Repeat filter time, default = 60 msec");
+
 #define dbginfo(dev, format, arg...) do { if (debug) dev_info(dev , format , ## arg); } while (0)
 #undef err
 #define err(format, arg...) printk(KERN_ERR format , ## arg)
@@ -143,19 +157,6 @@ MODULE_DEVICE_TABLE(usb, ati_remote_table);
 static char init1[] = { 0x01, 0x00, 0x20, 0x14 };
 static char init2[] = { 0x01, 0x00, 0x20, 0x14, 0x20, 0x20, 0x20 };
 
-/* Acceleration curve for directional control pad */
-static const char accel[] = { 1, 2, 4, 6, 9, 13, 20 };
-
-/* Duplicate event filtering time.
- * Sequential, identical KIND_FILTERED inputs with less than
- * FILTER_TIME jiffies between them are considered as repeat
- * events. The hardware generates 5 events for the first keypress
- * and we have to take this into account for an accurate repeat
- * behaviour.
- * (HZ / 20) == 50 ms and works well for me.
- */
-#define FILTER_TIME (HZ / 20)
-
 struct ati_remote {
         struct input_dev *idev;
         struct usb_device *udev;
@@ -413,6 +414,43 @@ static int ati_remote_event_lookup(int rem, unsigned char d1, unsigned char d2)
 }
 
 /*
+ *      ati_remote_compute_accel
+ *
+ * Implements acceleration curve for directional control pad
+ * If elapsed time since last event is > 1/4 second, user "stopped",
+ * so reset acceleration. Otherwise, user is probably holding the control
+ * pad down, so we increase acceleration, ramping up over two seconds to
+ * a maximum speed.
+ */
+static int ati_remote_compute_accel(struct ati_remote *ati_remote)
+{
+        static const char accel[] = { 1, 2, 4, 6, 9, 13, 20 };
+        unsigned long now = jiffies;
+        int acc;
+
+        if (time_after(now, ati_remote->old_jiffies + msecs_to_jiffies(250))) {
+                acc = 1;
+                ati_remote->acc_jiffies = now;
+        }
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(125)))
+                acc = accel[0];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(250)))
+                acc = accel[1];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(500)))
+                acc = accel[2];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(1000)))
+                acc = accel[3];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(1500)))
+                acc = accel[4];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(2000)))
+                acc = accel[5];
+        else
+                acc = accel[6];
+
+        return acc;
+}
+
+/*
  *      ati_remote_report_input
  */
 static void ati_remote_input_report(struct urb *urb, struct pt_regs *regs)
@@ -465,9 +503,9 @@ static void ati_remote_input_report(struct urb *urb, struct pt_regs *regs)
 
         if (ati_remote_tbl[index].kind == KIND_FILTERED) {
                 /* Filter duplicate events which happen "too close" together. */
-                if ((ati_remote->old_data[0] == data[1]) &&
-                        (ati_remote->old_data[1] == data[2]) &&
-                        time_before(jiffies, ati_remote->old_jiffies + FILTER_TIME)) {
+                if (ati_remote->old_data[0] == data[1] &&
+                    ati_remote->old_data[1] == data[2] &&
+                    time_before(jiffies, ati_remote->old_jiffies + msecs_to_jiffies(repeat_filter))) {
                         ati_remote->repeat_count++;
                 } else {
                         ati_remote->repeat_count = 0;
@@ -477,75 +515,61 @@ static void ati_remote_input_report(struct urb *urb, struct pt_regs *regs)
                 ati_remote->old_data[1] = data[2];
                 ati_remote->old_jiffies = jiffies;
 
-                if ((ati_remote->repeat_count > 0)
-                    && (ati_remote->repeat_count < 5))
+                if (ati_remote->repeat_count > 0 &&
+                    ati_remote->repeat_count < 5)
                         return;
 
 
                 input_regs(dev, regs);
                 input_event(dev, ati_remote_tbl[index].type,
                         ati_remote_tbl[index].code, 1);
+                input_sync(dev);
                 input_event(dev, ati_remote_tbl[index].type,
                         ati_remote_tbl[index].code, 0);
                 input_sync(dev);
 
-                return;
-        }
+        } else {
 
-        /*
-         * Other event kinds are from the directional control pad, and have an
-         * acceleration factor applied to them.  Without this acceleration, the
-         * control pad is mostly unusable.
-         *
-         * If elapsed time since last event is > 1/4 second, user "stopped",
-         * so reset acceleration. Otherwise, user is probably holding the control
-         * pad down, so we increase acceleration, ramping up over two seconds to
-         * a maximum speed.  The acceleration curve is #defined above.
-         */
-        if (time_after(jiffies, ati_remote->old_jiffies + (HZ >> 2))) {
-                acc = 1;
-                ati_remote->acc_jiffies = jiffies;
-        }
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ >> 3)))  acc = accel[0];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ >> 2)))  acc = accel[1];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ >> 1)))  acc = accel[2];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + HZ))         acc = accel[3];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + HZ+(HZ>>1))) acc = accel[4];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ << 1)))  acc = accel[5];
-        else acc = accel[6];
-
-        input_regs(dev, regs);
-        switch (ati_remote_tbl[index].kind) {
-        case KIND_ACCEL:
-                input_event(dev, ati_remote_tbl[index].type,
-                        ati_remote_tbl[index].code,
-                        ati_remote_tbl[index].value * acc);
-                break;
-        case KIND_LU:
-                input_report_rel(dev, REL_X, -acc);
-                input_report_rel(dev, REL_Y, -acc);
-                break;
-        case KIND_RU:
-                input_report_rel(dev, REL_X, acc);
-                input_report_rel(dev, REL_Y, -acc);
-                break;
-        case KIND_LD:
-                input_report_rel(dev, REL_X, -acc);
-                input_report_rel(dev, REL_Y, acc);
-                break;
-        case KIND_RD:
-                input_report_rel(dev, REL_X, acc);
-                input_report_rel(dev, REL_Y, acc);
-                break;
-        default:
-                dev_dbg(&ati_remote->interface->dev, "ati_remote kind=%d\n",
-                        ati_remote_tbl[index].kind);
-        }
-        input_sync(dev);
+                /*
+                 * Other event kinds are from the directional control pad, and have an
+                 * acceleration factor applied to them.  Without this acceleration, the
+                 * control pad is mostly unusable.
+                 */
+                acc = ati_remote_compute_accel(ati_remote);
+
+                input_regs(dev, regs);
+                switch (ati_remote_tbl[index].kind) {
+                case KIND_ACCEL:
+                        input_event(dev, ati_remote_tbl[index].type,
+                                ati_remote_tbl[index].code,
+                                ati_remote_tbl[index].value * acc);
+                        break;
+                case KIND_LU:
+                        input_report_rel(dev, REL_X, -acc);
+                        input_report_rel(dev, REL_Y, -acc);
+                        break;
+                case KIND_RU:
+                        input_report_rel(dev, REL_X, acc);
+                        input_report_rel(dev, REL_Y, -acc);
+                        break;
+                case KIND_LD:
+                        input_report_rel(dev, REL_X, -acc);
+                        input_report_rel(dev, REL_Y, acc);
+                        break;
+                case KIND_RD:
+                        input_report_rel(dev, REL_X, acc);
+                        input_report_rel(dev, REL_Y, acc);
+                        break;
+                default:
+                        dev_dbg(&ati_remote->interface->dev, "ati_remote kind=%d\n",
+                                ati_remote_tbl[index].kind);
+                }
+                input_sync(dev);
 
-        ati_remote->old_jiffies = jiffies;
-        ati_remote->old_data[0] = data[1];
-        ati_remote->old_data[1] = data[2];
+                ati_remote->old_jiffies = jiffies;
+                ati_remote->old_data[0] = data[1];
+                ati_remote->old_data[1] = data[2];
+        }
 }
 
 /*
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index b9fb9687f926..a2c56b2de589 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -1411,17 +1411,54 @@ void hid_init_reports(struct hid_device *hid)
                 warn("timeout initializing reports");
 }
 
+#define USB_VENDOR_ID_GTCO              0x078c
+#define USB_DEVICE_ID_GTCO_90           0x0090
+#define USB_DEVICE_ID_GTCO_100          0x0100
+#define USB_DEVICE_ID_GTCO_101          0x0101
+#define USB_DEVICE_ID_GTCO_103          0x0103
+#define USB_DEVICE_ID_GTCO_104          0x0104
+#define USB_DEVICE_ID_GTCO_105          0x0105
+#define USB_DEVICE_ID_GTCO_106          0x0106
+#define USB_DEVICE_ID_GTCO_107          0x0107
+#define USB_DEVICE_ID_GTCO_108          0x0108
+#define USB_DEVICE_ID_GTCO_200          0x0200
+#define USB_DEVICE_ID_GTCO_201          0x0201
+#define USB_DEVICE_ID_GTCO_202          0x0202
+#define USB_DEVICE_ID_GTCO_203          0x0203
+#define USB_DEVICE_ID_GTCO_204          0x0204
+#define USB_DEVICE_ID_GTCO_205          0x0205
+#define USB_DEVICE_ID_GTCO_206          0x0206
+#define USB_DEVICE_ID_GTCO_207          0x0207
+#define USB_DEVICE_ID_GTCO_300          0x0300
+#define USB_DEVICE_ID_GTCO_301          0x0301
+#define USB_DEVICE_ID_GTCO_302          0x0302
+#define USB_DEVICE_ID_GTCO_303          0x0303
+#define USB_DEVICE_ID_GTCO_304          0x0304
+#define USB_DEVICE_ID_GTCO_305          0x0305
+#define USB_DEVICE_ID_GTCO_306          0x0306
+#define USB_DEVICE_ID_GTCO_307          0x0307
+#define USB_DEVICE_ID_GTCO_308          0x0308
+#define USB_DEVICE_ID_GTCO_309          0x0309
+#define USB_DEVICE_ID_GTCO_400          0x0400
+#define USB_DEVICE_ID_GTCO_401          0x0401
+#define USB_DEVICE_ID_GTCO_402          0x0402
+#define USB_DEVICE_ID_GTCO_403          0x0403
+#define USB_DEVICE_ID_GTCO_404          0x0404
+#define USB_DEVICE_ID_GTCO_405          0x0405
+#define USB_DEVICE_ID_GTCO_500          0x0500
+#define USB_DEVICE_ID_GTCO_501          0x0501
+#define USB_DEVICE_ID_GTCO_502          0x0502
+#define USB_DEVICE_ID_GTCO_503          0x0503
+#define USB_DEVICE_ID_GTCO_504          0x0504
+#define USB_DEVICE_ID_GTCO_1000         0x1000
+#define USB_DEVICE_ID_GTCO_1001         0x1001
+#define USB_DEVICE_ID_GTCO_1002         0x1002
+#define USB_DEVICE_ID_GTCO_1003         0x1003
+#define USB_DEVICE_ID_GTCO_1004         0x1004
+#define USB_DEVICE_ID_GTCO_1005         0x1005
+#define USB_DEVICE_ID_GTCO_1006         0x1006
+
 #define USB_VENDOR_ID_WACOM             0x056a
-#define USB_DEVICE_ID_WACOM_PENPARTNER  0x0000
-#define USB_DEVICE_ID_WACOM_GRAPHIRE    0x0010
-#define USB_DEVICE_ID_WACOM_INTUOS      0x0020
-#define USB_DEVICE_ID_WACOM_PL          0x0030
-#define USB_DEVICE_ID_WACOM_INTUOS2     0x0040
-#define USB_DEVICE_ID_WACOM_VOLITO      0x0060
-#define USB_DEVICE_ID_WACOM_PTU         0x0003
-#define USB_DEVICE_ID_WACOM_INTUOS3     0x00B0
-#define USB_DEVICE_ID_WACOM_CINTIQ      0x003F
-#define USB_DEVICE_ID_WACOM_DTF         0x00C0
 
 #define USB_VENDOR_ID_ACECAD            0x0460
 #define USB_DEVICE_ID_ACECAD_FLAIR      0x0004
@@ -1507,6 +1544,9 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_4_PHIDGETSERVO_20 0x8104
 #define USB_DEVICE_ID_DUAL_USB_JOYPAD   0x8866
 
+#define USB_VENDOR_ID_WISEGROUP_LTD     0x6677
+#define USB_DEVICE_ID_SMARTJOY_DUAL_PLUS 0x8802
+
 #define USB_VENDOR_ID_CODEMERCS         0x07c0
 #define USB_DEVICE_ID_CODEMERCS_IOW40   0x1500
 #define USB_DEVICE_ID_CODEMERCS_IOW24   0x1501
@@ -1585,6 +1625,51 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_GLAB, USB_DEVICE_ID_0_8_8_IF_KIT, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_POWERMATE, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_SOUNDKNOB, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_90, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_100, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_101, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_103, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_104, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_105, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_106, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_107, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_108, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_200, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_201, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_202, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_203, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_204, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_205, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_206, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_207, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_300, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_301, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_302, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_303, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_304, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_305, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_306, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_307, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_308, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_309, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_400, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_401, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_402, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_403, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_404, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_405, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_500, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_501, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_502, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_503, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_504, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1000, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1001, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1002, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1003, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1004, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1005, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1006, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY, HID_QUIRK_IGNORE },
@@ -1614,49 +1699,6 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_CYCLOPS, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PENPARTNER, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 1, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 2, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 4, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 1, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 2, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 4, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 1, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 2, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 4, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 5, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 7, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 8, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 9, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 1, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 2, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 4, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 5, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 7, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_VOLITO, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_VOLITO + 1, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_VOLITO + 2, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_VOLITO + 3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_VOLITO + 4, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 5, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 6, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PTU, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS3 + 1, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS3 + 2, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS3 + 3, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS3 + 4, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS3 + 5, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_CINTIQ, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_DTF, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_DTF + 3, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_4_PHIDGETSERVO_20, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_1_PHIDGETSERVO_20, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K, HID_QUIRK_IGNORE },
@@ -1670,6 +1712,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
 
         { USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
         { USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU, HID_QUIRK_2WHEEL_MOUSE_HACK_7 },
@@ -1774,6 +1817,10 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
         char *rdesc;
         int n, len, insize = 0;
 
+        /* Ignore all Wacom devices */
+        if (dev->descriptor.idVendor == USB_VENDOR_ID_WACOM)
+                return NULL;
+
         for (n = 0; hid_blacklist[n].idVendor; n++)
                 if ((hid_blacklist[n].idVendor == le16_to_cpu(dev->descriptor.idVendor)) &&
                         (hid_blacklist[n].idProduct == le16_to_cpu(dev->descriptor.idProduct)))
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 028e1ad89f5d..7208839f2dbf 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -607,7 +607,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
 
         }
 
-        if (usage->hat_min < usage->hat_max || usage->hat_dir) {
+        if (usage->type == EV_ABS &&
+            (usage->hat_min < usage->hat_max || usage->hat_dir)) {
                 int i;
                 for (i = usage->code; i < usage->code + 2 && i <= max; i++) {
                         input_set_abs_params(input, i, -1, 1, 0, 0);
diff --git a/drivers/usb/input/hiddev.c b/drivers/usb/input/hiddev.c
index 70477f02cc29..f6b839c257a7 100644
--- a/drivers/usb/input/hiddev.c
+++ b/drivers/usb/input/hiddev.c
@@ -49,7 +49,7 @@ struct hiddev {
         int open;
         wait_queue_head_t wait;
         struct hid_device *hid;
-        struct hiddev_list *list;
+        struct list_head list;
 };
 
 struct hiddev_list {
@@ -59,7 +59,7 @@ struct hiddev_list {
         unsigned flags;
         struct fasync_struct *fasync;
         struct hiddev *hiddev;
-        struct hiddev_list *next;
+        struct list_head node;
 };
 
 static struct hiddev *hiddev_table[HIDDEV_MINORS];
@@ -73,12 +73,15 @@ static struct hiddev *hiddev_table[HIDDEV_MINORS];
 static struct hid_report *
 hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
 {
-        unsigned flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
+        unsigned int flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
+        unsigned int rid = rinfo->report_id & HID_REPORT_ID_MASK;
         struct hid_report_enum *report_enum;
+        struct hid_report *report;
         struct list_head *list;
 
         if (rinfo->report_type < HID_REPORT_TYPE_MIN ||
-            rinfo->report_type > HID_REPORT_TYPE_MAX) return NULL;
+            rinfo->report_type > HID_REPORT_TYPE_MAX)
+                return NULL;
 
         report_enum = hid->report_enum +
                 (rinfo->report_type - HID_REPORT_TYPE_MIN);
@@ -88,21 +91,25 @@ hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
                 break;
 
         case HID_REPORT_ID_FIRST:
-                list = report_enum->report_list.next;
-                if (list == &report_enum->report_list)
+                if (list_empty(&report_enum->report_list))
                         return NULL;
-                rinfo->report_id = ((struct hid_report *) list)->id;
+
+                list = report_enum->report_list.next;
+                report = list_entry(list, struct hid_report, list);
+                rinfo->report_id = report->id;
                 break;
 
         case HID_REPORT_ID_NEXT:
-                list = (struct list_head *)
-                        report_enum->report_id_hash[rinfo->report_id & HID_REPORT_ID_MASK];
-                if (list == NULL)
+                report = report_enum->report_id_hash[rid];
+                if (!report)
                         return NULL;
-                list = list->next;
+
+                list = report->list.next;
                 if (list == &report_enum->report_list)
                         return NULL;
-                rinfo->report_id = ((struct hid_report *) list)->id;
+
+                report = list_entry(list, struct hid_report, list);
+                rinfo->report_id = report->id;
                 break;
 
         default:
@@ -125,12 +132,13 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
         struct hid_field *field;
 
         if (uref->report_type < HID_REPORT_TYPE_MIN ||
-            uref->report_type > HID_REPORT_TYPE_MAX) return NULL;
+            uref->report_type > HID_REPORT_TYPE_MAX)
+                return NULL;
 
         report_enum = hid->report_enum +
                 (uref->report_type - HID_REPORT_TYPE_MIN);
 
-        list_for_each_entry(report, &report_enum->report_list, list)
+        list_for_each_entry(report, &report_enum->report_list, list) {
                 for (i = 0; i < report->maxfield; i++) {
                         field = report->field[i];
                         for (j = 0; j < field->maxusage; j++) {
@@ -142,6 +150,7 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
                                 }
                         }
                 }
+        }
 
         return NULL;
 }
@@ -150,9 +159,9 @@ static void hiddev_send_event(struct hid_device *hid,
                               struct hiddev_usage_ref *uref)
 {
         struct hiddev *hiddev = hid->hiddev;
-        struct hiddev_list *list = hiddev->list;
+        struct hiddev_list *list;
 
-        while (list) {
+        list_for_each_entry(list, &hiddev->list, node) {
                 if (uref->field_index != HID_FIELD_INDEX_NONE ||
                     (list->flags & HIDDEV_FLAG_REPORT) != 0) {
                         list->buffer[list->head] = *uref;
@@ -160,8 +169,6 @@ static void hiddev_send_event(struct hid_device *hid,
                                 (HIDDEV_BUFFER_SIZE - 1);
                         kill_fasync(&list->fasync, SIGIO, POLL_IN);
                 }
-
-                list = list->next;
         }
 
         wake_up_interruptible(&hiddev->wait);
@@ -180,7 +187,7 @@ void hiddev_hid_event(struct hid_device *hid, struct hid_field *field,
         uref.report_type =
           (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
           ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
-           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE:0));
+           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
         uref.report_id = field->report->id;
         uref.field_index = field->index;
         uref.usage_index = (usage - field->usage);
@@ -200,7 +207,7 @@ void hiddev_report_event(struct hid_device *hid, struct hid_report *report)
         uref.report_type =
           (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
           ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
-           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE:0));
+           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
         uref.report_id = report->id;
         uref.field_index = HID_FIELD_INDEX_NONE;
 
@@ -213,7 +220,9 @@ static int hiddev_fasync(int fd, struct file *file, int on)
 {
         int retval;
         struct hiddev_list *list = file->private_data;
+
         retval = fasync_helper(fd, file, on, &list->fasync);
+
         return retval < 0 ? retval : 0;
 }
 
@@ -224,14 +233,9 @@ static int hiddev_fasync(int fd, struct file *file, int on)
 static int hiddev_release(struct inode * inode, struct file * file)
 {
         struct hiddev_list *list = file->private_data;
-        struct hiddev_list **listptr;
 
-        listptr = &list->hiddev->list;
         hiddev_fasync(-1, file, 0);
-
-        while (*listptr && (*listptr != list))
-                listptr = &((*listptr)->next);
-        *listptr = (*listptr)->next;
+        list_del(&list->node);
 
         if (!--list->hiddev->open) {
                 if (list->hiddev->exist)
@@ -248,7 +252,8 @@ static int hiddev_release(struct inode * inode, struct file * file)
 /*
  * open file op
  */
-static int hiddev_open(struct inode * inode, struct file * file) {
+static int hiddev_open(struct inode *inode, struct file *file)
+{
         struct hiddev_list *list;
 
         int i = iminor(inode) - HIDDEV_MINOR_BASE;
@@ -260,9 +265,7 @@ static int hiddev_open(struct inode * inode, struct file * file) {
                 return -ENOMEM;
 
         list->hiddev = hiddev_table[i];
-        list->next = hiddev_table[i]->list;
-        hiddev_table[i]->list = list;
-
+        list_add_tail(&list->node, &hiddev_table[i]->list);
         file->private_data = list;
 
         if (!list->hiddev->open++)
@@ -362,6 +365,7 @@ static ssize_t hiddev_read(struct file * file, char __user * buffer, size_t coun
 static unsigned int hiddev_poll(struct file *file, poll_table *wait)
 {
         struct hiddev_list *list = file->private_data;
+
         poll_wait(file, &list->hiddev->wait, wait);
         if (list->head != list->tail)
                 return POLLIN | POLLRDNORM;
@@ -382,7 +386,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
         struct hiddev_collection_info cinfo;
         struct hiddev_report_info rinfo;
         struct hiddev_field_info finfo;
-        struct hiddev_usage_ref_multi *uref_multi=NULL;
+        struct hiddev_usage_ref_multi *uref_multi = NULL;
         struct hiddev_usage_ref *uref;
         struct hiddev_devinfo dinfo;
         struct hid_report *report;
@@ -764,15 +768,15 @@ int hiddev_connect(struct hid_device *hid)
         }
 
         init_waitqueue_head(&hiddev->wait);
-
-        hiddev_table[hid->intf->minor - HIDDEV_MINOR_BASE] = hiddev;
-
+        INIT_LIST_HEAD(&hiddev->list);
         hiddev->hid = hid;
         hiddev->exist = 1;
 
         hid->minor = hid->intf->minor;
         hid->hiddev = hiddev;
 
+        hiddev_table[hid->intf->minor - HIDDEV_MINOR_BASE] = hiddev;
+
         return 0;
 }
 
diff --git a/drivers/usb/input/usbtouchscreen.c b/drivers/usb/input/usbtouchscreen.c
index 3b175aa482cd..a338bf4c2d78 100644
--- a/drivers/usb/input/usbtouchscreen.c
+++ b/drivers/usb/input/usbtouchscreen.c
@@ -286,7 +286,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
 static int itm_read_data(unsigned char *pkt, int *x, int *y, int *touch, int *press)
 {
         *x = ((pkt[0] & 0x1F) << 7) | (pkt[3] & 0x7F);
-        *x = ((pkt[1] & 0x1F) << 7) | (pkt[4] & 0x7F);
+        *y = ((pkt[1] & 0x1F) << 7) | (pkt[4] & 0x7F);
         *press = ((pkt[2] & 0x1F) << 7) | (pkt[5] & 0x7F);
         *touch = ~pkt[7] & 0x20;
 
diff --git a/drivers/usb/input/yealink.c b/drivers/usb/input/yealink.c
index 575a4e672e96..7b45fd3de911 100644
--- a/drivers/usb/input/yealink.c
+++ b/drivers/usb/input/yealink.c
@@ -810,12 +810,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err)
         if (yld == NULL)
                 return err;
 
-        if (yld->urb_irq) {
-                usb_kill_urb(yld->urb_irq);
-                usb_free_urb(yld->urb_irq);
-        }
-        if (yld->urb_ctl)
-                usb_free_urb(yld->urb_ctl);
+        usb_kill_urb(yld->urb_irq);     /* parameter validation in core/urb */
+        usb_kill_urb(yld->urb_ctl);     /* parameter validation in core/urb */
+
         if (yld->idev) {
                 if (err)
                         input_free_device(yld->idev);
@@ -831,6 +828,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err)
         if (yld->irq_data)
                 usb_buffer_free(yld->udev, USB_PKT_LEN,
                                 yld->irq_data, yld->irq_dma);
+
+        usb_free_urb(yld->urb_irq);     /* parameter validation in core/urb */
+        usb_free_urb(yld->urb_ctl);     /* parameter validation in core/urb */
         kfree(yld);
         return err;
 }
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index daa486dde8cf..88928a4be805 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -88,19 +88,19 @@ config USB_LED
           To compile this driver as a module, choose M here: the
           module will be called usbled.
 
-config USB_CY7C63
+config USB_CYPRESS_CY7C63
         tristate "Cypress CY7C63xxx USB driver support"
         depends on USB
         help
           Say Y here if you want to connect a Cypress CY7C63xxx
-          micro controller to your computer's USB port. This driver
-          supports the pre-programmed devices (incl. firmware) by
-          AK Modul-Bus Computer GmbH.
+          micro controller to your computer's USB port. Currently this
+          driver supports the pre-programmed devices (incl. firmware)
+          by AK Modul-Bus Computer GmbH.
 
           Please see: http://www.ak-modul-bus.de/stat/mikrocontroller.html
 
           To compile this driver as a module, choose M here: the
-          module will be called cy7c63.
+          module will be called cypress_cy7c63.
 
 config USB_CYTHERM
         tristate "Cypress USB thermometer driver support"
diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
index f25a97227297..2927260c5812 100644
--- a/drivers/usb/misc/Makefile
+++ b/drivers/usb/misc/Makefile
@@ -4,7 +4,7 @@
 #
 
 obj-$(CONFIG_USB_AUERSWALD)     += auerswald.o
-obj-$(CONFIG_USB_CY7C63)        += cy7c63.o
+obj-$(CONFIG_USB_CYPRESS_CY7C63)+= cypress_cy7c63.o
 obj-$(CONFIG_USB_CYTHERM)       += cytherm.o
 obj-$(CONFIG_USB_EMI26)         += emi26.o
 obj-$(CONFIG_USB_EMI62)         += emi62.o
diff --git a/drivers/usb/misc/cy7c63.c b/drivers/usb/misc/cy7c63.c
deleted file mode 100644
index 8a1c10b89b76..000000000000
--- a/drivers/usb/misc/cy7c63.c
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
-* cy7c63.c
-*
-* Copyright (c) 2006 Oliver Bock (bock@fh-wolfenbuettel.de)
-*
-*       This driver is based on the Cypress Thermometer USB Driver by
-*       Marcus Maul and the 2.0 version of Greg Kroah-Hartman's
-*       USB Skeleton driver.
-*
-*       Is is a generic driver for the Cypress CY7C63000 family.
-*       For the time being it enables you to toggle the single I/O ports
-*       of the device.
-*
-*       Supported vendors:      AK Modul-Bus Computer GmbH
-*       Supported devices:      CY7C63001A-PC (to be continued...)
-*       Supported functions:    Read/Write Ports (to be continued...)
-*
-*       Chipsets families:      CY7C63000, CY7C63001, CY7C63100, CY7C63101
-*
-*
-*       This program is free software; you can redistribute it and/or
-*       modify it under the terms of the GNU General Public License as
-*       published by the Free Software Foundation, version 2.
-*/
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/usb.h>
-
-#define DRIVER_AUTHOR           "Oliver Bock (bock@fh-wolfenbuettel.de)"
-#define DRIVER_DESC             "Cypress CY7C63xxx USB driver"
-
-#define CY7C63_VENDOR_ID        0xa2c
-#define CY7C63_PRODUCT_ID       0x8
-
-#define CY7C63_READ_PORT        0x4
-#define CY7C63_WRITE_PORT       0x5
-#define CY7C63_READ_RAM         0x2
-#define CY7C63_WRITE_RAM        0x3
-#define CY7C63_READ_ROM         0x1
-
-#define CY7C63_READ_PORT_ID0    0
-#define CY7C63_WRITE_PORT_ID0   0
-#define CY7C63_READ_PORT_ID1    0x2
-#define CY7C63_WRITE_PORT_ID1   1
-
-#define CY7C63_MAX_REQSIZE      8
-
-
-/* table of devices that work with this driver */
-static struct usb_device_id cy7c63_table [] = {
-        { USB_DEVICE(CY7C63_VENDOR_ID, CY7C63_PRODUCT_ID) },
-        { }
-};
-MODULE_DEVICE_TABLE(usb, cy7c63_table);
-
-/* structure to hold all of our device specific stuff */
-struct cy7c63 {
-        struct usb_device *     udev;
-        char                    port0;
-        char                    port1;
-};
-
-/* used to send usb control messages to device */
-int vendor_command(struct cy7c63 *dev, unsigned char request,
-                         unsigned char address, unsigned char data) {
-
-        int retval = 0;
-        unsigned int pipe;
-        unsigned char *iobuf;
-
-        /* allocate some memory for the i/o buffer*/
-        iobuf = kzalloc(CY7C63_MAX_REQSIZE, GFP_KERNEL);
-        if (!iobuf) {
-                dev_err(&dev->udev->dev, "Out of memory!\n");
-                retval = -ENOMEM;
-                goto error;
-        }
-
-        dev_dbg(&dev->udev->dev, "Sending usb_control_msg (data: %d)\n", data);
-
-        /* prepare usb control message and send it upstream */
-        pipe = usb_rcvctrlpipe(dev->udev, 0);
-        retval = usb_control_msg(dev->udev, pipe, request,
-                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
-                                address, data, iobuf, CY7C63_MAX_REQSIZE,
-                                USB_CTRL_GET_TIMEOUT);
-
-        /* store returned data (more READs to be added!) */
-        switch (request) {
-                case CY7C63_READ_PORT:
-                        if (address == CY7C63_READ_PORT_ID0) {
-                                dev->port0 = iobuf[1];
-                                dev_dbg(&dev->udev->dev,
-                                        "READ_PORT0 returned: %d\n",dev->port0);
-                        }
-                        else if (address == CY7C63_READ_PORT_ID1) {
-                                dev->port1 = iobuf[1];
-                                dev_dbg(&dev->udev->dev,
-                                        "READ_PORT1 returned: %d\n",dev->port1);
-                        }
-                        break;
-        }
-
-        kfree(iobuf);
-error:
-        return retval;
-}
-
-#define get_set_port(num,read_id,write_id) \
-static ssize_t set_port##num(struct device *dev, struct device_attribute *attr, \
-                                        const char *buf, size_t count) {        \
-                                                                                \
-        int value;                                                              \
-        int result = 0;                                                         \
-                                                                                \
-        struct usb_interface *intf = to_usb_interface(dev);                     \
-        struct cy7c63 *cyp = usb_get_intfdata(intf);                            \
-                                                                                \
-        dev_dbg(&cyp->udev->dev, "WRITE_PORT%d called\n", num);                 \
-                                                                                \
-        /* validate input data */                                               \
-        if (sscanf(buf, "%d", &value) < 1) {                                    \
-                result = -EINVAL;                                               \
-                goto error;                                                     \
-        }                                                                       \
-        if (value>255 || value<0) {                                             \
-                result = -EINVAL;                                               \
-                goto error;                                                     \
-        }                                                                       \
-                                                                                \
-        result = vendor_command(cyp, CY7C63_WRITE_PORT, write_id,               \
-                                         (unsigned char)value);                 \
-                                                                                \
-        dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n",result);    \
-error:                                                                          \
-        return result < 0 ? result : count;                                     \
-}                                                                               \
-                                                                                \
-static ssize_t get_port##num(struct device *dev,                                \
-                                 struct device_attribute *attr, char *buf) {    \
-                                                                                \
-        int result = 0;                                                         \
-                                                                                \
-        struct usb_interface *intf = to_usb_interface(dev);                     \
-        struct cy7c63 *cyp = usb_get_intfdata(intf);                            \
-                                                                                \
-        dev_dbg(&cyp->udev->dev, "READ_PORT%d called\n", num);                  \
-                                                                                \
-        result = vendor_command(cyp, CY7C63_READ_PORT, read_id, 0);             \
-                                                                                \
-        dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n", result);   \
-                                                                                \
-        return sprintf(buf, "%d", cyp->port##num);                              \
-}                                                                               \
-static DEVICE_ATTR(port##num, S_IWUGO | S_IRUGO, get_port##num, set_port##num);
-
-get_set_port(0, CY7C63_READ_PORT_ID0, CY7C63_WRITE_PORT_ID0);
-get_set_port(1, CY7C63_READ_PORT_ID1, CY7C63_WRITE_PORT_ID1);
-
-static int cy7c63_probe(struct usb_interface *interface,
-                        const struct usb_device_id *id) {
-
-        struct cy7c63 *dev = NULL;
-        int retval = -ENOMEM;
-
-        /* allocate memory for our device state and initialize it */
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
-        if (dev == NULL) {
-                dev_err(&dev->udev->dev, "Out of memory!\n");
-                goto error;
-        }
-
-        dev->udev = usb_get_dev(interface_to_usbdev(interface));
-
-        /* save our data pointer in this interface device */
-        usb_set_intfdata(interface, dev);
-
-        /* create device attribute files */
-        device_create_file(&interface->dev, &dev_attr_port0);
-        device_create_file(&interface->dev, &dev_attr_port1);
-
-        /* let the user know what node this device is now attached to */
-        dev_info(&interface->dev,
-                "Cypress CY7C63xxx device now attached\n");
-
-        retval = 0;
-error:
-        return retval;
-}
-
-static void cy7c63_disconnect(struct usb_interface *interface) {
-
-        struct cy7c63 *dev;
-
-        dev = usb_get_intfdata(interface);
-        usb_set_intfdata(interface, NULL);
-
-        /* remove device attribute files */
-        device_remove_file(&interface->dev, &dev_attr_port0);
-        device_remove_file(&interface->dev, &dev_attr_port1);
-
-        usb_put_dev(dev->udev);
-
-        dev_info(&interface->dev,
-                "Cypress CY7C63xxx device now disconnected\n");
-
-        kfree(dev);
-}
-
-static struct usb_driver cy7c63_driver = {
-        .name = "cy7c63",
-        .probe = cy7c63_probe,
-        .disconnect = cy7c63_disconnect,
-        .id_table = cy7c63_table,
-};
-
-static int __init cy7c63_init(void) {
-
-        int result;
-
-        /* register this driver with the USB subsystem */
-        result = usb_register(&cy7c63_driver);
-        if (result) {
-                err("Function usb_register failed! Error number: %d\n", result);
-        }
-
-        return result;
-}
-
-static void __exit cy7c63_exit(void) {
-
-        /* deregister this driver with the USB subsystem */
-        usb_deregister(&cy7c63_driver);
-}
-
-module_init(cy7c63_init);
-module_exit(cy7c63_exit);
-
-MODULE_AUTHOR(DRIVER_AUTHOR);
-MODULE_DESCRIPTION(DRIVER_DESC);
-
-MODULE_LICENSE("GPL");
diff --git a/drivers/usb/misc/cypress_cy7c63.c b/drivers/usb/misc/cypress_cy7c63.c
new file mode 100644
index 000000000000..9c46746d5d00
--- /dev/null
+++ b/drivers/usb/misc/cypress_cy7c63.c
@@ -0,0 +1,284 @@
+/*
+* cypress_cy7c63.c
+*
+* Copyright (c) 2006 Oliver Bock (o.bock@fh-wolfenbuettel.de)
+*
+*       This driver is based on the Cypress USB Driver by Marcus Maul
+*       (cyport) and the 2.0 version of Greg Kroah-Hartman's
+*       USB Skeleton driver.
+*
+*       This is a generic driver for the Cypress CY7C63xxx family.
+*       For the time being it enables you to read from and write to
+*       the single I/O ports of the device.
+*
+*       Supported vendors:      AK Modul-Bus Computer GmbH
+*                               (Firmware "Port-Chip")
+*
+*       Supported devices:      CY7C63001A-PC
+*                               CY7C63001C-PXC
+*                               CY7C63001C-SXC
+*
+*       Supported functions:    Read/Write Ports
+*
+*
+*       This program is free software; you can redistribute it and/or
+*       modify it under the terms of the GNU General Public License as
+*       published by the Free Software Foundation, version 2.
+*/
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/usb.h>
+
+#define DRIVER_AUTHOR           "Oliver Bock (o.bock@fh-wolfenbuettel.de)"
+#define DRIVER_DESC             "Cypress CY7C63xxx USB driver"
+
+#define CYPRESS_VENDOR_ID       0xa2c
+#define CYPRESS_PRODUCT_ID      0x8
+
+#define CYPRESS_READ_PORT       0x4
+#define CYPRESS_WRITE_PORT      0x5
+
+#define CYPRESS_READ_RAM        0x2
+#define CYPRESS_WRITE_RAM       0x3
+#define CYPRESS_READ_ROM        0x1
+
+#define CYPRESS_READ_PORT_ID0   0
+#define CYPRESS_WRITE_PORT_ID0  0
+#define CYPRESS_READ_PORT_ID1   0x2
+#define CYPRESS_WRITE_PORT_ID1  1
+
+#define CYPRESS_MAX_REQSIZE     8
+
+
+/* table of devices that work with this driver */
+static struct usb_device_id cypress_table [] = {
+        { USB_DEVICE(CYPRESS_VENDOR_ID, CYPRESS_PRODUCT_ID) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, cypress_table);
+
+/* structure to hold all of our device specific stuff */
+struct cypress {
+        struct usb_device *     udev;
+        unsigned char           port[2];
+};
+
+/* used to send usb control messages to device */
+static int vendor_command(struct cypress *dev, unsigned char request,
+                          unsigned char address, unsigned char data)
+{
+        int retval = 0;
+        unsigned int pipe;
+        unsigned char *iobuf;
+
+        /* allocate some memory for the i/o buffer*/
+        iobuf = kzalloc(CYPRESS_MAX_REQSIZE, GFP_KERNEL);
+        if (!iobuf) {
+                dev_err(&dev->udev->dev, "Out of memory!\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        dev_dbg(&dev->udev->dev, "Sending usb_control_msg (data: %d)\n", data);
+
+        /* prepare usb control message and send it upstream */
+        pipe = usb_rcvctrlpipe(dev->udev, 0);
+        retval = usb_control_msg(dev->udev, pipe, request,
+                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+                                 address, data, iobuf, CYPRESS_MAX_REQSIZE,
+                                 USB_CTRL_GET_TIMEOUT);
+
+        /* store returned data (more READs to be added) */
+        switch (request) {
+                case CYPRESS_READ_PORT:
+                        if (address == CYPRESS_READ_PORT_ID0) {
+                                dev->port[0] = iobuf[1];
+                                dev_dbg(&dev->udev->dev,
+                                        "READ_PORT0 returned: %d\n",
+                                        dev->port[0]);
+                        }
+                        else if (address == CYPRESS_READ_PORT_ID1) {
+                                dev->port[1] = iobuf[1];
+                                dev_dbg(&dev->udev->dev,
+                                        "READ_PORT1 returned: %d\n",
+                                        dev->port[1]);
+                        }
+                        break;
+        }
+
+        kfree(iobuf);
+error:
+        return retval;
+}
+
+/* write port value */
+static ssize_t write_port(struct device *dev, struct device_attribute *attr,
+                          const char *buf, size_t count,
+                          int port_num, int write_id)
+{
+        int value = -1;
+        int result = 0;
+
+        struct usb_interface *intf = to_usb_interface(dev);
+        struct cypress *cyp = usb_get_intfdata(intf);
+
+        dev_dbg(&cyp->udev->dev, "WRITE_PORT%d called\n", port_num);
+
+        /* validate input data */
+        if (sscanf(buf, "%d", &value) < 1) {
+                result = -EINVAL;
+                goto error;
+        }
+        if (value < 0 || value > 255) {
+                result = -EINVAL;
+                goto error;
+        }
+
+        result = vendor_command(cyp, CYPRESS_WRITE_PORT, write_id,
+                                (unsigned char)value);
+
+        dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n", result);
+error:
+        return result < 0 ? result : count;
+}
+
+/* attribute callback handler (write) */
+static ssize_t set_port0_handler(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        return write_port(dev, attr, buf, count, 0, CYPRESS_WRITE_PORT_ID0);
+}
+
+/* attribute callback handler (write) */
+static ssize_t set_port1_handler(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        return write_port(dev, attr, buf, count, 1, CYPRESS_WRITE_PORT_ID1);
+}
+
+/* read port value */
+static ssize_t read_port(struct device *dev, struct device_attribute *attr,
+                         char *buf, int port_num, int read_id)
+{
+        int result = 0;
+
+        struct usb_interface *intf = to_usb_interface(dev);
+        struct cypress *cyp = usb_get_intfdata(intf);
+
+        dev_dbg(&cyp->udev->dev, "READ_PORT%d called\n", port_num);
+
+        result = vendor_command(cyp, CYPRESS_READ_PORT, read_id, 0);
+
+        dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n", result);
+
+        return sprintf(buf, "%d", cyp->port[port_num]);
+}
+
+/* attribute callback handler (read) */
+static ssize_t get_port0_handler(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return read_port(dev, attr, buf, 0, CYPRESS_READ_PORT_ID0);
+}
+
+/* attribute callback handler (read) */
+static ssize_t get_port1_handler(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return read_port(dev, attr, buf, 1, CYPRESS_READ_PORT_ID1);
+}
+
+static DEVICE_ATTR(port0, S_IWUGO | S_IRUGO,
+                   get_port0_handler, set_port0_handler);
+
+static DEVICE_ATTR(port1, S_IWUGO | S_IRUGO,
+                   get_port1_handler, set_port1_handler);
+
+
+static int cypress_probe(struct usb_interface *interface,
+                         const struct usb_device_id *id)
+{
+        struct cypress *dev = NULL;
+        int retval = -ENOMEM;
+
+        /* allocate memory for our device state and initialize it */
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (dev == NULL) {
+                dev_err(&interface->dev, "Out of memory!\n");
+                goto error;
+        }
+
+        dev->udev = usb_get_dev(interface_to_usbdev(interface));
+
+        /* save our data pointer in this interface device */
+        usb_set_intfdata(interface, dev);
+
+        /* create device attribute files */
+        device_create_file(&interface->dev, &dev_attr_port0);
+        device_create_file(&interface->dev, &dev_attr_port1);
+
+        /* let the user know that the device is now attached */
+        dev_info(&interface->dev,
+                 "Cypress CY7C63xxx device now attached\n");
+
+        retval = 0;
+error:
+        return retval;
+}
+
+static void cypress_disconnect(struct usb_interface *interface)
+{
+        struct cypress *dev;
+
+        dev = usb_get_intfdata(interface);
+        usb_set_intfdata(interface, NULL);
+
+        /* remove device attribute files */
+        device_remove_file(&interface->dev, &dev_attr_port0);
+        device_remove_file(&interface->dev, &dev_attr_port1);
+
+        usb_put_dev(dev->udev);
+
+        dev_info(&interface->dev,
+                 "Cypress CY7C63xxx device now disconnected\n");
+
+        kfree(dev);
+}
+
+static struct usb_driver cypress_driver = {
+        .name = "cypress_cy7c63",
+        .probe = cypress_probe,
+        .disconnect = cypress_disconnect,
+        .id_table = cypress_table,
+};
+
+static int __init cypress_init(void)
+{
+        int result;
+
+        /* register this driver with the USB subsystem */
+        result = usb_register(&cypress_driver);
+        if (result) {
+                err("Function usb_register failed! Error number: %d\n", result);
+        }
+
+        return result;
+}
+
+static void __exit cypress_exit(void)
+{
+        /* deregister this driver with the USB subsystem */
+        usb_deregister(&cypress_driver);
+}
+
+module_init(cypress_init);
+module_exit(cypress_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 738bd7c7451f..e16582f3733c 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3435,6 +3435,8 @@ static void sisusb_disconnect(struct usb_interface *intf)
 
 static struct usb_device_id sisusb_table [] = {
         { USB_DEVICE(0x0711, 0x0900) },
+        { USB_DEVICE(0x0711, 0x0901) },
+        { USB_DEVICE(0x0711, 0x0902) },
         { USB_DEVICE(0x182d, 0x021c) },
         { USB_DEVICE(0x182d, 0x0269) },
         { }
diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
index c82c402285a0..e095772dd8e9 100644
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -200,10 +200,8 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer, siz
 
