Merge branch 'linux-2.6'

294 files changed, 9882 insertions, 4020 deletions

diff --git a/drivers/acorn/char/defkeymap-l7200.c b/drivers/acorn/char/defkeymap-l7200.c
index 28a5fbc6aa1a..93d80a1c36f9 100644
--- a/drivers/acorn/char/defkeymap-l7200.c
+++ b/drivers/acorn/char/defkeymap-l7200.c
@@ -347,40 +347,40 @@ char *func_table[MAX_NR_FUNC] = {
 };
 
 struct kbdiacruc accent_table[MAX_DIACR] = {
-        {'`', 'A', '\300'},     {'`', 'a', '\340'},
-        {'\'', 'A', '\301'},    {'\'', 'a', '\341'},
-        {'^', 'A', '\302'},     {'^', 'a', '\342'},
-        {'~', 'A', '\303'},     {'~', 'a', '\343'},
-        {'"', 'A', '\304'},     {'"', 'a', '\344'},
-        {'O', 'A', '\305'},     {'o', 'a', '\345'},
-        {'0', 'A', '\305'},     {'0', 'a', '\345'},
-        {'A', 'A', '\305'},     {'a', 'a', '\345'},
-        {'A', 'E', '\306'},     {'a', 'e', '\346'},
-        {',', 'C', '\307'},     {',', 'c', '\347'},
-        {'`', 'E', '\310'},     {'`', 'e', '\350'},
-        {'\'', 'E', '\311'},    {'\'', 'e', '\351'},
-        {'^', 'E', '\312'},     {'^', 'e', '\352'},
-        {'"', 'E', '\313'},     {'"', 'e', '\353'},
-        {'`', 'I', '\314'},     {'`', 'i', '\354'},
-        {'\'', 'I', '\315'},    {'\'', 'i', '\355'},
-        {'^', 'I', '\316'},     {'^', 'i', '\356'},
-        {'"', 'I', '\317'},     {'"', 'i', '\357'},
-        {'-', 'D', '\320'},     {'-', 'd', '\360'},
-        {'~', 'N', '\321'},     {'~', 'n', '\361'},
-        {'`', 'O', '\322'},     {'`', 'o', '\362'},
-        {'\'', 'O', '\323'},    {'\'', 'o', '\363'},
-        {'^', 'O', '\324'},     {'^', 'o', '\364'},
-        {'~', 'O', '\325'},     {'~', 'o', '\365'},
-        {'"', 'O', '\326'},     {'"', 'o', '\366'},
-        {'/', 'O', '\330'},     {'/', 'o', '\370'},
-        {'`', 'U', '\331'},     {'`', 'u', '\371'},
-        {'\'', 'U', '\332'},    {'\'', 'u', '\372'},
-        {'^', 'U', '\333'},     {'^', 'u', '\373'},
-        {'"', 'U', '\334'},     {'"', 'u', '\374'},
-        {'\'', 'Y', '\335'},    {'\'', 'y', '\375'},
-        {'T', 'H', '\336'},     {'t', 'h', '\376'},
-        {'s', 's', '\337'},     {'"', 'y', '\377'},
-        {'s', 'z', '\337'},     {'i', 'j', '\377'},
+        {'`', 'A', 0300},       {'`', 'a', 0340},
+        {'\'', 'A', 0301},      {'\'', 'a', 0341},
+        {'^', 'A', 0302},       {'^', 'a', 0342},
+        {'~', 'A', 0303},       {'~', 'a', 0343},
+        {'"', 'A', 0304},       {'"', 'a', 0344},
+        {'O', 'A', 0305},       {'o', 'a', 0345},
+        {'0', 'A', 0305},       {'0', 'a', 0345},
+        {'A', 'A', 0305},       {'a', 'a', 0345},
+        {'A', 'E', 0306},       {'a', 'e', 0346},
+        {',', 'C', 0307},       {',', 'c', 0347},
+        {'`', 'E', 0310},       {'`', 'e', 0350},
+        {'\'', 'E', 0311},      {'\'', 'e', 0351},
+        {'^', 'E', 0312},       {'^', 'e', 0352},
+        {'"', 'E', 0313},       {'"', 'e', 0353},
+        {'`', 'I', 0314},       {'`', 'i', 0354},
+        {'\'', 'I', 0315},      {'\'', 'i', 0355},
+        {'^', 'I', 0316},       {'^', 'i', 0356},
+        {'"', 'I', 0317},       {'"', 'i', 0357},
+        {'-', 'D', 0320},       {'-', 'd', 0360},
+        {'~', 'N', 0321},       {'~', 'n', 0361},
+        {'`', 'O', 0322},       {'`', 'o', 0362},
+        {'\'', 'O', 0323},      {'\'', 'o', 0363},
+        {'^', 'O', 0324},       {'^', 'o', 0364},
+        {'~', 'O', 0325},       {'~', 'o', 0365},
+        {'"', 'O', 0326},       {'"', 'o', 0366},
+        {'/', 'O', 0330},       {'/', 'o', 0370},
+        {'`', 'U', 0331},       {'`', 'u', 0371},
+        {'\'', 'U', 0332},      {'\'', 'u', 0372},
+        {'^', 'U', 0333},       {'^', 'u', 0373},
+        {'"', 'U', 0334},       {'"', 'u', 0374},
+        {'\'', 'Y', 0335},      {'\'', 'y', 0375},
+        {'T', 'H', 0336},       {'t', 'h', 0376},
+        {'s', 's', 0337},       {'"', 'y', 0377},
+        {'s', 'z', 0337},       {'i', 'j', 0377},
 };
 