         /* create a urb, and a buffer for it, and copy the data to the urb */
         urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!urb) {
-                retval = -ENOMEM;
-                goto error;
-        }
+        if (!urb)
+                return -ENOMEM;
         
         buf = usb_buffer_alloc(dev->udev, count, GFP_KERNEL, &urb->transfer_dma);
         if (!buf) {
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 786e1dbe88ec..983e104dd452 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -1242,11 +1242,12 @@ done:
 static int ctrl_out (struct usbtest_dev *dev,
                 unsigned count, unsigned length, unsigned vary)
 {
-        unsigned                i, j, len, retval;
+        unsigned                i, j, len;
+        int                     retval;
         u8                      *buf;
         char                    *what = "?";
         struct usb_device       *udev;
-        
+
         if (length < 1 || length > 0xffff || vary >= length)
                 return -EINVAL;
 
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index e02c1a30c4cd..f961a770cee2 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -64,7 +64,6 @@ struct mon_reader_text {
 };
 
 static void mon_text_ctor(void *, kmem_cache_t *, unsigned long);
-static void mon_text_dtor(void *, kmem_cache_t *, unsigned long);
 
 /*
  * mon_text_submit
@@ -268,7 +267,7 @@ static int mon_text_open(struct inode *inode, struct file *file)
             (long)rp);
         rp->e_slab = kmem_cache_create(rp->slab_name,
             sizeof(struct mon_event_text), sizeof(long), 0,
-            mon_text_ctor, mon_text_dtor);
+            mon_text_ctor, NULL);
         if (rp->e_slab == NULL) {
                 rc = -ENOMEM;
                 goto err_slab;
@@ -459,7 +458,3 @@ static void mon_text_ctor(void *mem, kmem_cache_t *slab, unsigned long sflags)
         memset(mem, 0xe5, sizeof(struct mon_event_text));
 }
 
-static void mon_text_dtor(void *mem, kmem_cache_t *slab, unsigned long sflags)
-{
-        ;
-}
diff --git a/drivers/usb/net/pegasus.h b/drivers/usb/net/pegasus.h
index a54752ce1493..006438069b66 100644
--- a/drivers/usb/net/pegasus.h
+++ b/drivers/usb/net/pegasus.h
@@ -131,6 +131,7 @@ struct usb_eth_dev {
 #define VENDOR_COREGA           0x07aa
 #define VENDOR_DLINK            0x2001
 #define VENDOR_ELCON            0x0db7
+#define VENDOR_ELECOM           0x056e
 #define VENDOR_ELSA             0x05cc
 #define VENDOR_GIGABYTE         0x1044
 #define VENDOR_HAWKING          0x0e66
@@ -233,6 +234,8 @@ PEGASUS_DEV( "D-Link DSB-650", VENDOR_DLINK, 0xabc1,
                 DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "GOLDPFEIL USB Adapter", VENDOR_ELCON, 0x0002,
                 DEFAULT_GPIO_RESET | PEGASUS_II | HAS_HOME_PNA )
+PEGASUS_DEV( "ELECOM USB Ethernet LD-USB20", VENDOR_ELECOM,  0x4010,
+                DEFAULT_GPIO_RESET  | PEGASUS_II )
 PEGASUS_DEV( "EasiDock Ethernet", VENDOR_MOBILITY, 0x0304,
                 DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "Elsa Micolink USB2Ethernet", VENDOR_ELSA, 0x3000,
diff --git a/drivers/usb/net/rtl8150.c b/drivers/usb/net/rtl8150.c
index 718f8e2b552b..a72685b96061 100644
--- a/drivers/usb/net/rtl8150.c
+++ b/drivers/usb/net/rtl8150.c
@@ -128,11 +128,13 @@
 #define VENDOR_ID_MELCO                 0x0411
 #define VENDOR_ID_MICRONET              0x3980
 #define VENDOR_ID_LONGSHINE             0x07b8
+#define VENDOR_ID_ZYXEL                 0x0586
 
 #define PRODUCT_ID_RTL8150              0x8150
 #define PRODUCT_ID_LUAKTX               0x0012
 #define PRODUCT_ID_LCS8138TX            0x401a
 #define PRODUCT_ID_SP128AR              0x0003
+#define PRODUCT_ID_PRESTIGE             0x401a
 
 #undef  EEPROM_WRITE
 
@@ -142,6 +144,7 @@ static struct usb_device_id rtl8150_table[] = {
         {USB_DEVICE(VENDOR_ID_MELCO, PRODUCT_ID_LUAKTX)},
         {USB_DEVICE(VENDOR_ID_MICRONET, PRODUCT_ID_SP128AR)},
         {USB_DEVICE(VENDOR_ID_LONGSHINE, PRODUCT_ID_LCS8138TX)},
+        {USB_DEVICE(VENDOR_ID_ZYXEL, PRODUCT_ID_PRESTIGE)},
         {}
 };
 
@@ -172,6 +175,8 @@ static inline struct sk_buff *pull_skb(rtl8150_t *);
 static void rtl8150_disconnect(struct usb_interface *intf);
 static int rtl8150_probe(struct usb_interface *intf,
                            const struct usb_device_id *id);
+static int rtl8150_suspend(struct usb_interface *intf, pm_message_t message);
+static int rtl8150_resume(struct usb_interface *intf);
 
 static const char driver_name [] = "rtl8150";
 
@@ -180,6 +185,8 @@ static struct usb_driver rtl8150_driver = {
         .probe =        rtl8150_probe,
         .disconnect =   rtl8150_disconnect,
         .id_table =     rtl8150_table,
+        .suspend =      rtl8150_suspend,
+        .resume =       rtl8150_resume
 };
 
 /*
@@ -235,9 +242,11 @@ static int async_set_registers(rtl8150_t * dev, u16 indx, u16 size)
         usb_fill_control_urb(dev->ctrl_urb, dev->udev,
                          usb_sndctrlpipe(dev->udev, 0), (char *) &dev->dr,
                          &dev->rx_creg, size, ctrl_callback, dev);
-        if ((ret = usb_submit_urb(dev->ctrl_urb, GFP_ATOMIC)))
+        if ((ret = usb_submit_urb(dev->ctrl_urb, GFP_ATOMIC))) {
+                if (ret == -ENODEV)
+                        netif_device_detach(dev->netdev);
                 err("control request submission failed: %d", ret);
-        else
+        } else
                 set_bit(RX_REG_SET, &dev->flags);
 
         return ret;
@@ -413,6 +422,7 @@ static void read_bulk_callback(struct urb *urb, struct pt_regs *regs)
         struct sk_buff *skb;
         struct net_device *netdev;
         u16 rx_stat;
+        int status;
 
         dev = urb->context;
         if (!dev)
@@ -462,7 +472,10 @@ static void read_bulk_callback(struct urb *urb, struct pt_regs *regs)
 goon:
         usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
                       dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
-        if (usb_submit_urb(dev->rx_urb, GFP_ATOMIC)) {
+        status = usb_submit_urb(dev->rx_urb, GFP_ATOMIC);
+        if (status == -ENODEV)
+                netif_device_detach(dev->netdev);
+        else if (status) {
                 set_bit(RX_URB_FAIL, &dev->flags);
                 goto resched;
         } else {
@@ -478,6 +491,7 @@ static void rx_fixup(unsigned long data)
 {
         rtl8150_t *dev;
         struct sk_buff *skb;
+        int status;
 
         dev = (rtl8150_t *)data;
 
@@ -496,10 +510,13 @@ static void rx_fixup(unsigned long data)
         usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
                       dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
 try_again:
-        if (usb_submit_urb(dev->rx_urb, GFP_ATOMIC)) {
+        status = usb_submit_urb(dev->rx_urb, GFP_ATOMIC);
+        if (status == -ENODEV) {
+                netif_device_detach(dev->netdev);
+        } else if (status) {
                 set_bit(RX_URB_FAIL, &dev->flags);
                 goto tlsched;
-         } else {
+        } else {
                 clear_bit(RX_URB_FAIL, &dev->flags);
         }
 
@@ -571,12 +588,43 @@ static void intr_callback(struct urb *urb, struct pt_regs *regs)
 
 resubmit:
         status = usb_submit_urb (urb, SLAB_ATOMIC);
-        if (status)
+        if (status == -ENODEV)
+                netif_device_detach(dev->netdev);
+        else if (status)
                 err ("can't resubmit intr, %s-%s/input0, status %d",
                                 dev->udev->bus->bus_name,
                                 dev->udev->devpath, status);
 }
 
+static int rtl8150_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        rtl8150_t *dev = usb_get_intfdata(intf);
+
+        netif_device_detach(dev->netdev);
+
+        if (netif_running(dev->netdev)) {
+                usb_kill_urb(dev->rx_urb);
+                usb_kill_urb(dev->intr_urb);
+        }
+        return 0;
+}
+
+static int rtl8150_resume(struct usb_interface *intf)
+{
+        rtl8150_t *dev = usb_get_intfdata(intf);
+
+        netif_device_attach(dev->netdev);
+        if (netif_running(dev->netdev)) {
+                dev->rx_urb->status = 0;
+                dev->rx_urb->actual_length = 0;
+                read_bulk_callback(dev->rx_urb, NULL);
+
+                dev->intr_urb->status = 0;
+                dev->intr_urb->actual_length = 0;
+                intr_callback(dev->intr_urb, NULL);
+        }
+        return 0;
+}
 
 /*
 **
@@ -687,9 +735,14 @@ static int rtl8150_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2),
                       skb->data, count, write_bulk_callback, dev);
         if ((res = usb_submit_urb(dev->tx_urb, GFP_ATOMIC))) {
-                warn("failed tx_urb %d\n", res);
-                dev->stats.tx_errors++;
-                netif_start_queue(netdev);
+                /* Can we get/handle EPIPE here? */
+                if (res == -ENODEV)
+                        netif_device_detach(dev->netdev);
+                else {
+                        warn("failed tx_urb %d\n", res);
+                        dev->stats.tx_errors++;
+                        netif_start_queue(netdev);
+                }
         } else {
                 dev->stats.tx_packets++;
                 dev->stats.tx_bytes += skb->len;
@@ -726,16 +779,25 @@ static int rtl8150_open(struct net_device *netdev)
         
         usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
                       dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
-        if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL)))
+        if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL))) {
+                if (res == -ENODEV)
+                        netif_device_detach(dev->netdev);
                 warn("%s: rx_urb submit failed: %d", __FUNCTION__, res);
+                return res;
+        }
         usb_fill_int_urb(dev->intr_urb, dev->udev, usb_rcvintpipe(dev->udev, 3),
                      dev->intr_buff, INTBUFSIZE, intr_callback,
                      dev, dev->intr_interval);
-        if ((res = usb_submit_urb(dev->intr_urb, GFP_KERNEL)))
+        if ((res = usb_submit_urb(dev->intr_urb, GFP_KERNEL))) {
+                if (res == -ENODEV)
+                        netif_device_detach(dev->netdev);
                 warn("%s: intr_urb submit failed: %d", __FUNCTION__, res);
-        netif_start_queue(netdev);
+                usb_kill_urb(dev->rx_urb);
+                return res;
+        }
         enable_net_traffic(dev);
         set_carrier(netdev);
+        netif_start_queue(netdev);
 
         return res;
 }
@@ -910,6 +972,7 @@ static void rtl8150_disconnect(struct usb_interface *intf)
         if (dev) {
                 set_bit(RTL8150_UNPLUG, &dev->flags);
                 tasklet_disable(&dev->tl);
+                tasklet_kill(&dev->tl);
                 unregister_netdev(dev->netdev);
                 unlink_all_urbs(dev);
                 free_all_urbs(dev);
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 8bd44fda5eaf..f5b9438c94f0 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -62,15 +62,6 @@ config USB_SERIAL_AIRPRIME
           To compile this driver as a module, choose M here: the
           module will be called airprime.
 
-config USB_SERIAL_ANYDATA
-        tristate "USB AnyData CDMA Wireless Driver"
-        depends on USB_SERIAL
-        help
-          Say Y here if you want to use a AnyData CDMA device.
-
-          To compile this driver as a module, choose M here: the
-          module will be called anydata.
-
 config USB_SERIAL_ARK3116
         tristate "USB ARK Micro 3116 USB Serial Driver (EXPERIMENTAL)"
         depends on USB_SERIAL && EXPERIMENTAL
@@ -456,6 +447,17 @@ config USB_SERIAL_SAFE_PADDED
         bool "USB Secure Encapsulated Driver - Padded"
         depends on USB_SERIAL_SAFE
 
+config USB_SERIAL_SIERRAWIRELESS
+        tristate "USB Sierra Wireless Driver"
+        depends on USB_SERIAL
+        help
+          Say M here if you want to use a Sierra Wireless device (if
+          using an PC 5220 or AC580 please use the Airprime driver
+          instead).
+
+          To compile this driver as a module, choose M here: the
+          module will be called sierra.
+
 config USB_SERIAL_TI
         tristate "USB TI 3410/5052 Serial Driver"
         depends on USB_SERIAL
@@ -491,15 +493,18 @@ config USB_SERIAL_XIRCOM
           module will be called keyspan_pda.
 
 config USB_SERIAL_OPTION
-        tristate "USB driver for GSM modems"
+        tristate "USB driver for GSM and CDMA modems"
         depends on USB_SERIAL
         help
-          Say Y here if you have an "Option" GSM PCMCIA card
-          (or an OEM version: branded Huawei, Audiovox, or Novatel).
+          Say Y here if you have a GSM or CDMA modem that's connected to USB.
+
+          This driver also supports several PCMCIA cards which have a
+          built-in OHCI-USB adapter and an internally-connected GSM modem.
+          The USB bus on these cards is not accessible externally.
 
-          These cards feature a built-in OHCI-USB adapter and an
-          internally-connected GSM modem. The USB bus is not
-          accessible externally.
+          Supported devices include (some of?) those made by:
+          Option, Huawei, Audiovox, Sierra Wireless, Novatel Wireless, or
+          Anydata.
 
           To compile this driver as a module, choose M here: the
           module will be called option.
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index 5a0960fc9d3e..8efed2ce1ba3 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -12,7 +12,6 @@ usbserial-obj-$(CONFIG_USB_EZUSB)		+= ezusb.o
 usbserial-objs  := usb-serial.o generic.o bus.o $(usbserial-obj-y)
 
 obj-$(CONFIG_USB_SERIAL_AIRPRIME)               += airprime.o
-obj-$(CONFIG_USB_SERIAL_ANYDATA)                += anydata.o
 obj-$(CONFIG_USB_SERIAL_ARK3116)                += ark3116.o
 obj-$(CONFIG_USB_SERIAL_BELKIN)                 += belkin_sa.o
 obj-$(CONFIG_USB_SERIAL_CP2101)                 += cp2101.o
@@ -39,6 +38,7 @@ obj-$(CONFIG_USB_SERIAL_OMNINET)		+= omninet.o
 obj-$(CONFIG_USB_SERIAL_OPTION)                 += option.o
 obj-$(CONFIG_USB_SERIAL_PL2303)                 += pl2303.o
 obj-$(CONFIG_USB_SERIAL_SAFE)                   += safe_serial.o
+obj-$(CONFIG_USB_SERIAL_SIERRAWIRELESS)         += sierra.o
 obj-$(CONFIG_USB_SERIAL_TI)                     += ti_usb_3410_5052.o
 obj-$(CONFIG_USB_SERIAL_VISOR)                  += visor.o
 obj-$(CONFIG_USB_SERIAL_WHITEHEAT)              += whiteheat.o
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 94b9ba0ff875..62082532a8b3 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -13,7 +13,7 @@
 #include <linux/tty.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
diff --git a/drivers/usb/serial/anydata.c b/drivers/usb/serial/anydata.c
deleted file mode 100644
index 343f6f228220..000000000000
--- a/drivers/usb/serial/anydata.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * AnyData CDMA Serial USB driver
- *
- * Copyright (C) 2005 Greg Kroah-Hartman <gregkh@suse.de>
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License version
- *      2 as published by the Free Software Foundation.
- */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/tty.h>
-#include <linux/module.h>
-#include <linux/usb.h>
-#include "usb-serial.h"
-
-static struct usb_device_id id_table [] = {
-        { USB_DEVICE(0x16d5, 0x6501) }, /* AirData CDMA device */
-        { },
-};
-MODULE_DEVICE_TABLE(usb, id_table);
-
-/* if overridden by the user, then use their value for the size of the
- * read and write urbs */
-static int buffer_size;
-static int debug;
-
-static struct usb_driver anydata_driver = {
-        .name =         "anydata",
-        .probe =        usb_serial_probe,
-        .disconnect =   usb_serial_disconnect,
-        .id_table =     id_table,
-        .no_dynamic_id =        1,
-};
-
-static int anydata_open(struct usb_serial_port *port, struct file *filp)
-{
-        char *buffer;
-        int result = 0;
-
-        dbg("%s - port %d", __FUNCTION__, port->number);
-
-        if (buffer_size) {
-                /* override the default buffer sizes */
-                buffer = kmalloc(buffer_size, GFP_KERNEL);
-                if (!buffer) {
-                        dev_err(&port->dev, "%s - out of memory.\n",
-                                __FUNCTION__);
-                        return -ENOMEM;
-                }
-                kfree (port->read_urb->transfer_buffer);
-                port->read_urb->transfer_buffer = buffer;
-                port->read_urb->transfer_buffer_length = buffer_size;
-
-                buffer = kmalloc(buffer_size, GFP_KERNEL);
-                if (!buffer) {
-                        dev_err(&port->dev, "%s - out of memory.\n",
-                                __FUNCTION__);
-                        return -ENOMEM;
-                }
-                kfree (port->write_urb->transfer_buffer);
-                port->write_urb->transfer_buffer = buffer;
-                port->write_urb->transfer_buffer_length = buffer_size;
-                port->bulk_out_size = buffer_size;
-        }
-
-        /* Start reading from the device */
-        usb_fill_bulk_urb(port->read_urb, port->serial->dev,
-                          usb_rcvbulkpipe(port->serial->dev,
-                                          port->bulk_in_endpointAddress),
-                          port->read_urb->transfer_buffer,
-                          port->read_urb->transfer_buffer_length,
-                          usb_serial_generic_write_bulk_callback, port);
-        result = usb_submit_urb(port->read_urb, GFP_KERNEL);
-        if (result)
-                dev_err(&port->dev,
-                        "%s - failed submitting read urb, error %d\n",
-                        __FUNCTION__, result);
-
-        return result;
-}
-
-static struct usb_serial_driver anydata_device = {
-        .driver = {
-                .owner =        THIS_MODULE,
-                .name =         "anydata",
-        },
-        .id_table =             id_table,
-        .num_interrupt_in =     NUM_DONT_CARE,
-        .num_bulk_in =          NUM_DONT_CARE,
-        .num_bulk_out =         NUM_DONT_CARE,
-        .num_ports =            1,
-        .open =                 anydata_open,
-};
-
-static int __init anydata_init(void)
-{
-        int retval;
-
-        retval = usb_serial_register(&anydata_device);
-        if (retval)
-                return retval;
-        retval = usb_register(&anydata_driver);
-        if (retval)
-                usb_serial_deregister(&anydata_device);
-        return retval;
-}
-
-static void __exit anydata_exit(void)
-{
-        usb_deregister(&anydata_driver);
-        usb_serial_deregister(&anydata_device);
-}
-
-module_init(anydata_init);
-module_exit(anydata_exit);
-MODULE_LICENSE("GPL");
-
-module_param(debug, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(debug, "Debug enabled or not");
-module_param(buffer_size, int, 0);
-MODULE_PARM_DESC(buffer_size, "Size of the transfer buffers");
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index 8dec796222a0..970d9ef0a7a5 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -21,7 +21,7 @@
 #include <linux/tty.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 
 static int debug;
diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
index 3faa7aa0111a..70ece9e01ce4 100644
--- a/drivers/usb/serial/belkin_sa.c
+++ b/drivers/usb/serial/belkin_sa.c
@@ -74,7 +74,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "belkin_sa.h"
 
 static int debug;
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index f2d993b70c18..6542f220468f 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -13,7 +13,7 @@
 #include <linux/tty.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 static int usb_serial_device_match (struct device *dev, struct device_driver *drv)
 {
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 3d456b32c316..3a9073dbfe6a 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -17,11 +17,10 @@
 #include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 
 static int debug;
 
-#include "usb-serial.h"
-
 struct usbcons_info {
         int                     magic;
         int                     break_flag;
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index df0a4f98b4ae..486c7411b9a7 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -26,7 +26,7 @@
 #include <linux/moduleparam.h>
 #include <linux/usb.h>
 #include <asm/uaccess.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 49b51ab0d4cb..6286aba86fae 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -39,7 +39,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 #define CYBERJACK_LOCAL_BUF_SIZE 32
 
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 4ff2dfb299bd..ee70fddcab60 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -59,11 +59,11 @@
 #include <linux/moduleparam.h>
 #include <linux/spinlock.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 #include <linux/serial.h>
 #include <linux/delay.h>
 #include <asm/uaccess.h>
 
-#include "usb-serial.h"
 #include "cypress_m8.h"
 
 
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 6953d3ef5738..9b225183fc7a 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -246,7 +246,7 @@
 #include <asm/uaccess.h>
 #include <linux/usb.h>
 #include <linux/wait.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 /* Defines */
 
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 1e2b31eeb497..daafe405d86d 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -62,7 +62,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 static int debug;
 
diff --git a/drivers/usb/serial/ezusb.c b/drivers/usb/serial/ezusb.c
index debc3b0f9662..5169c2d154ab 100644
--- a/drivers/usb/serial/ezusb.c
+++ b/drivers/usb/serial/ezusb.c
@@ -15,7 +15,7 @@
 #include <linux/tty.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 /* EZ-USB Control and Status Register.  Bit 0 controls 8051 reset */
 #define CPUCS_REG    0x7F92
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8a74b19f1283..c6115aa1b445 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -257,7 +257,7 @@
 #include <asm/uaccess.h>
 #include <linux/usb.h>
 #include <linux/serial.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "ftdi_sio.h"
 
 /*
@@ -306,6 +306,8 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 
 
 static struct usb_device_id id_table_combined [] = {
+        { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
@@ -313,6 +315,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
@@ -336,6 +339,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2101_PID) },
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2102_PID) },
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2103_PID) },
@@ -500,6 +504,9 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
+        { USB_DEVICE(TESTO_VID, TESTO_USB_INTERFACE_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_GAMMA_SCOUT_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -548,11 +555,17 @@ struct ftdi_private {
         spinlock_t rx_lock;     /* spinlock for receive state */
         struct work_struct rx_work;
         int rx_processed;
+        unsigned long rx_bytes;
 
         __u16 interface;        /* FT2232C port interface (0 for FT232/245) */
 
         int force_baud;         /* if non-zero, force the baud rate to this value */
         int force_rtscts;       /* if non-zero, force RTS-CTS to always be enabled */
+
+        spinlock_t tx_lock;     /* spinlock for transmit state */
+        unsigned long tx_bytes;
+        unsigned long tx_outstanding_bytes;
+        unsigned long tx_outstanding_urbs;
 };
 
 /* Used for TIOCMIWAIT */
@@ -626,6 +639,9 @@ static struct usb_serial_driver ftdi_sio_device = {
 #define HIGH 1
 #define LOW 0
 
+/* number of outstanding urbs to prevent userspace DoS from happening */
+#define URB_UPPER_LIMIT 42
+
 /*
  * ***************************************************************************
  * Utlity functions
@@ -1156,6 +1172,7 @@ static int ftdi_sio_attach (struct usb_serial *serial)
         }
 
         spin_lock_init(&priv->rx_lock);
+        spin_lock_init(&priv->tx_lock);
         init_waitqueue_head(&priv->delta_msr_wait);
         /* This will push the characters through immediately rather
            than queue a task to deliver them */
@@ -1270,6 +1287,13 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 
         dbg("%s", __FUNCTION__);
 
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        priv->tx_bytes = 0;
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+        spin_lock_irqsave(&priv->rx_lock, flags);
+        priv->rx_bytes = 0;
+        spin_unlock_irqrestore(&priv->rx_lock, flags);
+
         if (port->tty)
                 port->tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
 
@@ -1372,6 +1396,7 @@ static int ftdi_write (struct usb_serial_port *port,
         int data_offset ;       /* will be 1 for the SIO and 0 otherwise */
         int status;
         int transfer_size;
+        unsigned long flags;
 
         dbg("%s port %d, %d bytes", __FUNCTION__, port->number, count);
 
@@ -1379,6 +1404,13 @@ static int ftdi_write (struct usb_serial_port *port,
                 dbg("write request of 0 bytes");
                 return 0;
         }
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        if (priv->tx_outstanding_urbs > URB_UPPER_LIMIT) {
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                dbg("%s - write limit hit\n", __FUNCTION__);
+                return 0;
+        }
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
         
         data_offset = priv->write_offset;
         dbg("data_offset set to %d",data_offset);
@@ -1445,6 +1477,12 @@ static int ftdi_write (struct usb_serial_port *port,
                 err("%s - failed submitting write urb, error %d", __FUNCTION__, status);
                 count = status;
                 kfree (buffer);
+        } else {
+                spin_lock_irqsave(&priv->tx_lock, flags);
+                ++priv->tx_outstanding_urbs;
+                priv->tx_outstanding_bytes += count;
+                priv->tx_bytes += count;
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
         }
 
         /* we are done with this urb, so let the host driver
@@ -1460,7 +1498,11 @@ static int ftdi_write (struct usb_serial_port *port,
 
 static void ftdi_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 {
+        unsigned long flags;
         struct usb_serial_port *port = (struct usb_serial_port *)urb->context;
+        struct ftdi_private *priv;
+        int data_offset;       /* will be 1 for the SIO and 0 otherwise */
+        unsigned long countback;
 
         /* free up the transfer buffer, as usb_free_urb() does not do this */
         kfree (urb->transfer_buffer);
@@ -1472,34 +1514,67 @@ static void ftdi_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 return;
         }
 
+        priv = usb_get_serial_port_data(port);
+        if (!priv) {
+                dbg("%s - bad port private data pointer - exiting", __FUNCTION__);
+                return;
+        }
+        /* account for transferred data */
+        countback = urb->actual_length;
+        data_offset = priv->write_offset;
+        if (data_offset > 0) {
+                /* Subtract the control bytes */
+                countback -= (data_offset * ((countback + (PKTSZ - 1)) / PKTSZ));
+        }
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        --priv->tx_outstanding_urbs;
+        priv->tx_outstanding_bytes -= countback;
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+
         usb_serial_port_softint(port);
 } /* ftdi_write_bulk_callback */
 
 
 static int ftdi_write_room( struct usb_serial_port *port )
 {
+        struct ftdi_private *priv = usb_get_serial_port_data(port);
+        int room;
+        unsigned long flags;
+
         dbg("%s - port %d", __FUNCTION__, port->number);
 
-        /*
-         * We really can take anything the user throws at us
-         * but let's pick a nice big number to tell the tty
-         * layer that we have lots of free space
-         */
-        return 2048;
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        if (priv->tx_outstanding_urbs < URB_UPPER_LIMIT) {
+                /*
+                 * We really can take anything the user throws at us
+                 * but let's pick a nice big number to tell the tty
+                 * layer that we have lots of free space
+                 */
+                room = 2048;
+        } else {
+                room = 0;
+        }
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+        return room;
 } /* ftdi_write_room */
 
 
 static int ftdi_chars_in_buffer (struct usb_serial_port *port)
 { /* ftdi_chars_in_buffer */
+        struct ftdi_private *priv = usb_get_serial_port_data(port);
+        int buffered;
+        unsigned long flags;
+
         dbg("%s - port %d", __FUNCTION__, port->number);
 
-        /* 
-         * We can't really account for how much data we
-         * have sent out, but hasn't made it through to the
-         * device, so just tell the tty layer that everything
-         * is flushed.
-         */
-        return 0;
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        buffered = (int)priv->tx_outstanding_bytes;
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+        if (buffered < 0) {
+                err("%s outstanding tx bytes is negative!", __FUNCTION__);
+                buffered = 0;
+        }
+        return buffered;
 } /* ftdi_chars_in_buffer */
 
 
@@ -1509,6 +1584,8 @@ static void ftdi_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
         struct usb_serial_port *port = (struct usb_serial_port *)urb->context;
         struct tty_struct *tty;
         struct ftdi_private *priv;
+        unsigned long countread;
+        unsigned long flags;
 
         if (urb->number_of_packets > 0) {
                 err("%s transfer_buffer_length %d actual_length %d number of packets %d",__FUNCTION__,
@@ -1543,6 +1620,13 @@ static void ftdi_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 return;
         }
 
+        /* count data bytes, but not status bytes */
+        countread = urb->actual_length;
+        countread -= 2 * ((countread + (PKTSZ - 1)) / PKTSZ);
+        spin_lock_irqsave(&priv->rx_lock, flags);
+        priv->rx_bytes += countread;
+        spin_unlock_irqrestore(&priv->rx_lock, flags);
+
         ftdi_process_read(port);
 
 } /* ftdi_read_bulk_callback */
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 6ab2ac845bd7..77299996f7ee 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -32,10 +32,19 @@
 #define FTDI_NF_RIC_PID 0x0001  /* Product Id */
 
 
+/* www.canusb.com Lawicel CANUSB device */
+#define FTDI_CANUSB_PID 0xFFA8 /* Product Id */
+
+/* AlphaMicro Components AMC-232USB01 device */
+#define FTDI_AMC232_PID 0xFF00 /* Product Id */
+
 /* ACT Solutions HomePro ZWave interface (http://www.act-solutions.com/HomePro.htm) */
 #define FTDI_ACTZWAVE_PID       0xF2D0
 
 
+/* www.starting-point-systems.com µChameleon device */
+#define FTDI_MICRO_CHAMELEON_PID        0xCAA0  /* Product Id */
+
 /* www.irtrans.de device */
 #define FTDI_IRTRANS_PID 0xFC60 /* Product Id */
 
@@ -179,6 +188,10 @@
 /* http://home.earthlink.net/~jrhees/USBUIRT/index.htm */
 #define FTDI_USB_UIRT_PID       0xF850  /* Product Id */
 
+/* TNC-X USB-to-packet-radio adapter, versions prior to 3.0 (DLP module) */
+
+#define FTDI_TNC_X_PID          0xEBE0
+
 /*
  * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
  * All of these devices use FTDI's vendor ID (0x0403).
@@ -442,6 +455,23 @@
  */
 #define FTDI_YEI_SERVOCENTER31_PID      0xE050  /* YEI ServoCenter3.1 USB */
 
+/*
+ * ThorLabs USB motor drivers
+ */
+#define FTDI_THORLABS_PID               0xfaf0 /* ThorLabs USB motor drivers */
+
+/*
+ * Testo products (http://www.testo.com/)
+ * Submitted by Colin Leroy
+ */
+#define TESTO_VID                       0x128D
+#define TESTO_USB_INTERFACE_PID         0x0001
+
+/*
+ * Gamma Scout (http://gamma-scout.com/). Submitted by rsc@runtux.com.
+ */
+#define FTDI_GAMMA_SCOUT_PID            0xD678  /* Gamma Scout online */
+
 /* Commands */
 #define FTDI_SIO_RESET          0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL     1 /* Set the modem control register */
diff --git a/drivers/usb/serial/funsoft.c b/drivers/usb/serial/funsoft.c
index 803721b97e2e..77b977206a8c 100644
--- a/drivers/usb/serial/funsoft.c
+++ b/drivers/usb/serial/funsoft.c
@@ -13,7 +13,7 @@
 #include <linux/tty.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x1404, 0xcddc) },
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 1f5d1620baa1..727852634be9 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -35,6 +35,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 
 /* the mode to be set when the port ist opened */
 static int initial_mode = 1;
@@ -42,8 +43,6 @@ static int initial_mode = 1;
 /* debug flag */
 static int debug = 0;
 
-#include "usb-serial.h"
-
 #define GARMIN_VENDOR_ID             0x091E
 
 /*
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 945b8bb38c92..172713556393 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -17,8 +17,8 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 #include <asm/uaccess.h>
-#include "usb-serial.h"
 
 static int debug;
 
@@ -285,6 +285,7 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
         if (result)
                 dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
 }
+EXPORT_SYMBOL_GPL(usb_serial_generic_read_bulk_callback);
 
 void usb_serial_generic_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 {
diff --git a/drivers/usb/serial/hp4x.c b/drivers/usb/serial/hp4x.c
index 7e06358b0310..ebcac701b069 100644
--- a/drivers/usb/serial/hp4x.c
+++ b/drivers/usb/serial/hp4x.c
@@ -17,7 +17,7 @@
 #include <linux/tty.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index bd2c05dac2a9..c49976c3ad52 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -44,7 +44,7 @@
 #include <linux/wait.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "io_edgeport.h"
 #include "io_ionsp.h"           /* info for the iosp messages */
 #include "io_16654.h"           /* 16654 UART defines */
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 723a12ae87b5..17c5b1d2311a 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -39,8 +39,8 @@
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 
-#include "usb-serial.h"
 #include "io_16654.h"
 #include "io_usbvend.h"
 #include "io_ti.h"
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index dbcfe172a5cc..9840bade79f9 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -55,7 +55,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "ipaq.h"
 
 #define KP_RETRIES      100
@@ -70,6 +70,8 @@
 
 static __u16 product, vendor;
 static int debug;
+static int connect_retries = KP_RETRIES;
+static int initial_wait;
 
 /* Function prototypes for an ipaq */
 static int  ipaq_open (struct usb_serial_port *port, struct file *filp);
@@ -248,6 +250,9 @@ static struct usb_device_id ipaq_id_table [] = {
         { USB_DEVICE(0x04C5, 0x1058) }, /* FUJITSU USB Sync */
         { USB_DEVICE(0x04C5, 0x1079) }, /* FUJITSU USB Sync */
         { USB_DEVICE(0x04DA, 0x2500) }, /* Panasonic USB Sync */
+        { USB_DEVICE(0x04DD, 0x9102) }, /* SHARP WS003SH USB Modem */
+        { USB_DEVICE(0x04DD, 0x9121) }, /* SHARP WS004SH USB Modem */
+        { USB_DEVICE(0x04DD, 0x9123) }, /* SHARP WS007SH USB Modem */
         { USB_DEVICE(0x04E8, 0x5F00) }, /* Samsung NEXiO USB Sync */
         { USB_DEVICE(0x04E8, 0x5F01) }, /* Samsung NEXiO USB Sync */
         { USB_DEVICE(0x04E8, 0x5F02) }, /* Samsung NEXiO USB Sync */
@@ -582,7 +587,7 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp)
         struct ipaq_private     *priv;
         struct ipaq_packet      *pkt;
         int                     i, result = 0;
-        int                     retries = KP_RETRIES;
+        int                     retries = connect_retries;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
 
@@ -646,16 +651,12 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp)
         port->read_urb->transfer_buffer_length = URBDATA_SIZE;
         port->bulk_out_size = port->write_urb->transfer_buffer_length = URBDATA_SIZE;
         
+        msleep(1000*initial_wait);
         /* Start reading from the device */
         usb_fill_bulk_urb(port->read_urb, serial->dev, 
                       usb_rcvbulkpipe(serial->dev, port->bulk_in_endpointAddress),
                       port->read_urb->transfer_buffer, port->read_urb->transfer_buffer_length,
                       ipaq_read_bulk_callback, port);
-        result = usb_submit_urb(port->read_urb, GFP_KERNEL);
-        if (result) {
-                err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
-                goto error;
-        }
 
         /*
          * Send out control message observed in win98 sniffs. Not sure what
@@ -670,8 +671,14 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp)
                                 usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
                                 0x1, 0, NULL, 0, 100);
                 if (result == 0) {
+                        result = usb_submit_urb(port->read_urb, GFP_KERNEL);
+                        if (result) {
+                                err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
+                                goto error;
+                        }
                         return 0;
                 }
+                msleep(1000);
         }
         err("%s - failed doing control urb, error %d", __FUNCTION__, result);
         goto error;
@@ -854,6 +861,7 @@ static void ipaq_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
         
         if (urb->status) {
                 dbg("%s - nonzero write bulk status received: %d", __FUNCTION__, urb->status);
+                return;
         }
 
         spin_lock_irqsave(&write_list_lock, flags);
@@ -966,3 +974,9 @@ MODULE_PARM_DESC(vendor, "User specified USB idVendor");
 
 module_param(product, ushort, 0);
 MODULE_PARM_DESC(product, "User specified USB idProduct");
+
+module_param(connect_retries, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(connect_retries, "Maximum number of connect retries (one second each)");
+
+module_param(initial_wait, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(initial_wait, "Time to wait before attempting a connection (in seconds)");
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index a4a0bfeaab00..87306cb6f9f5 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -46,8 +46,8 @@
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 #include <asm/uaccess.h>
-#include "usb-serial.h"
 
 /*
  * Version Information
@@ -373,6 +373,8 @@ static void ipw_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
 
         dbg("%s", __FUNCTION__);
 
+        port->write_urb_busy = 0;
+
         if (urb->status)
                 dbg("%s - nonzero write bulk status received: %d", __FUNCTION__, urb->status);
 
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 2cf1fed3de43..1738b0b6a376 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -57,7 +57,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index d7c58f1bc960..015ad6cc1bbb 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -107,7 +107,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "keyspan.h"
 
 static int debug;
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 03ab3c0f3cce..49b8dc039d1f 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -78,6 +78,7 @@
 #include <linux/workqueue.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 
 static int debug;
 
@@ -107,8 +108,6 @@ struct ezusb_hex_record {
 #include "xircom_pgs_fw.h"
 #endif
 
-#include "usb-serial.h"
-
 /*
  * Version Information
  */
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index b45ff3e7ab40..2a2f3e2da055 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -55,7 +55,7 @@
 #include <linux/module.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "kl5kusb105.h"
 
 static int debug;
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 457733374772..d50dce034958 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -46,8 +46,8 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 #include <linux/ioctl.h>
-#include "usb-serial.h"
 #include "kobil_sct.h"
 
 static int debug;
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index ca05d3275f3e..f4d4305c2c02 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -75,7 +75,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "mct_u232.h"
 
 /*
diff --git a/drivers/usb/serial/navman.c b/drivers/usb/serial/navman.c
index 7f544081032e..ac3f8b5d2c49 100644
--- a/drivers/usb/serial/navman.c
+++ b/drivers/usb/serial/navman.c
@@ -14,7 +14,7 @@
 #include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 static int debug;
 
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index cfb711a21a45..e49f40913c27 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -46,7 +46,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 static int debug;
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 78ad4b3126a6..c856e6f40e22 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -9,39 +9,14 @@
 
   Portions copied from the Keyspan driver by Hugh Blemings <hugh@blemings.org>
 
-  History:
-
-  2005-05-19  v0.1   Initial version, based on incomplete docs
-                     and analysis of misbehavior with the standard driver
-  2005-05-20  v0.2   Extended the input buffer to avoid losing
-                     random 64-byte chunks of data
-  2005-05-21  v0.3   implemented chars_in_buffer()
-                     turned on low_latency
-                     simplified the code somewhat
-  2005-05-24  v0.4   option_write() sometimes deadlocked under heavy load
-                     removed some dead code
-                     added sponsor notice
-                     coding style clean-up
-  2005-06-20  v0.4.1 add missing braces :-/
-                     killed end-of-line whitespace
-  2005-07-15  v0.4.2 rename WLAN product to FUSION, add FUSION2
-  2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
-  2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
-                     wants to send >2000 bytes.
-  2006-04-10  v0.5   fixed two array overrun errors :-/
-  2006-04-21  v0.5.1 added support for Sierra Wireless MC8755
-  2006-05-15  v0.6   re-enable multi-port support
-  2006-06-01  v0.6.1 add COBRA
-  2006-06-01  v0.6.2 add backwards-compatibility stuff
-  2006-06-01  v0.6.3 add Novatel Wireless
-  2006-06-01  v0.7   Option => GSM
+  History: see the git log.
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
   This driver exists because the "normal" serial driver doesn't work too well
   with GSM modems. Issues:
   - data loss -- one single Receive URB is not nearly enough
-  - nonstandard flow (Option devices) and multiplex (Sierra) control
+  - nonstandard flow (Option devices) control
   - controlling the baud rate doesn't make sense
 
   This driver is named "option" because the most common device it's
@@ -53,7 +28,7 @@
   device features.
 */
 
-#define DRIVER_VERSION "v0.7.0"
+#define DRIVER_VERSION "v0.7.1"
 #define DRIVER_AUTHOR "Matthias Urlichs <smurf@smurf.noris.de>"
 #define DRIVER_DESC "USB Driver for GSM modems"
 
@@ -64,7 +39,7 @@
 #include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 /* Function prototypes */
 static int  option_open(struct usb_serial_port *port, struct file *filp);
@@ -95,27 +70,29 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define OPTION_VENDOR_ID                0x0AF0
 #define HUAWEI_VENDOR_ID                0x12D1
 #define AUDIOVOX_VENDOR_ID              0x0F3D
-#define SIERRAWIRELESS_VENDOR_ID        0x1199
 #define NOVATELWIRELESS_VENDOR_ID       0x1410
+#define ANYDATA_VENDOR_ID               0x16d5
 
 #define OPTION_PRODUCT_OLD              0x5000
 #define OPTION_PRODUCT_FUSION           0x6000
 #define OPTION_PRODUCT_FUSION2          0x6300
 #define OPTION_PRODUCT_COBRA            0x6500
+#define OPTION_PRODUCT_COBRA2           0x6600
 #define HUAWEI_PRODUCT_E600             0x1001
 #define AUDIOVOX_PRODUCT_AIRCARD        0x0112
-#define SIERRAWIRELESS_PRODUCT_MC8755   0x6802
 #define NOVATELWIRELESS_PRODUCT_U740    0x1400
+#define ANYDATA_PRODUCT_ID              0x6501
 
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA) },
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA2) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
-        { USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ID) },
         { } /* Terminating entry */
 };
 
@@ -124,13 +101,11 @@ static struct usb_device_id option_ids1[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA) },
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA2) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
-        { } /* Terminating entry */
-};
-static struct usb_device_id option_ids3[] = {
-        { USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
+        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ID) },
         { } /* Terminating entry */
 };
 
@@ -147,37 +122,11 @@ static struct usb_driver option_driver = {
 /* The card has three separate interfaces, which the serial driver
  * recognizes separately, thus num_port=1.
  */
-static struct usb_serial_driver option_3port_device = {
-        .driver = {
-                .owner =        THIS_MODULE,
-                .name =         "option",
-        },
-        .description       = "GSM modem (3-port)",
-        .id_table          = option_ids3,
-        .num_interrupt_in  = NUM_DONT_CARE,
-        .num_bulk_in       = NUM_DONT_CARE,
-        .num_bulk_out      = NUM_DONT_CARE,
-        .num_ports         = 3,
-        .open              = option_open,
-        .close             = option_close,
-        .write             = option_write,
-        .write_room        = option_write_room,
-        .chars_in_buffer   = option_chars_in_buffer,
-        .throttle          = option_rx_throttle,
-        .unthrottle        = option_rx_unthrottle,
-        .set_termios       = option_set_termios,
-        .break_ctl         = option_break_ctl,
-        .tiocmget          = option_tiocmget,
-        .tiocmset          = option_tiocmset,
-        .attach            = option_startup,
-        .shutdown          = option_shutdown,
-        .read_int_callback = option_instat_callback,
-};
 
 static struct usb_serial_driver option_1port_device = {
         .driver = {
                 .owner =        THIS_MODULE,
-                .name =         "option",
+                .name =         "option1",
         },
         .description       = "GSM modem (1-port)",
         .id_table          = option_ids1,
@@ -241,9 +190,6 @@ static int __init option_init(void)
         retval = usb_serial_register(&option_1port_device);
         if (retval)
                 goto failed_1port_device_register;
-        retval = usb_serial_register(&option_3port_device);
-        if (retval)
-                goto failed_3port_device_register;
         retval = usb_register(&option_driver);
         if (retval)
                 goto failed_driver_register;
@@ -253,8 +199,6 @@ static int __init option_init(void)
         return 0;
 
 failed_driver_register:
-        usb_serial_deregister (&option_3port_device);
-failed_3port_device_register:
         usb_serial_deregister (&option_1port_device);
 failed_1port_device_register:
         return retval;
@@ -263,7 +207,6 @@ failed_1port_device_register:
 static void __exit option_exit(void)
 {
         usb_deregister (&option_driver);
-        usb_serial_deregister (&option_3port_device);
         usb_serial_deregister (&option_1port_device);
 }
 
@@ -652,7 +595,6 @@ static void option_setup_urbs(struct usb_serial *serial)
 
         dbg("%s", __FUNCTION__);
 
-
         for (i = 0; i < serial->num_ports; i++) {
                 port = serial->port[i];
                 portdata = usb_get_serial_port_data(port);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index de93a2b909e7..65e4d046951a 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -27,7 +27,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "pl2303.h"
 
 /*
@@ -52,6 +52,7 @@ struct pl2303_buf {
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ2) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_DCU11) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ3) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_PHAROS) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
@@ -78,7 +79,8 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(SAGEM_VENDOR_ID, SAGEM_PRODUCT_ID) },
         { USB_DEVICE(LEADTEK_VENDOR_ID, LEADTEK_9531_PRODUCT_ID) },
         { USB_DEVICE(SPEEDDRAGON_VENDOR_ID, SPEEDDRAGON_PRODUCT_ID) },
-        { USB_DEVICE(OTI_VENDOR_ID, OTI_PRODUCT_ID) },
+        { USB_DEVICE(DATAPILOT_U2_VENDOR_ID, DATAPILOT_U2_PRODUCT_ID) },
+        { USB_DEVICE(BELKIN_VENDOR_ID, BELKIN_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 7f29e81d3e35..55195e76eb6f 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -10,6 +10,7 @@
 #define PL2303_VENDOR_ID        0x067b
 #define PL2303_PRODUCT_ID       0x2303
 #define PL2303_PRODUCT_ID_RSAQ2         0x04bb
+#define PL2303_PRODUCT_ID_DCU11         0x1234
 #define PL2303_PRODUCT_ID_PHAROS        0xaaa0
 #define PL2303_PRODUCT_ID_RSAQ3         0xaaa2
 
@@ -81,6 +82,10 @@
 #define SPEEDDRAGON_VENDOR_ID   0x0e55
 #define SPEEDDRAGON_PRODUCT_ID  0x110b
 
-/* Ours Technology Inc DKU-5 clone, chipset: Prolific Technology Inc */
-#define OTI_VENDOR_ID   0x0ea0
-#define OTI_PRODUCT_ID  0x6858
+/* DATAPILOT Universal-2 Phone Cable */
+#define DATAPILOT_U2_VENDOR_ID  0x0731
+#define DATAPILOT_U2_PRODUCT_ID 0x2003
+
+/* Belkin "F5U257" Serial Adapter */
+#define BELKIN_VENDOR_ID        0x050d
+#define BELKIN_PRODUCT_ID       0x0257
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index 897d8447252b..789771ecdb11 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -71,7 +71,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 
 
 #ifndef CONFIG_USB_SAFE_PADDED
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
new file mode 100644
index 000000000000..d29638daa987
--- /dev/null
+++ b/drivers/usb/serial/sierra.c
@@ -0,0 +1,75 @@
+/*
+ * Sierra Wireless CDMA Wireless Serial USB driver
+ *
+ * Current Copy modified by: Kevin Lloyd <linux@sierrawireless.com>
+ * Original Copyright (C) 2005-2006 Greg Kroah-Hartman <gregkh@suse.de>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License version
+ *      2 as published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+
+static struct usb_device_id id_table [] = {
+        { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
+        { USB_DEVICE(0x1199, 0x0020) }, /* Sierra Wireless MC5725 */
+        { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
+        { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
+        { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
+        { USB_DEVICE(0x1199, 0x6803) }, /* Sierra Wireless MC8765 */
+        { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 */
+        { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
+        /* Following devices are supported in the airprime.c driver */
+        /* { USB_DEVICE(0x1199, 0x0112) }, */   /* Sierra Wireless AirCard 580 */
+        /* { USB_DEVICE(0x0F3D, 0x0112) }, */   /* AirPrime/Sierra PC 5220 */
+        { }
+};
+MODULE_DEVICE_TABLE(usb, id_table);
+
+static struct usb_driver sierra_driver = {
+        .name =         "sierra_wireless",
+        .probe =        usb_serial_probe,
+        .disconnect =   usb_serial_disconnect,
+        .id_table =     id_table,
+};
+
+static struct usb_serial_driver sierra_device = {
+        .driver = {
+        .owner =                THIS_MODULE,
+        .name =                 "Sierra_Wireless",
+        },
+        .id_table =             id_table,
+        .num_interrupt_in =     NUM_DONT_CARE,
+        .num_bulk_in =          NUM_DONT_CARE,
+        .num_bulk_out =         NUM_DONT_CARE,
+        .num_ports =            3,
+};
+
+static int __init sierra_init(void)
+{
+        int retval;
+
+        retval = usb_serial_register(&sierra_device);
+        if (retval)
+                return retval;
+        retval = usb_register(&sierra_driver);
+        if (retval)
+                usb_serial_deregister(&sierra_device);
+        return retval;
+}
+
+static void __exit sierra_exit(void)
+{
+        usb_deregister(&sierra_driver);
+        usb_serial_deregister(&sierra_device);
+}
+
+module_init(sierra_init);
+module_exit(sierra_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index a9afff31a921..ac9b8ee52d44 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -83,8 +83,8 @@
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
 #include <linux/usb.h>
+#include <linux/usb/serial.h>
 
-#include "usb-serial.h"
 #include "ti_usb_3410_5052.h"
 #include "ti_fw_3410.h"         /* firmware image for 3410 */
 #include "ti_fw_5052.h"         /* firmware image for 5052 */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index b59a0536ea5c..e06a41bd0f3b 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -31,7 +31,7 @@
 #include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "pl2303.h"
 
 /*
@@ -40,6 +40,8 @@
 #define DRIVER_AUTHOR "Greg Kroah-Hartman, greg@kroah.com, http://www.kroah.com/linux/"
 #define DRIVER_DESC "USB Serial Driver core"
 
+static void port_free(struct usb_serial_port *port);
+
 /* Driver structure we register with the USB core */
 static struct usb_driver usb_serial_driver = {
         .name =         "usbserial",
@@ -146,23 +148,10 @@ static void destroy_serial(struct kref *kref)
                         port = serial->port[i];
                         if (!port)
                                 continue;
-                        usb_kill_urb(port->read_urb);
-                        usb_free_urb(port->read_urb);
-                        usb_kill_urb(port->write_urb);
-                        usb_free_urb(port->write_urb);
-                        usb_kill_urb(port->interrupt_in_urb);
-                        usb_free_urb(port->interrupt_in_urb);
-                        usb_kill_urb(port->interrupt_out_urb);
-                        usb_free_urb(port->interrupt_out_urb);
-                        kfree(port->bulk_in_buffer);
-                        kfree(port->bulk_out_buffer);
-                        kfree(port->interrupt_in_buffer);
-                        kfree(port->interrupt_out_buffer);
+                        port_free(port);
                 }
         }
 
-        flush_scheduled_work();         /* port->work */
-
         usb_put_dev(serial->dev);
 
         /* free up any memory that we allocated */
@@ -475,8 +464,10 @@ static int serial_read_proc (char *page, char **start, off_t off, int count, int
                 length += sprintf (page+length, " path:%s", tmp);
                         
                 length += sprintf (page+length, "\n");
-                if ((length + begin) > (off + count))
+                if ((length + begin) > (off + count)) {
+                        usb_serial_put(serial);
                         goto done;
+                }
                 if ((length + begin) < off) {
                         begin += length;
                         length = 0;
@@ -564,6 +555,11 @@ static void port_release(struct device *dev)
         struct usb_serial_port *port = to_usb_serial_port(dev);
 
         dbg ("%s - %s", __FUNCTION__, dev->bus_id);
+        port_free(port);
+}
+
+static void port_free(struct usb_serial_port *port)
+{
         usb_kill_urb(port->read_urb);
         usb_free_urb(port->read_urb);
         usb_kill_urb(port->write_urb);
@@ -576,6 +572,7 @@ static void port_release(struct device *dev)
         kfree(port->bulk_out_buffer);
         kfree(port->interrupt_in_buffer);
         kfree(port->interrupt_out_buffer);
+        flush_scheduled_work();         /* port->work */
         kfree(port);
 }
 
diff --git a/drivers/usb/serial/usb-serial.h b/drivers/usb/serial/usb-serial.h
deleted file mode 100644
index 0f2802a60194..000000000000
--- a/drivers/usb/serial/usb-serial.h
+++ /dev/null
@@ -1,300 +0,0 @@
-/*
- * USB Serial Converter driver
- *
- *      Copyright (C) 1999 - 2005
- *          Greg Kroah-Hartman (greg@kroah.com)
- *
- *      This program is free software; you can redistribute it and/or modify
- *      it under the terms of the GNU General Public License as published by
- *      the Free Software Foundation; either version 2 of the License.
- *
- */
-
-
-#ifndef __LINUX_USB_SERIAL_H
-#define __LINUX_USB_SERIAL_H
-
-#include <linux/kref.h>
-#include <linux/mutex.h>
-
-#define SERIAL_TTY_MAJOR        188     /* Nice legal number now */
-#define SERIAL_TTY_MINORS       255     /* loads of devices :) */
-
-#define MAX_NUM_PORTS           8       /* The maximum number of ports one device can grab at once */
-
-/* parity check flag */
-#define RELEVANT_IFLAG(iflag)   (iflag & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
-
-/**
- * usb_serial_port: structure for the specific ports of a device.
- * @serial: pointer back to the struct usb_serial owner of this port.
- * @tty: pointer to the corresponding tty for this port.
- * @lock: spinlock to grab when updating portions of this structure.
- * @mutex: mutex used to synchronize serial_open() and serial_close()
- *      access for this port.
- * @number: the number of the port (the minor number).
- * @interrupt_in_buffer: pointer to the interrupt in buffer for this port.
- * @interrupt_in_urb: pointer to the interrupt in struct urb for this port.
- * @interrupt_in_endpointAddress: endpoint address for the interrupt in pipe
- *      for this port.
- * @interrupt_out_buffer: pointer to the interrupt out buffer for this port.
- * @interrupt_out_size: the size of the interrupt_out_buffer, in bytes.
- * @interrupt_out_urb: pointer to the interrupt out struct urb for this port.
- * @interrupt_out_endpointAddress: endpoint address for the interrupt out pipe
- *      for this port.
- * @bulk_in_buffer: pointer to the bulk in buffer for this port.
- * @read_urb: pointer to the bulk in struct urb for this port.
- * @bulk_in_endpointAddress: endpoint address for the bulk in pipe for this
- *      port.
- * @bulk_out_buffer: pointer to the bulk out buffer for this port.
- * @bulk_out_size: the size of the bulk_out_buffer, in bytes.
- * @write_urb: pointer to the bulk out struct urb for this port.
- * @bulk_out_endpointAddress: endpoint address for the bulk out pipe for this
- *      port.
- * @write_wait: a wait_queue_head_t used by the port.
- * @work: work queue entry for the line discipline waking up.
- * @open_count: number of times this port has been opened.
- *
- * This structure is used by the usb-serial core and drivers for the specific
- * ports of a device.
- */
-struct usb_serial_port {
-        struct usb_serial *     serial;
-        struct tty_struct *     tty;
-        spinlock_t              lock;
-        struct mutex            mutex;
-        unsigned char           number;
-
-        unsigned char *         interrupt_in_buffer;
-        struct urb *            interrupt_in_urb;
-        __u8                    interrupt_in_endpointAddress;
-
-        unsigned char *         interrupt_out_buffer;
-        int                     interrupt_out_size;
-        struct urb *            interrupt_out_urb;
-        __u8                    interrupt_out_endpointAddress;
-
-        unsigned char *         bulk_in_buffer;
-        int                     bulk_in_size;
-        struct urb *            read_urb;
-        __u8                    bulk_in_endpointAddress;
-
-        unsigned char *         bulk_out_buffer;
-        int                     bulk_out_size;
-        struct urb *            write_urb;
-        int                     write_urb_busy;
-        __u8                    bulk_out_endpointAddress;
-
-        wait_queue_head_t       write_wait;
-        struct work_struct      work;
-        int                     open_count;
-        struct device           dev;
-};
-#define to_usb_serial_port(d) container_of(d, struct usb_serial_port, dev)
-
-/* get and set the port private data pointer helper functions */
-static inline void *usb_get_serial_port_data (struct usb_serial_port *port)
-{
-        return dev_get_drvdata(&port->dev);
-}
-
-static inline void usb_set_serial_port_data (struct usb_serial_port *port, void *data)
-{
-        dev_set_drvdata(&port->dev, data);
-}
-
-/**
- * usb_serial - structure used by the usb-serial core for a device
- * @dev: pointer to the struct usb_device for this device
- * @type: pointer to the struct usb_serial_driver for this device
- * @interface: pointer to the struct usb_interface for this device
- * @minor: the starting minor number for this device
- * @num_ports: the number of ports this device has
- * @num_interrupt_in: number of interrupt in endpoints we have
- * @num_interrupt_out: number of interrupt out endpoints we have
- * @num_bulk_in: number of bulk in endpoints we have
- * @num_bulk_out: number of bulk out endpoints we have
- * @port: array of struct usb_serial_port structures for the different ports.
- * @private: place to put any driver specific information that is needed.  The
- *      usb-serial driver is required to manage this data, the usb-serial core
- *      will not touch this.  Use usb_get_serial_data() and
- *      usb_set_serial_data() to access this.
- */
-struct usb_serial {
-        struct usb_device *             dev;
-        struct usb_serial_driver *      type;
-        struct usb_interface *          interface;
-        unsigned char                   minor;
-        unsigned char                   num_ports;
-        unsigned char                   num_port_pointers;
-        char                            num_interrupt_in;
-        char                            num_interrupt_out;
-        char                            num_bulk_in;
-        char                            num_bulk_out;
-        struct usb_serial_port *        port[MAX_NUM_PORTS];
-        struct kref                     kref;
-        void *                          private;
-};
-#define to_usb_serial(d) container_of(d, struct usb_serial, kref)
-
-#define NUM_DONT_CARE   (-1)
-
-/* get and set the serial private data pointer helper functions */
-static inline void *usb_get_serial_data (struct usb_serial *serial)
-{
-        return serial->private;
-}
-
-static inline void usb_set_serial_data (struct usb_serial *serial, void *data)
-{
-        serial->private = data;
-}
-
-/**
- * usb_serial_driver - describes a usb serial driver
- * @description: pointer to a string that describes this driver.  This string used
- *      in the syslog messages when a device is inserted or removed.
- * @id_table: pointer to a list of usb_device_id structures that define all
- *      of the devices this structure can support.
- * @num_interrupt_in: the number of interrupt in endpoints this device will
- *      have.
- * @num_interrupt_out: the number of interrupt out endpoints this device will
- *      have.
- * @num_bulk_in: the number of bulk in endpoints this device will have.
- * @num_bulk_out: the number of bulk out endpoints this device will have.
- * @num_ports: the number of different ports this device will have.
- * @calc_num_ports: pointer to a function to determine how many ports this
- *      device has dynamically.  It will be called after the probe()
- *      callback is called, but before attach()
- * @probe: pointer to the driver's probe function.
- *      This will be called when the device is inserted into the system,
- *      but before the device has been fully initialized by the usb_serial
- *      subsystem.  Use this function to download any firmware to the device,
- *      or any other early initialization that might be needed.
- *      Return 0 to continue on with the initialization sequence.  Anything 
- *      else will abort it.
- * @attach: pointer to the driver's attach function.
- *      This will be called when the struct usb_serial structure is fully set
- *      set up.  Do any local initialization of the device, or any private
- *      memory structure allocation at this point in time.
- * @shutdown: pointer to the driver's shutdown function.  This will be
- *      called when the device is removed from the system.
- *
- * This structure is defines a USB Serial driver.  It provides all of
- * the information that the USB serial core code needs.  If the function
- * pointers are defined, then the USB serial core code will call them when
- * the corresponding tty port functions are called.  If they are not
- * called, the generic serial function will be used instead.
- *
- * The driver.owner field should be set to the module owner of this driver.
- * The driver.name field should be set to the name of this driver (remember
- * it will show up in sysfs, so it needs to be short and to the point.
- * Useing the module name is a good idea.)
- */
-struct usb_serial_driver {
-        const char *description;
-        const struct usb_device_id *id_table;
-        char    num_interrupt_in;
-        char    num_interrupt_out;
-        char    num_bulk_in;
-        char    num_bulk_out;
-        char    num_ports;
-
-        struct list_head        driver_list;
-        struct device_driver    driver;
-
-        int (*probe) (struct usb_serial *serial, const struct usb_device_id *id);
-        int (*attach) (struct usb_serial *serial);
-        int (*calc_num_ports) (struct usb_serial *serial);
-
-        void (*shutdown) (struct usb_serial *serial);
-
-        int (*port_probe) (struct usb_serial_port *port);
-        int (*port_remove) (struct usb_serial_port *port);
-
-        /* serial function calls */
-        int  (*open)            (struct usb_serial_port *port, struct file * filp);
-        void (*close)           (struct usb_serial_port *port, struct file * filp);
-        int  (*write)           (struct usb_serial_port *port, const unsigned char *buf, int count);
-        int  (*write_room)      (struct usb_serial_port *port);
-        int  (*ioctl)           (struct usb_serial_port *port, struct file * file, unsigned int cmd, unsigned long arg);
-        void (*set_termios)     (struct usb_serial_port *port, struct termios * old);
-        void (*break_ctl)       (struct usb_serial_port *port, int break_state);
-        int  (*chars_in_buffer) (struct usb_serial_port *port);
-        void (*throttle)        (struct usb_serial_port *port);
-        void (*unthrottle)      (struct usb_serial_port *port);
-        int  (*tiocmget)        (struct usb_serial_port *port, struct file *file);
-        int  (*tiocmset)        (struct usb_serial_port *port, struct file *file, unsigned int set, unsigned int clear);
-
-        void (*read_int_callback)(struct urb *urb, struct pt_regs *regs);
-        void (*write_int_callback)(struct urb *urb, struct pt_regs *regs);
-        void (*read_bulk_callback)(struct urb *urb, struct pt_regs *regs);
-        void (*write_bulk_callback)(struct urb *urb, struct pt_regs *regs);
-};
-#define to_usb_serial_driver(d) container_of(d, struct usb_serial_driver, driver)
-
-extern int  usb_serial_register(struct usb_serial_driver *driver);
-extern void usb_serial_deregister(struct usb_serial_driver *driver);
-extern void usb_serial_port_softint(struct usb_serial_port *port);
-
-extern int usb_serial_probe(struct usb_interface *iface, const struct usb_device_id *id);
-extern void usb_serial_disconnect(struct usb_interface *iface);
-
-extern int ezusb_writememory (struct usb_serial *serial, int address, unsigned char *data, int length, __u8 bRequest);
-extern int ezusb_set_reset (struct usb_serial *serial, unsigned char reset_bit);
-
-/* USB Serial console functions */
-#ifdef CONFIG_USB_SERIAL_CONSOLE
-extern void usb_serial_console_init (int debug, int minor);
-extern void usb_serial_console_exit (void);
-extern void usb_serial_console_disconnect(struct usb_serial *serial);
-#else
-static inline void usb_serial_console_init (int debug, int minor) { }
-static inline void usb_serial_console_exit (void) { }
-static inline void usb_serial_console_disconnect(struct usb_serial *serial) {}
-#endif
-
-/* Functions needed by other parts of the usbserial core */
-extern struct usb_serial *usb_serial_get_by_index (unsigned int minor);
-extern void usb_serial_put(struct usb_serial *serial);
-extern int usb_serial_generic_open (struct usb_serial_port *port, struct file *filp);
-extern int usb_serial_generic_write (struct usb_serial_port *port, const unsigned char *buf, int count);
-extern void usb_serial_generic_close (struct usb_serial_port *port, struct file *filp);
-extern int usb_serial_generic_write_room (struct usb_serial_port *port);
-extern int usb_serial_generic_chars_in_buffer (struct usb_serial_port *port);
-extern void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *regs);
-extern void usb_serial_generic_write_bulk_callback (struct urb *urb, struct pt_regs *regs);
-extern void usb_serial_generic_shutdown (struct usb_serial *serial);
-extern int usb_serial_generic_register (int debug);
-extern void usb_serial_generic_deregister (void);
-
-extern int usb_serial_bus_register (struct usb_serial_driver *device);
-extern void usb_serial_bus_deregister (struct usb_serial_driver *device);
-
-extern struct usb_serial_driver usb_serial_generic_device;
-extern struct bus_type usb_serial_bus_type;
-extern struct tty_driver *usb_serial_tty_driver;
-
-static inline void usb_serial_debug_data(int debug,
-                                         struct device *dev,
-                                         const char *function, int size,
-                                         const unsigned char *data)
-{
-        int i;
-
-        if (debug) {
-                dev_printk(KERN_DEBUG, dev, "%s - length = %d, data = ", function, size);
-                for (i = 0; i < size; ++i)
-                        printk ("%.2x ", data[i]);
-                printk ("\n");
-        }
-}
-
-/* Use our own dbg macro */
-#undef dbg
-#define dbg(format, arg...) do { if (debug) printk(KERN_DEBUG "%s: " format "\n" , __FILE__ , ## arg); } while (0)
-
-
-
-#endif  /* ifdef __LINUX_USB_SERIAL_H */
-
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index 95a2936e902e..88949f7884ca 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -25,7 +25,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "visor.h"
 
 /*
@@ -302,7 +302,6 @@ static int visor_open (struct usb_serial_port *port, struct file *filp)
         spin_lock_irqsave(&priv->lock, flags);
         priv->bytes_in = 0;
         priv->bytes_out = 0;
-        priv->outstanding_urbs = 0;
         priv->throttled = 0;
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -435,13 +434,25 @@ static int visor_write (struct usb_serial_port *port, const unsigned char *buf,
 
 static int visor_write_room (struct usb_serial_port *port)
 {
+        struct visor_private *priv = usb_get_serial_port_data(port);
+        unsigned long flags;
+
         dbg("%s - port %d", __FUNCTION__, port->number);
 
         /*
          * We really can take anything the user throws at us
          * but let's pick a nice big number to tell the tty
-         * layer that we have lots of free space
+         * layer that we have lots of free space, unless we don't.
          */
+
+        spin_lock_irqsave(&priv->lock, flags);
+        if (priv->outstanding_urbs > URB_UPPER_LIMIT * 2 / 3) {
+                spin_unlock_irqrestore(&priv->lock, flags);
+                dbg("%s - write limit hit\n", __FUNCTION__);
+                return 0;
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         return 2048;
 }
 
@@ -758,15 +769,22 @@ static int visor_calc_num_ports (struct usb_serial *serial)
 
 static int generic_startup(struct usb_serial *serial)
 {
+        struct usb_serial_port **ports = serial->port;
         struct visor_private *priv;
         int i;
 
         for (i = 0; i < serial->num_ports; ++i) {
                 priv = kzalloc (sizeof(*priv), GFP_KERNEL);
-                if (!priv)
+                if (!priv) {
+                        while (i-- != 0) {
+                                priv = usb_get_serial_port_data(ports[i]);
+                                usb_set_serial_port_data(ports[i], NULL);
+                                kfree(priv);
+                        }
                         return -ENOMEM;
+                }
                 spin_lock_init(&priv->lock);
-                usb_set_serial_port_data(serial->port[i], priv);
+                usb_set_serial_port_data(ports[i], priv);
         }
         return 0;
 }
@@ -876,7 +894,18 @@ static int clie_5_attach (struct usb_serial *serial)
 
 static void visor_shutdown (struct usb_serial *serial)
 {
+        struct visor_private *priv;
+        int i;
+
         dbg("%s", __FUNCTION__);
+
+        for (i = 0; i < serial->num_ports; i++) {
+                priv = usb_get_serial_port_data(serial->port[i]);
+                if (priv) {
+                        usb_set_serial_port_data(serial->port[i], NULL);
+                        kfree(priv);
+                }
+        }
 }
 
 static int visor_ioctl (struct usb_serial_port *port, struct file * file, unsigned int cmd, unsigned long arg)
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 540438c3f381..6e6c7934be32 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -79,7 +79,7 @@
 #include <linux/usb.h>
 #include <linux/serial_reg.h>
 #include <linux/serial.h>
-#include "usb-serial.h"
+#include <linux/usb/serial.h>
 #include "whiteheat_fw.h"               /* firmware for the ConnectTech WhiteHEAT device */
 #include "whiteheat.h"                  /* WhiteHEAT specific commands */
 
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 5715291ba540..a4b7df9ff8c1 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -112,13 +112,11 @@ static int slave_configure(struct scsi_device *sdev)
         if (sdev->scsi_level < SCSI_2)
                 sdev->scsi_level = sdev->sdev_target->scsi_level = SCSI_2;
 
-        /* According to the technical support people at Genesys Logic,
-         * devices using their chips have problems transferring more than
-         * 32 KB at a time.  In practice people have found that 64 KB
-         * works okay and that's what Windows does.  But we'll be
-         * conservative; people can always use the sysfs interface to
-         * increase max_sectors. */
-        if (le16_to_cpu(us->pusb_dev->descriptor.idVendor) == USB_VENDOR_ID_GENESYS &&
+        /* Many devices have trouble transfering more than 32KB at a time,
+         * while others have trouble with more than 64K. At this time we
+         * are limiting both to 32K (64 sectores).
+         */
+        if ((us->flags & US_FL_MAX_SECTORS_64) &&
                         sdev->request_queue->max_sectors > 64)
                 blk_queue_max_sectors(sdev->request_queue, 64);
 
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index eb7188b3565c..d6acc92a4ae3 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -180,7 +180,7 @@ static int usb_stor_msg_common(struct us_data *us, int timeout)
         if (timeleft <= 0) {
                 US_DEBUGP("%s -- cancelling URB\n",
                           timeleft == 0 ? "Timeout" : "Signal");
-                usb_unlink_urb(us->current_urb);
+                usb_kill_urb(us->current_urb);
         }
 
         /* return the URB status */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c7e84e653df9..b130e170b4a8 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -112,6 +112,19 @@ UNUSUAL_DEV(  0x0411, 0x001c, 0x0113, 0x0113,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
+/* Submitted by Ernestas Vaiciukevicius <ernisv@gmail.com> */
+UNUSUAL_DEV(  0x0419, 0x0100, 0x0100, 0x0100,
+                "Samsung Info. Systems America, Inc.",
+                "MP3 Player",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
+/* Reported by Orgad Shaneh <orgads@gmail.com> */
+UNUSUAL_DEV(  0x0419, 0xaace, 0x0100, 0x0100,
+                "Samsung", "MP3 Player",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Christian Leber <christian@leber.de> */
 UNUSUAL_DEV(  0x0419, 0xaaf5, 0x0100, 0x0100,
                 "TrekStor",
@@ -132,6 +145,21 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Mario Rettig <mariorettig@web.de> */
+UNUSUAL_DEV(  0x0421, 0x042e, 0x0100, 0x0100,
+                "Nokia",
+                "Nokia 3250",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
+
+/* Reported by Sumedha Swamy <sumedhaswamy@gmail.com> and
+ * Einar Th. Einarsson <einarthered@gmail.com> */
+UNUSUAL_DEV(  0x0421, 0x0444, 0x0100, 0x0100,
+                "Nokia",
+                "N91",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
+
 /* Reported by Jiri Slaby <jirislaby@gmail.com> and
  * Rene C. Castberg <Rene@Castberg.org> */
 UNUSUAL_DEV(  0x0421, 0x0446, 0x0100, 0x0100,
@@ -140,6 +168,13 @@ UNUSUAL_DEV(  0x0421, 0x0446, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
 
+/* Reported by Matthew Bloch <matthew@bytemark.co.uk> */
+UNUSUAL_DEV(  0x0421, 0x044e, 0x0100, 0x0100,
+                "Nokia",
+                "E61",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
+
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
                 "SMSC",
@@ -206,16 +241,6 @@ UNUSUAL_DEV(  0x0482, 0x0103, 0x0100, 0x0100,
                 "Finecam S5",
                 US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_FIX_INQUIRY),
 
-/* Patch for Kyocera Finecam L3
- * Submitted by Michael Krauth <michael.krauth@web.de>
- * and Alessandro Fracchetti <al.fracchetti@tin.it>
- */
-UNUSUAL_DEV(  0x0482, 0x0105, 0x0100, 0x0100,
-                "Kyocera",
-                "Finecam L3",
-                US_SC_SCSI, US_PR_BULK, NULL,
-                US_FL_FIX_INQUIRY),
-
 /* Reported by Paul Stewart <stewart@wetlogic.net>
  * This entry is needed because the device reports Sub=ff */
 UNUSUAL_DEV(  0x04a4, 0x0004, 0x0001, 0x0001,
@@ -473,10 +498,11 @@ UNUSUAL_DEV(  0x054c, 0x0010, 0x0106, 0x0450,
                 US_SC_SCSI, US_PR_DEVICE, NULL,
                 US_FL_SINGLE_LUN | US_FL_NOT_LOCKABLE | US_FL_NO_WP_DETECT ),
 
-/* This entry is needed because the device reports Sub=ff */
-UNUSUAL_DEV(  0x054c, 0x0010, 0x0500, 0x0600,
+/* Submitted by Lars Jacob <jacob.lars@googlemail.com>
+ * This entry is needed because the device reports Sub=ff */
+UNUSUAL_DEV(  0x054c, 0x0010, 0x0500, 0x0610,
                 "Sony",
-                "DSC-T1/T5",
+                "DSC-T1/T5/H5",
                 US_SC_8070, US_PR_DEVICE, NULL,
                 US_FL_SINGLE_LUN ),
 
@@ -563,6 +589,13 @@ UNUSUAL_DEV(  0x054c, 0x0099, 0x0000, 0x9999,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
+/* floppy reports multiple luns */
+UNUSUAL_DEV(  0x055d, 0x2020, 0x0000, 0x0210,
+               "SAMSUNG",
+               "SFD-321U [FW 0C]",
+               US_SC_DEVICE, US_PR_DEVICE, NULL,
+               US_FL_SINGLE_LUN ),
+
                 
 UNUSUAL_DEV(  0x057b, 0x0000, 0x0000, 0x0299, 
                 "Y-E Data",
@@ -598,18 +631,6 @@ UNUSUAL_DEV(  0x0595, 0x4343, 0x0000, 0x2210,
                 "Digital Camera EX-20 DSC",
                 US_SC_8070, US_PR_DEVICE, NULL, 0 ),
 
-/* The entry was here before I took over, and had US_SC_RBC. It turns
- * out that isn't needed. Additionally, Torsten Eriksson
- * <Torsten.Eriksson@bergianska.se> is able to use his device fine
- * without this entry at all - but I don't suspect that will be true
- * for all users (the protocol is likely needed), so is staying at
- * this time. - Phil Dibowitz <phil@ipom.com>
- */
-UNUSUAL_DEV(  0x059f, 0xa601, 0x0200, 0x0200, 
-                "LaCie",
-                "USB Hard Disk",
-                US_SC_DEVICE, US_PR_CB, NULL, 0 ),
-
 /* Submitted by Joel Bourquard <numlock@freesurf.ch>
  * Some versions of this device need the SubClass and Protocol overrides
  * while others don't.
@@ -708,18 +729,22 @@ UNUSUAL_DEV(  0x05dc, 0xb002, 0x0000, 0x0113,
  * They were originally reported by Alexander Oltu
  * <alexander@all-2.com> and Peter Marks <peter.marks@turner.com>
  * respectively.
+ *
+ * US_FL_GO_SLOW and US_FL_MAX_SECTORS_64 added by Phil Dibowitz
+ * <phil@ipom.com> as these flags were made and hard-coded
+ * special-cases were pulled from scsiglue.c.
  */
 UNUSUAL_DEV(  0x05e3, 0x0701, 0x0000, 0xffff,
                 "Genesys Logic",
                 "USB to IDE Optical",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_GO_SLOW ),
+                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
 
 UNUSUAL_DEV(  0x05e3, 0x0702, 0x0000, 0xffff,
                 "Genesys Logic",
                 "USB to IDE Disk",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_GO_SLOW ),
+                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
 
 /* Reported by Hanno Boeck <hanno@gmx.de>
  * Taken from the Lycoris Kernel */
@@ -1073,7 +1098,15 @@ UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xffff,
                 "Optio S/S4",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
-                
+
+/* This is a virtual windows driver CD, which the zd1211rw driver automatically
+ * converts into a WLAN device. */
+UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,
+                "ZyXEL",
+                "G-220F USB-WLAN Install",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_DEVICE ),
+
 #ifdef CONFIG_USB_STORAGE_ISD200
 UNUSUAL_DEV(  0x0bf6, 0xa001, 0x0100, 0x0110,
                 "ATI",
@@ -1196,6 +1229,24 @@ UNUSUAL_DEV(  0x0ea0, 0x6828, 0x0110, 0x0110,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Benjamin Schiller <sbenni@gmx.de>
+ * It is also sold by Easylite as DJ 20 */
+UNUSUAL_DEV(  0x0ed1, 0x7636, 0x0103, 0x0103,
+                "Typhoon",
+                "My DJ 1820",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_GO_SLOW | US_FL_MAX_SECTORS_64),
+
+/* David Kuehling <dvdkhlng@gmx.de>:
+ * for MP3-Player AVOX WSX-300ER (bought in Japan).  Reports lots of SCSI
+ * errors when trying to write.
+ */
+UNUSUAL_DEV(  0x0f19, 0x0105, 0x0100, 0x0100,
+                "C-MEX",
+                "A-VOX",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Michael Stattmann <michael@stattmann.com> */
 UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
                 "Sony Ericsson",
@@ -1203,11 +1254,18 @@ UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_NO_WP_DETECT ),
 
+/* Reported by Emmanuel Vasilakis <evas@forthnet.gr> */
+UNUSUAL_DEV(  0x0fce, 0xe031, 0x0000, 0x0000,
+                "Sony Ericsson",
+                "M600i",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
+
 /* Reported by Kevin Cernekee <kpc-usbdev@gelato.uiuc.edu>
  * Tested on hardware version 1.10.
  * Entry is needed only for the initializer function override.
  */
-UNUSUAL_DEV(  0x1019, 0x0c55, 0x0000, 0x9999,
+UNUSUAL_DEV(  0x1019, 0x0c55, 0x0110, 0x0110,
                 "Desknote",
                 "UCR-61S2B",
                 US_SC_DEVICE, US_PR_DEVICE, usb_stor_ucr61s2b_init,
@@ -1227,6 +1285,15 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* patch submitted by Davide Perini <perini.davide@dpsoftware.org>
+ * and Renato Perini <rperini@email.it>
+ */
+UNUSUAL_DEV(  0x22b8, 0x3010, 0x0001, 0x0001,
+                "Motorola",
+                "RAZR V3x",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Radovan Garabik <garabik@kassiopeia.juls.savba.sk> */
 UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
                 "MPIO",
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 1185acac4b21..8d7bdcb5924d 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -55,6 +55,7 @@
 #include <linux/slab.h>
 #include <linux/kthread.h>
 #include <linux/mutex.h>
+#include <linux/utsrelease.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
@@ -373,8 +374,12 @@ static int usb_stor_control_thread(void * __us)
                 /* lock access to the state */
                 scsi_lock(host);
 
+                /* did the command already complete because of a disconnect? */
+                if (!us->srb)
+                        ;               /* nothing to do */
+
                 /* indicate that the command is done */
-                if (us->srb->result != DID_ABORT << 16) {
+                else if (us->srb->result != DID_ABORT << 16) {
                         US_DEBUGP("scsi cmd done, result=0x%x\n", 
                                    us->srb->result);
                         us->srb->scsi_done(us->srb);
@@ -478,7 +483,7 @@ static struct us_unusual_dev *find_unusual(const struct usb_device_id *id)
 }
 
 /* Get the unusual_devs entries and the string descriptors */
-static void get_device_info(struct us_data *us, const struct usb_device_id *id)
+static int get_device_info(struct us_data *us, const struct usb_device_id *id)
 {
         struct usb_device *dev = us->pusb_dev;
         struct usb_interface_descriptor *idesc =
@@ -495,6 +500,11 @@ static void get_device_info(struct us_data *us, const struct usb_device_id *id)
                         unusual_dev->useTransport;
         us->flags = USB_US_ORIG_FLAGS(id->driver_info);
 
+        if (us->flags & US_FL_IGNORE_DEVICE) {
+                printk(KERN_INFO USB_STORAGE "device ignored\n");
+                return -ENODEV;
+        }
+
         /*
          * This flag is only needed when we're in high-speed, so let's
          * disable it if we're in full-speed
@@ -524,7 +534,8 @@ static void get_device_info(struct us_data *us, const struct usb_device_id *id)
                 if (msg >= 0 && !(us->flags & US_FL_NEED_OVERRIDE))
                         printk(KERN_NOTICE USB_STORAGE "This device "
                                 "(%04x,%04x,%04x S %02x P %02x)"
-                                " has %s in unusual_devs.h\n"
+                                " has %s in unusual_devs.h (kernel"
+                                " %s)\n"
                                 "   Please send a copy of this message to "
                                 "<linux-usb-devel@lists.sourceforge.net>\n",
                                 le16_to_cpu(ddesc->idVendor),
@@ -532,8 +543,11 @@ static void get_device_info(struct us_data *us, const struct usb_device_id *id)
                                 le16_to_cpu(ddesc->bcdDevice),
                                 idesc->bInterfaceSubClass,
                                 idesc->bInterfaceProtocol,
-                                msgs[msg]);
+                                msgs[msg],
+                                UTS_RELEASE);
         }
+
+        return 0;
 }
 
 /* Get the transport settings */
@@ -836,32 +850,34 @@ static void dissociate_dev(struct us_data *us)
  * the host */
 static void quiesce_and_remove_host(struct us_data *us)
 {
+        struct Scsi_Host *host = us_to_host(us);
+
         /* Prevent new USB transfers, stop the current command, and
          * interrupt a SCSI-scan or device-reset delay */
+        scsi_lock(host);
         set_bit(US_FLIDX_DISCONNECTING, &us->flags);
+        scsi_unlock(host);
         usb_stor_stop_transport(us);
         wake_up(&us->delay_wait);
 
         /* It doesn't matter if the SCSI-scanning thread is still running.
          * The thread will exit when it sees the DISCONNECTING flag. */
 
-        /* Wait for the current command to finish, then remove the host */
-        mutex_lock(&us->dev_mutex);
-        mutex_unlock(&us->dev_mutex);
-
         /* queuecommand won't accept any new commands and the control
          * thread won't execute a previously-queued command.  If there
          * is such a command pending, complete it with an error. */
+        mutex_lock(&us->dev_mutex);
         if (us->srb) {
                 us->srb->result = DID_NO_CONNECT << 16;
-                scsi_lock(us_to_host(us));
+                scsi_lock(host);
                 us->srb->scsi_done(us->srb);
                 us->srb = NULL;
-                scsi_unlock(us_to_host(us));
+                scsi_unlock(host);
         }
+        mutex_unlock(&us->dev_mutex);
 
         /* Now we own no commands so it's safe to remove the SCSI host */
-        scsi_remove_host(us_to_host(us));
+        scsi_remove_host(host);
 }
 
 /* Second stage of disconnect processing: deallocate all resources */
@@ -960,7 +976,9 @@ static int storage_probe(struct usb_interface *intf,
          * of the match from the usb_device_id table, so we can find the
          * corresponding entry in the private table.
          */
-        get_device_info(us, id);
+        result = get_device_info(us, id);
+        if (result)
+                goto BadDevice;
 
         /* Get the transport, protocol, and pipe settings */
         result = get_transport(us);
diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
index 5284abe1b5eb..21f3ddbc9080 100644
--- a/drivers/usb/storage/usb.h
+++ b/drivers/usb/storage/usb.h
@@ -176,8 +176,4 @@ extern void fill_inquiry_response(struct us_data *us,
 #define scsi_unlock(host)       spin_unlock_irq(host->host_lock)
 #define scsi_lock(host)         spin_lock_irq(host->host_lock)
 
-
-/* Vendor ID list for devices that require special handling */
-#define USB_VENDOR_ID_GENESYS           0x05e3  /* Genesys Logic */
-
 #endif
diff --git a/drivers/video/68328fb.c b/drivers/video/68328fb.c
index 78488bb41aeb..0dda73da8628 100644
--- a/drivers/video/68328fb.c
+++ b/drivers/video/68328fb.c
@@ -32,7 +32,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 17de4c84db69..702eb933cf88 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -86,9 +86,11 @@ config FB_MACMODES
        default n
 
 config FB_BACKLIGHT
-       bool
-       depends on FB
-       default n
+        bool
+        depends on FB
+        select BACKLIGHT_LCD_SUPPORT
+        select BACKLIGHT_CLASS_DEVICE
+        default n
 
 config FB_MODE_HELPERS
         bool "Enable Video Mode Handling Helpers"
@@ -420,7 +422,7 @@ config FB_OF
 
 config FB_CONTROL
         bool "Apple \"control\" display support"
-        depends on (FB = y) && PPC_PMAC
+        depends on (FB = y) && PPC_PMAC && PPC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -431,7 +433,7 @@ config FB_CONTROL
 
 config FB_PLATINUM
         bool "Apple \"platinum\" display support"
-        depends on (FB = y) && PPC_PMAC
+        depends on (FB = y) && PPC_PMAC && PPC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -442,7 +444,7 @@ config FB_PLATINUM
 
 config FB_VALKYRIE
         bool "Apple \"valkyrie\" display support"
-        depends on (FB = y) && (MAC || PPC_PMAC)
+        depends on (FB = y) && (MAC || (PPC_PMAC && PPC32))
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -453,7 +455,7 @@ config FB_VALKYRIE
 
 config FB_CT65550
         bool "Chips 65550 display support"
-        depends on (FB = y) && PPC
+        depends on (FB = y) && PPC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -552,7 +554,7 @@ config FB_VESA
 
 config FB_IMAC
         bool "Intel-based Macintosh Framebuffer Support"
-        depends on (FB = y) && X86
+        depends on (FB = y) && X86 && EFI
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -721,10 +723,8 @@ config FB_NVIDIA_I2C
 
 config FB_NVIDIA_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_NVIDIA && PPC_PMAC
+        depends on FB_NVIDIA && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -769,10 +769,8 @@ config FB_RIVA_DEBUG
 
 config FB_RIVA_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_RIVA && PPC_PMAC
+        depends on FB_RIVA && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1025,10 +1023,8 @@ config FB_RADEON_I2C
 
 config FB_RADEON_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_RADEON && PPC_PMAC
+        depends on FB_RADEON && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1059,10 +1055,8 @@ config FB_ATY128
 
 config FB_ATY128_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_ATY128 && PPC_PMAC
+        depends on FB_ATY128 && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1111,10 +1105,8 @@ config FB_ATY_GX
 
 config FB_ATY_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_ATY && PPC_PMAC
+        depends on FB_ATY && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1518,6 +1510,26 @@ config FB_PXA_PARAMETERS
 
           <file:Documentation/fb/pxafb.txt> describes the available parameters.
 