 unsigned int accent_table_size = 68;
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index ba8f7f4dfa11..e469647330de 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -538,6 +538,15 @@ config PATA_RADISYS
 
           If unsure, say N.
 
+config PATA_RB500
+        tristate "RouterBoard 500 PATA CompactFlash support"
+        depends on MIKROTIK_RB500
+        help
+          This option enables support for the RouterBoard 500
+          PATA CompactFlash controller.
+
+          If unsure, say N.
+
 config PATA_RZ1000
         tristate "PC Tech RZ1000 PATA support"
         depends on PCI
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index 701651e37c89..0511e6f0bb58 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -55,6 +55,7 @@ obj-$(CONFIG_PATA_PDC2027X)	+= pata_pdc2027x.o
 obj-$(CONFIG_PATA_PDC_OLD)      += pata_pdc202xx_old.o
 obj-$(CONFIG_PATA_QDI)          += pata_qdi.o
 obj-$(CONFIG_PATA_RADISYS)      += pata_radisys.o
+obj-$(CONFIG_PATA_RB500)        += pata_rb500_cf.o
 obj-$(CONFIG_PATA_RZ1000)       += pata_rz1000.o
 obj-$(CONFIG_PATA_SC1200)       += pata_sc1200.o
 obj-$(CONFIG_PATA_SERVERWORKS)  += pata_serverworks.o
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 1db93b619074..6978469eb16d 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -186,6 +186,7 @@ enum {
         AHCI_HFLAG_NO_MSI               = (1 << 5), /* no PCI MSI */
         AHCI_HFLAG_NO_PMP               = (1 << 6), /* no PMP */
         AHCI_HFLAG_NO_HOTPLUG           = (1 << 7), /* ignore PxSERR.DIAG.N */
+        AHCI_HFLAG_SECT255              = (1 << 8), /* max 255 sectors */
 
         /* ap->flags bits */
 
@@ -255,6 +256,7 @@ static void ahci_vt8251_error_handler(struct ata_port *ap);
 static void ahci_p5wdh_error_handler(struct ata_port *ap);
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc);
 static int ahci_port_resume(struct ata_port *ap);
+static void ahci_dev_config(struct ata_device *dev);
 static unsigned int ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl);
 static void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
                                u32 opts);
@@ -294,6 +296,8 @@ static const struct ata_port_operations ahci_ops = {
         .check_altstatus        = ahci_check_status,
         .dev_select             = ata_noop_dev_select,
 