+config FB_MBX
+        tristate "2700G LCD framebuffer support"
+        depends on FB && ARCH_PXA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Framebuffer driver for the Intel 2700G (Marathon) Graphics
+          Accelerator
+
+config FB_MBX_DEBUG
+       bool "Enable debugging info via debugfs"
+       depends on FB_MBX && DEBUG_FS
+       default n
+       ---help---
+         Enable this if you want debugging information using the debug
+         filesystem (debugfs)
+
+         If unsure, say N.
+
 config FB_W100
         tristate "W100 frame buffer support"
         depends on FB && PXA_SHARPSL
@@ -1557,6 +1569,21 @@ config FB_S3C2410_DEBUG
           Turn on debugging messages. Note that you can set/unset at run time
           through sysfs
 
+config FB_PNX4008_DUM
+        tristate "Display Update Module support on Philips PNX4008 board"
+        depends on FB && ARCH_PNX4008
+        ---help---
+          Say Y here to enable support for PNX4008 Display Update Module (DUM)
+
+config FB_PNX4008_DUM_RGB
+        tristate "RGB Framebuffer support on Philips PNX4008 board"
+        depends on FB_PNX4008_DUM
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Say Y here to enable support for PNX4008 RGB Framebuffer
+
 config FB_VIRTUAL
         tristate "Virtual Frame Buffer support (ONLY FOR TESTING!)"
         depends on FB
@@ -1585,7 +1612,7 @@ if FB || SGI_NEWPORT_CONSOLE
         source "drivers/video/logo/Kconfig"
 endif
 
-if FB && SYSFS
+if SYSFS
         source "drivers/video/backlight/Kconfig"
 endif
 
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index c335e9bc3b20..481c6c9695f8 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -4,6 +4,7 @@
 
 # Each configuration option enables a list of files.
 
+obj-y                             += fb_notify.o
 obj-$(CONFIG_FB)                  += fb.o
 fb-y                              := fbmem.o fbmon.o fbcmap.o fbsysfs.o \
                                      modedb.o fbcvt.o
@@ -38,6 +39,7 @@ obj-$(CONFIG_FB_SIS)		  += sis/
 obj-$(CONFIG_FB_KYRO)             += kyro/
 obj-$(CONFIG_FB_SAVAGE)           += savage/
 obj-$(CONFIG_FB_GEODE)            += geode/
+obj-$(CONFIG_FB_MBX)              += mbx/
 obj-$(CONFIG_FB_I810)             += vgastate.o
 obj-$(CONFIG_FB_NEOMAGIC)         += neofb.o vgastate.o
 obj-$(CONFIG_FB_VIRGE)            += virgefb.o
@@ -94,6 +96,8 @@ obj-$(CONFIG_FB_TX3912)		  += tx3912fb.o
 obj-$(CONFIG_FB_S1D13XXX)         += s1d13xxxfb.o
 obj-$(CONFIG_FB_IMX)              += imxfb.o
 obj-$(CONFIG_FB_S3C2410)          += s3c2410fb.o
+obj-$(CONFIG_FB_PNX4008_DUM)      += pnx4008/
+obj-$(CONFIG_FB_PNX4008_DUM_RGB)  += pnx4008/
 
 # Platform or fallback drivers go here
 obj-$(CONFIG_FB_VESA)             += vesafb.o
diff --git a/drivers/video/S3triofb.c b/drivers/video/S3triofb.c
index e714e8449c1d..afd146f5f683 100644
--- a/drivers/video/S3triofb.c
+++ b/drivers/video/S3triofb.c
@@ -28,7 +28,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/amifb.c b/drivers/video/amifb.c
index f9bc9f777e75..f1ba54f4fc39 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/amifb.c
@@ -45,7 +45,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index fd95c2dbd4f7..70dd8115a4d8 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -39,7 +39,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index eaeaf4d1a094..1fd22f460b0f 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -34,7 +34,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/atafb.c b/drivers/video/atafb.c
index e69ab65f7843..5831893bf7a0 100644
--- a/drivers/video/atafb.c
+++ b/drivers/video/atafb.c
@@ -53,7 +53,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index 72c589109471..276a21530b95 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -52,7 +52,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
@@ -457,6 +456,10 @@ static void wait_for_fifo(u16 entries, struct aty128fb_par *par);
 static void wait_for_idle(struct aty128fb_par *par);
 static u32 depth_to_dst(u32 depth);
 
+#ifdef CONFIG_FB_ATY128_BACKLIGHT
+static void aty128_bl_set_power(struct fb_info *info, int power);
+#endif
+
 #define BIOS_IN8(v)     (readb(bios + (v)))
 #define BIOS_IN16(v)    (readb(bios + (v)) | \
                           (readb(bios + (v) + 1) << 8))
@@ -1258,25 +1261,11 @@ static void aty128_set_lcd_enable(struct aty128fb_par *par, int on)
                 reg &= ~LVDS_DISPLAY_DIS;
                 aty_st_le32(LVDS_GEN_CNTL, reg);
 #ifdef CONFIG_FB_ATY128_BACKLIGHT
-                mutex_lock(&info->bl_mutex);
-                if (info->bl_dev) {
-                        down(&info->bl_dev->sem);
-                        info->bl_dev->props->update_status(info->bl_dev);
-                        up(&info->bl_dev->sem);
-                }
-                mutex_unlock(&info->bl_mutex);
+                aty128_bl_set_power(info, FB_BLANK_UNBLANK);
 #endif  
         } else {
 #ifdef CONFIG_FB_ATY128_BACKLIGHT
-                mutex_lock(&info->bl_mutex);
-                if (info->bl_dev) {
-                        down(&info->bl_dev->sem);
-                        info->bl_dev->props->brightness = 0;
-                        info->bl_dev->props->power = FB_BLANK_POWERDOWN;
-                        info->bl_dev->props->update_status(info->bl_dev);
-                        up(&info->bl_dev->sem);
-                }
-                mutex_unlock(&info->bl_mutex);
+                aty128_bl_set_power(info, FB_BLANK_POWERDOWN);
 #endif  
                 reg = aty_ld_le32(LVDS_GEN_CNTL);
                 reg |= LVDS_DISPLAY_DIS;
@@ -1703,6 +1692,7 @@ static int __devinit aty128fb_setup(char *options)
 
 static struct backlight_properties aty128_bl_data;
 
+/* Call with fb_info->bl_mutex held */
 static int aty128_bl_get_level_brightness(struct aty128fb_par *par,
                 int level)
 {
@@ -1710,10 +1700,8 @@ static int aty128_bl_get_level_brightness(struct aty128fb_par *par,
         int atylevel;
 
         /* Get and convert the value */
-        mutex_lock(&info->bl_mutex);
         atylevel = MAX_LEVEL -
                 (info->bl_curve[level] * FB_BACKLIGHT_MAX / MAX_LEVEL);
-        mutex_unlock(&info->bl_mutex);
 
         if (atylevel < 0)
                 atylevel = 0;
@@ -1731,7 +1719,8 @@ static int aty128_bl_get_level_brightness(struct aty128fb_par *par,
 /* That one prevents proper CRT output with LCD off */
 #undef BACKLIGHT_DAC_OFF
 
-static int aty128_bl_update_status(struct backlight_device *bd)
+/* Call with fb_info->bl_mutex held */
+static int __aty128_bl_update_status(struct backlight_device *bd)
 {
         struct aty128fb_par *par = class_get_devdata(&bd->class_dev);
         unsigned int reg = aty_ld_le32(LVDS_GEN_CNTL);
@@ -1784,6 +1773,19 @@ static int aty128_bl_update_status(struct backlight_device *bd)
         return 0;
 }
 
+static int aty128_bl_update_status(struct backlight_device *bd)
+{
+        struct aty128fb_par *par = class_get_devdata(&bd->class_dev);
+        struct fb_info *info = pci_get_drvdata(par->pdev);
+        int ret;
+
+        mutex_lock(&info->bl_mutex);
+        ret = __aty128_bl_update_status(bd);
+        mutex_unlock(&info->bl_mutex);
+
+        return ret;
+}
+
 static int aty128_bl_get_brightness(struct backlight_device *bd)
 {
         return bd->props->brightness;
@@ -1796,6 +1798,20 @@ static struct backlight_properties aty128_bl_data = {
         .max_brightness = (FB_BACKLIGHT_LEVELS - 1),
 };
 
+static void aty128_bl_set_power(struct fb_info *info, int power)
+{
+        mutex_lock(&info->bl_mutex);
+
+        if (info->bl_dev) {
+                down(&info->bl_dev->sem);
+                info->bl_dev->props->power = power;
+                __aty128_bl_update_status(info->bl_dev);
+                up(&info->bl_dev->sem);
+        }
+
+        mutex_unlock(&info->bl_mutex);
+}
+
 static void aty128_bl_init(struct aty128fb_par *par)
 {
         struct fb_info *info = pci_get_drvdata(par->pdev);
@@ -1816,7 +1832,7 @@ static void aty128_bl_init(struct aty128fb_par *par)
         bd = backlight_device_register(name, par, &aty128_bl_data);
         if (IS_ERR(bd)) {
                 info->bl_dev = NULL;
-                printk("aty128: Backlight registration failed\n");
+                printk(KERN_WARNING "aty128: Backlight registration failed\n");
                 goto error;
         }
 
@@ -1827,11 +1843,11 @@ static void aty128_bl_init(struct aty128fb_par *par)
                 219 * FB_BACKLIGHT_MAX / MAX_LEVEL);
         mutex_unlock(&info->bl_mutex);
 
-        up(&bd->sem);
+        down(&bd->sem);
         bd->props->brightness = aty128_bl_data.max_brightness;
         bd->props->power = FB_BLANK_UNBLANK;
         bd->props->update_status(bd);
-        down(&bd->sem);
+        up(&bd->sem);
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         mutex_lock(&pmac_backlight_mutex);
@@ -1901,9 +1917,6 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         u8 chip_rev;
         u32 dac;
 
-        if (!par->vram_size)    /* may have already been probed */
-                par->vram_size = aty_ld_le32(CONFIG_MEMSIZE) & 0x03FFFFFF;
-
         /* Get the chip revision */
         chip_rev = (aty_ld_le32(CONFIG_CNTL) >> 16) & 0x1F;
 
@@ -2016,9 +2029,6 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
 
         aty128_init_engine(par);
 
-        if (register_framebuffer(info) < 0)
-                return 0;
-
         par->pm_reg = pci_find_capability(pdev, PCI_CAP_ID_PM);
         par->pdev = pdev;
         par->asleep = 0;
@@ -2028,6 +2038,9 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         aty128_bl_init(par);
 #endif
 
+        if (register_framebuffer(info) < 0)
+                return 0;
+
         printk(KERN_INFO "fb%d: %s frame buffer device on %s\n",
                info->node, info->fix.id, video_card);
 
@@ -2077,7 +2090,6 @@ static int __devinit aty128_probe(struct pci_dev *pdev, const struct pci_device_
         par = info->par;
 
         info->pseudo_palette = par->pseudo_palette;
-        info->fix = aty128fb_fix;
 
         /* Virtualize mmio region */
         info->fix.mmio_start = reg_addr;
@@ -2198,12 +2210,8 @@ static int aty128fb_blank(int blank, struct fb_info *fb)
                 return 0;
 
 #ifdef CONFIG_FB_ATY128_BACKLIGHT
-        if (machine_is(powermac) && blank) {
-                down(&fb->bl_dev->sem);
-                fb->bl_dev->props->power = FB_BLANK_POWERDOWN;
-                fb->bl_dev->props->update_status(fb->bl_dev);
-                up(&fb->bl_dev->sem);
-        }
+        if (machine_is(powermac) && blank)
+                aty128_bl_set_power(fb, FB_BLANK_POWERDOWN);
 #endif
 
         if (blank & FB_BLANK_VSYNC_SUSPEND)
@@ -2219,14 +2227,12 @@ static int aty128fb_blank(int blank, struct fb_info *fb)
                 aty128_set_crt_enable(par, par->crt_on && !blank);
                 aty128_set_lcd_enable(par, par->lcd_on && !blank);
         }
+
 #ifdef CONFIG_FB_ATY128_BACKLIGHT
-        if (machine_is(powermac) && !blank) {
-                down(&fb->bl_dev->sem);
-                fb->bl_dev->props->power = FB_BLANK_UNBLANK;
-                fb->bl_dev->props->update_status(fb->bl_dev);
-                up(&fb->bl_dev->sem);
-        }
+        if (machine_is(powermac) && !blank)
+                aty128_bl_set_power(fb, FB_BLANK_UNBLANK);
 #endif
+
         return 0;
 }
 
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index 0c9706746d79..19a71f045784 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -2129,15 +2129,14 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
 
 static struct backlight_properties aty_bl_data;
 
+/* Call with fb_info->bl_mutex held */
 static int aty_bl_get_level_brightness(struct atyfb_par *par, int level)
 {
         struct fb_info *info = pci_get_drvdata(par->pdev);
         int atylevel;
 
         /* Get and convert the value */
-        mutex_lock(&info->bl_mutex);
         atylevel = info->bl_curve[level] * FB_BACKLIGHT_MAX / MAX_LEVEL;
-        mutex_unlock(&info->bl_mutex);
 
         if (atylevel < 0)
                 atylevel = 0;
@@ -2147,7 +2146,8 @@ static int aty_bl_get_level_brightness(struct atyfb_par *par, int level)
         return atylevel;
 }
 
-static int aty_bl_update_status(struct backlight_device *bd)
+/* Call with fb_info->bl_mutex held */
+static int __aty_bl_update_status(struct backlight_device *bd)
 {
         struct atyfb_par *par = class_get_devdata(&bd->class_dev);
         unsigned int reg = aty_ld_lcd(LCD_MISC_CNTL, par);
@@ -2172,6 +2172,19 @@ static int aty_bl_update_status(struct backlight_device *bd)
         return 0;
 }
 
+static int aty_bl_update_status(struct backlight_device *bd)
+{
+        struct atyfb_par *par = class_get_devdata(&bd->class_dev);
+        struct fb_info *info = pci_get_drvdata(par->pdev);
+        int ret;
+
+        mutex_lock(&info->bl_mutex);
+        ret = __aty_bl_update_status(bd);
+        mutex_unlock(&info->bl_mutex);
+
+        return ret;
+}
+
 static int aty_bl_get_brightness(struct backlight_device *bd)
 {
         return bd->props->brightness;
@@ -2184,6 +2197,20 @@ static struct backlight_properties aty_bl_data = {
         .max_brightness = (FB_BACKLIGHT_LEVELS - 1),
 };
 
+static void aty_bl_set_power(struct fb_info *info, int power)
+{
+        mutex_lock(&info->bl_mutex);
+
+        if (info->bl_dev) {
+                down(&info->bl_dev->sem);
+                info->bl_dev->props->power = power;
+                __aty_bl_update_status(info->bl_dev);
+                up(&info->bl_dev->sem);
+        }
+
+        mutex_unlock(&info->bl_mutex);
+}
+
 static void aty_bl_init(struct atyfb_par *par)
 {
         struct fb_info *info = pci_get_drvdata(par->pdev);
@@ -2200,7 +2227,7 @@ static void aty_bl_init(struct atyfb_par *par)
         bd = backlight_device_register(name, par, &aty_bl_data);
         if (IS_ERR(bd)) {
                 info->bl_dev = NULL;
-                printk("aty: Backlight registration failed\n");
+                printk(KERN_WARNING "aty: Backlight registration failed\n");
                 goto error;
         }
 
@@ -2211,11 +2238,11 @@ static void aty_bl_init(struct atyfb_par *par)
                 0xFF * FB_BACKLIGHT_MAX / MAX_LEVEL);
         mutex_unlock(&info->bl_mutex);
 
-        up(&bd->sem);
+        down(&bd->sem);
         bd->props->brightness = aty_bl_data.max_brightness;
         bd->props->power = FB_BLANK_UNBLANK;
         bd->props->update_status(bd);
-        down(&bd->sem);
+        up(&bd->sem);
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         mutex_lock(&pmac_backlight_mutex);
@@ -2789,17 +2816,9 @@ static int atyfb_blank(int blank, struct fb_info *info)
         if (par->lock_blank || par->asleep)
                 return 0;
 
-#ifdef CONFIG_PMAC_BACKLIGHT
-        if (machine_is(powermac) && blank > FB_BLANK_NORMAL) {
-                mutex_lock(&info->bl_mutex);
-                if (info->bl_dev) {
-                        down(&info->bl_dev->sem);
-                        info->bl_dev->props->power = FB_BLANK_POWERDOWN;
-                        info->bl_dev->props->update_status(info->bl_dev);
-                        up(&info->bl_dev->sem);
-                }
-                mutex_unlock(&info->bl_mutex);
-        }
+#ifdef CONFIG_FB_ATY_BACKLIGHT
+        if (machine_is(powermac) && blank > FB_BLANK_NORMAL)
+                aty_bl_set_power(info, FB_BLANK_POWERDOWN);
 #elif defined(CONFIG_FB_ATY_GENERIC_LCD)
         if (par->lcd_table && blank > FB_BLANK_NORMAL &&
             (aty_ld_lcd(LCD_GEN_CNTL, par) & LCD_ON)) {
@@ -2829,17 +2848,9 @@ static int atyfb_blank(int blank, struct fb_info *info)
         }
         aty_st_le32(CRTC_GEN_CNTL, gen_cntl, par);
 
-#ifdef CONFIG_PMAC_BACKLIGHT
-        if (machine_is(powermac) && blank <= FB_BLANK_NORMAL) {
-                mutex_lock(&info->bl_mutex);
-                if (info->bl_dev) {
-                        down(&info->bl_dev->sem);
-                        info->bl_dev->props->power = FB_BLANK_UNBLANK;
-                        info->bl_dev->props->update_status(info->bl_dev);
-                        up(&info->bl_dev->sem);
-                }
-                mutex_unlock(&info->bl_mutex);
-        }
+#ifdef CONFIG_FB_ATY_BACKLIGHT
+        if (machine_is(powermac) && blank <= FB_BLANK_NORMAL)
+                aty_bl_set_power(info, FB_BLANK_UNBLANK);
 #elif defined(CONFIG_FB_ATY_GENERIC_LCD)
         if (par->lcd_table && blank <= FB_BLANK_NORMAL &&
             (aty_ld_lcd(LCD_GEN_CNTL, par) & LCD_ON)) {
diff --git a/drivers/video/aty/radeon_backlight.c b/drivers/video/aty/radeon_backlight.c
index 1755dddf1899..585eb7b9e636 100644
--- a/drivers/video/aty/radeon_backlight.c
+++ b/drivers/video/aty/radeon_backlight.c
@@ -195,11 +195,11 @@ void radeonfb_bl_init(struct radeonfb_info *rinfo)
                 217 * FB_BACKLIGHT_MAX / MAX_RADEON_LEVEL);
         mutex_unlock(&rinfo->info->bl_mutex);
 
-        up(&bd->sem);
+        down(&bd->sem);
         bd->props->brightness = radeon_bl_data.max_brightness;
         bd->props->power = FB_BLANK_UNBLANK;
         bd->props->update_status(bd);
-        down(&bd->sem);
+        up(&bd->sem);
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         mutex_lock(&pmac_backlight_mutex);
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 51b78f8de949..8e3400d5dd21 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -58,7 +58,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/time.h>
@@ -267,6 +266,8 @@ static int force_measure_pll = 0;
 #ifdef CONFIG_MTRR
 static int nomtrr = 0;
 #endif
+static int force_sleep;
+static int ignore_devlist;
 
 /*
  * prototypes
@@ -2328,9 +2329,9 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
                 /* -2 is special: means  ON on mobility chips and do not
                  * change on others
                  */
-                radeonfb_pm_init(rinfo, rinfo->is_mobility ? 1 : -1);
+                radeonfb_pm_init(rinfo, rinfo->is_mobility ? 1 : -1, ignore_devlist, force_sleep);
         } else
-                radeonfb_pm_init(rinfo, default_dynclk);
+                radeonfb_pm_init(rinfo, default_dynclk, ignore_devlist, force_sleep);
 
         pci_set_drvdata(pdev, info);
 
@@ -2478,6 +2479,12 @@ static int __init radeonfb_setup (char *options)
                         force_measure_pll = 1;
                 } else if (!strncmp(this_opt, "ignore_edid", 11)) {
                         ignore_edid = 1;
+#if defined(CONFIG_PM) && defined(CONFIG_X86)
+                } else if (!strncmp(this_opt, "force_sleep", 11)) {
+                        force_sleep = 1;
+                } else if (!strncmp(this_opt, "ignore_devlist", 14)) {
+                        ignore_devlist = 1;
+#endif
                 } else
                         mode_option = this_opt;
         }
@@ -2533,3 +2540,9 @@ module_param(panel_yres, int, 0);
 MODULE_PARM_DESC(panel_yres, "int: set panel yres");
 module_param(mode_option, charp, 0);
 MODULE_PARM_DESC(mode_option, "Specify resolution as \"<xres>x<yres>[-<bpp>][@<refresh>]\" ");
+#if defined(CONFIG_PM) && defined(CONFIG_X86)
+module_param(force_sleep, bool, 0);
+MODULE_PARM_DESC(force_sleep, "bool: force D2 sleep mode on all hardware");
+module_param(ignore_devlist, bool, 0);
+MODULE_PARM_DESC(ignore_devlist, "bool: ignore workarounds for bugs in specific laptops");
+#endif
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index c7091761cef4..f31e606a2ded 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -27,6 +27,99 @@
 
 #include "ati_ids.h"
 
+static void radeon_reinitialize_M10(struct radeonfb_info *rinfo);
+
+/*
+ * Workarounds for bugs in PC laptops:
+ * - enable D2 sleep in some IBM Thinkpads
+ * - special case for Samsung P35
+ *
+ * Whitelist by subsystem vendor/device because
+ * its the subsystem vendor's fault!
+ */
+
+#if defined(CONFIG_PM) && defined(CONFIG_X86)
+struct radeon_device_id {
+        const char *ident;                     /* (arbitrary) Name */
+        const unsigned short subsystem_vendor; /* Subsystem Vendor ID */
+        const unsigned short subsystem_device; /* Subsystem Device ID */
+        const enum radeon_pm_mode pm_mode_modifier; /* modify pm_mode */
+        const reinit_function_ptr new_reinit_func;   /* changed reinit_func */
+};
+
+#define BUGFIX(model, sv, sd, pm, fn) { \
+        .ident = model, \
+        .subsystem_vendor = sv, \
+        .subsystem_device = sd, \
+        .pm_mode_modifier = pm, \
+        .new_reinit_func  = fn  \
+}
+
+static struct radeon_device_id radeon_workaround_list[] = {
+        BUGFIX("IBM Thinkpad R32",
+               PCI_VENDOR_ID_IBM, 0x1905,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R40",
+               PCI_VENDOR_ID_IBM, 0x0526,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R40",
+               PCI_VENDOR_ID_IBM, 0x0527,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R50/R51/T40/T41",
+               PCI_VENDOR_ID_IBM, 0x0531,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R51/T40/T41/T42",
+               PCI_VENDOR_ID_IBM, 0x0530,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad T30",
+               PCI_VENDOR_ID_IBM, 0x0517,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad T40p",
+               PCI_VENDOR_ID_IBM, 0x054d,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad T42",
+               PCI_VENDOR_ID_IBM, 0x0550,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad X31/X32",
+               PCI_VENDOR_ID_IBM, 0x052f,
+               radeon_pm_d2, NULL),
+        BUGFIX("Samsung P35",
+               PCI_VENDOR_ID_SAMSUNG, 0xc00c,
+               radeon_pm_off, radeon_reinitialize_M10),
+        { .ident = NULL }
+};
+
+static int radeon_apply_workarounds(struct radeonfb_info *rinfo)
+{
+        struct radeon_device_id *id;
+
+        for (id = radeon_workaround_list; id->ident != NULL; id++ )
+                if ((id->subsystem_vendor == rinfo->pdev->subsystem_vendor ) &&
+                    (id->subsystem_device == rinfo->pdev->subsystem_device )) {
+
+                        /* we found a device that requires workaround */
+                        printk(KERN_DEBUG "radeonfb: %s detected"
+                               ", enabling workaround\n", id->ident);
+
+                        rinfo->pm_mode |= id->pm_mode_modifier;
+
+                        if (id->new_reinit_func != NULL)
+                                rinfo->reinit_func = id->new_reinit_func;
+
+                        return 1;
+                }
+        return 0;  /* not found */
+}
+
+#else  /* defined(CONFIG_PM) && defined(CONFIG_X86) */
+static inline int radeon_apply_workarounds(struct radeonfb_info *rinfo)
+{
+        return 0;
+}
+#endif /* defined(CONFIG_PM) && defined(CONFIG_X86) */
+
+
+
 static void radeon_pm_disable_dynamic_mode(struct radeonfb_info *rinfo)
 {
         u32 tmp;
@@ -852,18 +945,26 @@ static void radeon_pm_setup_for_suspend(struct radeonfb_info *rinfo)
         /* because both INPLL and OUTPLL take the same lock, that's why. */
         tmp = INPLL( pllMCLK_MISC) | MCLK_MISC__EN_MCLK_TRISTATE_IN_SUSPEND;
         OUTPLL( pllMCLK_MISC, tmp);
-        
-        /* AGP PLL control */
-        if (rinfo->family <= CHIP_FAMILY_RV280) {
-                OUTREG(BUS_CNTL1, INREG(BUS_CNTL1) |  BUS_CNTL1__AGPCLK_VALID);
 
-                OUTREG(BUS_CNTL1,
-                       (INREG(BUS_CNTL1) & ~BUS_CNTL1__MOBILE_PLATFORM_SEL_MASK)
-                       | (2<<BUS_CNTL1__MOBILE_PLATFORM_SEL__SHIFT));   // 440BX
-        } else {
-                OUTREG(BUS_CNTL1, INREG(BUS_CNTL1));
-                OUTREG(BUS_CNTL1, (INREG(BUS_CNTL1) & ~0x4000) | 0x8000);
+        /* BUS_CNTL1__MOBILE_PLATORM_SEL setting is northbridge chipset
+         * and radeon chip dependent. Thus we only enable it on Mac for
+         * now (until we get more info on how to compute the correct
+         * value for various X86 bridges).
+         */
+#ifdef CONFIG_PPC_PMAC
+        if (machine_is(powermac)) {
+                /* AGP PLL control */
+                if (rinfo->family <= CHIP_FAMILY_RV280) {
+                        OUTREG(BUS_CNTL1, INREG(BUS_CNTL1) |  BUS_CNTL1__AGPCLK_VALID);
+                        OUTREG(BUS_CNTL1,
+                               (INREG(BUS_CNTL1) & ~BUS_CNTL1__MOBILE_PLATFORM_SEL_MASK)
+                               | (2<<BUS_CNTL1__MOBILE_PLATFORM_SEL__SHIFT));   // 440BX
+                } else {
+                        OUTREG(BUS_CNTL1, INREG(BUS_CNTL1));
+                        OUTREG(BUS_CNTL1, (INREG(BUS_CNTL1) & ~0x4000) | 0x8000);
+                }
         }
+#endif
 
         OUTREG(CRTC_OFFSET_CNTL, (INREG(CRTC_OFFSET_CNTL)
                                   & ~CRTC_OFFSET_CNTL__CRTC_STEREO_SYNC_OUT_EN));
@@ -2713,7 +2814,7 @@ static void radeonfb_early_resume(void *data)
 
 #endif /* CONFIG_PM */
 
-void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
+void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlist, int force_sleep)
 {
         /* Find PM registers in config space if any*/
         rinfo->pm_reg = pci_find_capability(rinfo->pdev, PCI_CAP_ID_PM);
@@ -2729,22 +2830,13 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
         }
 
 #if defined(CONFIG_PM)
+#if defined(CONFIG_PPC_PMAC)
         /* Check if we can power manage on suspend/resume. We can do
          * D2 on M6, M7 and M9, and we can resume from D3 cold a few other
          * "Mac" cards, but that's all. We need more infos about what the
          * BIOS does tho. Right now, all this PM stuff is pmac-only for that
          * reason. --BenH
          */
-        /* Special case for Samsung P35 laptops
-         */
-        if ((rinfo->pdev->vendor == PCI_VENDOR_ID_ATI) &&
-            (rinfo->pdev->device == PCI_CHIP_RV350_NP) &&
-            (rinfo->pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG) &&
-            (rinfo->pdev->subsystem_device == 0xc00c)) {
-                rinfo->reinit_func = radeon_reinitialize_M10;
-                rinfo->pm_mode |= radeon_pm_off;
-        }
-#if defined(CONFIG_PPC_PMAC)
         if (machine_is(powermac) && rinfo->of_node) {
                 if (rinfo->is_mobility && rinfo->pm_reg &&
                     rinfo->family <= CHIP_FAMILY_RV250)
@@ -2790,6 +2882,18 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
         }
 #endif /* defined(CONFIG_PPC_PMAC) */
 #endif /* defined(CONFIG_PM) */
+
+        if (ignore_devlist)
+                printk(KERN_DEBUG
+                       "radeonfb: skipping test for device workarounds\n");
+        else
+                radeon_apply_workarounds(rinfo);
+
+        if (force_sleep) {
+                printk(KERN_DEBUG
+                       "radeonfb: forcefully enabling D2 sleep mode\n");
+                rinfo->pm_mode |= radeon_pm_d2;
+        }
 }
 
 void radeonfb_pm_exit(struct radeonfb_info *rinfo)
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index 38657b2d10eb..d5ff224a6258 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -273,6 +273,8 @@ enum radeon_pm_mode {
         radeon_pm_off   = 0x00000002,   /* Can resume from D3 cold */
 };
 
+typedef void (*reinit_function_ptr)(struct radeonfb_info *rinfo);
+
 struct radeonfb_info {
         struct fb_info          *info;
 
@@ -338,7 +340,7 @@ struct radeonfb_info {
         int                     dynclk;
         int                     no_schedule;
         enum radeon_pm_mode     pm_mode;
-        void                    (*reinit_func)(struct radeonfb_info *rinfo);
+        reinit_function_ptr     reinit_func;
 
         /* Lock on register access */
         spinlock_t              reg_lock;
@@ -600,7 +602,7 @@ extern int radeon_probe_i2c_connector(struct radeonfb_info *rinfo, int conn, u8
 /* PM Functions */
 extern int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t state);
 extern int radeonfb_pci_resume(struct pci_dev *pdev);
-extern void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk);
+extern void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlist, int force_sleep);
 extern void radeonfb_pm_exit(struct radeonfb_info *rinfo);
 
 /* Monitor probe functions */
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index a92a91fef16f..f25d5d648333 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -156,7 +156,7 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 
                         info->fix.visual = FB_VISUAL_TRUECOLOR;
                         info->fix.line_length = info->var.xres_virtual << 1; /* depth=16 */
-        }
+                }
         } else {
                 /* mono */
                 info->fix.visual = FB_VISUAL_MONO10;
@@ -164,20 +164,16 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
         }
 
         info->screen_size = info->fix.line_length * info->var.yres_virtual;
+        info->var.rotate = ((fbdev->panel->control_base&LCD_CONTROL_SM_MASK) \
+                                >> LCD_CONTROL_SM_BIT) * 90;
 
         /* Determine BPP mode and format */
-        fbdev->regs->lcd_control = fbdev->panel->control_base |
-                            ((info->var.rotate/90) << LCD_CONTROL_SM_BIT);
-
-        fbdev->regs->lcd_intenable = 0;
-        fbdev->regs->lcd_intstatus = 0;
-
+        fbdev->regs->lcd_control = fbdev->panel->control_base;
         fbdev->regs->lcd_horztiming = fbdev->panel->horztiming;
-
         fbdev->regs->lcd_verttiming = fbdev->panel->verttiming;
-
         fbdev->regs->lcd_clkcontrol = fbdev->panel->clkcontrol_base;
-
+        fbdev->regs->lcd_intenable = 0;
+        fbdev->regs->lcd_intstatus = 0;
         fbdev->regs->lcd_dmaaddr0 = LCD_DMA_SA_N(fbdev->fb_phys);
 
         if (panel_is_dual(fbdev->panel)) {
@@ -206,6 +202,8 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 
         /* Resume controller */
         fbdev->regs->lcd_control |= LCD_CONTROL_GO;
+        mdelay(10);
+        au1100fb_fb_blank(VESA_NO_BLANKING, info);
 
         return 0;
 }
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index 022f9d3473f5..02f15297a021 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -10,7 +10,7 @@ menuconfig BACKLIGHT_LCD_SUPPORT
 
 config BACKLIGHT_CLASS_DEVICE
         tristate "Lowlevel Backlight controls"
-        depends on BACKLIGHT_LCD_SUPPORT && FB
+        depends on BACKLIGHT_LCD_SUPPORT
         default m
         help
           This framework adds support for low-level control of the LCD
@@ -26,7 +26,7 @@ config BACKLIGHT_DEVICE
 
 config LCD_CLASS_DEVICE
         tristate "Lowlevel LCD controls"
-        depends on BACKLIGHT_LCD_SUPPORT && FB
+        depends on BACKLIGHT_LCD_SUPPORT
         default m
         help
           This framework adds support for low-level control of LCD.
diff --git a/drivers/video/chipsfb.c b/drivers/video/chipsfb.c
index 0e465c80ef24..73cb426bf2d7 100644
--- a/drivers/video/chipsfb.c
+++ b/drivers/video/chipsfb.c
@@ -19,7 +19,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
@@ -150,12 +149,11 @@ static int chipsfb_blank(int blank, struct fb_info *info)
         mutex_lock(&pmac_backlight_mutex);
 
         if (pmac_backlight) {
-                down(&pmac_backlight->sem);
-
                 /* used to disable backlight only for blank > 1, but it seems
                  * useful at blank = 1 too (saves battery, extends backlight
                  * life)
                  */
+                down(&pmac_backlight->sem);
                 if (blank)
                         pmac_backlight->props->power = FB_BLANK_POWERDOWN;
                 else
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index 7355da09c721..daf43f535a0b 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -41,7 +41,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c
index 878707a04398..d9315d99445f 100644
--- a/drivers/video/console/dummycon.c
+++ b/drivers/video/console/dummycon.c
@@ -7,9 +7,9 @@
 
 #include <linux/types.h>
 #include <linux/kdev_t.h>
-#include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/vt_kern.h>
+#include <linux/screen_info.h>
 #include <linux/init.h>
 #include <linux/module.h>
 
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 94e9f7069bef..390439b3d899 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -64,7 +64,6 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>        /* MSch: for IRQ probe */
-#include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/string.h>
 #include <linux/kd.h>
diff --git a/drivers/video/console/mdacon.c b/drivers/video/console/mdacon.c
index c89f90edf8ac..eb4d03fa5391 100644
--- a/drivers/video/console/mdacon.c
+++ b/drivers/video/console/mdacon.c
@@ -31,7 +31,6 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/string.h>
 #include <linux/kd.h>
@@ -198,7 +197,7 @@ static int __init mdacon_setup(char *str)
 __setup("mdacon=", mdacon_setup);
 #endif
 
-static int __init mda_detect(void)
+static int mda_detect(void)
 {
         int count=0;
         u16 *p, p_save;
@@ -283,7 +282,7 @@ static int __init mda_detect(void)
         return 1;
 }
 
-static void __init mda_initialize(void)
+static void mda_initialize(void)
 {
         write_mda_b(97, 0x00);          /* horizontal total */
         write_mda_b(80, 0x01);          /* horizontal displayed */
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index 03041311711b..7fa1afeae8dc 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -12,7 +12,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
-#include <linux/tty.h>
 #include <linux/kd.h>
 #include <linux/selection.h>
 #include <linux/console.h>
diff --git a/drivers/video/console/promcon.c b/drivers/video/console/promcon.c
index 5cd5e114d1e6..b78eac63459f 100644
--- a/drivers/video/console/promcon.c
+++ b/drivers/video/console/promcon.c
@@ -10,7 +10,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/console.h>
diff --git a/drivers/video/console/softcursor.c b/drivers/video/console/softcursor.c
index 3957fc7523e2..557c563e4aed 100644
--- a/drivers/video/console/softcursor.c
+++ b/drivers/video/console/softcursor.c
@@ -10,7 +10,6 @@
 
 #include <linux/module.h>
 #include <linux/string.h>
-#include <linux/tty.h>
 #include <linux/fb.h>
 #include <linux/slab.h>
 
diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c
index 45c4f227e56e..45586aaabd1e 100644
--- a/drivers/video/console/sticon.c
+++ b/drivers/video/console/sticon.c
@@ -37,7 +37,6 @@
 
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/errno.h>
 #include <linux/vt_kern.h>
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 05735ff4e9c5..0a2c10a1abf8 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -38,7 +38,6 @@
 #include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
-#include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/string.h>
 #include <linux/kd.h>
@@ -48,6 +47,7 @@
 #include <linux/spinlock.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
+#include <linux/screen_info.h>
 #include <linux/smp_lock.h>
 #include <video/vga.h>
 #include <asm/io.h>
diff --git a/drivers/video/controlfb.c b/drivers/video/controlfb.c
index acdd6a103dbb..8cc6c0e2d27a 100644
--- a/drivers/video/controlfb.c
+++ b/drivers/video/controlfb.c
@@ -36,7 +36,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/cyber2000fb.c
index 2e2924957d8f..aae6d9c26e88 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/cyber2000fb.c
@@ -41,7 +41,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/cyberfb.c b/drivers/video/cyberfb.c
index a3e189f90a7d..c40e72dafb0e 100644
--- a/drivers/video/cyberfb.c
+++ b/drivers/video/cyberfb.c
@@ -81,7 +81,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/zorro.h>
diff --git a/drivers/video/dnfb.c b/drivers/video/dnfb.c
index 5abd3cb00671..b083ea7e9c69 100644
--- a/drivers/video/dnfb.c
+++ b/drivers/video/dnfb.c
@@ -2,7 +2,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/video/epson1355fb.c b/drivers/video/epson1355fb.c
index f0a621ecc288..737257d278f0 100644
--- a/drivers/video/epson1355fb.c
+++ b/drivers/video/epson1355fb.c
@@ -48,7 +48,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/fb_notify.c b/drivers/video/fb_notify.c
new file mode 100644
index 000000000000..8c020389e4fa
--- /dev/null
+++ b/drivers/video/fb_notify.c
@@ -0,0 +1,46 @@
+/*
+ *  linux/drivers/video/fb_notify.c
+ *
+ *  Copyright (C) 2006 Antonino Daplas <adaplas@pol.net>
+ *
+ *      2001 - Documented with DocBook
+ *      - Brad Douglas <brad@neruo.com>
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+#include <linux/fb.h>
+#include <linux/notifier.h>
+
+static BLOCKING_NOTIFIER_HEAD(fb_notifier_list);
+
+/**
+ *      fb_register_client - register a client notifier
+ *      @nb: notifier block to callback on events
+ */
+int fb_register_client(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_register(&fb_notifier_list, nb);
+}
+EXPORT_SYMBOL(fb_register_client);
+
+/**
+ *      fb_unregister_client - unregister a client notifier
+ *      @nb: notifier block to callback on events
+ */
+int fb_unregister_client(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_unregister(&fb_notifier_list, nb);
+}
+EXPORT_SYMBOL(fb_unregister_client);
+
+/**
+ * fb_notifier_call_chain - notify clients of fb_events
+ *
+ */
+int fb_notifier_call_chain(unsigned long val, void *v)
+{
+        return blocking_notifier_call_chain(&fb_notifier_list, val, v);
+}
+EXPORT_SYMBOL_GPL(fb_notifier_call_chain);
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index 1f98392a43b3..e8b135f3d80d 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -13,7 +13,6 @@
 
 #include <linux/string.h>
 #include <linux/module.h>
-#include <linux/tty.h>
 #include <linux/fb.h>
 #include <linux/slab.h>
 
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 33034f81114d..17961e3ecaa0 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -23,7 +23,7 @@
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
-#include <linux/tty.h>
+#include <linux/vt.h>
 #include <linux/init.h>
 #include <linux/linux_logo.h>
 #include <linux/proc_fs.h>
@@ -52,7 +52,6 @@
 
 #define FBPIXMAPSIZE    (1024 * 8)
 
-static BLOCKING_NOTIFIER_HEAD(fb_notifier_list);
 struct fb_info *registered_fb[FB_MAX];
 int num_registered_fb;
 
@@ -791,8 +790,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 
                     event.info = info;
                     event.data = &mode1;
-                    ret = blocking_notifier_call_chain(&fb_notifier_list,
-                                              FB_EVENT_MODE_DELETE, &event);
+                    ret = fb_notifier_call_chain(FB_EVENT_MODE_DELETE, &event);
                 }
 
                 if (!ret)
@@ -837,8 +835,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 
                                 info->flags &= ~FBINFO_MISC_USEREVENT;
                                 event.info = info;
-                                blocking_notifier_call_chain(&fb_notifier_list,
-                                                evnt, &event);
+                                fb_notifier_call_chain(evnt, &event);
                         }
                 }
         }
@@ -861,8 +858,7 @@ fb_blank(struct fb_info *info, int blank)
 
                 event.info = info;
                 event.data = &blank;
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                FB_EVENT_BLANK, &event);
+                fb_notifier_call_chain(FB_EVENT_BLANK, &event);
         }
 
         return ret;
@@ -933,8 +929,7 @@ fb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                 con2fb.framebuffer = -1;
                 event.info = info;
                 event.data = &con2fb;
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                    FB_EVENT_GET_CONSOLE_MAP, &event);
+                fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
                 return copy_to_user(argp, &con2fb,
                                     sizeof(con2fb)) ? -EFAULT : 0;
         case FBIOPUT_CON2FBMAP:
@@ -952,9 +947,8 @@ fb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                     return -EINVAL;
                 event.info = info;
                 event.data = &con2fb;
-                return blocking_notifier_call_chain(&fb_notifier_list,
-                                           FB_EVENT_SET_CONSOLE_MAP,
-                                           &event);
+                return fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
+                                              &event);
         case FBIOBLANK:
                 acquire_console_sem();
                 info->flags |= FBINFO_MISC_USEREVENT;
@@ -1330,8 +1324,7 @@ register_framebuffer(struct fb_info *fb_info)
         registered_fb[i] = fb_info;
 
         event.info = fb_info;
-        blocking_notifier_call_chain(&fb_notifier_list,
-                            FB_EVENT_FB_REGISTERED, &event);
+        fb_notifier_call_chain(FB_EVENT_FB_REGISTERED, &event);
         return 0;
 }
 
@@ -1365,30 +1358,11 @@ unregister_framebuffer(struct fb_info *fb_info)
         fb_cleanup_class_device(fb_info);
         class_device_destroy(fb_class, MKDEV(FB_MAJOR, i));
         event.info = fb_info;
-        blocking_notifier_call_chain(&fb_notifier_list,
-                                     FB_EVENT_FB_UNREGISTERED, &event);
+        fb_notifier_call_chain(FB_EVENT_FB_UNREGISTERED, &event);
         return 0;
 }
 
 /**
- *      fb_register_client - register a client notifier
- *      @nb: notifier block to callback on events
- */
-int fb_register_client(struct notifier_block *nb)
-{
-        return blocking_notifier_chain_register(&fb_notifier_list, nb);
-}
-
-/**
- *      fb_unregister_client - unregister a client notifier
- *      @nb: notifier block to callback on events
- */
-int fb_unregister_client(struct notifier_block *nb)
-{
-        return blocking_notifier_chain_unregister(&fb_notifier_list, nb);
-}
-
-/**
  *      fb_set_suspend - low level driver signals suspend
  *      @info: framebuffer affected
  *      @state: 0 = resuming, !=0 = suspending
@@ -1403,13 +1377,11 @@ void fb_set_suspend(struct fb_info *info, int state)
 
         event.info = info;
         if (state) {
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                FB_EVENT_SUSPEND, &event);
+                fb_notifier_call_chain(FB_EVENT_SUSPEND, &event);
                 info->state = FBINFO_STATE_SUSPENDED;
         } else {
                 info->state = FBINFO_STATE_RUNNING;
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                FB_EVENT_RESUME, &event);
+                fb_notifier_call_chain(FB_EVENT_RESUME, &event);
         }
 }
 
@@ -1480,9 +1452,7 @@ int fb_new_modelist(struct fb_info *info)
 
         if (!list_empty(&info->modelist)) {
                 event.info = info;
-                err = blocking_notifier_call_chain(&fb_notifier_list,
-                                           FB_EVENT_NEW_MODELIST,
-                                           &event);
+                err = fb_notifier_call_chain(FB_EVENT_NEW_MODELIST, &event);
         }
 
         return err;
@@ -1594,8 +1564,6 @@ EXPORT_SYMBOL(fb_blank);
 EXPORT_SYMBOL(fb_pan_display);
 EXPORT_SYMBOL(fb_get_buffer_offset);
 EXPORT_SYMBOL(fb_set_suspend);
-EXPORT_SYMBOL(fb_register_client);
-EXPORT_SYMBOL(fb_unregister_client);
 EXPORT_SYMBOL(fb_get_options);
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbmon.c b/drivers/video/fbmon.c
index 3ccfff715a51..de93139ccbb5 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbmon.c
@@ -26,7 +26,6 @@
  * for more details.
  *
  */
-#include <linux/tty.h>
 #include <linux/fb.h>
 #include <linux/module.h>
 #include <linux/pci.h>
diff --git a/drivers/video/g364fb.c b/drivers/video/g364fb.c
index 605d1a132020..1b981b635675 100644
--- a/drivers/video/g364fb.c
+++ b/drivers/video/g364fb.c
@@ -21,7 +21,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
index 4d3a8871d3d1..bcf9cea54d8b 100644
--- a/drivers/video/geode/gx1fb_core.c
+++ b/drivers/video/geode/gx1fb_core.c
@@ -15,7 +15,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 5ef12a3dfa50..0d3643fc6293 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -25,7 +25,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c
index 4e39035cf335..fb9e67228543 100644
--- a/drivers/video/hgafb.c
+++ b/drivers/video/hgafb.c
@@ -36,7 +36,6 @@
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/hitfb.c b/drivers/video/hitfb.c
index 01864767450d..4cc6b454265e 100644
--- a/drivers/video/hitfb.c
+++ b/drivers/video/hitfb.c
@@ -17,7 +17,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/video/hpfb.c b/drivers/video/hpfb.c
index abd920a663a0..91cf3b577d15 100644
--- a/drivers/video/hpfb.c
+++ b/drivers/video/hpfb.c
@@ -11,7 +11,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index fbe8a2c4b04c..a6ca02f2156a 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -33,7 +33,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/init.h>
diff --git a/drivers/video/igafb.c b/drivers/video/igafb.c
index 8a0c2d3d3805..67f384f86758 100644
--- a/drivers/video/igafb.c
+++ b/drivers/video/igafb.c
@@ -33,7 +33,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/imacfb.c b/drivers/video/imacfb.c
index cdbae173d69a..18ea4a549105 100644
--- a/drivers/video/imacfb.c
+++ b/drivers/video/imacfb.c
@@ -15,9 +15,11 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/screen_info.h>
 #include <linux/slab.h>
 #include <linux/string.h>
-#include <linux/tty.h>
+#include <linux/dmi.h>
+#include <linux/efi.h>
 
 #include <asm/io.h>
 
@@ -28,7 +30,7 @@ typedef enum _MAC_TYPE {
         M_I20,
         M_MINI,
         M_MACBOOK,
-        M_NEW
+        M_UNKNOWN
 } MAC_TYPE;
 
 /* --------------------------------------------------------------------- */
@@ -52,10 +54,36 @@ static struct fb_fix_screeninfo imacfb_fix __initdata = {
 };
 
 static int inverse;
-static int model                = M_NEW;
+static int model                = M_UNKNOWN;
 static int manual_height;
 static int manual_width;
 
+static int set_system(struct dmi_system_id *id)
+{
+        printk(KERN_INFO "imacfb: %s detected - set system to %ld\n",
+                id->ident, (long)id->driver_data);
+
+        model = (long)id->driver_data;
+
+        return 0;
+}
+
+static struct dmi_system_id __initdata dmi_system_table[] = {
+        { set_system, "iMac4,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"iMac4,1") }, (void*)M_I17},
+        { set_system, "MacBookPro1,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"MacBookPro1,1") }, (void*)M_I17},
+        { set_system, "MacBook1,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"MacBook1,1")}, (void *)M_MACBOOK},
+        { set_system, "Macmini1,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"Macmini1,1")}, (void *)M_MINI},
+        {},
+};
+
 #define DEFAULT_FB_MEM  1024*1024*16
 
 /* --------------------------------------------------------------------- */
@@ -149,7 +177,6 @@ static int __init imacfb_probe(struct platform_device *dev)
                 screen_info.lfb_linelength = 1472 * 4;
                 screen_info.lfb_base = 0x80010000;
                 break;
-        case M_NEW:
         case M_I20:
                 screen_info.lfb_width = 1680;
                 screen_info.lfb_height = 1050;
@@ -207,6 +234,10 @@ static int __init imacfb_probe(struct platform_device *dev)
                 size_remap = size_total;
         imacfb_fix.smem_len = size_remap;
 
+#ifndef __i386__
+        screen_info.imacpm_seg = 0;
+#endif
+
         if (!request_mem_region(imacfb_fix.smem_start, size_total, "imacfb")) {
                 printk(KERN_WARNING
                        "imacfb: cannot reserve video memory at 0x%lx\n",
@@ -324,8 +355,16 @@ static int __init imacfb_init(void)
         int ret;
         char *option = NULL;
 
-        /* ignore error return of fb_get_options */
-        fb_get_options("imacfb", &option);
+        if (!efi_enabled)
+                return -ENODEV;
+        if (!dmi_check_system(dmi_system_table))
+                return -ENODEV;
+        if (model == M_UNKNOWN)
+                return -ENODEV;
+
+        if (fb_get_options("imacfb", &option))
+                return -ENODEV;
+
         imacfb_setup(option);
         ret = platform_driver_register(&imacfb_driver);
 
diff --git a/drivers/video/imsttfb.c b/drivers/video/imsttfb.c
index 5f393d985b11..5715b8ad0ddc 100644
--- a/drivers/video/imsttfb.c
+++ b/drivers/video/imsttfb.c
@@ -21,7 +21,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 3f39d84015f1..06af89d44a0d 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -113,7 +113,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
@@ -122,6 +121,7 @@
 #include <linux/pci.h>
 #include <linux/vmalloc.h>
 #include <linux/pagemap.h>
+#include <linux/screen_info.h>
 
 #include <asm/io.h>
 
diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c
index 3b78a57924f0..2a9322f9cfdc 100644
--- a/drivers/video/intelfb/intelfbhw.c
+++ b/drivers/video/intelfb/intelfbhw.c
@@ -24,7 +24,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/kyro/fbdev.c b/drivers/video/kyro/fbdev.c
index 2fdbe9b2b04b..f0d614a80f1f 100644
--- a/drivers/video/kyro/fbdev.c
+++ b/drivers/video/kyro/fbdev.c
@@ -16,7 +16,6 @@
 #include <linux/mm.h>
 #include <linux/errno.h>
 #include <linux/string.h>
-#include <linux/tty.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
 #include <linux/ioctl.h>
diff --git a/drivers/video/macfb.c b/drivers/video/macfb.c
index e6cbd9de944a..80a043807161 100644
--- a/drivers/video/macfb.c
+++ b/drivers/video/macfb.c
@@ -24,7 +24,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/nubus.h>
diff --git a/drivers/video/matrox/g450_pll.c b/drivers/video/matrox/g450_pll.c
index 440272ad10e7..7c76e079ca7d 100644
--- a/drivers/video/matrox/g450_pll.c
+++ b/drivers/video/matrox/g450_pll.c
@@ -331,7 +331,15 @@ static int __g450_setclk(WPMINFO unsigned int fout, unsigned int pll,
                                         tmp |= M1064_XPIXCLKCTRL_PLL_UP;
                                 }
                                 matroxfb_DAC_out(PMINFO M1064_XPIXCLKCTRL, tmp);
+#ifdef __powerpc__
+                                /* This is necessary to avoid jitter on PowerPC
+                                 * (OpenFirmware) systems, but apparently
+                                 * introduces jitter, at least on a x86-64
+                                 * using DVI.
+                                 * A simple workaround is disable for non-PPC.
+                                 */
                                 matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL, 0);
+#endif /* __powerpc__ */
                                 matroxfb_DAC_out(PMINFO M1064_XPWRCTRL, xpwrctrl);
 