+        .dev_config             = ahci_dev_config,
+
         .tf_read                = ahci_tf_read,
 
         .qc_defer               = sata_pmp_qc_defer_cmd_switch,
@@ -425,7 +429,7 @@ static const struct ata_port_info ahci_port_info[] = {
         /* board_ahci_sb600 */
         {
                 AHCI_HFLAGS     (AHCI_HFLAG_IGN_SERR_INTERNAL |
-                                 AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_PMP),
+                                 AHCI_HFLAG_SECT255 | AHCI_HFLAG_NO_PMP),
                 .flags          = AHCI_FLAG_COMMON,
                 .link_flags     = AHCI_LFLAG_COMMON,
                 .pio_mask       = 0x1f, /* pio0-4 */
@@ -563,6 +567,18 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(NVIDIA, 0x0abd), board_ahci },            /* MCP79 */
         { PCI_VDEVICE(NVIDIA, 0x0abe), board_ahci },            /* MCP79 */
         { PCI_VDEVICE(NVIDIA, 0x0abf), board_ahci },            /* MCP79 */
+        { PCI_VDEVICE(NVIDIA, 0x0bc8), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bc9), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bca), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bcb), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bcc), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bcd), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bce), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bcf), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bd0), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bd1), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bd2), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bd3), board_ahci },            /* MCP7B */
 
         /* SiS */
         { PCI_VDEVICE(SI, 0x1184), board_ahci }, /* SiS 966 */
@@ -668,7 +684,7 @@ static void ahci_save_initial_config(struct pci_dev *pdev,
                 cap &= ~HOST_CAP_NCQ;
         }
 
-        if ((cap && HOST_CAP_PMP) && (hpriv->flags & AHCI_HFLAG_NO_PMP)) {
+        if ((cap & HOST_CAP_PMP) && (hpriv->flags & AHCI_HFLAG_NO_PMP)) {
                 dev_printk(KERN_INFO, &pdev->dev,
                            "controller can't do PMP, turning off CAP_PMP\n");
                 cap &= ~HOST_CAP_PMP;
@@ -1176,6 +1192,14 @@ static void ahci_init_controller(struct ata_host *host)
         VPRINTK("HOST_CTL 0x%x\n", tmp);
 }
 
+static void ahci_dev_config(struct ata_device *dev)
+{
+        struct ahci_host_priv *hpriv = dev->link->ap->host->private_data;
+
+        if (hpriv->flags & AHCI_HFLAG_SECT255)
+                dev->max_sectors = 255;
+}
+
 static unsigned int ahci_dev_classify(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 9e8ec19260af..0770cb7391a4 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -382,7 +382,7 @@ static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf)
 
         if (ata_msg_probe(ap))
                 ata_dev_printk(dev, KERN_DEBUG, "%s: ENTER: port#: %d\n",
-                               __FUNCTION__, ap->port_no);
+                               __func__, ap->port_no);
 
         /* _GTF has no input parameters */
         status = acpi_evaluate_object(dev->acpi_handle, "_GTF", NULL, &output);
@@ -402,7 +402,7 @@ static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf)
                 if (ata_msg_probe(ap))
                         ata_dev_printk(dev, KERN_DEBUG, "%s: Run _GTF: "
                                 "length or ptr is NULL (0x%llx, 0x%p)\n",
-                                __FUNCTION__,
+                                __func__,
                                 (unsigned long long)output.length,
                                 output.pointer);
                 rc = -EINVAL;
@@ -432,7 +432,7 @@ static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf)
                 if (ata_msg_probe(ap))
                         ata_dev_printk(dev, KERN_DEBUG,
                                        "%s: returning gtf=%p, gtf_count=%d\n",
-                                       __FUNCTION__, *gtf, rc);
+                                       __func__, *gtf, rc);
         }
         return rc;
 