                                 matroxfb_DAC_unlock_irqrestore(flags);
diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
index b95779b57c06..9c25c2f7966b 100644
--- a/drivers/video/matrox/matroxfb_base.h
+++ b/drivers/video/matrox/matroxfb_base.h
@@ -30,7 +30,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/maxinefb.c b/drivers/video/maxinefb.c
index f85421bf7cb5..38c8d38de4fd 100644
--- a/drivers/video/maxinefb.c
+++ b/drivers/video/maxinefb.c
@@ -29,7 +29,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/video/mbx/Makefile b/drivers/video/mbx/Makefile
new file mode 100644
index 000000000000..16c1165cf9c7
--- /dev/null
+++ b/drivers/video/mbx/Makefile
@@ -0,0 +1,4 @@
+# Makefile for the 2700G controller driver.
+
+obj-$(CONFIG_FB_MBX)       += mbxfb.o
+obj-$(CONFIG_FB_MBX_DEBUG) += mbxfbdebugfs.o
diff --git a/drivers/video/mbx/mbxdebugfs.c b/drivers/video/mbx/mbxdebugfs.c
new file mode 100644
index 000000000000..84aab3ad024e
--- /dev/null
+++ b/drivers/video/mbx/mbxdebugfs.c
@@ -0,0 +1,188 @@
+#include <linux/debugfs.h>
+
+#define BIG_BUFFER_SIZE (1024)
+
+static char big_buffer[BIG_BUFFER_SIZE];
+
+struct mbxfb_debugfs_data {
+        struct dentry *dir;
+        struct dentry *sysconf;
+        struct dentry *clock;
+        struct dentry *display;
+        struct dentry *gsctl;
+};
+
+static int open_file_generic(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->u.generic_ip;
+        return 0;
+}
+
+static ssize_t write_file_dummy(struct file *file, const char __user *buf,
+                                size_t count, loff_t *ppos)
+{
+        return count;
+}
+
+static ssize_t sysconf_read_file(struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        char * s = big_buffer;
+
+        s += sprintf(s, "SYSCFG = %08lx\n", SYSCFG);
+        s += sprintf(s, "PFBASE = %08lx\n", PFBASE);
+        s += sprintf(s, "PFCEIL = %08lx\n", PFCEIL);
+        s += sprintf(s, "POLLFLAG = %08lx\n", POLLFLAG);
+        s += sprintf(s, "SYSRST = %08lx\n", SYSRST);
+
+        return  simple_read_from_buffer(userbuf, count, ppos,
+                                        big_buffer, s-big_buffer);
+}
+
+
+static ssize_t gsctl_read_file(struct file *file, char __user *userbuf,
+                               size_t count, loff_t *ppos)
+{
+        char * s = big_buffer;
+
+        s += sprintf(s, "GSCTRL = %08lx\n", GSCTRL);
+        s += sprintf(s, "VSCTRL = %08lx\n", VSCTRL);
+        s += sprintf(s, "GBBASE = %08lx\n", GBBASE);
+        s += sprintf(s, "VBBASE = %08lx\n", VBBASE);
+        s += sprintf(s, "GDRCTRL = %08lx\n", GDRCTRL);
+        s += sprintf(s, "VCMSK = %08lx\n", VCMSK);
+        s += sprintf(s, "GSCADR = %08lx\n", GSCADR);
+        s += sprintf(s, "VSCADR = %08lx\n", VSCADR);
+        s += sprintf(s, "VUBASE = %08lx\n", VUBASE);
+        s += sprintf(s, "VVBASE = %08lx\n", VVBASE);
+        s += sprintf(s, "GSADR = %08lx\n", GSADR);
+        s += sprintf(s, "VSADR = %08lx\n", VSADR);
+        s += sprintf(s, "HCCTRL = %08lx\n", HCCTRL);
+        s += sprintf(s, "HCSIZE = %08lx\n", HCSIZE);
+        s += sprintf(s, "HCPOS = %08lx\n", HCPOS);
+        s += sprintf(s, "HCBADR = %08lx\n", HCBADR);
+        s += sprintf(s, "HCCKMSK = %08lx\n", HCCKMSK);
+        s += sprintf(s, "GPLUT = %08lx\n", GPLUT);
+
+        return  simple_read_from_buffer(userbuf, count, ppos,
+                                        big_buffer, s-big_buffer);
+}
+
+static ssize_t display_read_file(struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        char * s = big_buffer;
+
+        s += sprintf(s, "DSCTRL = %08lx\n", DSCTRL);
+        s += sprintf(s, "DHT01 = %08lx\n", DHT01);
+        s += sprintf(s, "DHT02 = %08lx\n", DHT02);
+        s += sprintf(s, "DHT03 = %08lx\n", DHT03);
+        s += sprintf(s, "DVT01 = %08lx\n", DVT01);
+        s += sprintf(s, "DVT02 = %08lx\n", DVT02);
+        s += sprintf(s, "DVT03 = %08lx\n", DVT03);
+        s += sprintf(s, "DBCOL = %08lx\n", DBCOL);
+        s += sprintf(s, "BGCOLOR = %08lx\n", BGCOLOR);
+        s += sprintf(s, "DINTRS = %08lx\n", DINTRS);
+        s += sprintf(s, "DINTRE = %08lx\n", DINTRE);
+        s += sprintf(s, "DINTRCNT = %08lx\n", DINTRCNT);
+        s += sprintf(s, "DSIG = %08lx\n", DSIG);
+        s += sprintf(s, "DMCTRL = %08lx\n", DMCTRL);
+        s += sprintf(s, "CLIPCTRL = %08lx\n", CLIPCTRL);
+        s += sprintf(s, "SPOCTRL = %08lx\n", SPOCTRL);
+        s += sprintf(s, "SVCTRL = %08lx\n", SVCTRL);
+        s += sprintf(s, "DLSTS = %08lx\n", DLSTS);
+        s += sprintf(s, "DLLCTRL = %08lx\n", DLLCTRL);
+        s += sprintf(s, "DVLNUM = %08lx\n", DVLNUM);
+        s += sprintf(s, "DUCTRL = %08lx\n", DUCTRL);
+        s += sprintf(s, "DVECTRL = %08lx\n", DVECTRL);
+        s += sprintf(s, "DHDET = %08lx\n", DHDET);
+        s += sprintf(s, "DVDET = %08lx\n", DVDET);
+        s += sprintf(s, "DODMSK = %08lx\n", DODMSK);
+        s += sprintf(s, "CSC01 = %08lx\n", CSC01);
+        s += sprintf(s, "CSC02 = %08lx\n", CSC02);
+        s += sprintf(s, "CSC03 = %08lx\n", CSC03);
+        s += sprintf(s, "CSC04 = %08lx\n", CSC04);
+        s += sprintf(s, "CSC05 = %08lx\n", CSC05);
+
+        return  simple_read_from_buffer(userbuf, count, ppos,
+                                        big_buffer, s-big_buffer);
+}
+
+static ssize_t clock_read_file(struct file *file, char __user *userbuf,
+                               size_t count, loff_t *ppos)
+{
+        char * s = big_buffer;
+
+        s += sprintf(s, "SYSCLKSRC = %08lx\n", SYSCLKSRC);
+        s += sprintf(s, "PIXCLKSRC = %08lx\n", PIXCLKSRC);
+        s += sprintf(s, "CLKSLEEP = %08lx\n", CLKSLEEP);
+        s += sprintf(s, "COREPLL = %08lx\n", COREPLL);
+        s += sprintf(s, "DISPPLL = %08lx\n", DISPPLL);
+        s += sprintf(s, "PLLSTAT = %08lx\n", PLLSTAT);
+        s += sprintf(s, "VOVRCLK = %08lx\n", VOVRCLK);
+        s += sprintf(s, "PIXCLK = %08lx\n", PIXCLK);
+        s += sprintf(s, "MEMCLK = %08lx\n", MEMCLK);
+        s += sprintf(s, "M24CLK = %08lx\n", M24CLK);
+        s += sprintf(s, "MBXCLK = %08lx\n", MBXCLK);
+        s += sprintf(s, "SDCLK = %08lx\n", SDCLK);
+        s += sprintf(s, "PIXCLKDIV = %08lx\n", PIXCLKDIV);
+
+        return  simple_read_from_buffer(userbuf, count, ppos,
+                                        big_buffer, s-big_buffer);
+}
+
+static struct file_operations sysconf_fops = {
+        .read = sysconf_read_file,
+        .write = write_file_dummy,
+        .open = open_file_generic,
+};
+
+static struct file_operations clock_fops = {
+        .read = clock_read_file,
+        .write = write_file_dummy,
+        .open = open_file_generic,
+};
+
+static struct file_operations display_fops = {
+        .read = display_read_file,
+        .write = write_file_dummy,
+        .open = open_file_generic,
+};
+
+static struct file_operations gsctl_fops = {
+        .read = gsctl_read_file,
+        .write = write_file_dummy,
+        .open = open_file_generic,
+};
+
+
+static void __devinit mbxfb_debugfs_init(struct fb_info *fbi)
+{
+        struct mbxfb_info *mfbi = fbi->par;
+        struct mbxfb_debugfs_data *dbg;
+
+        dbg = kzalloc(sizeof(struct mbxfb_debugfs_data), GFP_KERNEL);
+        mfbi->debugfs_data = dbg;
+
+        dbg->dir = debugfs_create_dir("mbxfb", NULL);
+        dbg->sysconf = debugfs_create_file("sysconf", 0444, dbg->dir,
+                                      fbi, &sysconf_fops);
+        dbg->clock = debugfs_create_file("clock", 0444, dbg->dir,
+                                    fbi, &clock_fops);
+        dbg->display = debugfs_create_file("display", 0444, dbg->dir,
+                                      fbi, &display_fops);
+        dbg->gsctl = debugfs_create_file("gsctl", 0444, dbg->dir,
+                                    fbi, &gsctl_fops);
+}
+
+static void __devexit mbxfb_debugfs_remove(struct fb_info *fbi)
+{
+        struct mbxfb_info *mfbi = fbi->par;
+        struct mbxfb_debugfs_data *dbg = mfbi->debugfs_data;
+
+        debugfs_remove(dbg->gsctl);
+        debugfs_remove(dbg->display);
+        debugfs_remove(dbg->clock);
+        debugfs_remove(dbg->sysconf);
+        debugfs_remove(dbg->dir);
+}
diff --git a/drivers/video/mbx/mbxfb.c b/drivers/video/mbx/mbxfb.c
new file mode 100644
index 000000000000..6849ab75d403
--- /dev/null
+++ b/drivers/video/mbx/mbxfb.c
@@ -0,0 +1,683 @@
+/*
+ *  linux/drivers/video/mbx/mbxfb.c
+ *
+ *  Copyright (C) 2006 Compulab, Ltd.
+ *  Mike Rapoport <mike@compulab.co.il>
+ *
+ *   Based on pxafb.c
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive for
+ * more details.
+ *
+ *   Intel 2700G (Marathon) Graphics Accelerator Frame Buffer Driver
+ *
+ */
+
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <asm/io.h>
+
+#include <video/mbxfb.h>
+
+#include "regs.h"
+#include "reg_bits.h"
+
+static unsigned long virt_base_2700;
+
+#define MIN_XRES        16
+#define MIN_YRES        16
+#define MAX_XRES        2048
+#define MAX_YRES        2048
+
+#define MAX_PALETTES    16
+
+/* FIXME: take care of different chip revisions with different sizes
+   of ODFB */
+#define MEMORY_OFFSET   0x60000
+
+struct mbxfb_info {
+        struct device *dev;
+
+        struct resource *fb_res;
+        struct resource *fb_req;
+
+        struct resource *reg_res;
+        struct resource *reg_req;
+
+        void __iomem *fb_virt_addr;
+        unsigned long fb_phys_addr;
+
+        void __iomem *reg_virt_addr;
+        unsigned long reg_phys_addr;
+
+        int (*platform_probe) (struct fb_info * fb);
+        int (*platform_remove) (struct fb_info * fb);
+
+        u32 pseudo_palette[MAX_PALETTES];
+#ifdef CONFIG_FB_MBX_DEBUG
+        void *debugfs_data;
+#endif
+
+};
+
+static struct fb_var_screeninfo mbxfb_default __devinitdata = {
+        .xres = 640,
+        .yres = 480,
+        .xres_virtual = 640,
+        .yres_virtual = 480,
+        .bits_per_pixel = 16,
+        .red = {11, 5, 0},
+        .green = {5, 6, 0},
+        .blue = {0, 5, 0},
+        .activate = FB_ACTIVATE_TEST,
+        .height = -1,
+        .width = -1,
+        .pixclock = 40000,
+        .left_margin = 48,
+        .right_margin = 16,
+        .upper_margin = 33,
+        .lower_margin = 10,
+        .hsync_len = 96,
+        .vsync_len = 2,
+        .vmode = FB_VMODE_NONINTERLACED,
+        .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+};
+
+static struct fb_fix_screeninfo mbxfb_fix  __devinitdata = {
+        .id = "MBX",
+        .type = FB_TYPE_PACKED_PIXELS,
+        .visual = FB_VISUAL_TRUECOLOR,
+        .xpanstep = 0,
+        .ypanstep = 0,
+        .ywrapstep = 0,
+        .accel = FB_ACCEL_NONE,
+};
+
+struct pixclock_div {
+        u8 m;
+        u8 n;
+        u8 p;
+};
+
+static unsigned int mbxfb_get_pixclock(unsigned int pixclock_ps,
+                                       struct pixclock_div *div)
+{
+        u8 m, n, p;
+        unsigned int err = 0;
+        unsigned int min_err = ~0x0;
+        unsigned int clk;
+        unsigned int best_clk = 0;
+        unsigned int ref_clk = 13000;   /* FIXME: take from platform data */
+        unsigned int pixclock;
+
+        /* convert pixclock to KHz */
+        pixclock = PICOS2KHZ(pixclock_ps);
+
+        for (m = 1; m < 64; m++) {
+                for (n = 1; n < 8; n++) {
+                        for (p = 0; p < 8; p++) {
+                                clk = (ref_clk * m) / (n * (1 << p));
+                                err = (clk > pixclock) ? (clk - pixclock) :
+                                        (pixclock - clk);
+                                if (err < min_err) {
+                                        min_err = err;
+                                        best_clk = clk;
+                                        div->m = m;
+                                        div->n = n;
+                                        div->p = p;
+                                }
+                        }
+                }
+        }
+        return KHZ2PICOS(best_clk);
+}
+
+static int mbxfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+                           u_int trans, struct fb_info *info)
+{
+        u32 val, ret = 1;
+
+        if (regno < MAX_PALETTES) {
+                u32 *pal = info->pseudo_palette;
+
+                val = (red & 0xf800) | ((green & 0xfc00) >> 5) |
+                        ((blue & 0xf800) >> 11);
+                pal[regno] = val;
+                ret = 0;
+        }
+
+        return ret;
+}
+
+static int mbxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+        struct pixclock_div div;
+
+        var->pixclock = mbxfb_get_pixclock(var->pixclock, &div);
+
+        if (var->xres < MIN_XRES)
+                var->xres = MIN_XRES;
+        if (var->yres < MIN_YRES)
+                var->yres = MIN_YRES;
+        if (var->xres > MAX_XRES)
+                return -EINVAL;
+        if (var->yres > MAX_YRES)
+                return -EINVAL;
+        var->xres_virtual = max(var->xres_virtual, var->xres);
+        var->yres_virtual = max(var->yres_virtual, var->yres);
+
+        switch (var->bits_per_pixel) {
+                /* 8 bits-per-pixel is not supported yet */
+        case 8:
+                return -EINVAL;
+        case 16:
+                var->green.length = (var->green.length == 5) ? 5 : 6;
+                var->red.length = 5;
+                var->blue.length = 5;
+                var->transp.length = 6 - var->green.length;
+                var->blue.offset = 0;
+                var->green.offset = 5;
+                var->red.offset = 5 + var->green.length;
+                var->transp.offset = (5 + var->red.offset) & 15;
+                break;
+        case 24:                /* RGB 888   */
+        case 32:                /* RGBA 8888 */
+                var->red.offset = 16;
+                var->red.length = 8;
+                var->green.offset = 8;
+                var->green.length = 8;
+                var->blue.offset = 0;
+                var->blue.length = 8;
+                var->transp.length = var->bits_per_pixel - 24;
+                var->transp.offset = (var->transp.length) ? 24 : 0;
+                break;
+        }
+        var->red.msb_right = 0;
+        var->green.msb_right = 0;
+        var->blue.msb_right = 0;
+        var->transp.msb_right = 0;
+
+        return 0;
+}
+
+static int mbxfb_set_par(struct fb_info *info)
+{
+        struct fb_var_screeninfo *var = &info->var;
+        struct pixclock_div div;
+        ushort hbps, ht, hfps, has;
+        ushort vbps, vt, vfps, vas;
+        u32 gsctrl = readl(GSCTRL);
+        u32 gsadr = readl(GSADR);
+
+        info->fix.line_length = var->xres_virtual * var->bits_per_pixel / 8;
+
+        /* setup color mode */
+        gsctrl &= ~(FMsk(GSCTRL_GPIXFMT));
+        /* FIXME: add *WORKING* support for 8-bits per color */
+        if (info->var.bits_per_pixel == 8) {
+                return -EINVAL;
+        } else {
+                fb_dealloc_cmap(&info->cmap);
+                gsctrl &= ~GSCTRL_LUT_EN;
+
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
+                switch (info->var.bits_per_pixel) {
+                case 16:
+                        if (info->var.green.length == 5)
+                                gsctrl |= GSCTRL_GPIXFMT_ARGB1555;
+                        else
+                                gsctrl |= GSCTRL_GPIXFMT_RGB565;
+                        break;
+                case 24:
+                        gsctrl |= GSCTRL_GPIXFMT_RGB888;
+                        break;
+                case 32:
+                        gsctrl |= GSCTRL_GPIXFMT_ARGB8888;
+                        break;
+                }
+        }
+
+        /* setup resolution */
+        gsctrl &= ~(FMsk(GSCTRL_GSWIDTH) | FMsk(GSCTRL_GSHEIGHT));
+        gsctrl |= Gsctrl_Width(info->var.xres - 1) |
+                Gsctrl_Height(info->var.yres - 1);
+        writel(gsctrl, GSCTRL);
+        udelay(1000);
+
+        gsadr &= ~(FMsk(GSADR_SRCSTRIDE));
+        gsadr |= Gsadr_Srcstride(info->var.xres * info->var.bits_per_pixel /
+                                 (8 * 16) - 1);
+        writel(gsadr, GSADR);
+        udelay(1000);
+
+        /* setup timings */
+        var->pixclock = mbxfb_get_pixclock(info->var.pixclock, &div);
+
+        writel((Disp_Pll_M(div.m) | Disp_Pll_N(div.n) |
+                Disp_Pll_P(div.p) | DISP_PLL_EN), DISPPLL);
+
+        hbps = var->hsync_len;
+        has = hbps + var->left_margin;
+        hfps = has + var->xres;
+        ht = hfps + var->right_margin;
+
+        vbps = var->vsync_len;
+        vas = vbps + var->upper_margin;
+        vfps = vas + var->yres;
+        vt = vfps + var->lower_margin;
+
+        writel((Dht01_Hbps(hbps) | Dht01_Ht(ht)), DHT01);
+        writel((Dht02_Hlbs(has) | Dht02_Has(has)), DHT02);
+        writel((Dht03_Hfps(hfps) | Dht03_Hrbs(hfps)), DHT03);
+        writel((Dhdet_Hdes(has) | Dhdet_Hdef(hfps)), DHDET);
+
+        writel((Dvt01_Vbps(vbps) | Dvt01_Vt(vt)), DVT01);
+        writel((Dvt02_Vtbs(vas) | Dvt02_Vas(vas)), DVT02);
+        writel((Dvt03_Vfps(vfps) | Dvt03_Vbbs(vfps)), DVT03);
+        writel((Dvdet_Vdes(vas) | Dvdet_Vdef(vfps)), DVDET);
+        writel((Dvectrl_Vevent(vfps) | Dvectrl_Vfetch(vbps)), DVECTRL);
+
+        writel((readl(DSCTRL) | DSCTRL_SYNCGEN_EN), DSCTRL);
+
+        return 0;
+}
+
+static int mbxfb_blank(int blank, struct fb_info *info)
+{
+        switch (blank) {
+        case FB_BLANK_POWERDOWN:
+        case FB_BLANK_VSYNC_SUSPEND:
+        case FB_BLANK_HSYNC_SUSPEND:
+        case FB_BLANK_NORMAL:
+                writel((readl(DSCTRL) & ~DSCTRL_SYNCGEN_EN), DSCTRL);
+                udelay(1000);
+                writel((readl(PIXCLK) & ~PIXCLK_EN), PIXCLK);
+                udelay(1000);
+                writel((readl(VOVRCLK) & ~VOVRCLK_EN), VOVRCLK);
+                udelay(1000);
+                break;
+        case FB_BLANK_UNBLANK:
+                writel((readl(DSCTRL) | DSCTRL_SYNCGEN_EN), DSCTRL);
+                udelay(1000);
+                writel((readl(PIXCLK) | PIXCLK_EN), PIXCLK);
+                udelay(1000);
+                break;
+        }
+        return 0;
+}
+
+static struct fb_ops mbxfb_ops = {
+        .owner = THIS_MODULE,
+        .fb_check_var = mbxfb_check_var,
+        .fb_set_par = mbxfb_set_par,
+        .fb_setcolreg = mbxfb_setcolreg,
+        .fb_fillrect = cfb_fillrect,
+        .fb_copyarea = cfb_copyarea,
+        .fb_imageblit = cfb_imageblit,
+        .fb_blank = mbxfb_blank,
+};
+
+/*
+  Enable external SDRAM controller. Assume that all clocks are active
+  by now.
+*/
+static void __devinit setup_memc(struct fb_info *fbi)
+{
+        struct mbxfb_info *mfbi = fbi->par;
+        unsigned long tmp;
+        int i;
+
+        /* FIXME: use platfrom specific parameters */
+        /* setup SDRAM controller */
+        writel((LMCFG_LMC_DS | LMCFG_LMC_TS | LMCFG_LMD_TS |
+                LMCFG_LMA_TS),
+               LMCFG);
+        udelay(1000);
+
+        writel(LMPWR_MC_PWR_ACT, LMPWR);
+        udelay(1000);
+
+        /* setup SDRAM timings */
+        writel((Lmtim_Tras(7) | Lmtim_Trp(3) | Lmtim_Trcd(3) |
+                Lmtim_Trc(9) | Lmtim_Tdpl(2)),
+               LMTIM);
+        udelay(1000);
+        /* setup SDRAM refresh rate */
+        writel(0xc2b, LMREFRESH);
+        udelay(1000);
+        /* setup SDRAM type parameters */
+        writel((LMTYPE_CASLAT_3 | LMTYPE_BKSZ_2 | LMTYPE_ROWSZ_11 |
+                LMTYPE_COLSZ_8),
+               LMTYPE);
+        udelay(1000);
+        /* enable memory controller */
+        writel(LMPWR_MC_PWR_ACT, LMPWR);
+        udelay(1000);
+
+        /* perform dummy reads */
+        for ( i = 0; i < 16; i++ ) {
+                tmp = readl(fbi->screen_base);
+        }
+}
+
+static void enable_clocks(struct fb_info *fbi)
+{
+        /* enable clocks */
+        writel(SYSCLKSRC_PLL_2, SYSCLKSRC);
+        udelay(1000);
+        writel(PIXCLKSRC_PLL_1, PIXCLKSRC);
+        udelay(1000);
+        writel(0x00000000, CLKSLEEP);
+        udelay(1000);
+        writel((Core_Pll_M(0x17) | Core_Pll_N(0x3) | Core_Pll_P(0x0) |
+                CORE_PLL_EN),
+               COREPLL);
+        udelay(1000);
+        writel((Disp_Pll_M(0x1b) | Disp_Pll_N(0x7) | Disp_Pll_P(0x1) |
+                DISP_PLL_EN),
+               DISPPLL);
+
+        writel(0x00000000, VOVRCLK);
+        udelay(1000);
+        writel(PIXCLK_EN, PIXCLK);
+        udelay(1000);
+        writel(MEMCLK_EN, MEMCLK);
+        udelay(1000);
+        writel(0x00000006, M24CLK);
+        udelay(1000);
+        writel(0x00000006, MBXCLK);
+        udelay(1000);
+        writel(SDCLK_EN, SDCLK);
+        udelay(1000);
+        writel(0x00000001, PIXCLKDIV);
+        udelay(1000);
+}
+
+static void __devinit setup_graphics(struct fb_info *fbi)
+{
+        unsigned long gsctrl;
+
+        gsctrl = GSCTRL_GAMMA_EN | Gsctrl_Width(fbi->var.xres - 1) |
+                Gsctrl_Height(fbi->var.yres - 1);
+        switch (fbi->var.bits_per_pixel) {
+        case 16:
+                if (fbi->var.green.length == 5)
+                        gsctrl |= GSCTRL_GPIXFMT_ARGB1555;
+                else
+                        gsctrl |= GSCTRL_GPIXFMT_RGB565;
+                break;
+        case 24:
+                gsctrl |= GSCTRL_GPIXFMT_RGB888;
+                break;
+        case 32:
+                gsctrl |= GSCTRL_GPIXFMT_ARGB8888;
+                break;
+        }
+
+        writel(gsctrl, GSCTRL);
+        udelay(1000);
+        writel(0x00000000, GBBASE);
+        udelay(1000);
+        writel(0x00ffffff, GDRCTRL);
+        udelay(1000);
+        writel((GSCADR_STR_EN | Gscadr_Gbase_Adr(0x6000)), GSCADR);
+        udelay(1000);
+        writel(0x00000000, GPLUT);
+        udelay(1000);
+}
+
+static void __devinit setup_display(struct fb_info *fbi)
+{
+        unsigned long dsctrl = 0;
+
+        dsctrl = DSCTRL_BLNK_POL;
+        if (fbi->var.sync & FB_SYNC_HOR_HIGH_ACT)
+                dsctrl |= DSCTRL_HS_POL;
+        if (fbi->var.sync & FB_SYNC_VERT_HIGH_ACT)
+                dsctrl |= DSCTRL_VS_POL;
+        writel(dsctrl, DSCTRL);
+        udelay(1000);
+        writel(0xd0303010, DMCTRL);
+        udelay(1000);
+        writel((readl(DSCTRL) | DSCTRL_SYNCGEN_EN), DSCTRL);
+}
+
+static void __devinit enable_controller(struct fb_info *fbi)
+{
+        writel(SYSRST_RST, SYSRST);
+        udelay(1000);
+
+
+        enable_clocks(fbi);
+        setup_memc(fbi);
+        setup_graphics(fbi);
+        setup_display(fbi);
+}
+
+#ifdef CONFIG_PM
+/*
+ * Power management hooks.  Note that we won't be called from IRQ context,
+ * unlike the blank functions above, so we may sleep.
+ */
+static int mbxfb_suspend(struct platform_device *dev, pm_message_t state)
+{
+        /* make frame buffer memory enter self-refresh mode */
+        writel(LMPWR_MC_PWR_SRM, LMPWR);
+        while (LMPWRSTAT != LMPWRSTAT_MC_PWR_SRM)
+                ; /* empty statement */
+
+        /* reset the device, since it's initial state is 'mostly sleeping' */
+        writel(SYSRST_RST, SYSRST);
+        return 0;
+}
+
+static int mbxfb_resume(struct platform_device *dev)
+{
+        struct fb_info *fbi = platform_get_drvdata(dev);
+
+        enable_clocks(fbi);
+/*      setup_graphics(fbi); */
+/*      setup_display(fbi); */
+
+        writel((readl(DSCTRL) | DSCTRL_SYNCGEN_EN), DSCTRL);
+        return 0;
+}
+#else
+#define mbxfb_suspend   NULL
+#define mbxfb_resume    NULL
+#endif
+
+/* debugfs entries */
+#ifndef CONFIG_FB_MBX_DEBUG
+#define mbxfb_debugfs_init(x)   do {} while(0)
+#define mbxfb_debugfs_remove(x) do {} while(0)
+#endif
+
+#define res_size(_r) (((_r)->end - (_r)->start) + 1)
+
+static int __devinit mbxfb_probe(struct platform_device *dev)
+{
+        int ret;
+        struct fb_info *fbi;
+        struct mbxfb_info *mfbi;
+        struct mbxfb_platform_data *pdata;
+
+        dev_dbg(dev, "mbxfb_probe\n");
+
+        fbi = framebuffer_alloc(sizeof(struct mbxfb_info), &dev->dev);
+        if (fbi == NULL) {
+                dev_err(&dev->dev, "framebuffer_alloc failed\n");
+                return -ENOMEM;
+        }
+
+        mfbi = fbi->par;
+        fbi->pseudo_palette = mfbi->pseudo_palette;
+        pdata = dev->dev.platform_data;
+        if (pdata->probe)
+                mfbi->platform_probe = pdata->probe;
+        if (pdata->remove)
+                mfbi->platform_remove = pdata->remove;
+
+        mfbi->fb_res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+        mfbi->reg_res = platform_get_resource(dev, IORESOURCE_MEM, 1);
+
+        if (!mfbi->fb_res || !mfbi->reg_res) {
+                dev_err(&dev->dev, "no resources found\n");
+                ret = -ENODEV;
+                goto err1;
+        }
+
+        mfbi->fb_req = request_mem_region(mfbi->fb_res->start,
+                                          res_size(mfbi->fb_res), dev->name);
+        if (mfbi->fb_req == NULL) {
+                dev_err(&dev->dev, "failed to claim framebuffer memory\n");
+                ret = -EINVAL;
+                goto err1;
+        }
+        mfbi->fb_phys_addr = mfbi->fb_res->start;
+
+        mfbi->reg_req = request_mem_region(mfbi->reg_res->start,
+                                           res_size(mfbi->reg_res), dev->name);
+        if (mfbi->reg_req == NULL) {
+                dev_err(&dev->dev, "failed to claim Marathon registers\n");
+                ret = -EINVAL;
+                goto err2;
+        }
+        mfbi->reg_phys_addr = mfbi->reg_res->start;
+
+        mfbi->reg_virt_addr = ioremap_nocache(mfbi->reg_phys_addr,
+                                              res_size(mfbi->reg_req));
+        if (!mfbi->reg_virt_addr) {
+                dev_err(&dev->dev, "failed to ioremap Marathon registers\n");
+                ret = -EINVAL;
+                goto err3;
+        }
+        virt_base_2700 = (unsigned long)mfbi->reg_virt_addr;
+
+        mfbi->fb_virt_addr = ioremap_nocache(mfbi->fb_phys_addr,
+                                             res_size(mfbi->fb_req));
+        if (!mfbi->reg_virt_addr) {
+                dev_err(&dev->dev, "failed to ioremap frame buffer\n");
+                ret = -EINVAL;
+                goto err4;
+        }
+
+        /* FIXME: get from platform */
+        fbi->screen_base = (char __iomem *)(mfbi->fb_virt_addr + 0x60000);
+        fbi->screen_size = 8 * 1024 * 1024;     /* 8 Megs */
+        fbi->fbops = &mbxfb_ops;
+
+        fbi->var = mbxfb_default;
+        fbi->fix = mbxfb_fix;
+        fbi->fix.smem_start = mfbi->fb_phys_addr + 0x60000;
+        fbi->fix.smem_len = 8 * 1024 * 1024;
+        fbi->fix.line_length = 640 * 2;
+
+        ret = fb_alloc_cmap(&fbi->cmap, 256, 0);
+        if (ret < 0) {
+                dev_err(&dev->dev, "fb_alloc_cmap failed\n");
+                ret = -EINVAL;
+                goto err5;
+        }
+
+        platform_set_drvdata(dev, fbi);
+
+        printk(KERN_INFO "fb%d: mbx frame buffer device\n", fbi->node);
+
+        if (mfbi->platform_probe)
+                mfbi->platform_probe(fbi);
+
+        enable_controller(fbi);
+
+        mbxfb_debugfs_init(fbi);
+
+        ret = register_framebuffer(fbi);
+        if (ret < 0) {
+                dev_err(&dev->dev, "register_framebuffer failed\n");
+                ret = -EINVAL;
+                goto err6;
+        }
+
+        return 0;
+
+err6:
+        fb_dealloc_cmap(&fbi->cmap);
+err5:
+        iounmap(mfbi->fb_virt_addr);
+err4:
+        iounmap(mfbi->reg_virt_addr);
+err3:
+        release_mem_region(mfbi->reg_res->start, res_size(mfbi->reg_res));
+err2:
+        release_mem_region(mfbi->fb_res->start, res_size(mfbi->fb_res));
+err1:
+        framebuffer_release(fbi);
+
+        return ret;
+}
+
+static int __devexit mbxfb_remove(struct platform_device *dev)
+{
+        struct fb_info *fbi = platform_get_drvdata(dev);
+
+        writel(SYSRST_RST, SYSRST);
+        udelay(1000);
+
+        mbxfb_debugfs_remove(fbi);
+
+        if (fbi) {
+                struct mbxfb_info *mfbi = fbi->par;
+
+                unregister_framebuffer(fbi);
+                if (mfbi) {
+                        if (mfbi->platform_remove)
+                                mfbi->platform_remove(fbi);
+
+                        if (mfbi->fb_virt_addr)
+                                iounmap(mfbi->fb_virt_addr);
+                        if (mfbi->reg_virt_addr)
+                                iounmap(mfbi->reg_virt_addr);
+                        if (mfbi->reg_req)
+                                release_mem_region(mfbi->reg_req->start,
+                                                   res_size(mfbi->reg_req));
+                        if (mfbi->fb_req)
+                                release_mem_region(mfbi->fb_req->start,
+                                                   res_size(mfbi->fb_req));
+                }
+                framebuffer_release(fbi);
+        }
+
+        return 0;
+}
+
+static struct platform_driver mbxfb_driver = {
+        .probe = mbxfb_probe,
+        .remove = mbxfb_remove,
+        .suspend = mbxfb_suspend,
+        .resume = mbxfb_resume,
+        .driver = {
+                .name = "mbx-fb",
+        },
+};
+
+int __devinit mbxfb_init(void)
+{
+        return platform_driver_register(&mbxfb_driver);
+}
+
+static void __devexit mbxfb_exit(void)
+{
+        platform_driver_unregister(&mbxfb_driver);
+}
+
+module_init(mbxfb_init);
+module_exit(mbxfb_exit);
+
+MODULE_DESCRIPTION("loadable framebuffer driver for Marathon device");
+MODULE_AUTHOR("Mike Rapoport, Compulab");
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/mbx/reg_bits.h b/drivers/video/mbx/reg_bits.h
new file mode 100644
index 000000000000..c226a8e45312
--- /dev/null
+++ b/drivers/video/mbx/reg_bits.h
@@ -0,0 +1,418 @@
+#ifndef __REG_BITS_2700G_
+#define __REG_BITS_2700G_
+
+/* use defines from asm-arm/arch-pxa/bitfields.h for bit fields access */
+#define UData(Data)     ((unsigned long) (Data))
+#define Fld(Size, Shft) (((Size) << 16) + (Shft))
+#define FSize(Field)    ((Field) >> 16)
+#define FShft(Field)    ((Field) & 0x0000FFFF)
+#define FMsk(Field)     (((UData (1) << FSize (Field)) - 1) << FShft (Field))
+#define FAlnMsk(Field)  ((UData (1) << FSize (Field)) - 1)
+#define F1stBit(Field)  (UData (1) << FShft (Field))
+
+#define SYSRST_RST      (1 << 0)
+
+/* SYSCLKSRC - SYSCLK Source Control Register */
+#define SYSCLKSRC_SEL   Fld(2,0)
+#define SYSCLKSRC_REF   ((0x0) << FShft(SYSCLKSRC_SEL))
+#define SYSCLKSRC_PLL_1 ((0x1) << FShft(SYSCLKSRC_SEL))
+#define SYSCLKSRC_PLL_2 ((0x2) << FShft(SYSCLKSRC_SEL))
+
+/* PIXCLKSRC - PIXCLK Source Control Register */
+#define PIXCLKSRC_SEL   Fld(2,0)
+#define PIXCLKSRC_REF   ((0x0) << FShft(PIXCLKSRC_SEL))
+#define PIXCLKSRC_PLL_1 ((0x1) << FShft(PIXCLKSRC_SEL))
+#define PIXCLKSRC_PLL_2 ((0x2) << FShft(PIXCLKSRC_SEL))
+
+/* Clock Disable Register */
+#define CLKSLEEP_SLP    (1 << 0)
+
+/* Core PLL Control Register */
+#define CORE_PLL_M      Fld(6,7)
+#define Core_Pll_M(x)   ((x) << FShft(CORE_PLL_M))
+#define CORE_PLL_N      Fld(3,4)
+#define Core_Pll_N(x)   ((x) << FShft(CORE_PLL_N))
+#define CORE_PLL_P      Fld(3,1)
+#define Core_Pll_P(x)   ((x) << FShft(CORE_PLL_P))
+#define CORE_PLL_EN     (1 << 0)
+
+/* Display PLL Control Register */
+#define DISP_PLL_M      Fld(6,7)
+#define Disp_Pll_M(x)   ((x) << FShft(DISP_PLL_M))
+#define DISP_PLL_N      Fld(3,4)
+#define Disp_Pll_N(x)   ((x) << FShft(DISP_PLL_N))
+#define DISP_PLL_P      Fld(3,1)
+#define Disp_Pll_P(x)   ((x) << FShft(DISP_PLL_P))
+#define DISP_PLL_EN     (1 << 0)
+
+/* PLL status register */
+#define PLLSTAT_CORE_PLL_LOST_L (1 << 3)
+#define PLLSTAT_CORE_PLL_LSTS   (1 << 2)
+#define PLLSTAT_DISP_PLL_LOST_L (1 << 1)
+#define PLLSTAT_DISP_PLL_LSTS   (1 << 0)
+
+/* Video and scale clock control register */
+#define VOVRCLK_EN      (1 << 0)
+
+/* Pixel clock control register */
+#define PIXCLK_EN       (1 << 0)
+
+/* Memory clock control register */
+#define MEMCLK_EN       (1 << 0)
+
+/* MBX clock control register */
+#define MBXCLK_DIV      Fld(2,2)
+#define MBXCLK_DIV_1    ((0x0) << FShft(MBXCLK_DIV))
+#define MBXCLK_DIV_2    ((0x1) << FShft(MBXCLK_DIV))
+#define MBXCLK_DIV_3    ((0x2) << FShft(MBXCLK_DIV))
+#define MBXCLK_DIV_4    ((0x3) << FShft(MBXCLK_DIV))
+#define MBXCLK_EN       Fld(2,0)
+#define MBXCLK_EN_NONE  ((0x0) << FShft(MBXCLK_EN))
+#define MBXCLK_EN_2D    ((0x1) << FShft(MBXCLK_EN))
+#define MBXCLK_EN_BOTH  ((0x2) << FShft(MBXCLK_EN))
+
+/* M24 clock control register */
+#define M24CLK_DIV      Fld(2,1)
+#define M24CLK_DIV_1    ((0x0) << FShft(M24CLK_DIV))
+#define M24CLK_DIV_2    ((0x1) << FShft(M24CLK_DIV))
+#define M24CLK_DIV_3    ((0x2) << FShft(M24CLK_DIV))
+#define M24CLK_DIV_4    ((0x3) << FShft(M24CLK_DIV))
+#define M24CLK_EN       (1 << 0)
+
+/* SDRAM clock control register */
+#define SDCLK_EN        (1 << 0)
+
+/* PixClk Divisor Register */
+#define PIXCLKDIV_PD    Fld(9,0)
+#define Pixclkdiv_Pd(x) ((x) << FShft(PIXCLKDIV_PD))
+
+/* LCD Config control register */
+#define LCDCFG_IN_FMT   Fld(3,28)
+#define Lcdcfg_In_Fmt(x)        ((x) << FShft(LCDCFG_IN_FMT))
+#define LCDCFG_LCD1DEN_POL      (1 << 27)
+#define LCDCFG_LCD1FCLK_POL     (1 << 26)
+#define LCDCFG_LCD1LCLK_POL     (1 << 25)
+#define LCDCFG_LCD1D_POL        (1 << 24)
+#define LCDCFG_LCD2DEN_POL      (1 << 23)
+#define LCDCFG_LCD2FCLK_POL     (1 << 22)
+#define LCDCFG_LCD2LCLK_POL     (1 << 21)
+#define LCDCFG_LCD2D_POL        (1 << 20)
+#define LCDCFG_LCD1_TS          (1 << 19)
+#define LCDCFG_LCD1D_DS         (1 << 18)
+#define LCDCFG_LCD1C_DS         (1 << 17)
+#define LCDCFG_LCD1_IS_IN       (1 << 16)
+#define LCDCFG_LCD2_TS          (1 << 3)
+#define LCDCFG_LCD2D_DS         (1 << 2)
+#define LCDCFG_LCD2C_DS         (1 << 1)
+#define LCDCFG_LCD2_IS_IN       (1 << 0)
+
+/* On-Die Frame Buffer Power Control Register */
+#define ODFBPWR_SLOW    (1 << 2)
+#define ODFBPWR_MODE    Fld(2,0)
+#define ODFBPWR_MODE_ACT        ((0x0) << FShft(ODFBPWR_MODE))
+#define ODFBPWR_MODE_ACT_LP     ((0x1) << FShft(ODFBPWR_MODE))
+#define ODFBPWR_MODE_SLEEP      ((0x2) << FShft(ODFBPWR_MODE))
+#define ODFBPWR_MODE_SHUTD      ((0x3) << FShft(ODFBPWR_MODE))
+
+/* On-Die Frame Buffer Power State Status Register */
+#define ODFBSTAT_ACT    (1 << 2)
+#define ODFBSTAT_SLP    (1 << 1)
+#define ODFBSTAT_SDN    (1 << 0)
+
+/* LMRST - Local Memory (SDRAM) Reset */
+#define LMRST_MC_RST    (1 << 0)
+
+/* LMCFG - Local Memory (SDRAM) Configuration Register */
+#define LMCFG_LMC_DS    (1 << 5)
+#define LMCFG_LMD_DS    (1 << 4)
+#define LMCFG_LMA_DS    (1 << 3)
+#define LMCFG_LMC_TS    (1 << 2)
+#define LMCFG_LMD_TS    (1 << 1)
+#define LMCFG_LMA_TS    (1 << 0)
+
+/* LMPWR - Local Memory (SDRAM) Power Control Register */
+#define LMPWR_MC_PWR_CNT        Fld(2,0)
+#define LMPWR_MC_PWR_ACT        ((0x0) << FShft(LMPWR_MC_PWR_CNT)) /* Active */
+#define LMPWR_MC_PWR_SRM        ((0x1) << FShft(LMPWR_MC_PWR_CNT)) /* Self-refresh */
+#define LMPWR_MC_PWR_DPD        ((0x3) << FShft(LMPWR_MC_PWR_CNT)) /* deep power down */
+
+/* LMPWRSTAT - Local Memory (SDRAM) Power Status Register */
+#define LMPWRSTAT_MC_PWR_CNT    Fld(2,0)
+#define LMPWRSTAT_MC_PWR_ACT    ((0x0) << FShft(LMPWRSTAT_MC_PWR_CNT)) /* Active */
+#define LMPWRSTAT_MC_PWR_SRM    ((0x1) << FShft(LMPWRSTAT_MC_PWR_CNT)) /* Self-refresh */
+#define LMPWRSTAT_MC_PWR_DPD    ((0x3) << FShft(LMPWRSTAT_MC_PWR_CNT)) /* deep power down */
+
+/* LMTYPE - Local Memory (SDRAM) Type Register */
+#define LMTYPE_CASLAT   Fld(3,10)
+#define LMTYPE_CASLAT_1 ((0x1) << FShft(LMTYPE_CASLAT))
+#define LMTYPE_CASLAT_2 ((0x2) << FShft(LMTYPE_CASLAT))
+#define LMTYPE_CASLAT_3 ((0x3) << FShft(LMTYPE_CASLAT))
+#define LMTYPE_BKSZ     Fld(2,8)
+#define LMTYPE_BKSZ_1   ((0x1) << FShft(LMTYPE_BKSZ))
+#define LMTYPE_BKSZ_2   ((0x2) << FShft(LMTYPE_BKSZ))
+#define LMTYPE_ROWSZ    Fld(4,4)
+#define LMTYPE_ROWSZ_11 ((0xb) << FShft(LMTYPE_ROWSZ))
+#define LMTYPE_ROWSZ_12 ((0xc) << FShft(LMTYPE_ROWSZ))
+#define LMTYPE_ROWSZ_13 ((0xd) << FShft(LMTYPE_ROWSZ))
+#define LMTYPE_COLSZ    Fld(4,0)
+#define LMTYPE_COLSZ_7  ((0x7) << FShft(LMTYPE_COLSZ))
+#define LMTYPE_COLSZ_8  ((0x8) << FShft(LMTYPE_COLSZ))
+#define LMTYPE_COLSZ_9  ((0x9) << FShft(LMTYPE_COLSZ))
+#define LMTYPE_COLSZ_10 ((0xa) << FShft(LMTYPE_COLSZ))
+#define LMTYPE_COLSZ_11 ((0xb) << FShft(LMTYPE_COLSZ))
+#define LMTYPE_COLSZ_12 ((0xc) << FShft(LMTYPE_COLSZ))
+
+/* LMTIM - Local Memory (SDRAM) Timing Register */
+#define LMTIM_TRAS      Fld(4,16)
+#define Lmtim_Tras(x)   ((x) << FShft(LMTIM_TRAS))
+#define LMTIM_TRP       Fld(4,12)
+#define Lmtim_Trp(x)    ((x) << FShft(LMTIM_TRP))
+#define LMTIM_TRCD      Fld(4,8)
+#define Lmtim_Trcd(x)   ((x) << FShft(LMTIM_TRCD))
+#define LMTIM_TRC       Fld(4,4)
+#define Lmtim_Trc(x)    ((x) << FShft(LMTIM_TRC))
+#define LMTIM_TDPL      Fld(4,0)
+#define Lmtim_Tdpl(x)   ((x) << FShft(LMTIM_TDPL))
+
+/* LMREFRESH - Local Memory (SDRAM) tREF Control Register */
+#define LMREFRESH_TREF  Fld(2,0)
+#define Lmrefresh_Tref(x)       ((x) << FShft(LMREFRESH_TREF))
+
+/* GSCTRL - Graphics surface control register */
+#define GSCTRL_LUT_EN   (1 << 31)
+#define GSCTRL_GPIXFMT  Fld(4,27)
+#define GSCTRL_GPIXFMT_INDEXED  ((0x0) << FShft(GSCTRL_GPIXFMT))
+#define GSCTRL_GPIXFMT_ARGB4444 ((0x4) << FShft(GSCTRL_GPIXFMT))
+#define GSCTRL_GPIXFMT_ARGB1555 ((0x5) << FShft(GSCTRL_GPIXFMT))
+#define GSCTRL_GPIXFMT_RGB888   ((0x6) << FShft(GSCTRL_GPIXFMT))
+#define GSCTRL_GPIXFMT_RGB565   ((0x7) << FShft(GSCTRL_GPIXFMT))
+#define GSCTRL_GPIXFMT_ARGB8888 ((0x8) << FShft(GSCTRL_GPIXFMT))
+#define GSCTRL_GAMMA_EN (1 << 26)
+
+#define GSCTRL_GSWIDTH Fld(11,11)
+#define Gsctrl_Width(Pixel)     /* Display Width [1..2048 pix.]  */ \
+                        (((Pixel) - 1) << FShft(GSCTRL_GSWIDTH))
+
+#define GSCTRL_GSHEIGHT Fld(11,0)
+#define Gsctrl_Height(Pixel)    /* Display Height [1..2048 pix.]  */ \
+                        (((Pixel) - 1) << FShft(GSCTRL_GSHEIGHT))
+
+/* GBBASE fileds */
+#define GBBASE_GLALPHA Fld(8,24)
+#define Gbbase_Glalpha(x)       ((x) << FShft(GBBASE_GLALPHA))
+
+#define GBBASE_COLKEY Fld(24,0)
+#define Gbbase_Colkey(x)        ((x) << FShft(GBBASE_COLKEY))
+
+/* GDRCTRL fields */
+#define GDRCTRL_PIXDBL  (1 << 31)
+#define GDRCTRL_PIXHLV  (1 << 30)
+#define GDRCTRL_LNDBL   (1 << 29)
+#define GDRCTRL_LNHLV   (1 << 28)
+#define GDRCTRL_COLKEYM Fld(24,0)
+#define Gdrctrl_Colkeym(x)      ((x) << FShft(GDRCTRL_COLKEYM))
+
+/* GSCADR graphics stream control address register fields */
+#define GSCADR_STR_EN   (1 << 31)
+#define GSCADR_COLKEY_EN        (1 << 30)
+#define GSCADR_COLKEYSCR        (1 << 29)
+#define GSCADR_BLEND_M  Fld(2,27)
+#define GSCADR_BLEND_NONE       ((0x0) << FShft(GSCADR_BLEND_M))
+#define GSCADR_BLEND_INV        ((0x1) << FShft(GSCADR_BLEND_M))
+#define GSCADR_BLEND_GLOB       ((0x2) << FShft(GSCADR_BLEND_M))
+#define GSCADR_BLEND_PIX        ((0x3) << FShft(GSCADR_BLEND_M))
+#define GSCADR_BLEND_POS        Fld(2,24)
+#define GSCADR_BLEND_GFX        ((0x0) << FShft(GSCADR_BLEND_POS))
+#define GSCADR_BLEND_VID        ((0x1) << FShft(GSCADR_BLEND_POS))
+#define GSCADR_BLEND_CUR        ((0x2) << FShft(GSCADR_BLEND_POS))
+#define GSCADR_GBASE_ADR        Fld(23,0)
+#define Gscadr_Gbase_Adr(x)     ((x) << FShft(GSCADR_GBASE_ADR))
+
+/* GSADR graphics stride address register fields */
+#define GSADR_SRCSTRIDE Fld(10,22)
+#define Gsadr_Srcstride(x)      ((x) << FShft(GSADR_SRCSTRIDE))
+#define GSADR_XSTART    Fld(11,11)
+#define Gsadr_Xstart(x)         ((x) << FShft(GSADR_XSTART))
+#define GSADR_YSTART    Fld(11,0)
+#define Gsadr_Ystart(y)         ((y) << FShft(GSADR_YSTART))
+
+/* GPLUT graphics palette register fields */
+#define GPLUT_LUTADR    Fld(8,24)
+#define Gplut_Lutadr(x) ((x) << FShft(GPLUT_LUTADR))
+#define GPLUT_LUTDATA   Fld(24,0)
+#define Gplut_Lutdata(x)        ((x) << FShft(GPLUT_LUTDATA))
+
+/* HCCTRL - Hardware Cursor Register fields */
+#define HCCTRL_CUR_EN   (1 << 31)
+#define HCCTRL_COLKEY_EN        (1 << 29)
+#define HCCTRL_COLKEYSRC        (1 << 28)
+#define HCCTRL_BLEND_M  Fld(2,26)
+#define HCCTRL_BLEND_NONE       ((0x0) << FShft(HCCTRL_BLEND_M))
+#define HCCTRL_BLEND_INV        ((0x1) << FShft(HCCTRL_BLEND_M))
+#define HCCTRL_BLEND_GLOB       ((0x2) << FShft(HCCTRL_BLEND_M))
+#define HCCTRL_BLEND_PIX        ((0x3) << FShft(HCCTRL_BLEND_M))
+#define HCCTRL_CPIXFMT  Fld(3,23)
+#define HCCTRL_CPIXFMT_RGB332   ((0x3) << FShft(HCCTRL_CPIXFMT))
+#define HCCTRL_CPIXFMT_ARGB4444 ((0x4) << FShft(HCCTRL_CPIXFMT))
+#define HCCTRL_CPIXFMT_ARGB1555 ((0x5) << FShft(HCCTRL_CPIXFMT))
+#define HCCTRL_CBASE_ADR        Fld(23,0)
+#define Hcctrl_Cbase_Adr(x)     ((x) << FShft(HCCTRL_CBASE_ADR))
+
+/* HCSIZE Hardware Cursor Size Register fields */
+#define HCSIZE_BLEND_POS        Fld(2,29)
+#define HCSIZE_BLEND_GFX        ((0x0) << FShft(HCSIZE_BLEND_POS))
+#define HCSIZE_BLEND_VID        ((0x1) << FShft(HCSIZE_BLEND_POS))
+#define HCSIZE_BLEND_CUR        ((0x2) << FShft(HCSIZE_BLEND_POS))
+#define HCSIZE_CWIDTH   Fld(3,16)
+#define Hcsize_Cwidth(x)        ((x) << FShft(HCSIZE_CWIDTH))
+#define HCSIZE_CHEIGHT  Fld(3,0)
+#define Hcsize_Cheight(x)       ((x) << FShft(HCSIZE_CHEIGHT))
+
+/* HCPOS Hardware Cursor Position Register fields */
+#define HCPOS_SWITCHSRC (1 << 30)
+#define HCPOS_CURBLINK  Fld(6,24)
+#define Hcpos_Curblink(x)       ((x) << FShft(HCPOS_CURBLINK))
+#define HCPOS_XSTART    Fld(12,12)
+#define Hcpos_Xstart(x) ((x) << FShft(HCPOS_XSTART))
+#define HCPOS_YSTART    Fld(12,0)
+#define Hcpos_Ystart(y) ((y) << FShft(HCPOS_YSTART))
+
+/* HCBADR Hardware Cursor Blend Address Register */
+#define HCBADR_GLALPHA  Fld(8,24)
+#define Hcbadr_Glalpha(x)       ((x) << FShft(HCBADR_GLALPHA))
+#define HCBADR_COLKEY   Fld(24,0)
+#define Hcbadr_Colkey(x)        ((x) << FShft(HCBADR_COLKEY))
+
+/* HCCKMSK - Hardware Cursor Color Key Mask Register */
+#define HCCKMSK_COLKEY_M        Fld(24,0)
+#define Hcckmsk_Colkey_M(x)     ((x) << FShft(HCCKMSK_COLKEY_M))
+
+/* DSCTRL - Display sync control register */
+#define DSCTRL_SYNCGEN_EN       (1 << 31)
+#define DSCTRL_DPL_RST          (1 << 29)
+#define DSCTRL_PWRDN_M          (1 << 28)
+#define DSCTRL_UPDSYNCCNT       (1 << 26)
+#define DSCTRL_UPDINTCNT        (1 << 25)
+#define DSCTRL_UPDCNT           (1 << 24)
+#define DSCTRL_UPDWAIT  Fld(4,16)
+#define Dsctrl_Updwait(x)       ((x) << FShft(DSCTRL_UPDWAIT))
+#define DSCTRL_CLKPOL           (1 << 11)
+#define DSCTRL_CSYNC_EN         (1 << 10)
+#define DSCTRL_VS_SLAVE         (1 << 7)
+#define DSCTRL_HS_SLAVE         (1 << 6)
+#define DSCTRL_BLNK_POL         (1 << 5)
+#define DSCTRL_BLNK_DIS         (1 << 4)
+#define DSCTRL_VS_POL           (1 << 3)
+#define DSCTRL_VS_DIS           (1 << 2)
+#define DSCTRL_HS_POL           (1 << 1)
+#define DSCTRL_HS_DIS           (1 << 0)
+
+/* DHT01 - Display horizontal timing register 01 */
+#define DHT01_HBPS      Fld(12,16)
+#define Dht01_Hbps(x)   ((x) << FShft(DHT01_HBPS))
+#define DHT01_HT        Fld(12,0)
+#define Dht01_Ht(x)     ((x) << FShft(DHT01_HT))
+
+/* DHT02 - Display horizontal timing register 02 */
+#define DHT02_HAS       Fld(12,16)
+#define Dht02_Has(x)    ((x) << FShft(DHT02_HAS))
+#define DHT02_HLBS      Fld(12,0)
+#define Dht02_Hlbs(x)   ((x) << FShft(DHT02_HLBS))
+
+/* DHT03 - Display horizontal timing register 03 */
+#define DHT03_HFPS      Fld(12,16)
+#define Dht03_Hfps(x)   ((x) << FShft(DHT03_HFPS))
+#define DHT03_HRBS      Fld(12,0)
+#define Dht03_Hrbs(x)   ((x) << FShft(DHT03_HRBS))
+
+/* DVT01 - Display vertical timing register 01 */
+#define DVT01_VBPS      Fld(12,16)
+#define Dvt01_Vbps(x)   ((x) << FShft(DVT01_VBPS))
+#define DVT01_VT        Fld(12,0)
+#define Dvt01_Vt(x)     ((x) << FShft(DVT01_VT))
+
+/* DVT02 - Display vertical timing register 02 */
+#define DVT02_VAS       Fld(12,16)
+#define Dvt02_Vas(x)    ((x) << FShft(DVT02_VAS))
+#define DVT02_VTBS      Fld(12,0)
+#define Dvt02_Vtbs(x)   ((x) << FShft(DVT02_VTBS))
+
+/* DVT03 - Display vertical timing register 03 */
+#define DVT03_VFPS      Fld(12,16)
+#define Dvt03_Vfps(x)   ((x) << FShft(DVT03_VFPS))
+#define DVT03_VBBS      Fld(12,0)
+#define Dvt03_Vbbs(x)   ((x) << FShft(DVT03_VBBS))
+
+/* DVECTRL - display vertical event control register */
+#define DVECTRL_VEVENT  Fld(12,16)
+#define Dvectrl_Vevent(x)       ((x) << FShft(DVECTRL_VEVENT))
+#define DVECTRL_VFETCH  Fld(12,0)
+#define Dvectrl_Vfetch(x)       ((x) << FShft(DVECTRL_VFETCH))
+
+/* DHDET - display horizontal DE timing register */
+#define DHDET_HDES      Fld(12,16)
+#define Dhdet_Hdes(x)   ((x) << FShft(DHDET_HDES))
+#define DHDET_HDEF      Fld(12,0)
+#define Dhdet_Hdef(x)   ((x) << FShft(DHDET_HDEF))
+
+/* DVDET - display vertical DE timing register */
+#define DVDET_VDES      Fld(12,16)
+#define Dvdet_Vdes(x)   ((x) << FShft(DVDET_VDES))
+#define DVDET_VDEF      Fld(12,0)
+#define Dvdet_Vdef(x)   ((x) << FShft(DVDET_VDEF))
+
+/* DODMSK - display output data mask register */
+#define DODMSK_MASK_LVL (1 << 31)
+#define DODMSK_BLNK_LVL (1 << 30)
+#define DODMSK_MASK_B   Fld(8,16)
+#define Dodmsk_Mask_B(x)        ((x) << FShft(DODMSK_MASK_B))
+#define DODMSK_MASK_G   Fld(8,8)
+#define Dodmsk_Mask_G(x)        ((x) << FShft(DODMSK_MASK_G))
+#define DODMSK_MASK_R   Fld(8,0)
+#define Dodmsk_Mask_R(x)        ((x) << FShft(DODMSK_MASK_R))
+
+/* DBCOL - display border color control register */
+#define DBCOL_BORDCOL   Fld(24,0)
+#define Dbcol_Bordcol(x)        ((x) << FShft(DBCOL_BORDCOL))
+
+/* DVLNUM - display vertical line number register */
+#define DVLNUM_VLINE    Fld(12,0)
+#define Dvlnum_Vline(x) ((x) << FShft(DVLNUM_VLINE))
+
+/* DMCTRL - Display Memory Control Register */
+#define DMCTRL_MEM_REF  Fld(2,30)
+#define DMCTRL_MEM_REF_ACT      ((0x0) << FShft(DMCTRL_MEM_REF))
+#define DMCTRL_MEM_REF_HB       ((0x1) << FShft(DMCTRL_MEM_REF))
+#define DMCTRL_MEM_REF_VB       ((0x2) << FShft(DMCTRL_MEM_REF))
+#define DMCTRL_MEM_REF_BOTH     ((0x3) << FShft(DMCTRL_MEM_REF))
+#define DMCTRL_UV_THRHLD        Fld(6,24)
+#define Dmctrl_Uv_Thrhld(x)     ((x) << FShft(DMCTRL_UV_THRHLD))
+#define DMCTRL_V_THRHLD         Fld(7,16)
+#define Dmctrl_V_Thrhld(x)      ((x) << FShft(DMCTRL_V_THRHLD))
+#define DMCTRL_D_THRHLD         Fld(7,8)
+#define Dmctrl_D_Thrhld(x)      ((x) << FShft(DMCTRL_D_THRHLD))
+#define DMCTRL_BURSTLEN Fld(6,0)
+#define Dmctrl_Burstlen(x)      ((x) << FShft(DMCTRL_BURSTLEN))
+
+
+/* DLSTS - display load status register */
+#define DLSTS_RLD_ADONE (1 << 23)
+/* #define DLSTS_RLD_ADOUT      Fld(23,0) */
+
+/* DLLCTRL - display list load control register */
+#define DLLCTRL_RLD_ADRLN       Fld(8,24)
+#define Dllctrl_Rld_Adrln(x)    ((x) << FShft(DLLCTRL_RLD_ADRLN))
+
+/* SPOCTRL - Scale Pitch/Order Control Register */
+#define SPOCTRL_H_SC_BP         (1 << 31)
+#define SPOCTRL_V_SC_BP         (1 << 30)
+#define SPOCTRL_HV_SC_OR        (1 << 29)
+#define SPOCTRL_VS_UR_C         (1 << 27)
+#define SPOCTRL_VORDER  Fld(2,16)
+#define SPOCTRL_VORDER_1TAP     ((0x0) << FShft(SPOCTRL_VORDER))
+#define SPOCTRL_VORDER_2TAP     ((0x1) << FShft(SPOCTRL_VORDER))
+#define SPOCTRL_VORDER_4TAP     ((0x3) << FShft(SPOCTRL_VORDER))
+#define SPOCTRL_VPITCH  Fld(16,0)
+#define Spoctrl_Vpitch(x)       ((x) << FShft(SPOCTRL_VPITCH))
+
+#endif /* __REG_BITS_2700G_ */
diff --git a/drivers/video/mbx/regs.h b/drivers/video/mbx/regs.h
new file mode 100644
index 000000000000..ad20be07666b
--- /dev/null
+++ b/drivers/video/mbx/regs.h
@@ -0,0 +1,195 @@
+#ifndef __REGS_2700G_
+#define __REGS_2700G_
+
+/* extern unsigned long virt_base_2700; */
+/* #define __REG_2700G(x)       (*(volatile unsigned long*)((x)+virt_base_2700)) */
+#define __REG_2700G(x)  ((x)+virt_base_2700)
+
+/* System Configuration Registers (0x0000_0000  0x0000_0010) */
+#define SYSCFG          __REG_2700G(0x00000000)
+#define PFBASE          __REG_2700G(0x00000004)
+#define PFCEIL          __REG_2700G(0x00000008)
+#define POLLFLAG        __REG_2700G(0x0000000c)
+#define SYSRST          __REG_2700G(0x00000010)
+
+/* Interrupt Control Registers (0x0000_0014  0x0000_002F) */
+#define NINTPW          __REG_2700G(0x00000014)
+#define MINTENABLE      __REG_2700G(0x00000018)
+#define MINTSTAT        __REG_2700G(0x0000001c)
+#define SINTENABLE      __REG_2700G(0x00000020)
+#define SINTSTAT        __REG_2700G(0x00000024)
+#define SINTCLR         __REG_2700G(0x00000028)
+
+/* Clock Control Registers (0x0000_002C  0x0000_005F) */
+#define SYSCLKSRC       __REG_2700G(0x0000002c)
+#define PIXCLKSRC       __REG_2700G(0x00000030)
+#define CLKSLEEP        __REG_2700G(0x00000034)
+#define COREPLL         __REG_2700G(0x00000038)
+#define DISPPLL         __REG_2700G(0x0000003c)
+#define PLLSTAT         __REG_2700G(0x00000040)
+#define VOVRCLK         __REG_2700G(0x00000044)
+#define PIXCLK          __REG_2700G(0x00000048)
+#define MEMCLK          __REG_2700G(0x0000004c)
+#define M24CLK          __REG_2700G(0x00000054)
+#define MBXCLK          __REG_2700G(0x00000054)
+#define SDCLK           __REG_2700G(0x00000058)
+#define PIXCLKDIV       __REG_2700G(0x0000005c)
+
+/* LCD Port Control Register (0x0000_0060  0x0000_006F) */
+#define LCD_CONFIG      __REG_2700G(0x00000060)
+
+/* On-Die Frame Buffer Registers (0x0000_0064  0x0000_006B) */
+#define ODFBPWR         __REG_2700G(0x00000064)
+#define ODFBSTAT        __REG_2700G(0x00000068)
+
+/* GPIO Registers (0x0000_006C  0x0000_007F) */
+#define GPIOCGF         __REG_2700G(0x0000006c)
+#define GPIOHI          __REG_2700G(0x00000070)
+#define GPIOLO          __REG_2700G(0x00000074)
+#define GPIOSTAT        __REG_2700G(0x00000078)
+
+/* Pulse Width Modulator (PWM) Registers (0x0000_0200  0x0000_02FF) */
+#define PWMRST          __REG_2700G(0x00000200)
+#define PWMCFG          __REG_2700G(0x00000204)
+#define PWM0DIV         __REG_2700G(0x00000210)
+#define PWM0DUTY        __REG_2700G(0x00000214)
+#define PWM0PER         __REG_2700G(0x00000218)
+#define PWM1DIV         __REG_2700G(0x00000220)
+#define PWM1DUTY        __REG_2700G(0x00000224)
+#define PWM1PER         __REG_2700G(0x00000228)
+
+/* Identification (ID) Registers (0x0000_0300  0x0000_0FFF) */
+#define ID              __REG_2700G(0x00000FF0)
+
+/* Local Memory (SDRAM) Interface Registers (0x0000_1000  0x0000_1FFF) */
+#define LMRST           __REG_2700G(0x00001000)
+#define LMCFG           __REG_2700G(0x00001004)
+#define LMPWR           __REG_2700G(0x00001008)
+#define LMPWRSTAT       __REG_2700G(0x0000100c)
+#define LMCEMR          __REG_2700G(0x00001010)
+#define LMTYPE          __REG_2700G(0x00001014)
+#define LMTIM           __REG_2700G(0x00001018)
+#define LMREFRESH       __REG_2700G(0x0000101c)
+#define LMPROTMIN       __REG_2700G(0x00001020)
+#define LMPROTMAX       __REG_2700G(0x00001024)
+#define LMPROTCFG       __REG_2700G(0x00001028)
+#define LMPROTERR       __REG_2700G(0x0000102c)
+
+/* Plane Controller Registers (0x0000_2000  0x0000_2FFF) */
+#define GSCTRL          __REG_2700G(0x00002000)
+#define VSCTRL          __REG_2700G(0x00002004)
+#define GBBASE          __REG_2700G(0x00002020)
+#define VBBASE          __REG_2700G(0x00002024)
+#define GDRCTRL         __REG_2700G(0x00002040)
+#define VCMSK           __REG_2700G(0x00002044)
+#define GSCADR          __REG_2700G(0x00002060)
+#define VSCADR          __REG_2700G(0x00002064)
+#define VUBASE          __REG_2700G(0x00002084)
+#define VVBASE          __REG_2700G(0x000020a4)
+#define GSADR           __REG_2700G(0x000020c0)
+#define VSADR           __REG_2700G(0x000020c4)
+#define HCCTRL          __REG_2700G(0x00002100)
+#define HCSIZE          __REG_2700G(0x00002110)
+#define HCPOS           __REG_2700G(0x00002120)
+#define HCBADR          __REG_2700G(0x00002130)
+#define HCCKMSK         __REG_2700G(0x00002140)
+#define GPLUT           __REG_2700G(0x00002150)
+#define DSCTRL          __REG_2700G(0x00002154)
+#define DHT01           __REG_2700G(0x00002158)
+#define DHT02           __REG_2700G(0x0000215c)
+#define DHT03           __REG_2700G(0x00002160)
+#define DVT01           __REG_2700G(0x00002164)
+#define DVT02           __REG_2700G(0x00002168)
+#define DVT03           __REG_2700G(0x0000216c)
+#define DBCOL           __REG_2700G(0x00002170)
+#define BGCOLOR         __REG_2700G(0x00002174)
+#define DINTRS          __REG_2700G(0x00002178)
+#define DINTRE          __REG_2700G(0x0000217c)
+#define DINTRCNT        __REG_2700G(0x00002180)
+#define DSIG            __REG_2700G(0x00002184)
+#define DMCTRL          __REG_2700G(0x00002188)
+#define CLIPCTRL        __REG_2700G(0x0000218c)
+#define SPOCTRL         __REG_2700G(0x00002190)
+#define SVCTRL          __REG_2700G(0x00002194)
+
+/* 0x0000_2198 */
+/* 0x0000_21A8 VSCOEFF[0:4] Video Scalar Vertical Coefficient [0:4] 4.14.5 */
+#define VSCOEFF0        __REG_2700G(0x00002198)
+#define VSCOEFF1        __REG_2700G(0x0000219c)
+#define VSCOEFF2        __REG_2700G(0x000021a0)
+#define VSCOEFF3        __REG_2700G(0x000021a4)
+#define VSCOEFF4        __REG_2700G(0x000021a8)
+
+#define SHCTRL          __REG_2700G(0x000021b0)
+
+/* 0x0000_21B4 */
+/* 0x0000_21D4 HSCOEFF[0:8] Video Scalar Horizontal Coefficient [0:8] 4.14.7 */
+#define HSCOEFF0        __REG_2700G(0x000021b4)
+#define HSCOEFF1        __REG_2700G(0x000021b8)
+#define HSCOEFF2        __REG_2700G(0x000021bc)
+#define HSCOEFF3        __REG_2700G(0x000021b0)
+#define HSCOEFF4        __REG_2700G(0x000021c4)
+#define HSCOEFF5        __REG_2700G(0x000021c8)
+#define HSCOEFF6        __REG_2700G(0x000021cc)
+#define HSCOEFF7        __REG_2700G(0x000021d0)
+#define HSCOEFF8        __REG_2700G(0x000021d4)
+
+#define SSSIZE          __REG_2700G(0x000021D8)
+
+/* 0x0000_2200 */
+/* 0x0000_2240 VIDGAM[0:16] Video Gamma LUT Index [0:16] 4.15.2 */
+#define VIDGAM0         __REG_2700G(0x00002200)
+#define VIDGAM1         __REG_2700G(0x00002204)
+#define VIDGAM2         __REG_2700G(0x00002208)
+#define VIDGAM3         __REG_2700G(0x0000220c)
+#define VIDGAM4         __REG_2700G(0x00002210)
+#define VIDGAM5         __REG_2700G(0x00002214)
+#define VIDGAM6         __REG_2700G(0x00002218)
+#define VIDGAM7         __REG_2700G(0x0000221c)
+#define VIDGAM8         __REG_2700G(0x00002220)
+#define VIDGAM9         __REG_2700G(0x00002224)
+#define VIDGAM10        __REG_2700G(0x00002228)
+#define VIDGAM11        __REG_2700G(0x0000222c)
+#define VIDGAM12        __REG_2700G(0x00002230)
+#define VIDGAM13        __REG_2700G(0x00002234)
+#define VIDGAM14        __REG_2700G(0x00002238)
+#define VIDGAM15        __REG_2700G(0x0000223c)
+#define VIDGAM16        __REG_2700G(0x00002240)
+
+/* 0x0000_2250 */
+/* 0x0000_2290 GFXGAM[0:16] Graphics Gamma LUT Index [0:16] 4.15.3 */
+#define GFXGAM0         __REG_2700G(0x00002250)
+#define GFXGAM1         __REG_2700G(0x00002254)
+#define GFXGAM2         __REG_2700G(0x00002258)
+#define GFXGAM3         __REG_2700G(0x0000225c)
+#define GFXGAM4         __REG_2700G(0x00002260)
+#define GFXGAM5         __REG_2700G(0x00002264)
+#define GFXGAM6         __REG_2700G(0x00002268)
+#define GFXGAM7         __REG_2700G(0x0000226c)
+#define GFXGAM8         __REG_2700G(0x00002270)
+#define GFXGAM9         __REG_2700G(0x00002274)
+#define GFXGAM10        __REG_2700G(0x00002278)
+#define GFXGAM11        __REG_2700G(0x0000227c)
+#define GFXGAM12        __REG_2700G(0x00002280)
+#define GFXGAM13        __REG_2700G(0x00002284)
+#define GFXGAM14        __REG_2700G(0x00002288)
+#define GFXGAM15        __REG_2700G(0x0000228c)
+#define GFXGAM16        __REG_2700G(0x00002290)
+
+#define DLSTS           __REG_2700G(0x00002300)
+#define DLLCTRL         __REG_2700G(0x00002304)
+#define DVLNUM          __REG_2700G(0x00002308)
+#define DUCTRL          __REG_2700G(0x0000230c)
+#define DVECTRL         __REG_2700G(0x00002310)
+#define DHDET           __REG_2700G(0x00002314)
+#define DVDET           __REG_2700G(0x00002318)
+#define DODMSK          __REG_2700G(0x0000231c)
+#define CSC01           __REG_2700G(0x00002330)
+#define CSC02           __REG_2700G(0x00002334)
+#define CSC03           __REG_2700G(0x00002338)
+#define CSC04           __REG_2700G(0x0000233c)
+#define CSC05           __REG_2700G(0x00002340)
+
+#define FB_MEMORY_START __REG_2700G(0x00060000)
+
+#endif /* __REGS_2700G_ */
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index ff5454601e22..d1267904c280 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -12,7 +12,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/tty.h>
 #include <linux/fb.h>
 #include <linux/sched.h>
 
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 773855a311e8..59a6f5fa5ae6 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -59,7 +59,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/nvidia/nv_backlight.c b/drivers/video/nvidia/nv_backlight.c
index 1c1c10c699c5..5b75ae4e9457 100644
--- a/drivers/video/nvidia/nv_backlight.c
+++ b/drivers/video/nvidia/nv_backlight.c
@@ -26,9 +26,11 @@
  */
 #define MIN_LEVEL 0x158
 #define MAX_LEVEL 0x534
+#define LEVEL_STEP ((MAX_LEVEL - MIN_LEVEL) / FB_BACKLIGHT_MAX)
 
 static struct backlight_properties nvidia_bl_data;
 
+/* Call with fb_info->bl_mutex held */
 static int nvidia_bl_get_level_brightness(struct nvidia_par *par,
                 int level)
 {
@@ -36,9 +38,7 @@ static int nvidia_bl_get_level_brightness(struct nvidia_par *par,
         int nlevel;
 
         /* Get and convert the value */
-        mutex_lock(&info->bl_mutex);
-        nlevel = info->bl_curve[level] * FB_BACKLIGHT_MAX / MAX_LEVEL;
-        mutex_unlock(&info->bl_mutex);
+        nlevel = MIN_LEVEL + info->bl_curve[level] * LEVEL_STEP;
 
         if (nlevel < 0)
                 nlevel = 0;
@@ -50,7 +50,8 @@ static int nvidia_bl_get_level_brightness(struct nvidia_par *par,
         return nlevel;
 }
 
-static int nvidia_bl_update_status(struct backlight_device *bd)
+/* Call with fb_info->bl_mutex held */
+static int __nvidia_bl_update_status(struct backlight_device *bd)
 {
         struct nvidia_par *par = class_get_devdata(&bd->class_dev);
         u32 tmp_pcrt, tmp_pmc, fpcontrol;
@@ -84,6 +85,19 @@ static int nvidia_bl_update_status(struct backlight_device *bd)
         return 0;
 }
 
+static int nvidia_bl_update_status(struct backlight_device *bd)
+{
+        struct nvidia_par *par = class_get_devdata(&bd->class_dev);
+        struct fb_info *info = pci_get_drvdata(par->pci_dev);
+        int ret;
+
+        mutex_lock(&info->bl_mutex);
+        ret = __nvidia_bl_update_status(bd);
+        mutex_unlock(&info->bl_mutex);
+
+        return ret;
+}
+
 static int nvidia_bl_get_brightness(struct backlight_device *bd)
 {
         return bd->props->brightness;
@@ -96,6 +110,20 @@ static struct backlight_properties nvidia_bl_data = {
         .max_brightness = (FB_BACKLIGHT_LEVELS - 1),
 };
 
+void nvidia_bl_set_power(struct fb_info *info, int power)
+{
+        mutex_lock(&info->bl_mutex);
+
+        if (info->bl_dev) {
+                down(&info->bl_dev->sem);
+                info->bl_dev->props->power = power;
+                __nvidia_bl_update_status(info->bl_dev);
+                up(&info->bl_dev->sem);
+        }
+
+        mutex_unlock(&info->bl_mutex);
+}
+
 void nvidia_bl_init(struct nvidia_par *par)
 {
         struct fb_info *info = pci_get_drvdata(par->pci_dev);
@@ -116,7 +144,7 @@ void nvidia_bl_init(struct nvidia_par *par)
         bd = backlight_device_register(name, par, &nvidia_bl_data);
         if (IS_ERR(bd)) {
                 info->bl_dev = NULL;
-                printk("nvidia: Backlight registration failed\n");
+                printk(KERN_WARNING "nvidia: Backlight registration failed\n");
                 goto error;
         }
 
@@ -127,11 +155,11 @@ void nvidia_bl_init(struct nvidia_par *par)
                 0x534 * FB_BACKLIGHT_MAX / MAX_LEVEL);
         mutex_unlock(&info->bl_mutex);
 
-        up(&bd->sem);
+        down(&bd->sem);
         bd->props->brightness = nvidia_bl_data.max_brightness;
         bd->props->power = FB_BLANK_UNBLANK;
         bd->props->update_status(bd);
-        down(&bd->sem);
+        up(&bd->sem);
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         mutex_lock(&pmac_backlight_mutex);
diff --git a/drivers/video/nvidia/nv_proto.h b/drivers/video/nvidia/nv_proto.h
index 6fba656cd56b..861271017655 100644
--- a/drivers/video/nvidia/nv_proto.h
+++ b/drivers/video/nvidia/nv_proto.h
@@ -68,9 +68,11 @@ extern u8 byte_rev[256];
 #ifdef CONFIG_FB_NVIDIA_BACKLIGHT
 extern void nvidia_bl_init(struct nvidia_par *par);
 extern void nvidia_bl_exit(struct nvidia_par *par);
+extern void nvidia_bl_set_power(struct fb_info *info, int power);
 #else
 static inline void nvidia_bl_init(struct nvidia_par *par) {}
 static inline void nvidia_bl_exit(struct nvidia_par *par) {}
+static inline void nvidia_bl_set_power(struct fb_info *info, int power) {}
 #endif
 
 #endif                          /* __NV_PROTO_H__ */
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index b02d6033cc0c..d4f850117874 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -14,7 +14,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
@@ -35,10 +34,6 @@
 #include "nv_proto.h"
 #include "nv_dma.h"
 