@@ -725,7 +725,7 @@ static int ata_acpi_push_id(struct ata_device *dev)
 
         if (ata_msg_probe(ap))
                 ata_dev_printk(dev, KERN_DEBUG, "%s: ix = %d, port#: %d\n",
-                               __FUNCTION__, dev->devno, ap->port_no);
+                               __func__, dev->devno, ap->port_no);
 
         /* Give the drive Identify data to the drive via the _SDD method */
         /* _SDD: set up input parameters */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index fbc24358ada0..4bbe31f98ef8 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -106,14 +106,15 @@ static struct ata_force_ent *ata_force_tbl;
 static int ata_force_tbl_size;
 
 static char ata_force_param_buf[PAGE_SIZE] __initdata;
-module_param_string(force, ata_force_param_buf, sizeof(ata_force_param_buf), 0444);
+/* param_buf is thrown away after initialization, disallow read */
+module_param_string(force, ata_force_param_buf, sizeof(ata_force_param_buf), 0);
 MODULE_PARM_DESC(force, "Force ATA configurations including cable type, link speed and transfer mode (see Documentation/kernel-parameters.txt for details)");
 
 int atapi_enabled = 1;
 module_param(atapi_enabled, int, 0444);
 MODULE_PARM_DESC(atapi_enabled, "Enable discovery of ATAPI devices (0=off, 1=on)");
 
-int atapi_dmadir = 0;
+static int atapi_dmadir = 0;
 module_param(atapi_dmadir, int, 0444);
 MODULE_PARM_DESC(atapi_dmadir, "Enable ATAPI DMADIR bridge support (0=off, 1=on)");
 
@@ -1719,7 +1720,7 @@ void ata_port_flush_task(struct ata_port *ap)
         cancel_rearming_delayed_work(&ap->port_task);
 
         if (ata_msg_ctl(ap))
-                ata_port_printk(ap, KERN_DEBUG, "%s: EXIT\n", __FUNCTION__);
+                ata_port_printk(ap, KERN_DEBUG, "%s: EXIT\n", __func__);
 }
 
 static void ata_qc_complete_internal(struct ata_queued_cmd *qc)
@@ -2056,7 +2057,7 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
         int rc;
 
         if (ata_msg_ctl(ap))
-                ata_dev_printk(dev, KERN_DEBUG, "%s: ENTER\n", __FUNCTION__);
+                ata_dev_printk(dev, KERN_DEBUG, "%s: ENTER\n", __func__);
 
         ata_dev_select(ap, dev->devno, 1, 1); /* select device 0/1 */
  retry:
@@ -2253,12 +2254,12 @@ int ata_dev_configure(struct ata_device *dev)
 
         if (!ata_dev_enabled(dev) && ata_msg_info(ap)) {
                 ata_dev_printk(dev, KERN_INFO, "%s: ENTER/EXIT -- nodev\n",
-                               __FUNCTION__);
+                               __func__);
                 return 0;
         }
 
         if (ata_msg_probe(ap))
-                ata_dev_printk(dev, KERN_DEBUG, "%s: ENTER\n", __FUNCTION__);
+                ata_dev_printk(dev, KERN_DEBUG, "%s: ENTER\n", __func__);
 
         /* set horkage */
         dev->horkage |= ata_dev_blacklisted(dev);
@@ -2279,7 +2280,7 @@ int ata_dev_configure(struct ata_device *dev)
                 ata_dev_printk(dev, KERN_DEBUG,
                                "%s: cfg 49:%04x 82:%04x 83:%04x 84:%04x "
                                "85:%04x 86:%04x 87:%04x 88:%04x\n",
-                               __FUNCTION__,
+                               __func__,
                                id[49], id[82], id[83], id[84],
                                id[85], id[86], id[87], id[88]);
 