-#ifndef CONFIG_PCI              /* sanity check */
-#error This driver requires PCI support.
-#endif
-
 #undef CONFIG_FB_NVIDIA_DEBUG
 #ifdef CONFIG_FB_NVIDIA_DEBUG
 #define NVTRACE          printk
@@ -933,16 +928,7 @@ static int nvidiafb_blank(int blank, struct fb_info *info)
         NVWriteSeq(par, 0x01, tmp);
         NVWriteCrtc(par, 0x1a, vesa);
 
-#ifdef CONFIG_FB_NVIDIA_BACKLIGHT
-        mutex_lock(&info->bl_mutex);
-        if (info->bl_dev) {
-                down(&info->bl_dev->sem);
-                info->bl_dev->props->power = blank;
-                info->bl_dev->props->update_status(info->bl_dev);
-                up(&info->bl_dev->sem);
-        }
-        mutex_unlock(&info->bl_mutex);
-#endif
+        nvidia_bl_set_power(info, blank);
 
         NVTRACE_LEAVE();
 
@@ -1313,20 +1299,19 @@ static int __devinit nvidiafb_probe(struct pci_dev *pd,
 
         nvidia_save_vga(par, &par->SavedReg);
 
+        pci_set_drvdata(pd, info);
+        nvidia_bl_init(par);
         if (register_framebuffer(info) < 0) {
                 printk(KERN_ERR PFX "error registering nVidia framebuffer\n");
                 goto err_out_iounmap_fb;
         }
 
-        pci_set_drvdata(pd, info);
 
         printk(KERN_INFO PFX
                "PCI nVidia %s framebuffer (%dMB @ 0x%lX)\n",
                info->fix.id,
                par->FbMapSize / (1024 * 1024), info->fix.smem_start);
 
-        nvidia_bl_init(par);
-
         NVTRACE_LEAVE();
         return 0;
 
diff --git a/drivers/video/offb.c b/drivers/video/offb.c
index bfeb11bd4712..0013311e0564 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
@@ -17,7 +17,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
@@ -63,8 +62,6 @@ struct offb_par default_par;
      *  Interface used by the world
      */
 
-int offb_init(void);
-
 static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                           u_int transp, struct fb_info *info);
 static int offb_blank(int blank, struct fb_info *info);
@@ -73,11 +70,6 @@ static int offb_blank(int blank, struct fb_info *info);
 extern boot_infos_t *boot_infos;
 #endif
 
-static void offb_init_nodriver(struct device_node *);
-static void offb_init_fb(const char *name, const char *full_name,
-                         int width, int height, int depth, int pitch,
-                         unsigned long address, struct device_node *dp);
-
 static struct fb_ops offb_ops = {
         .owner          = THIS_MODULE,
         .fb_setcolreg   = offb_setcolreg,
@@ -97,14 +89,43 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                           u_int transp, struct fb_info *info)
 {
         struct offb_par *par = (struct offb_par *) info->par;
+        int i, depth;
+        u32 *pal = info->pseudo_palette;
 
-        if (!par->cmap_adr || regno > 255)
+        depth = info->var.bits_per_pixel;
+        if (depth == 16)
+                depth = (info->var.green.length == 5) ? 15 : 16;
+
+        if (regno > 255 ||
+            (depth == 16 && regno > 63) ||
+            (depth == 15 && regno > 31))
                 return 1;
 
+        if (regno < 16) {
+                switch (depth) {
+                case 15:
+                        pal[regno] = (regno << 10) | (regno << 5) | regno;
+                        break;
+                case 16:
+                        pal[regno] = (regno << 11) | (regno << 5) | regno;
+                        break;
+                case 24:
+                        pal[regno] = (regno << 16) | (regno << 8) | regno;
+                        break;
+                case 32:
+                        i = (regno << 8) | regno;
+                        pal[regno] = (i << 16) | i;
+                        break;
+                }
+        }
+
         red >>= 8;
         green >>= 8;
         blue >>= 8;
 
+        if (!par->cmap_adr)
+                return 0;
+
         switch (par->cmap_type) {
         case cmap_m64:
                 writeb(regno, par->cmap_adr);
@@ -141,20 +162,6 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                 break;
         }
 
-        if (regno < 16)
-                switch (info->var.bits_per_pixel) {
-                case 16:
-                        ((u16 *) (info->pseudo_palette))[regno] =
-                            (regno << 10) | (regno << 5) | regno;
-                        break;
-                case 32:
-                        {
-                                int i = (regno << 8) | regno;
-                                ((u32 *) (info->pseudo_palette))[regno] =
-                                    (i << 16) | i;
-                                break;
-                        }
-                }
         return 0;
 }
 
@@ -215,196 +222,17 @@ static int offb_blank(int blank, struct fb_info *info)
         return 0;
 }
 
-    /*
-     *  Initialisation
-     */
 
-int __init offb_init(void)
+static void __iomem *offb_map_reg(struct device_node *np, int index,
+                                  unsigned long offset, unsigned long size)
 {
-        struct device_node *dp = NULL, *boot_disp = NULL;
-
-#if defined(CONFIG_BOOTX_TEXT) && defined(CONFIG_PPC32)
-        struct device_node *macos_display = NULL;
-#endif
-        if (fb_get_options("offb", NULL))
-                return -ENODEV;
-
-#if defined(CONFIG_BOOTX_TEXT) && defined(CONFIG_PPC32)
-        /* If we're booted from BootX... */
-        if (boot_infos != 0) {
-                unsigned long addr =
-                    (unsigned long) boot_infos->dispDeviceBase;
-                u32 *addrp;
-                u64 daddr, dsize;
-                unsigned int flags;
-
-                /* find the device node corresponding to the macos display */
-                while ((dp = of_find_node_by_type(dp, "display"))) {
-                        int i;
-
-                        /*
-                         * Look for an AAPL,address property first.
-                         */
-                        unsigned int na;
-                        unsigned int *ap =
-                                (unsigned int *)get_property(dp, "AAPL,address",
-                                                             &na);
-                        if (ap != 0) {
-                                for (na /= sizeof(unsigned int); na > 0;
-                                     --na, ++ap)
-                                        if (*ap <= addr &&
-                                            addr < *ap + 0x1000000) {
-                                                macos_display = dp;
-                                                goto foundit;
-                                        }
-                        }
-
-                        /*
-                         * See if the display address is in one of the address
-                         * ranges for this display.
-                         */
-                        i = 0;
-                        for (;;) {
-                                addrp = of_get_address(dp, i++, &dsize, &flags);
-                                if (addrp == NULL)
-                                        break;
-                                if (!(flags & IORESOURCE_MEM))
-                                        continue;
-                                daddr = of_translate_address(dp, addrp);
-                                if (daddr == OF_BAD_ADDR)
-                                        continue;
-                                if (daddr <= addr && addr < (daddr + dsize)) {
-                                        macos_display = dp;
-                                        goto foundit;
-                                }
-                        }
-                foundit:
-                        if (macos_display) {
-                                printk(KERN_INFO "MacOS display is %s\n",
-                                       dp->full_name);
-                                break;
-                        }
-                }
-
-                /* initialize it */
-                offb_init_fb(macos_display ? macos_display->
-                             name : "MacOS display",
-                             macos_display ? macos_display->
-                             full_name : "MacOS display",
-                             boot_infos->dispDeviceRect[2],
-                             boot_infos->dispDeviceRect[3],
-                             boot_infos->dispDeviceDepth,
-                             boot_infos->dispDeviceRowBytes, addr, NULL);
-        }
-#endif /* defined(CONFIG_BOOTX_TEXT) && defined(CONFIG_PPC32) */
-
-        for (dp = NULL; (dp = of_find_node_by_type(dp, "display"));) {
-                if (get_property(dp, "linux,opened", NULL) &&
-                    get_property(dp, "linux,boot-display", NULL)) {
-                        boot_disp = dp;
-                        offb_init_nodriver(dp);
-                }
-        }
-        for (dp = NULL; (dp = of_find_node_by_type(dp, "display"));) {
-                if (get_property(dp, "linux,opened", NULL) &&
-                    dp != boot_disp)
-                        offb_init_nodriver(dp);
-        }
-
-        return 0;
-}
-
-
-static void __init offb_init_nodriver(struct device_node *dp)
-{
-        int *pp, i;
-        unsigned int len;
-        int width = 640, height = 480, depth = 8, pitch;
-        unsigned int flags, rsize, *up;
-        u64 address = OF_BAD_ADDR;
-        u32 *addrp;
-        u64 asize;
-
-        if ((pp = (int *) get_property(dp, "depth", &len)) != NULL
-            && len == sizeof(int))
-                depth = *pp;
-        if ((pp = (int *) get_property(dp, "width", &len)) != NULL
-            && len == sizeof(int))
-                width = *pp;
-        if ((pp = (int *) get_property(dp, "height", &len)) != NULL
-            && len == sizeof(int))
-                height = *pp;
-        if ((pp = (int *) get_property(dp, "linebytes", &len)) != NULL
-            && len == sizeof(int)) {
-                pitch = *pp;
-                if (pitch == 1)
-                        pitch = 0x1000;
-        } else
-                pitch = width;
-
-       rsize = (unsigned long)pitch * (unsigned long)height *
-               (unsigned long)(depth / 8);
-
-       /* Try to match device to a PCI device in order to get a properly
-        * translated address rather then trying to decode the open firmware
-        * stuff in various incorrect ways
-        */
-#ifdef CONFIG_PCI
-       /* First try to locate the PCI device if any */
-       {
-               struct pci_dev *pdev = NULL;
-
-               for_each_pci_dev(pdev) {
-                       if (dp == pci_device_to_OF_node(pdev))
-                               break;
-               }
-               if (pdev) {
-                       for (i = 0; i < 6 && address == OF_BAD_ADDR; i++) {
-                               if ((pci_resource_flags(pdev, i) &
-                                    IORESOURCE_MEM) &&
-                                   (pci_resource_len(pdev, i) >= rsize))
-                                       address = pci_resource_start(pdev, i);
-                       }
-                       pci_dev_put(pdev);
-               }
-        }
-#endif /* CONFIG_PCI */
-
-       /* This one is dodgy, we may drop it ... */
-       if (address == OF_BAD_ADDR &&
-           (up = (unsigned *) get_property(dp, "address", &len)) != NULL &&
-           len == sizeof(unsigned int))
-               address = (u64) * up;
-
-       if (address == OF_BAD_ADDR) {
-               for (i = 0; (addrp = of_get_address(dp, i, &asize, &flags))
-                            != NULL; i++) {
-                       if (!(flags & IORESOURCE_MEM))
-                               continue;
-                       if (asize >= pitch * height * depth / 8)
-                               break;
-               }
-                if (addrp == NULL) {
-                        printk(KERN_ERR
-                               "no framebuffer address found for %s\n",
-                               dp->full_name);
-                        return;
-                }
-                address = of_translate_address(dp, addrp);
-                if (address == OF_BAD_ADDR) {
-                        printk(KERN_ERR
-                               "can't translate framebuffer address for %s\n",
-                               dp->full_name);
-                        return;
-                }
-
-                /* kludge for valkyrie */
-                if (strcmp(dp->name, "valkyrie") == 0)
-                        address += 0x1000;
-        }
-        offb_init_fb(dp->name, dp->full_name, width, height, depth,
-                     pitch, address, dp);
+        struct resource r;
 
+        if (of_address_to_resource(np, index, &r))
+                return 0;
+        if ((r.start + offset + size) > r.end)
+                return 0;
+        return ioremap(r.start + offset, size);
 }
 
 static void __init offb_init_fb(const char *name, const char *full_name,
@@ -412,7 +240,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
                                 int pitch, unsigned long address,
                                 struct device_node *dp)
 {
-        unsigned long res_size = pitch * height * depth / 8;
+        unsigned long res_size = pitch * height * (depth + 7) / 8;
         struct offb_par *par = &default_par;
         unsigned long res_start = address;
         struct fb_fix_screeninfo *fix;
@@ -426,7 +254,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
         printk(KERN_INFO
                "Using unsupported %dx%d %s at %lx, depth=%d, pitch=%d\n",
                width, height, name, address, depth, pitch);
-        if (depth != 8 && depth != 16 && depth != 32) {
+        if (depth != 8 && depth != 15 && depth != 16 && depth != 32) {
                 printk(KERN_ERR "%s: can't use depth = %d\n", full_name,
                        depth);
                 release_mem_region(res_start, res_size);
@@ -461,48 +289,41 @@ static void __init offb_init_fb(const char *name, const char *full_name,
 
         par->cmap_type = cmap_unknown;
         if (depth == 8) {
-
                 /* Palette hacks disabled for now */
-#if 0
                 if (dp && !strncmp(name, "ATY,Rage128", 11)) {
-                        unsigned long regbase = dp->addrs[2].address;
-                        par->cmap_adr = ioremap(regbase, 0x1FFF);
-                        par->cmap_type = cmap_r128;
+                        par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
+                        if (par->cmap_adr)
+                                par->cmap_type = cmap_r128;
                 } else if (dp && (!strncmp(name, "ATY,RageM3pA", 12)
                                   || !strncmp(name, "ATY,RageM3p12A", 14))) {
-                        unsigned long regbase =
-                            dp->parent->addrs[2].address;
-                        par->cmap_adr = ioremap(regbase, 0x1FFF);
-                        par->cmap_type = cmap_M3A;
+                        par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
+                        if (par->cmap_adr)
+                                par->cmap_type = cmap_M3A;
                 } else if (dp && !strncmp(name, "ATY,RageM3pB", 12)) {
-                        unsigned long regbase =
-                            dp->parent->addrs[2].address;
-                        par->cmap_adr = ioremap(regbase, 0x1FFF);
-                        par->cmap_type = cmap_M3B;
+                        par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
+                        if (par->cmap_adr)
+                                par->cmap_type = cmap_M3B;
                 } else if (dp && !strncmp(name, "ATY,Rage6", 9)) {
-                        unsigned long regbase = dp->addrs[1].address;
-                        par->cmap_adr = ioremap(regbase, 0x1FFF);
-                        par->cmap_type = cmap_radeon;
+                        par->cmap_adr = offb_map_reg(dp, 1, 0, 0x1fff);
+                        if (par->cmap_adr)
+                                par->cmap_type = cmap_radeon;
                 } else if (!strncmp(name, "ATY,", 4)) {
                         unsigned long base = address & 0xff000000UL;
                         par->cmap_adr =
                             ioremap(base + 0x7ff000, 0x1000) + 0xcc0;
                         par->cmap_data = par->cmap_adr + 1;
                         par->cmap_type = cmap_m64;
-                } else if (device_is_compatible(dp, "pci1014,b7")) {
-                        unsigned long regbase = dp->addrs[0].address;
-                        par->cmap_adr = ioremap(regbase + 0x6000, 0x1000);
-                        par->cmap_type = cmap_gxt2000;
+                } else if (dp && device_is_compatible(dp, "pci1014,b7")) {
+                        par->cmap_adr = offb_map_reg(dp, 0, 0x6000, 0x1000);
+                        if (par->cmap_adr)
+                                par->cmap_type = cmap_gxt2000;
                 }
-#endif
-                fix->visual = par->cmap_adr ? FB_VISUAL_PSEUDOCOLOR
-                    : FB_VISUAL_STATIC_PSEUDOCOLOR;
+                fix->visual = (par->cmap_type != cmap_unknown) ?
+                        FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_STATIC_PSEUDOCOLOR;
         } else
-                fix->visual =   /* par->cmap_adr ? FB_VISUAL_DIRECTCOLOR
-                                   : */ FB_VISUAL_TRUECOLOR;
+                fix->visual = FB_VISUAL_TRUECOLOR;
 
         var->xoffset = var->yoffset = 0;
-        var->bits_per_pixel = depth;
         switch (depth) {
         case 8:
                 var->bits_per_pixel = 8;
@@ -515,7 +336,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
                 var->transp.offset = 0;
                 var->transp.length = 0;
                 break;
-        case 16:                /* RGB 555 */
+        case 15:                /* RGB 555 */
                 var->bits_per_pixel = 16;
                 var->red.offset = 10;
                 var->red.length = 5;
@@ -526,6 +347,17 @@ static void __init offb_init_fb(const char *name, const char *full_name,
                 var->transp.offset = 0;
                 var->transp.length = 0;
                 break;
+        case 16:                /* RGB 565 */
+                var->bits_per_pixel = 16;
+                var->red.offset = 11;
+                var->red.length = 5;
+                var->green.offset = 5;
+                var->green.length = 6;
+                var->blue.offset = 0;
+                var->blue.length = 5;
+                var->transp.offset = 0;
+                var->transp.length = 0;
+                break;
         case 32:                /* RGB 888 */
                 var->bits_per_pixel = 32;
                 var->red.offset = 16;
@@ -569,5 +401,139 @@ static void __init offb_init_fb(const char *name, const char *full_name,
                info->node, full_name);
 }
 
+
+static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
+{
+        unsigned int len;
+        int i, width = 640, height = 480, depth = 8, pitch = 640;
+        unsigned int flags, rsize, addr_prop = 0;
+        unsigned long max_size = 0;
+        u64 rstart, address = OF_BAD_ADDR;
+        u32 *pp, *addrp, *up;
+        u64 asize;
+
+        pp = (u32 *)get_property(dp, "linux,bootx-depth", &len);
+        if (pp == NULL)
+                pp = (u32 *)get_property(dp, "depth", &len);
+        if (pp && len == sizeof(u32))
+                depth = *pp;
+
+        pp = (u32 *)get_property(dp, "linux,bootx-width", &len);
+        if (pp == NULL)
+                pp = (u32 *)get_property(dp, "width", &len);
+        if (pp && len == sizeof(u32))
+                width = *pp;
+
+        pp = (u32 *)get_property(dp, "linux,bootx-height", &len);
+        if (pp == NULL)
+                pp = (u32 *)get_property(dp, "height", &len);
+        if (pp && len == sizeof(u32))
+                height = *pp;
+
+        pp = (u32 *)get_property(dp, "linux,bootx-linebytes", &len);
+        if (pp == NULL)
+                pp = (u32 *)get_property(dp, "linebytes", &len);
+        if (pp && len == sizeof(u32))
+                pitch = *pp;
+        else
+                pitch = width * ((depth + 7) / 8);
+
+        rsize = (unsigned long)pitch * (unsigned long)height;
+
+        /* Ok, now we try to figure out the address of the framebuffer.
+         *
+         * Unfortunately, Open Firmware doesn't provide a standard way to do
+         * so. All we can do is a dodgy heuristic that happens to work in
+         * practice. On most machines, the "address" property contains what
+         * we need, though not on Matrox cards found in IBM machines. What I've
+         * found that appears to give good results is to go through the PCI
+         * ranges and pick one that is both big enough and if possible encloses
+         * the "address" property. If none match, we pick the biggest
+         */
+        up = (u32 *)get_property(dp, "linux,bootx-addr", &len);
+        if (up == NULL)
+                up = (u32 *)get_property(dp, "address", &len);
+        if (up && len == sizeof(u32))
+                addr_prop = *up;
+
+        /* Hack for when BootX is passing us */
+        if (no_real_node)
+                goto skip_addr;
+
+        for (i = 0; (addrp = of_get_address(dp, i, &asize, &flags))
+                     != NULL; i++) {
+                int match_addrp = 0;
+
+                if (!(flags & IORESOURCE_MEM))
+                        continue;
+                if (asize < rsize)
+                        continue;
+                rstart = of_translate_address(dp, addrp);
+                if (rstart == OF_BAD_ADDR)
+                        continue;
+                if (addr_prop && (rstart <= addr_prop) &&
+                    ((rstart + asize) >= (addr_prop + rsize)))
+                        match_addrp = 1;
+                if (match_addrp) {
+                        address = addr_prop;
+                        break;
+                }
+                if (rsize > max_size) {
+                        max_size = rsize;
+                        address = OF_BAD_ADDR;
+                }
+
+                if (address == OF_BAD_ADDR)
+                        address = rstart;
+        }
+ skip_addr:
+        if (address == OF_BAD_ADDR && addr_prop)
+                address = (u64)addr_prop;
+        if (address != OF_BAD_ADDR) {
+                /* kludge for valkyrie */
+                if (strcmp(dp->name, "valkyrie") == 0)
+                        address += 0x1000;
+                offb_init_fb(no_real_node ? "bootx" : dp->name,
+                             no_real_node ? "display" : dp->full_name,
+                             width, height, depth, pitch, address,
+                             no_real_node ? dp : NULL);
+        }
+}
+
+static int __init offb_init(void)
+{
+        struct device_node *dp = NULL, *boot_disp = NULL;
+
+        if (fb_get_options("offb", NULL))
+                return -ENODEV;
+
+        /* Check if we have a MacOS display without a node spec */
+        if (get_property(of_chosen, "linux,bootx-noscreen", NULL) != NULL) {
+                /* The old code tried to work out which node was the MacOS
+                 * display based on the address. I'm dropping that since the
+                 * lack of a node spec only happens with old BootX versions
+                 * (users can update) and with this code, they'll still get
+                 * a display (just not the palette hacks).
+                 */
+                offb_init_nodriver(of_chosen, 1);
+        }
+
+        for (dp = NULL; (dp = of_find_node_by_type(dp, "display"));) {
+                if (get_property(dp, "linux,opened", NULL) &&
+                    get_property(dp, "linux,boot-display", NULL)) {
+                        boot_disp = dp;
+                        offb_init_nodriver(dp, 0);
+                }
+        }
+        for (dp = NULL; (dp = of_find_node_by_type(dp, "display"));) {
+                if (get_property(dp, "linux,opened", NULL) &&
+                    dp != boot_disp)
+                        offb_init_nodriver(dp, 0);
+        }
+
+        return 0;
+}
+
+
 module_init(offb_init);
 MODULE_LICENSE("GPL");
diff --git a/drivers/video/platinumfb.c b/drivers/video/platinumfb.c
index 450e802e0aa8..983be3ec2345 100644
--- a/drivers/video/platinumfb.c
+++ b/drivers/video/platinumfb.c
@@ -22,7 +22,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c
index 49a203e1591c..a560a2223825 100644
--- a/drivers/video/pm2fb.c
+++ b/drivers/video/pm2fb.c
@@ -33,7 +33,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/pm3fb.c b/drivers/video/pm3fb.c
index 0e0f977b05ee..1d81ef47efd3 100644
--- a/drivers/video/pm3fb.c
+++ b/drivers/video/pm3fb.c
@@ -57,7 +57,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/pmag-aa-fb.c b/drivers/video/pmag-aa-fb.c
index d92f352211ef..68ca3cc40770 100644
--- a/drivers/video/pmag-aa-fb.c
+++ b/drivers/video/pmag-aa-fb.c
@@ -29,7 +29,6 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/video/pnx4008/Makefile b/drivers/video/pnx4008/Makefile
new file mode 100644
index 000000000000..636aaccf01fd
--- /dev/null
+++ b/drivers/video/pnx4008/Makefile
@@ -0,0 +1,7 @@
+#
+# Makefile for the new PNX4008 framebuffer device driver
+#
+
+obj-$(CONFIG_FB_PNX4008_DUM) += sdum.o
+obj-$(CONFIG_FB_PNX4008_DUM_RGB) += pnxrgbfb.o
+
diff --git a/drivers/video/pnx4008/dum.h b/drivers/video/pnx4008/dum.h
new file mode 100644
index 000000000000..d80a614d89ed
--- /dev/null
+++ b/drivers/video/pnx4008/dum.h
@@ -0,0 +1,211 @@
+/*
+ * linux/drivers/video/pnx4008/dum.h
+ *
+ * Internal header for SDUM
+ *
+ * 2005 (c) Koninklijke Philips N.V. This file is licensed under
+ * the terms of the GNU General Public License version 2. This program
+ * is licensed "as is" without any warranty of any kind, whether express
+ * or implied.
+ */
+
+#ifndef __PNX008_DUM_H__
+#define __PNX008_DUM_H__
+
+#include <asm/arch/platform.h>
+
+#define PNX4008_DUMCONF_VA_BASE         IO_ADDRESS(PNX4008_DUMCONF_BASE)
+#define PNX4008_DUM_MAIN_VA_BASE        IO_ADDRESS(PNX4008_DUM_MAINCFG_BASE)
+
+/* DUM CFG ADDRESSES */
+#define DUM_CH_BASE_ADR         (PNX4008_DUMCONF_VA_BASE + 0x00)
+#define DUM_CH_MIN_ADR          (PNX4008_DUMCONF_VA_BASE + 0x00)
+#define DUM_CH_MAX_ADR          (PNX4008_DUMCONF_VA_BASE + 0x04)
+#define DUM_CH_CONF_ADR         (PNX4008_DUMCONF_VA_BASE + 0x08)
+#define DUM_CH_STAT_ADR         (PNX4008_DUMCONF_VA_BASE + 0x0C)
+#define DUM_CH_CTRL_ADR         (PNX4008_DUMCONF_VA_BASE + 0x10)
+
+#define CH_MARG         (0x100 / sizeof(u32))
+#define DUM_CH_MIN(i)   (*((volatile u32 *)DUM_CH_MIN_ADR + (i) * CH_MARG))
+#define DUM_CH_MAX(i)   (*((volatile u32 *)DUM_CH_MAX_ADR + (i) * CH_MARG))
+#define DUM_CH_CONF(i)  (*((volatile u32 *)DUM_CH_CONF_ADR + (i) * CH_MARG))
+#define DUM_CH_STAT(i)  (*((volatile u32 *)DUM_CH_STAT_ADR + (i) * CH_MARG))
+#define DUM_CH_CTRL(i)  (*((volatile u32 *)DUM_CH_CTRL_ADR + (i) * CH_MARG))
+
+#define DUM_CONF_ADR          (PNX4008_DUM_MAIN_VA_BASE + 0x00)
+#define DUM_CTRL_ADR          (PNX4008_DUM_MAIN_VA_BASE + 0x04)
+#define DUM_STAT_ADR          (PNX4008_DUM_MAIN_VA_BASE + 0x08)
+#define DUM_DECODE_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x0C)
+#define DUM_COM_BASE_ADR      (PNX4008_DUM_MAIN_VA_BASE + 0x10)
+#define DUM_SYNC_C_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x14)
+#define DUM_CLK_DIV_ADR       (PNX4008_DUM_MAIN_VA_BASE + 0x18)
+#define DUM_DIRTY_LOW_ADR     (PNX4008_DUM_MAIN_VA_BASE + 0x20)
+#define DUM_DIRTY_HIGH_ADR    (PNX4008_DUM_MAIN_VA_BASE + 0x24)
+#define DUM_FORMAT_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x28)
+#define DUM_WTCFG1_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x30)
+#define DUM_RTCFG1_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x34)
+#define DUM_WTCFG2_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x38)
+#define DUM_RTCFG2_ADR        (PNX4008_DUM_MAIN_VA_BASE + 0x3C)
+#define DUM_TCFG_ADR          (PNX4008_DUM_MAIN_VA_BASE + 0x40)
+#define DUM_OUTP_FORMAT1_ADR  (PNX4008_DUM_MAIN_VA_BASE + 0x44)
+#define DUM_OUTP_FORMAT2_ADR  (PNX4008_DUM_MAIN_VA_BASE + 0x48)
+#define DUM_SYNC_MODE_ADR     (PNX4008_DUM_MAIN_VA_BASE + 0x4C)
+#define DUM_SYNC_OUT_C_ADR    (PNX4008_DUM_MAIN_VA_BASE + 0x50)
+
+#define DUM_CONF              (*(volatile u32 *)(DUM_CONF_ADR))
+#define DUM_CTRL              (*(volatile u32 *)(DUM_CTRL_ADR))
+#define DUM_STAT              (*(volatile u32 *)(DUM_STAT_ADR))
+#define DUM_DECODE            (*(volatile u32 *)(DUM_DECODE_ADR))
+#define DUM_COM_BASE          (*(volatile u32 *)(DUM_COM_BASE_ADR))
+#define DUM_SYNC_C            (*(volatile u32 *)(DUM_SYNC_C_ADR))
+#define DUM_CLK_DIV           (*(volatile u32 *)(DUM_CLK_DIV_ADR))
+#define DUM_DIRTY_LOW         (*(volatile u32 *)(DUM_DIRTY_LOW_ADR))
+#define DUM_DIRTY_HIGH        (*(volatile u32 *)(DUM_DIRTY_HIGH_ADR))
+#define DUM_FORMAT            (*(volatile u32 *)(DUM_FORMAT_ADR))
+#define DUM_WTCFG1            (*(volatile u32 *)(DUM_WTCFG1_ADR))
+#define DUM_RTCFG1            (*(volatile u32 *)(DUM_RTCFG1_ADR))
+#define DUM_WTCFG2            (*(volatile u32 *)(DUM_WTCFG2_ADR))
+#define DUM_RTCFG2            (*(volatile u32 *)(DUM_RTCFG2_ADR))
+#define DUM_TCFG              (*(volatile u32 *)(DUM_TCFG_ADR))
+#define DUM_OUTP_FORMAT1      (*(volatile u32 *)(DUM_OUTP_FORMAT1_ADR))
+#define DUM_OUTP_FORMAT2      (*(volatile u32 *)(DUM_OUTP_FORMAT2_ADR))
+#define DUM_SYNC_MODE         (*(volatile u32 *)(DUM_SYNC_MODE_ADR))
+#define DUM_SYNC_OUT_C        (*(volatile u32 *)(DUM_SYNC_OUT_C_ADR))
+
+/* DUM SLAVE ADDRESSES */
+#define DUM_SLAVE_WRITE_ADR      (PNX4008_DUM_MAINCFG_BASE + 0x0000000)
+#define DUM_SLAVE_READ1_I_ADR    (PNX4008_DUM_MAINCFG_BASE + 0x1000000)
+#define DUM_SLAVE_READ1_R_ADR    (PNX4008_DUM_MAINCFG_BASE + 0x1000004)
+#define DUM_SLAVE_READ2_I_ADR    (PNX4008_DUM_MAINCFG_BASE + 0x1000008)
+#define DUM_SLAVE_READ2_R_ADR    (PNX4008_DUM_MAINCFG_BASE + 0x100000C)
+
+#define DUM_SLAVE_WRITE_W  ((volatile u32 *)(DUM_SLAVE_WRITE_ADR))
+#define DUM_SLAVE_WRITE_HW ((volatile u16 *)(DUM_SLAVE_WRITE_ADR))
+#define DUM_SLAVE_READ1_I  ((volatile u8 *)(DUM_SLAVE_READ1_I_ADR))
+#define DUM_SLAVE_READ1_R  ((volatile u16 *)(DUM_SLAVE_READ1_R_ADR))
+#define DUM_SLAVE_READ2_I  ((volatile u8 *)(DUM_SLAVE_READ2_I_ADR))
+#define DUM_SLAVE_READ2_R  ((volatile u16 *)(DUM_SLAVE_READ2_R_ADR))
+
+/* Sony display register addresses */
+#define DISP_0_REG            (0x00)
+#define DISP_1_REG            (0x01)
+#define DISP_CAL_REG          (0x20)
+#define DISP_ID_REG           (0x2A)
+#define DISP_XMIN_L_REG       (0x30)
+#define DISP_XMIN_H_REG       (0x31)
+#define DISP_YMIN_REG         (0x32)
+#define DISP_XMAX_L_REG       (0x34)
+#define DISP_XMAX_H_REG       (0x35)
+#define DISP_YMAX_REG         (0x36)
+#define DISP_SYNC_EN_REG      (0x38)
+#define DISP_SYNC_RISE_L_REG  (0x3C)
+#define DISP_SYNC_RISE_H_REG  (0x3D)
+#define DISP_SYNC_FALL_L_REG  (0x3E)
+#define DISP_SYNC_FALL_H_REG  (0x3F)
+#define DISP_PIXEL_REG        (0x0B)
+#define DISP_DUMMY1_REG       (0x28)
+#define DISP_DUMMY2_REG       (0x29)
+#define DISP_TIMING_REG       (0x98)
+#define DISP_DUMP_REG         (0x99)
+
+/* Sony display constants */
+#define SONY_ID1              (0x22)
+#define SONY_ID2              (0x23)
+
+/* Philips display register addresses */
+#define PH_DISP_ORIENT_REG    (0x003)
+#define PH_DISP_YPOINT_REG    (0x200)
+#define PH_DISP_XPOINT_REG    (0x201)
+#define PH_DISP_PIXEL_REG     (0x202)
+#define PH_DISP_YMIN_REG      (0x406)
+#define PH_DISP_YMAX_REG      (0x407)
+#define PH_DISP_XMIN_REG      (0x408)
+#define PH_DISP_XMAX_REG      (0x409)
+
+/* Misc constants */
+#define NO_VALID_DISPLAY_FOUND      (0)
+#define DISPLAY2_IS_NOT_CONNECTED   (0)
+
+/* register values */
+#define V_BAC_ENABLE            (BIT(0))
+#define V_BAC_DISABLE_IDLE      (BIT(1))
+#define V_BAC_DISABLE_TRIG      (BIT(2))
+#define V_DUM_RESET             (BIT(3))
+#define V_MUX_RESET             (BIT(4))
+#define BAC_ENABLED             (BIT(0))
+#define BAC_DISABLED            0
+
+/* Sony LCD commands */
+#define V_LCD_STANDBY_OFF       ((BIT(25)) | (0 << 16) | DISP_0_REG)
+#define V_LCD_USE_9BIT_BUS      ((BIT(25)) | (2 << 16) | DISP_1_REG)
+#define V_LCD_SYNC_RISE_L       ((BIT(25)) | (0 << 16) | DISP_SYNC_RISE_L_REG)
+#define V_LCD_SYNC_RISE_H       ((BIT(25)) | (0 << 16) | DISP_SYNC_RISE_H_REG)
+#define V_LCD_SYNC_FALL_L       ((BIT(25)) | (160 << 16) | DISP_SYNC_FALL_L_REG)
+#define V_LCD_SYNC_FALL_H       ((BIT(25)) | (0 << 16) | DISP_SYNC_FALL_H_REG)
+#define V_LCD_SYNC_ENABLE       ((BIT(25)) | (128 << 16) | DISP_SYNC_EN_REG)
+#define V_LCD_DISPLAY_ON        ((BIT(25)) | (64 << 16) | DISP_0_REG)
+
+enum {
+        PAD_NONE,
+        PAD_512,
+        PAD_1024
+};
+
+enum {
+        RGB888,
+        RGB666,
+        RGB565,
+        BGR565,
+        ARGB1555,
+        ABGR1555,
+        ARGB4444,
+        ABGR4444
+};
+
+struct dum_setup {
+        int sync_neg_edge;
+        int round_robin;
+        int mux_int;
+        int synced_dirty_flag_int;
+        int dirty_flag_int;
+        int error_int;
+        int pf_empty_int;
+        int sf_empty_int;
+        int bac_dis_int;
+        u32 dirty_base_adr;
+        u32 command_base_adr;
+        u32 sync_clk_div;
+        int sync_output;
+        u32 sync_restart_val;
+        u32 set_sync_high;
+        u32 set_sync_low;
+};
+
+struct dum_ch_setup {
+        int disp_no;
+        u32 xmin;
+        u32 ymin;
+        u32 xmax;
+        u32 ymax;
+        int xmirror;
+        int ymirror;
+        int rotate;
+        u32 minadr;
+        u32 maxadr;
+        u32 dirtybuffer;
+        int pad;
+        int format;
+        int hwdirty;
+        int slave_trans;
+};
+
+struct disp_window {
+        u32 xmin_l;
+        u32 xmin_h;
+        u32 ymin;
+        u32 xmax_l;
+        u32 xmax_h;
+        u32 ymax;
+};
+
+#endif                          /* #ifndef __PNX008_DUM_H__ */
diff --git a/drivers/video/pnx4008/fbcommon.h b/drivers/video/pnx4008/fbcommon.h
new file mode 100644
index 000000000000..4ebc87dafafb
--- /dev/null
+++ b/drivers/video/pnx4008/fbcommon.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2005 Philips Semiconductors
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA, or http://www.gnu.org/licenses/gpl.html
+*/
+
+#define QCIF_W  (176)
+#define QCIF_H  (144)
+
+#define CIF_W   (352)
+#define CIF_H   (288)
+
+#define LCD_X_RES       208
+#define LCD_Y_RES       320
+#define LCD_X_PAD       256
+#define LCD_BBP         4       /* Bytes Per Pixel */
+
+#define DISP_MAX_X_SIZE     (320)
+#define DISP_MAX_Y_SIZE     (208)
+
+#define RETURNVAL_BASE (0x400)
+
+enum fb_ioctl_returntype {
+        ENORESOURCESLEFT = RETURNVAL_BASE,
+        ERESOURCESNOTFREED,
+        EPROCNOTOWNER,
+        EFBNOTOWNER,
+        ECOPYFAILED,
+        EIOREMAPFAILED,
+};
diff --git a/drivers/video/pnx4008/pnxrgbfb.c b/drivers/video/pnx4008/pnxrgbfb.c
new file mode 100644
index 000000000000..7d9453c91a42
--- /dev/null
+++ b/drivers/video/pnx4008/pnxrgbfb.c
@@ -0,0 +1,213 @@
+/*
+ * drivers/video/pnx4008/pnxrgbfb.c
+ *
+ * PNX4008's framebuffer support
+ *
+ * Author: Grigory Tolstolytkin <gtolstolytkin@ru.mvista.com>
+ * Based on Philips Semiconductors's code
+ *
+ * Copyrght (c) 2005 MontaVista Software, Inc.
+ * Copyright (c) 2005 Philips Semiconductors
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+
+#include <asm/uaccess.h>
+#include "sdum.h"
+#include "fbcommon.h"
+
+static u32 colreg[16];
+
+static struct fb_var_screeninfo rgbfb_var __initdata = {
+        .xres = LCD_X_RES,
+        .yres = LCD_Y_RES,
+        .xres_virtual = LCD_X_RES,
+        .yres_virtual = LCD_Y_RES,
+        .bits_per_pixel = 32,
+        .red.offset = 16,
+        .red.length = 8,
+        .green.offset = 8,
+        .green.length = 8,
+        .blue.offset = 0,
+        .blue.length = 8,
+        .left_margin = 0,
+        .right_margin = 0,
+        .upper_margin = 0,
+        .lower_margin = 0,
+        .vmode = FB_VMODE_NONINTERLACED,
+};
+static struct fb_fix_screeninfo rgbfb_fix __initdata = {
+        .id = "RGBFB",
+        .line_length = LCD_X_RES * LCD_BBP,
+        .type = FB_TYPE_PACKED_PIXELS,
+        .visual = FB_VISUAL_TRUECOLOR,
+        .xpanstep = 0,
+        .ypanstep = 0,
+        .ywrapstep = 0,
+        .accel = FB_ACCEL_NONE,
+};
+
+static int channel_owned;
+
+static int no_cursor(struct fb_info *info, struct fb_cursor *cursor)
+{
+        return 0;
+}
+
+static int rgbfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+                           u_int transp, struct fb_info *info)
+{
+        if (regno > 15)
+                return 1;
+
+        colreg[regno] = ((red & 0xff00) << 8) | (green & 0xff00) |
+            ((blue & 0xff00) >> 8);
+        return 0;
+}
+
+static int rgbfb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+{
+        return pnx4008_sdum_mmap(info, vma, NULL);
+}
+
+static struct fb_ops rgbfb_ops = {
+        .fb_mmap = rgbfb_mmap,
+        .fb_setcolreg = rgbfb_setcolreg,
+        .fb_fillrect = cfb_fillrect,
+        .fb_copyarea = cfb_copyarea,
+        .fb_imageblit = cfb_imageblit,
+};
+
+static int rgbfb_remove(struct platform_device *pdev)
+{
+        struct fb_info *info = platform_get_drvdata(pdev);
+
+        if (info) {
+                unregister_framebuffer(info);
+                fb_dealloc_cmap(&info->cmap);
+                framebuffer_release(info);
+                platform_set_drvdata(pdev, NULL);
+                kfree(info);
+        }
+
+        pnx4008_free_dum_channel(channel_owned, pdev->id);
+        pnx4008_set_dum_exit_notification(pdev->id);
+
+        return 0;
+}
+
+static int __devinit rgbfb_probe(struct platform_device *pdev)
+{
+        struct fb_info *info;
+        struct dumchannel_uf chan_uf;
+        int ret;
+        char *option;
+
+        info = framebuffer_alloc(sizeof(u32) * 16, &pdev->dev);
+        if (!info) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        pnx4008_get_fb_addresses(FB_TYPE_RGB, (void **)&info->screen_base,
+                                 (dma_addr_t *) &rgbfb_fix.smem_start,
+                                 &rgbfb_fix.smem_len);
+
+        if ((ret = pnx4008_alloc_dum_channel(pdev->id)) < 0)
+                goto err0;
+        else {
+                channel_owned = ret;
+                chan_uf.channelnr = channel_owned;
+                chan_uf.dirty = (u32 *) NULL;
+                chan_uf.source = (u32 *) rgbfb_fix.smem_start;
+                chan_uf.x_offset = 0;
+                chan_uf.y_offset = 0;
+                chan_uf.width = LCD_X_RES;
+                chan_uf.height = LCD_Y_RES;
+
+                if ((ret = pnx4008_put_dum_channel_uf(chan_uf, pdev->id))< 0)
+                        goto err1;
+
+                if ((ret =
+                     pnx4008_set_dum_channel_sync(channel_owned, CONF_SYNC_ON,
+                                                  pdev->id)) < 0)
+                        goto err1;
+
+                if ((ret =
+                     pnx4008_set_dum_channel_dirty_detect(channel_owned,
+                                                         CONF_DIRTYDETECTION_ON,
+                                                         pdev->id)) < 0)
+                        goto err1;
+        }
+
+        if (!fb_get_options("pnxrgbfb", &option) && !strcmp(option, "nocursor"))
+                rgbfb_ops.fb_cursor = no_cursor;
+
+        info->node = -1;
+        info->flags = FBINFO_FLAG_DEFAULT;
+        info->fbops = &rgbfb_ops;
+        info->fix = rgbfb_fix;
+        info->var = rgbfb_var;
+        info->screen_size = rgbfb_fix.smem_len;
+        info->pseudo_palette = info->par;
+        info->par = NULL;
+
+        ret = fb_alloc_cmap(&info->cmap, 256, 0);
+        if (ret < 0)
+                goto err2;
+
+        ret = register_framebuffer(info);
+        if (ret < 0)
+                goto err3;
+        platform_set_drvdata(pdev, info);
+
+        return 0;
+
+err3:
+        fb_dealloc_cmap(&info->cmap);
+err2:
+        framebuffer_release(info);
+err1:
+        pnx4008_free_dum_channel(channel_owned, pdev->id);
+err0:
+        kfree(info);
+err:
+        return ret;
+}
+
+static struct platform_driver rgbfb_driver = {
+        .driver = {
+                .name = "rgbfb",
+        },
+        .probe = rgbfb_probe,
+        .remove = rgbfb_remove,
+};
+
+static int __init rgbfb_init(void)
+{
+        return platform_driver_register(&rgbfb_driver);
+}
+
+static void __exit rgbfb_exit(void)
+{
+        platform_driver_unregister(&rgbfb_driver);
+}
+
+module_init(rgbfb_init);
+module_exit(rgbfb_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/pnx4008/sdum.c b/drivers/video/pnx4008/sdum.c
new file mode 100644
index 000000000000..51f0ecc2a511
--- /dev/null
+++ b/drivers/video/pnx4008/sdum.c
@@ -0,0 +1,872 @@
+/*
+ * drivers/video/pnx4008/sdum.c
+ *
+ * Display Update Master support
+ *
+ * Authors: Grigory Tolstolytkin <gtolstolytkin@ru.mvista.com>
+ *          Vitaly Wool <vitalywool@gmail.com>
+ * Based on Philips Semiconductors's code
+ *
+ * Copyrght (c) 2005-2006 MontaVista Software, Inc.
+ * Copyright (c) 2005 Philips Semiconductors
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/tty.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/dma-mapping.h>
+#include <linux/clk.h>
+#include <asm/uaccess.h>
+#include <asm/arch/gpio.h>
+
+#include "sdum.h"
+#include "fbcommon.h"
+#include "dum.h"
+
+/* Framebuffers we have */
+
+static struct pnx4008_fb_addr {
+        int fb_type;
+        long addr_offset;
+        long fb_length;
+} fb_addr[] = {
+        [0] = {
+                FB_TYPE_YUV, 0, 0xB0000
+        },
+        [1] = {
+                FB_TYPE_RGB, 0xB0000, 0x50000
+        },
+};
+
+static struct dum_data {
+        u32 lcd_phys_start;
+        u32 lcd_virt_start;
+        u32 slave_phys_base;
+        u32 *slave_virt_base;
+        int fb_owning_channel[MAX_DUM_CHANNELS];
+        struct dumchannel_uf chan_uf_store[MAX_DUM_CHANNELS];
+} dum_data;
+
+/* Different local helper functions */
+
+static u32 nof_pixels_dx(struct dum_ch_setup *ch_setup)
+{
+        return (ch_setup->xmax - ch_setup->xmin + 1);
+}
+
+static u32 nof_pixels_dy(struct dum_ch_setup *ch_setup)
+{
+        return (ch_setup->ymax - ch_setup->ymin + 1);
+}
+
+static u32 nof_pixels_dxy(struct dum_ch_setup *ch_setup)
+{
+        return (nof_pixels_dx(ch_setup) * nof_pixels_dy(ch_setup));
+}
+
+static u32 nof_bytes(struct dum_ch_setup *ch_setup)
+{
+        u32 r = nof_pixels_dxy(ch_setup);
+        switch (ch_setup->format) {
+        case RGB888:
+        case RGB666:
+                r *= 4;
+                break;
+
+        default:
+                r *= 2;
+                break;
+        }
+        return r;
+}
+
+static u32 build_command(int disp_no, u32 reg, u32 val)
+{
+        return ((disp_no << 26) | BIT(25) | (val << 16) | (disp_no << 10) |
+                (reg << 0));
+}
+
+static u32 build_double_index(int disp_no, u32 val)
+{
+        return ((disp_no << 26) | (val << 16) | (disp_no << 10) | (val << 0));
+}
+
+static void build_disp_window(struct dum_ch_setup * ch_setup, struct disp_window * dw)
+{
+        dw->ymin = ch_setup->ymin;
+        dw->ymax = ch_setup->ymax;
+        dw->xmin_l = ch_setup->xmin & 0xFF;
+        dw->xmin_h = (ch_setup->xmin & BIT(8)) >> 8;
+        dw->xmax_l = ch_setup->xmax & 0xFF;
+        dw->xmax_h = (ch_setup->xmax & BIT(8)) >> 8;
+}
+
+static int put_channel(struct dumchannel chan)
+{
+        int i = chan.channelnr;
+
+        if (i < 0 || i > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else {
+                DUM_CH_MIN(i) = chan.dum_ch_min;
+                DUM_CH_MAX(i) = chan.dum_ch_max;
+                DUM_CH_CONF(i) = chan.dum_ch_conf;
+                DUM_CH_CTRL(i) = chan.dum_ch_ctrl;
+        }
+
+        return 0;
+}
+
+static void clear_channel(int channr)
+{
+        struct dumchannel chan;
+
+        chan.channelnr = channr;
+        chan.dum_ch_min = 0;
+        chan.dum_ch_max = 0;
+        chan.dum_ch_conf = 0;
+        chan.dum_ch_ctrl = 0;
+
+        put_channel(chan);
+}
+
+static int put_cmd_string(struct cmdstring cmds)
+{
+        u16 *cmd_str_virtaddr;
+        u32 *cmd_ptr0_virtaddr;
+        u32 cmd_str_physaddr;
+
+        int i = cmds.channelnr;
+
+        if (i < 0 || i > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if ((cmd_ptr0_virtaddr =
+                  (int *)ioremap_nocache(DUM_COM_BASE,
+                                         sizeof(int) * MAX_DUM_CHANNELS)) ==
+                 NULL)
+                return -EIOREMAPFAILED;
+        else {
+                cmd_str_physaddr = ioread32(&cmd_ptr0_virtaddr[cmds.channelnr]);
+                if ((cmd_str_virtaddr =
+                     (u16 *) ioremap_nocache(cmd_str_physaddr,
+                                             sizeof(cmds))) == NULL) {
+                        iounmap(cmd_ptr0_virtaddr);
+                        return -EIOREMAPFAILED;
+                } else {
+                        int t;
+                        for (t = 0; t < 8; t++)
+                                iowrite16(*((u16 *)&cmds.prestringlen + t),
+                                          cmd_str_virtaddr + t);
+
+                        for (t = 0; t < cmds.prestringlen / 2; t++)
+                                 iowrite16(*((u16 *)&cmds.precmd + t),
+                                           cmd_str_virtaddr + t + 8);
+
+                        for (t = 0; t < cmds.poststringlen / 2; t++)
+                                iowrite16(*((u16 *)&cmds.postcmd + t),
+                                          cmd_str_virtaddr + t + 8 +
+                                                cmds.prestringlen / 2);
+
+                        iounmap(cmd_ptr0_virtaddr);
+                        iounmap(cmd_str_virtaddr);
+                }
+        }
+
+        return 0;
+}
+
+static u32 dum_ch_setup(int ch_no, struct dum_ch_setup * ch_setup)
+{
+        struct cmdstring cmds_c;
+        struct cmdstring *cmds = &cmds_c;
+        struct disp_window dw;
+        int standard;
+        u32 orientation = 0;
+        struct dumchannel chan = { 0 };
+        int ret;
+
+        if ((ch_setup->xmirror) || (ch_setup->ymirror) || (ch_setup->rotate)) {
+                standard = 0;
+
+                orientation = BIT(1);   /* always set 9-bit-bus */
+                if (ch_setup->xmirror)
+                        orientation |= BIT(4);
+                if (ch_setup->ymirror)
+                        orientation |= BIT(3);
+                if (ch_setup->rotate)
+                        orientation |= BIT(0);
+        } else
+                standard = 1;
+
+        cmds->channelnr = ch_no;
+
+        /* build command string header */
+        if (standard) {
+                cmds->prestringlen = 32;
+                cmds->poststringlen = 0;
+        } else {
+                cmds->prestringlen = 48;
+                cmds->poststringlen = 16;
+        }
+
+        cmds->format =
+            (u16) ((ch_setup->disp_no << 4) | (BIT(3)) | (ch_setup->format));
+        cmds->reserved = 0x0;
+        cmds->startaddr_low = (ch_setup->minadr & 0xFFFF);
+        cmds->startaddr_high = (ch_setup->minadr >> 16);
+
+        if ((ch_setup->minadr == 0) && (ch_setup->maxadr == 0)
+            && (ch_setup->xmin == 0)
+            && (ch_setup->ymin == 0) && (ch_setup->xmax == 0)
+            && (ch_setup->ymax == 0)) {
+                cmds->pixdatlen_low = 0;
+                cmds->pixdatlen_high = 0;
+        } else {
+                u32 nbytes = nof_bytes(ch_setup);
+                cmds->pixdatlen_low = (nbytes & 0xFFFF);
+                cmds->pixdatlen_high = (nbytes >> 16);
+        }
+
+        if (ch_setup->slave_trans)
+                cmds->pixdatlen_high |= BIT(15);
+
+        /* build pre-string */
+        build_disp_window(ch_setup, &dw);
+
+        if (standard) {
+                cmds->precmd[0] =
+                    build_command(ch_setup->disp_no, DISP_XMIN_L_REG, 0x99);
+                cmds->precmd[1] =
+                    build_command(ch_setup->disp_no, DISP_XMIN_L_REG,
+                                  dw.xmin_l);
+                cmds->precmd[2] =
+                    build_command(ch_setup->disp_no, DISP_XMIN_H_REG,
+                                  dw.xmin_h);
+                cmds->precmd[3] =
+                    build_command(ch_setup->disp_no, DISP_YMIN_REG, dw.ymin);
+                cmds->precmd[4] =
+                    build_command(ch_setup->disp_no, DISP_XMAX_L_REG,
+                                  dw.xmax_l);
+                cmds->precmd[5] =
+                    build_command(ch_setup->disp_no, DISP_XMAX_H_REG,
+                                  dw.xmax_h);
+                cmds->precmd[6] =
+                    build_command(ch_setup->disp_no, DISP_YMAX_REG, dw.ymax);
+                cmds->precmd[7] =
+                    build_double_index(ch_setup->disp_no, DISP_PIXEL_REG);
+        } else {
+                if (dw.xmin_l == ch_no)
+                        cmds->precmd[0] =
+                            build_command(ch_setup->disp_no, DISP_XMIN_L_REG,
+                                          0x99);
+                else
+                        cmds->precmd[0] =
+                            build_command(ch_setup->disp_no, DISP_XMIN_L_REG,
+                                          ch_no);
+
+                cmds->precmd[1] =
+                    build_command(ch_setup->disp_no, DISP_XMIN_L_REG,
+                                  dw.xmin_l);
+                cmds->precmd[2] =
+                    build_command(ch_setup->disp_no, DISP_XMIN_H_REG,
+                                  dw.xmin_h);
+                cmds->precmd[3] =
+                    build_command(ch_setup->disp_no, DISP_YMIN_REG, dw.ymin);
+                cmds->precmd[4] =
+                    build_command(ch_setup->disp_no, DISP_XMAX_L_REG,
+                                  dw.xmax_l);
+                cmds->precmd[5] =
+                    build_command(ch_setup->disp_no, DISP_XMAX_H_REG,
+                                  dw.xmax_h);
+                cmds->precmd[6] =
+                    build_command(ch_setup->disp_no, DISP_YMAX_REG, dw.ymax);
+                cmds->precmd[7] =
+                    build_command(ch_setup->disp_no, DISP_1_REG, orientation);
+                cmds->precmd[8] =
+                    build_double_index(ch_setup->disp_no, DISP_PIXEL_REG);
+                cmds->precmd[9] =
+                    build_double_index(ch_setup->disp_no, DISP_PIXEL_REG);
+                cmds->precmd[0xA] =
+                    build_double_index(ch_setup->disp_no, DISP_PIXEL_REG);
+                cmds->precmd[0xB] =
+                    build_double_index(ch_setup->disp_no, DISP_PIXEL_REG);
+                cmds->postcmd[0] =
+                    build_command(ch_setup->disp_no, DISP_1_REG, BIT(1));
+                cmds->postcmd[1] =
+                    build_command(ch_setup->disp_no, DISP_DUMMY1_REG, 1);
+                cmds->postcmd[2] =
+                    build_command(ch_setup->disp_no, DISP_DUMMY1_REG, 2);
+                cmds->postcmd[3] =
+                    build_command(ch_setup->disp_no, DISP_DUMMY1_REG, 3);
+        }
+
+        if ((ret = put_cmd_string(cmds_c)) != 0) {
+                return ret;
+        }
+
+        chan.channelnr = cmds->channelnr;
+        chan.dum_ch_min = ch_setup->dirtybuffer + ch_setup->minadr;
+        chan.dum_ch_max = ch_setup->dirtybuffer + ch_setup->maxadr;
+        chan.dum_ch_conf = 0x002;
+        chan.dum_ch_ctrl = 0x04;
+
+        put_channel(chan);
+
+        return 0;
+}
+
+static u32 display_open(int ch_no, int auto_update, u32 * dirty_buffer,
+                        u32 * frame_buffer, u32 xpos, u32 ypos, u32 w, u32 h)
+{
+
+        struct dum_ch_setup k;
+        int ret;
+
+        /* keep width & height within display area */
+        if ((xpos + w) > DISP_MAX_X_SIZE)
+                w = DISP_MAX_X_SIZE - xpos;
+
+        if ((ypos + h) > DISP_MAX_Y_SIZE)
+                h = DISP_MAX_Y_SIZE - ypos;
+
+        /* assume 1 display only */
+        k.disp_no = 0;
+        k.xmin = xpos;
+        k.ymin = ypos;
+        k.xmax = xpos + (w - 1);
+        k.ymax = ypos + (h - 1);
+
+        /* adjust min and max values if necessary */
+        if (k.xmin > DISP_MAX_X_SIZE - 1)
+                k.xmin = DISP_MAX_X_SIZE - 1;
+        if (k.ymin > DISP_MAX_Y_SIZE - 1)
+                k.ymin = DISP_MAX_Y_SIZE - 1;
+
+        if (k.xmax > DISP_MAX_X_SIZE - 1)
+                k.xmax = DISP_MAX_X_SIZE - 1;
+        if (k.ymax > DISP_MAX_Y_SIZE - 1)
+                k.ymax = DISP_MAX_Y_SIZE - 1;
+
+        k.xmirror = 0;
+        k.ymirror = 0;
+        k.rotate = 0;
+        k.minadr = (u32) frame_buffer;
+        k.maxadr = (u32) frame_buffer + (((w - 1) << 10) | ((h << 2) - 2));
+        k.pad = PAD_1024;
+        k.dirtybuffer = (u32) dirty_buffer;
+        k.format = RGB888;
+        k.hwdirty = 0;
+        k.slave_trans = 0;
+
+        ret = dum_ch_setup(ch_no, &k);
+
+        return ret;
+}
+
+static void lcd_reset(void)
+{
+        u32 *dum_pio_base = (u32 *)IO_ADDRESS(PNX4008_PIO_BASE);
+
+        udelay(1);
+        iowrite32(BIT(19), &dum_pio_base[2]);
+        udelay(1);
+        iowrite32(BIT(19), &dum_pio_base[1]);
+        udelay(1);
+}
+
+static int dum_init(struct platform_device *pdev)
+{
+        struct clk *clk;
+
+        /* enable DUM clock */
+        clk = clk_get(&pdev->dev, "dum_ck");
+        if (IS_ERR(clk)) {
+                printk(KERN_ERR "pnx4008_dum: Unable to access DUM clock\n");
+                return PTR_ERR(clk);
+        }
+
+        clk_set_rate(clk, 1);
+        clk_put(clk);
+
+        DUM_CTRL = V_DUM_RESET;
+
+        /* set priority to "round-robin". All other params to "false" */
+        DUM_CONF = BIT(9);
+
+        /* Display 1 */
+        DUM_WTCFG1 = PNX4008_DUM_WT_CFG;
+        DUM_RTCFG1 = PNX4008_DUM_RT_CFG;
+        DUM_TCFG = PNX4008_DUM_T_CFG;
+
+        return 0;
+}
+
+static void dum_chan_init(void)
+{
+        int i = 0, ch = 0;
+        u32 *cmdptrs;
+        u32 *cmdstrings;
+
+        DUM_COM_BASE =
+                CMDSTRING_BASEADDR + BYTES_PER_CMDSTRING * NR_OF_CMDSTRINGS;
+
+        if ((cmdptrs =
+             (u32 *) ioremap_nocache(DUM_COM_BASE,
+                                     sizeof(u32) * NR_OF_CMDSTRINGS)) == NULL)
+                return;
+
+        for (ch = 0; ch < NR_OF_CMDSTRINGS; ch++)
+                iowrite32(CMDSTRING_BASEADDR + BYTES_PER_CMDSTRING * ch,
+                          cmdptrs + ch);
+
+        for (ch = 0; ch < MAX_DUM_CHANNELS; ch++)
+                clear_channel(ch);
+
+        /* Clear the cmdstrings */
+        cmdstrings =
+            (u32 *)ioremap_nocache(*cmdptrs,
+                                   BYTES_PER_CMDSTRING * NR_OF_CMDSTRINGS);
+
+        if (!cmdstrings)
+                goto out;
+
+        for (i = 0; i < NR_OF_CMDSTRINGS * BYTES_PER_CMDSTRING / sizeof(u32);
+             i++)
+                iowrite32(0, cmdstrings + i);
+
+        iounmap((u32 *)cmdstrings);
+
+out:
+        iounmap((u32 *)cmdptrs);
+}
+
+static void lcd_init(void)
+{
+        lcd_reset();
+
+        DUM_OUTP_FORMAT1 = 0; /* RGB666 */
+
+        udelay(1);
+        iowrite32(V_LCD_STANDBY_OFF, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_USE_9BIT_BUS, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_SYNC_RISE_L, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_SYNC_RISE_H, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_SYNC_FALL_L, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_SYNC_FALL_H, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_SYNC_ENABLE, dum_data.slave_virt_base);
+        udelay(1);
+        iowrite32(V_LCD_DISPLAY_ON, dum_data.slave_virt_base);
+        udelay(1);
+}
+
+/* Interface exported to framebuffer drivers */
+
+int pnx4008_get_fb_addresses(int fb_type, void **virt_addr,
+                             dma_addr_t *phys_addr, int *fb_length)
+{
+        int i;
+        int ret = -1;
+        for (i = 0; i < ARRAY_SIZE(fb_addr); i++)
+                if (fb_addr[i].fb_type == fb_type) {
+                        *virt_addr = (void *)(dum_data.lcd_virt_start +
+                                        fb_addr[i].addr_offset);
+                        *phys_addr =
+                            dum_data.lcd_phys_start + fb_addr[i].addr_offset;
+                        *fb_length = fb_addr[i].fb_length;
+                        ret = 0;
+                        break;
+                }
+
+        return ret;
+}
+
+EXPORT_SYMBOL(pnx4008_get_fb_addresses);
+
+int pnx4008_alloc_dum_channel(int dev_id)
+{
+        int i = 0;
+
+        while ((i < MAX_DUM_CHANNELS) && (dum_data.fb_owning_channel[i] != -1))
+                i++;
+
+        if (i == MAX_DUM_CHANNELS)
+                return -ENORESOURCESLEFT;
+        else {
+                dum_data.fb_owning_channel[i] = dev_id;
+                return i;
+        }
+}
+
+EXPORT_SYMBOL(pnx4008_alloc_dum_channel);
+
+int pnx4008_free_dum_channel(int channr, int dev_id)
+{
+        if (channr < 0 || channr > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if (dum_data.fb_owning_channel[channr] != dev_id)
+                return -EFBNOTOWNER;
+        else {
+                clear_channel(channr);
+                dum_data.fb_owning_channel[channr] = -1;
+        }
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_free_dum_channel);
+
+int pnx4008_put_dum_channel_uf(struct dumchannel_uf chan_uf, int dev_id)
+{
+        int i = chan_uf.channelnr;
+        int ret;
+
+        if (i < 0 || i > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if (dum_data.fb_owning_channel[i] != dev_id)
+                return -EFBNOTOWNER;
+        else if ((ret =
+                  display_open(chan_uf.channelnr, 0, chan_uf.dirty,
+                               chan_uf.source, chan_uf.y_offset,
+                               chan_uf.x_offset, chan_uf.height,
+                               chan_uf.width)) != 0)
+                return ret;
+        else {
+                dum_data.chan_uf_store[i].dirty = chan_uf.dirty;
+                dum_data.chan_uf_store[i].source = chan_uf.source;
+                dum_data.chan_uf_store[i].x_offset = chan_uf.x_offset;
+                dum_data.chan_uf_store[i].y_offset = chan_uf.y_offset;
+                dum_data.chan_uf_store[i].width = chan_uf.width;
+                dum_data.chan_uf_store[i].height = chan_uf.height;
+        }
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_put_dum_channel_uf);
+
+int pnx4008_set_dum_channel_sync(int channr, int val, int dev_id)
+{
+        if (channr < 0 || channr > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if (dum_data.fb_owning_channel[channr] != dev_id)
+                return -EFBNOTOWNER;
+        else {
+                if (val == CONF_SYNC_ON) {
+                        DUM_CH_CONF(channr) |= CONF_SYNCENABLE;
+                        DUM_CH_CONF(channr) |= DUM_CHANNEL_CFG_SYNC_MASK |
+                                DUM_CHANNEL_CFG_SYNC_MASK_SET;
+                } else if (val == CONF_SYNC_OFF)
+                        DUM_CH_CONF(channr) &= ~CONF_SYNCENABLE;
+                else
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_set_dum_channel_sync);
+
+int pnx4008_set_dum_channel_dirty_detect(int channr, int val, int dev_id)
+{
+        if (channr < 0 || channr > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if (dum_data.fb_owning_channel[channr] != dev_id)
+                return -EFBNOTOWNER;
+        else {
+                if (val == CONF_DIRTYDETECTION_ON)
+                        DUM_CH_CONF(channr) |= CONF_DIRTYENABLE;
+                else if (val == CONF_DIRTYDETECTION_OFF)
+                        DUM_CH_CONF(channr) &= ~CONF_DIRTYENABLE;
+                else
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_set_dum_channel_dirty_detect);
+
+#if 0 /* Functions not used currently, but likely to be used in future */
+
+static int get_channel(struct dumchannel *p_chan)
+{
+        int i = p_chan->channelnr;
+
+        if (i < 0 || i > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else {
+                p_chan->dum_ch_min = DUM_CH_MIN(i);
+                p_chan->dum_ch_max = DUM_CH_MAX(i);
+                p_chan->dum_ch_conf = DUM_CH_CONF(i);
+                p_chan->dum_ch_stat = DUM_CH_STAT(i);
+                p_chan->dum_ch_ctrl = 0;        /* WriteOnly control register */
+        }
+
+        return 0;
+}
+
+int pnx4008_get_dum_channel_uf(struct dumchannel_uf *p_chan_uf, int dev_id)
+{
+        int i = p_chan_uf->channelnr;
+
+        if (i < 0 || i > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if (dum_data.fb_owning_channel[i] != dev_id)
+                return -EFBNOTOWNER;
+        else {
+                p_chan_uf->dirty = dum_data.chan_uf_store[i].dirty;
+                p_chan_uf->source = dum_data.chan_uf_store[i].source;
+                p_chan_uf->x_offset = dum_data.chan_uf_store[i].x_offset;
+                p_chan_uf->y_offset = dum_data.chan_uf_store[i].y_offset;
+                p_chan_uf->width = dum_data.chan_uf_store[i].width;
+                p_chan_uf->height = dum_data.chan_uf_store[i].height;
+        }
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_get_dum_channel_uf);
+
+int pnx4008_get_dum_channel_config(int channr, int dev_id)
+{
+        int ret;
+        struct dumchannel chan;
+
+        if (channr < 0 || channr > MAX_DUM_CHANNELS)
+                return -EINVAL;
+        else if (dum_data.fb_owning_channel[channr] != dev_id)
+                return -EFBNOTOWNER;
+        else {
+                chan.channelnr = channr;
+                if ((ret = get_channel(&chan)) != 0)
+                        return ret;
+        }
+
+        return (chan.dum_ch_conf & DUM_CHANNEL_CFG_MASK);
+}
+
+EXPORT_SYMBOL(pnx4008_get_dum_channel_config);
+
+int pnx4008_force_update_dum_channel(int channr, int dev_id)
+{
+        if (channr < 0 || channr > MAX_DUM_CHANNELS)
+                return -EINVAL;
+
+        else if (dum_data.fb_owning_channel[channr] != dev_id)
+                return -EFBNOTOWNER;
+        else
+                DUM_CH_CTRL(channr) = CTRL_SETDIRTY;
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_force_update_dum_channel);
+
+#endif
+
+int pnx4008_sdum_mmap(struct fb_info *info, struct vm_area_struct *vma,
+                      struct device *dev)
+{
+        unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
+
+        if (off < info->fix.smem_len) {
+                vma->vm_pgoff += 1;
+                return dma_mmap_writecombine(dev, vma,
+                                (void *)dum_data.lcd_virt_start,
+                                dum_data.lcd_phys_start,
+                                FB_DMA_SIZE);
+        }
+        return -EINVAL;
+}
+
+EXPORT_SYMBOL(pnx4008_sdum_mmap);
+
+int pnx4008_set_dum_exit_notification(int dev_id)
+{
+        int i;
+
+        for (i = 0; i < MAX_DUM_CHANNELS; i++)
+                if (dum_data.fb_owning_channel[i] == dev_id)
+                        return -ERESOURCESNOTFREED;
+
+        return 0;
+}
+
+EXPORT_SYMBOL(pnx4008_set_dum_exit_notification);
+
+/* Platform device driver for DUM */
+
+static int sdum_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        int retval = 0;
+        struct clk *clk;
+
+        clk = clk_get(0, "dum_ck");
+        if (!IS_ERR(clk)) {
+                clk_set_rate(clk, 0);
+                clk_put(clk);
+        } else
+                retval = PTR_ERR(clk);
+
+        /* disable BAC */
+        DUM_CTRL = V_BAC_DISABLE_IDLE;
+
+        /* LCD standby & turn off display */
+        lcd_reset();
+
+        return retval;
+}
+
+static int sdum_resume(struct platform_device *pdev)
+{
+        int retval = 0;
+        struct clk *clk;
+
+        clk = clk_get(0, "dum_ck");
+        if (!IS_ERR(clk)) {
+                clk_set_rate(clk, 1);
+                clk_put(clk);
+        } else
+                retval = PTR_ERR(clk);
+
+        /* wait for BAC disable */
+        DUM_CTRL = V_BAC_DISABLE_TRIG;
+
+        while (DUM_CTRL & BAC_ENABLED)
+                udelay(10);
+
+        /* re-init LCD */
+        lcd_init();
+
+        /* enable BAC and reset MUX */
+        DUM_CTRL = V_BAC_ENABLE;
+        udelay(1);
+        DUM_CTRL = V_MUX_RESET;
+        return 0;
+}
+
+static int __devinit sdum_probe(struct platform_device *pdev)
+{
+        int ret = 0, i = 0;
+
+        /* map frame buffer */
+        dum_data.lcd_virt_start = (u32) dma_alloc_writecombine(&pdev->dev,
+                                                       FB_DMA_SIZE,
+                                                       &dum_data.lcd_phys_start,
+                                                       GFP_KERNEL);
+
+        if (!dum_data.lcd_virt_start) {
+                ret = -ENOMEM;
+                goto out_3;
+        }
+
+        /* map slave registers */
+        dum_data.slave_phys_base = PNX4008_DUM_SLAVE_BASE;
+        dum_data.slave_virt_base =
+            (u32 *) ioremap_nocache(dum_data.slave_phys_base, sizeof(u32));
+
+        if (dum_data.slave_virt_base == NULL) {
+                ret = -ENOMEM;
+                goto out_2;
+        }
+
+        /* initialize DUM and LCD display */
+        ret = dum_init(pdev);
+        if (ret)
+                goto out_1;
+
+        dum_chan_init();
+        lcd_init();
+
+        DUM_CTRL = V_BAC_ENABLE;
+        udelay(1);
+        DUM_CTRL = V_MUX_RESET;
+
+        /* set decode address and sync clock divider */
+        DUM_DECODE = dum_data.lcd_phys_start & DUM_DECODE_MASK;
+        DUM_CLK_DIV = PNX4008_DUM_CLK_DIV;
+
+        for (i = 0; i < MAX_DUM_CHANNELS; i++)
+                dum_data.fb_owning_channel[i] = -1;
+
+        /*setup wakeup interrupt */
+        start_int_set_rising_edge(SE_DISP_SYNC_INT);
+        start_int_ack(SE_DISP_SYNC_INT);
+        start_int_umask(SE_DISP_SYNC_INT);
+
+        return 0;
+
+out_1:
+        iounmap((void *)dum_data.slave_virt_base);
+out_2:
+        dma_free_writecombine(&pdev->dev, FB_DMA_SIZE,
+                        (void *)dum_data.lcd_virt_start,
+                        dum_data.lcd_phys_start);
+out_3:
+        return ret;
+}
+
+static int sdum_remove(struct platform_device *pdev)
+{
+        struct clk *clk;
+
+        start_int_mask(SE_DISP_SYNC_INT);
+
+        clk = clk_get(0, "dum_ck");
+        if (!IS_ERR(clk)) {
+                clk_set_rate(clk, 0);
+                clk_put(clk);
+        }
+
+        iounmap((void *)dum_data.slave_virt_base);
+
+        dma_free_writecombine(&pdev->dev, FB_DMA_SIZE,
+                        (void *)dum_data.lcd_virt_start,
+                        dum_data.lcd_phys_start);
+
+        return 0;
+}
+
+static struct platform_driver sdum_driver = {
+        .driver = {
+                .name = "sdum",
+        },
+        .probe = sdum_probe,
+        .remove = sdum_remove,
+        .suspend = sdum_suspend,
+        .resume = sdum_resume,
+};
+
+int __init sdum_init(void)
+{
+        return platform_driver_register(&sdum_driver);
+}
+
+static void __exit sdum_exit(void)
+{
+        platform_driver_unregister(&sdum_driver);
+};
+
+module_init(sdum_init);
+module_exit(sdum_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/pnx4008/sdum.h b/drivers/video/pnx4008/sdum.h
new file mode 100644
index 000000000000..e8c5dcdd8813
--- /dev/null
+++ b/drivers/video/pnx4008/sdum.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2005 Philips Semiconductors
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA, or http://www.gnu.org/licenses/gpl.html
+*/
+
+#define MAX_DUM_CHANNELS        64
+
+#define RGB_MEM_WINDOW(x) (0x10000000 + (x)*0x00100000)
+
+#define QCIF_OFFSET(x) (((x) == 0) ? 0x00000: ((x) == 1) ? 0x30000: -1)
+#define CIF_OFFSET(x)  (((x) == 0) ? 0x00000: ((x) == 1) ? 0x60000: -1)
+
+#define CTRL_SETDIRTY           (0x00000001)
+#define CONF_DIRTYENABLE        (0x00000020)
+#define CONF_SYNCENABLE         (0x00000004)
+
+#define DIRTY_ENABLED(conf)     ((conf) & 0x0020)
+#define SYNC_ENABLED(conf)      ((conf) & 0x0004)
+
+/* Display 1 & 2 Write Timing Configuration */
+#define PNX4008_DUM_WT_CFG              0x00372000
+
+/* Display 1 & 2 Read Timing Configuration */
+#define PNX4008_DUM_RT_CFG              0x00003A47
+
+/* DUM Transit State Timing Configuration */
+#define PNX4008_DUM_T_CFG               0x1D    /* 29 HCLK cycles */
+
+/* DUM Sync count clock divider */
+#define PNX4008_DUM_CLK_DIV             0x02DD
+
+/* Memory size for framebuffer, allocated through dma_alloc_writecombine().
+ * Must be PAGE aligned
+ */
+#define FB_DMA_SIZE (PAGE_ALIGN(SZ_1M + PAGE_SIZE))
+
+#define OFFSET_RGBBUFFER (0xB0000)
+#define OFFSET_YUVBUFFER (0x00000)
+
+#define YUVBUFFER (lcd_video_start + OFFSET_YUVBUFFER)
+#define RGBBUFFER (lcd_video_start + OFFSET_RGBBUFFER)
+
+#define CMDSTRING_BASEADDR      (0x00C000)      /* iram */
+#define BYTES_PER_CMDSTRING     (0x80)
+#define NR_OF_CMDSTRINGS        (64)
+
+#define MAX_NR_PRESTRINGS (0x40)
+#define MAX_NR_POSTSTRINGS (0x40)
+
+/* various mask definitions */
+#define DUM_CLK_ENABLE 0x01
+#define DUM_CLK_DISABLE 0
+#define DUM_DECODE_MASK 0x1FFFFFFF
+#define DUM_CHANNEL_CFG_MASK 0x01FF
+#define DUM_CHANNEL_CFG_SYNC_MASK 0xFFFE00FF
+#define DUM_CHANNEL_CFG_SYNC_MASK_SET 0x0CA00
+
+#define SDUM_RETURNVAL_BASE (0x500)
+
+#define CONF_SYNC_OFF           (0x602)
+#define CONF_SYNC_ON            (0x603)
+
+#define CONF_DIRTYDETECTION_OFF (0x600)
+#define CONF_DIRTYDETECTION_ON  (0x601)
+
+/* Set the corresponding bit. */
+#define BIT(n) (0x1U << (n))
+
+struct dumchannel_uf {
+        int channelnr;
+        u32 *dirty;
+        u32 *source;
+        u32 x_offset;
+        u32 y_offset;
+        u32 width;
+        u32 height;
+};
+
+enum {
+        FB_TYPE_YUV,
+        FB_TYPE_RGB
+};
+
+struct cmdstring {
+        int channelnr;
+        uint16_t prestringlen;
+        uint16_t poststringlen;
+        uint16_t format;
+        uint16_t reserved;
+        uint16_t startaddr_low;
+        uint16_t startaddr_high;
+        uint16_t pixdatlen_low;
+        uint16_t pixdatlen_high;
+        u32 precmd[MAX_NR_PRESTRINGS];
+        u32 postcmd[MAX_NR_POSTSTRINGS];
+
+};
+
+struct dumchannel {
+        int channelnr;
+        int dum_ch_min;
+        int dum_ch_max;
+        int dum_ch_conf;
+        int dum_ch_stat;
+        int dum_ch_ctrl;
+};
+
+int pnx4008_alloc_dum_channel(int dev_id);
+int pnx4008_free_dum_channel(int channr, int dev_id);
+
+int pnx4008_get_dum_channel_uf(struct dumchannel_uf *pChan_uf, int dev_id);
+int pnx4008_put_dum_channel_uf(struct dumchannel_uf chan_uf, int dev_id);
+
+int pnx4008_set_dum_channel_sync(int channr, int val, int dev_id);
+int pnx4008_set_dum_channel_dirty_detect(int channr, int val, int dev_id);
+
+int pnx4008_force_dum_update_channel(int channr, int dev_id);
+
+int pnx4008_get_dum_channel_config(int channr, int dev_id);
+
+int pnx4008_sdum_mmap(struct fb_info *info, struct vm_area_struct *vma, struct device *dev);
+int pnx4008_set_dum_exit_notification(int dev_id);
+
+int pnx4008_get_fb_addresses(int fb_type, void **virt_addr,
+                             dma_addr_t * phys_addr, int *fb_length);
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index 4a1e0e856920..940ba2be55e9 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -53,7 +53,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/video/q40fb.c b/drivers/video/q40fb.c
index fc91dbf896d2..48536c3e58a4 100644
--- a/drivers/video/q40fb.c
+++ b/drivers/video/q40fb.c
@@ -14,7 +14,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/video/retz3fb.c b/drivers/video/retz3fb.c
index 5e2c64f622cb..cf41ff177644 100644
--- a/drivers/video/retz3fb.c
+++ b/drivers/video/retz3fb.c
@@ -25,7 +25,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
index 2788655e6e7d..8ddb47a56b07 100644
--- a/drivers/video/riva/fbdev.c
+++ b/drivers/video/riva/fbdev.c
@@ -34,7 +34,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
@@ -278,9 +277,11 @@ static const struct riva_regs reg_template = {
  */
 #define MIN_LEVEL 0x158
 #define MAX_LEVEL 0x534
+#define LEVEL_STEP ((MAX_LEVEL - MIN_LEVEL) / FB_BACKLIGHT_MAX)
 
 static struct backlight_properties riva_bl_data;
 
+/* Call with fb_info->bl_mutex held */
 static int riva_bl_get_level_brightness(struct riva_par *par,
                 int level)
 {
@@ -288,9 +289,7 @@ static int riva_bl_get_level_brightness(struct riva_par *par,
         int nlevel;
 
         /* Get and convert the value */
-        mutex_lock(&info->bl_mutex);
-        nlevel = info->bl_curve[level] * FB_BACKLIGHT_MAX / MAX_LEVEL;
-        mutex_unlock(&info->bl_mutex);
+        nlevel = MIN_LEVEL + info->bl_curve[level] * LEVEL_STEP;
 
         if (nlevel < 0)
                 nlevel = 0;
@@ -302,7 +301,8 @@ static int riva_bl_get_level_brightness(struct riva_par *par,
         return nlevel;
 }
 
-static int riva_bl_update_status(struct backlight_device *bd)
+/* Call with fb_info->bl_mutex held */
+static int __riva_bl_update_status(struct backlight_device *bd)
 {
         struct riva_par *par = class_get_devdata(&bd->class_dev);
         U032 tmp_pcrt, tmp_pmc;
@@ -327,6 +327,19 @@ static int riva_bl_update_status(struct backlight_device *bd)
         return 0;
 }
 
+static int riva_bl_update_status(struct backlight_device *bd)
+{
+        struct riva_par *par = class_get_devdata(&bd->class_dev);
+        struct fb_info *info = pci_get_drvdata(par->pdev);
+        int ret;
+
+        mutex_lock(&info->bl_mutex);
+        ret = __riva_bl_update_status(bd);
+        mutex_unlock(&info->bl_mutex);
+
+        return ret;
+}
+
 static int riva_bl_get_brightness(struct backlight_device *bd)
 {
         return bd->props->brightness;
@@ -339,6 +352,20 @@ static struct backlight_properties riva_bl_data = {
         .max_brightness = (FB_BACKLIGHT_LEVELS - 1),
 };
 
+static void riva_bl_set_power(struct fb_info *info, int power)
+{
+        mutex_lock(&info->bl_mutex);
+
+        if (info->bl_dev) {
+                down(&info->bl_dev->sem);
+                info->bl_dev->props->power = power;
+                __riva_bl_update_status(info->bl_dev);
+                up(&info->bl_dev->sem);
+        }
+
+        mutex_unlock(&info->bl_mutex);
+}
+
 static void riva_bl_init(struct riva_par *par)
 {
         struct fb_info *info = pci_get_drvdata(par->pdev);
@@ -359,7 +386,7 @@ static void riva_bl_init(struct riva_par *par)
         bd = backlight_device_register(name, par, &riva_bl_data);
         if (IS_ERR(bd)) {
                 info->bl_dev = NULL;
-                printk("riva: Backlight registration failed\n");
+                printk(KERN_WARNING "riva: Backlight registration failed\n");
                 goto error;
         }
 
@@ -370,11 +397,11 @@ static void riva_bl_init(struct riva_par *par)
                 0x534 * FB_BACKLIGHT_MAX / MAX_LEVEL);
         mutex_unlock(&info->bl_mutex);
 
-        up(&bd->sem);
+        down(&bd->sem);
         bd->props->brightness = riva_bl_data.max_brightness;
         bd->props->power = FB_BLANK_UNBLANK;
         bd->props->update_status(bd);
-        down(&bd->sem);
+        up(&bd->sem);
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         mutex_lock(&pmac_backlight_mutex);
@@ -419,6 +446,7 @@ static void riva_bl_exit(struct riva_par *par)
 #else
 static inline void riva_bl_init(struct riva_par *par) {}
 static inline void riva_bl_exit(struct riva_par *par) {}
+static inline void riva_bl_set_power(struct fb_info *info, int power) {}
 #endif /* CONFIG_FB_RIVA_BACKLIGHT */
 
 /* ------------------------------------------------------------------------- *
@@ -1337,16 +1365,7 @@ static int rivafb_blank(int blank, struct fb_info *info)
         SEQout(par, 0x01, tmp);
         CRTCout(par, 0x1a, vesa);
 
-#ifdef CONFIG_FB_RIVA_BACKLIGHT
-        mutex_lock(&info->bl_mutex);
-        if (info->bl_dev) {
-                down(&info->bl_dev->sem);
-                info->bl_dev->props->power = blank;
-                info->bl_dev->props->update_status(info->bl_dev);
-                up(&info->bl_dev->sem);
-        }
-        mutex_unlock(&info->bl_mutex);
-#endif
+        riva_bl_set_power(info, blank);
 
         NVTRACE_LEAVE();
 
@@ -2117,6 +2136,9 @@ static int __devinit rivafb_probe(struct pci_dev *pd,
 
         fb_destroy_modedb(info->monspecs.modedb);
         info->monspecs.modedb = NULL;
+
+        pci_set_drvdata(pd, info);
+        riva_bl_init(info->par);
         ret = register_framebuffer(info);
         if (ret < 0) {
                 printk(KERN_ERR PFX
@@ -2124,8 +2146,6 @@ static int __devinit rivafb_probe(struct pci_dev *pd,
                 goto err_iounmap_screen_base;
         }
 
-        pci_set_drvdata(pd, info);
-
         printk(KERN_INFO PFX
                 "PCI nVidia %s framebuffer ver %s (%dMB @ 0x%lX)\n",
                 info->fix.id,
@@ -2133,8 +2153,6 @@ static int __devinit rivafb_probe(struct pci_dev *pd,
                 info->fix.smem_len / (1024 * 1024),
                 info->fix.smem_start);
 
-        riva_bl_init(info->par);
-
         NVTRACE_LEAVE();
         return 0;
 
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index f461eb10cc79..ad3bdd6f1ac1 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -76,7 +76,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 4729af477fbf..461e094e7b45 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -46,7 +46,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index b848ca7db7f9..895ebda7d9e3 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -44,7 +44,13 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
 #include <linux/tty.h>
+#else
+#include <linux/screen_info.h>
+#endif
+
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/selection.h>
diff --git a/drivers/video/skeletonfb.c b/drivers/video/skeletonfb.c
index 67f429e93189..bb96cb65fdaa 100644
--- a/drivers/video/skeletonfb.c
+++ b/drivers/video/skeletonfb.c
@@ -47,7 +47,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
diff --git a/drivers/video/sun3fb.c b/drivers/video/sun3fb.c
index e046e20f02b9..f80356dfa8e8 100644
--- a/drivers/video/sun3fb.c
+++ b/drivers/video/sun3fb.c
@@ -30,7 +30,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/tdfxfb.c b/drivers/video/tdfxfb.c
index 239b1496874b..689ce0270b81 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/tdfxfb.c
@@ -63,7 +63,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/video/tgafb.c b/drivers/video/tgafb.c
index 6c2c78ab9827..94fde625a6c0 100644
--- a/drivers/video/tgafb.c
+++ b/drivers/video/tgafb.c
@@ -17,7 +17,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/video/tx3912fb.c b/drivers/video/tx3912fb.c
index d904da44e1aa..07389ba01eff 100644
--- a/drivers/video/tx3912fb.c
+++ b/drivers/video/tx3912fb.c
@@ -14,7 +14,6 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/string.h>
-#include <linux/tty.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
diff --git a/drivers/video/valkyriefb.c b/drivers/video/valkyriefb.c
index 1d76c035050e..47f27924a7d7 100644
--- a/drivers/video/valkyriefb.c
+++ b/drivers/video/valkyriefb.c
@@ -44,7 +44,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
index 5718924b677f..2196448396ec 100644
--- a/drivers/video/vesafb.c
+++ b/drivers/video/vesafb.c
@@ -13,13 +13,13 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
+#include <linux/screen_info.h>
 
 #include <video/vga.h>
 #include <asm/io.h>
diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c
index d073ffb6e1f9..a9b99b01bd8e 100644
--- a/drivers/video/vfb.c
+++ b/drivers/video/vfb.c
@@ -15,7 +15,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 3c404c9bd36c..43d5a6d9c4a6 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -15,13 +15,13 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
+#include <linux/screen_info.h>
 
 #include <asm/io.h>
 #include <video/vga.h>
diff --git a/drivers/video/virgefb.c b/drivers/video/virgefb.c
index 5ea2345dab99..64378959dd7b 100644
--- a/drivers/video/virgefb.c
+++ b/drivers/video/virgefb.c
@@ -39,7 +39,6 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
-#include <linux/tty.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/zorro.h>
diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c
index af492cc48db2..d93eb626b2f0 100644
--- a/drivers/w1/masters/ds2482.c
+++ b/drivers/w1/masters/ds2482.c
@@ -218,7 +218,7 @@ static int ds2482_wait_1wire_idle(struct ds2482_data *pdev)
                 do {
                         temp = i2c_smbus_read_byte(&pdev->client);
                 } while ((temp >= 0) && (temp & DS2482_REG_STS_1WB) &&
-                         (++retries > DS2482_WAIT_IDLE_TIMEOUT));
+                         (++retries < DS2482_WAIT_IDLE_TIMEOUT));
         }
 
         if (retries > DS2482_WAIT_IDLE_TIMEOUT)