@@ -2511,13 +2512,13 @@ int ata_dev_configure(struct ata_device *dev)
 
         if (ata_msg_probe(ap))
                 ata_dev_printk(dev, KERN_DEBUG, "%s: EXIT, drv_stat = 0x%x\n",
-                        __FUNCTION__, ata_chk_status(ap));
+                        __func__, ata_chk_status(ap));
         return 0;
 
 err_out_nosup:
         if (ata_msg_probe(ap))
                 ata_dev_printk(dev, KERN_DEBUG,
-                               "%s: EXIT, err\n", __FUNCTION__);
+                               "%s: EXIT, err\n", __func__);
         return rc;
 }
 
@@ -6567,6 +6568,8 @@ int ata_host_suspend(struct ata_host *host, pm_message_t mesg)
         ata_lpm_enable(host);
 
         rc = ata_host_request_pm(host, mesg, 0, ATA_EHI_QUIET, 1);
+        if (rc == 0)
+                host->dev->power.power_state = mesg;
         return rc;
 }
 
@@ -6585,6 +6588,7 @@ void ata_host_resume(struct ata_host *host)
 {
         ata_host_request_pm(host, PMSG_ON, ATA_EH_SOFTRESET,
                             ATA_EHI_NO_AUTOPSY | ATA_EHI_QUIET, 0);
+        host->dev->power.power_state = PMSG_ON;
 
         /* reenable link pm */
         ata_lpm_disable(host);
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 698ce2cea52c..681252fd8143 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2150,6 +2150,15 @@ int ata_eh_reset(struct ata_link *link, int classify,
                         ap->ops->set_piomode(ap, dev);
         }
 
+        if (!softreset && !hardreset) {
+                if (verbose)
+                        ata_link_printk(link, KERN_INFO, "no reset method "
+                                        "available, skipping reset\n");
+                if (!(lflags & ATA_LFLAG_ASSUME_CLASS))
+                        lflags |= ATA_LFLAG_ASSUME_ATA;
+                goto done;
+        }
+
         /* Determine which reset to use and record in ehc->i.action.
          * prereset() may examine and modify it.
          */
@@ -2254,6 +2263,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
                 lflags |= ATA_LFLAG_ASSUME_ATA;
         }
 
+ done:
         ata_link_for_each_dev(dev, link) {
                 /* After the reset, the device state is PIO 0 and the
                  * controller state is undefined.  Reset also wakes up
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 0562b0a49f3b..8f0e8f2bc628 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -862,9 +862,10 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
                 struct request_queue *q = sdev->request_queue;
                 void *buf;
 
-                /* set the min alignment */
+                /* set the min alignment and padding */
                 blk_queue_update_dma_alignment(sdev->request_queue,
                                                ATA_DMA_PAD_SZ - 1);
+                blk_queue_dma_pad(sdev->request_queue, ATA_DMA_PAD_SZ - 1);
 
                 /* configure draining */
                 buf = kmalloc(ATAPI_MAX_DRAIN, q->bounce_gfp | GFP_KERNEL);
@@ -1694,12 +1695,17 @@ void ata_scsi_rbuf_fill(struct ata_scsi_args *args,
         u8 *rbuf;
         unsigned int buflen, rc;
         struct scsi_cmnd *cmd = args->cmd;
+        unsigned long flags;
+
+        local_irq_save(flags);
 
         buflen = ata_scsi_rbuf_get(cmd, &rbuf);
         memset(rbuf, 0, buflen);
         rc = actor(args, rbuf, buflen);
         ata_scsi_rbuf_put(cmd, rbuf);
 
+        local_irq_restore(flags);
+
         if (rc == 0)
                 cmd->result = SAM_STAT_GOOD;
         args->done(cmd);
@@ -2473,6 +2479,9 @@ static void atapi_qc_complete(struct ata_queued_cmd *qc)
                 if ((scsicmd[0] == INQUIRY) && ((scsicmd[1] & 0x03) == 0)) {
                         u8 *buf = NULL;
                         unsigned int buflen;
+                        unsigned long flags;
+
+                        local_irq_save(flags);
 
                         buflen = ata_scsi_rbuf_get(cmd, &buf);
 
@@ -2490,6 +2499,8 @@ static void atapi_qc_complete(struct ata_queued_cmd *qc)
                         }
 
                         ata_scsi_rbuf_put(cmd, buf);
+
+                        local_irq_restore(flags);
                 }
 
                 cmd->result = SAM_STAT_GOOD;
@@ -2528,7 +2539,7 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
         }
 
         qc->tf.command = ATA_CMD_PACKET;
-        qc->nbytes = scsi_bufflen(scmd);
+        qc->nbytes = scsi_bufflen(scmd) + scmd->request->extra_len;
 
         /* check whether ATAPI DMA is safe */
         if (!using_pio && ata_check_atapi_dma(qc))
@@ -2539,7 +2550,7 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
          * want to set it properly, and for DMA where it is
          * effectively meaningless.
          */
-        nbytes = min(scmd->request->raw_data_len, (unsigned int)63 * 1024);
+        nbytes = min(scmd->request->data_len, (unsigned int)63 * 1024);
 
         /* Most ATAPI devices which honor transfer chunk size don't
          * behave according to the spec when odd chunk size which
@@ -2865,7 +2876,7 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
          * TODO: find out if we need to do more here to
          *       cover scatter/gather case.
          */
-        qc->nbytes = scsi_bufflen(scmd);
+        qc->nbytes = scsi_bufflen(scmd) + scmd->request->extra_len;
 
         /* request result TF and be quiet about device error */
         qc->flags |= ATA_QCFLAG_RESULT_TF | ATA_QCFLAG_QUIET;
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 60cd4b179766..20dc572fb45a 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -56,7 +56,8 @@ u8 ata_irq_on(struct ata_port *ap)
         ap->ctl &= ~ATA_NIEN;
         ap->last_ctl = ap->ctl;
 
-        iowrite8(ap->ctl, ioaddr->ctl_addr);
+        if (ioaddr->ctl_addr)
+                iowrite8(ap->ctl, ioaddr->ctl_addr);
         tmp = ata_wait_idle(ap);
 
         ap->ops->irq_clear(ap);
@@ -81,12 +82,14 @@ void ata_tf_load(struct ata_port *ap, const struct ata_taskfile *tf)
         unsigned int is_addr = tf->flags & ATA_TFLAG_ISADDR;
 
         if (tf->ctl != ap->last_ctl) {
-                iowrite8(tf->ctl, ioaddr->ctl_addr);
+                if (ioaddr->ctl_addr)
+                        iowrite8(tf->ctl, ioaddr->ctl_addr);
                 ap->last_ctl = tf->ctl;
                 ata_wait_idle(ap);
         }
 
         if (is_addr && (tf->flags & ATA_TFLAG_LBA48)) {
+                WARN_ON(!ioaddr->ctl_addr);
                 iowrite8(tf->hob_feature, ioaddr->feature_addr);
                 iowrite8(tf->hob_nsect, ioaddr->nsect_addr);
                 iowrite8(tf->hob_lbal, ioaddr->lbal_addr);
@@ -167,14 +170,17 @@ void ata_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
         tf->device = ioread8(ioaddr->device_addr);
 
         if (tf->flags & ATA_TFLAG_LBA48) {
-                iowrite8(tf->ctl | ATA_HOB, ioaddr->ctl_addr);
-                tf->hob_feature = ioread8(ioaddr->error_addr);
-                tf->hob_nsect = ioread8(ioaddr->nsect_addr);
-                tf->hob_lbal = ioread8(ioaddr->lbal_addr);
-                tf->hob_lbam = ioread8(ioaddr->lbam_addr);
-                tf->hob_lbah = ioread8(ioaddr->lbah_addr);
-                iowrite8(tf->ctl, ioaddr->ctl_addr);
-                ap->last_ctl = tf->ctl;
+                if (likely(ioaddr->ctl_addr)) {
+                        iowrite8(tf->ctl | ATA_HOB, ioaddr->ctl_addr);
+                        tf->hob_feature = ioread8(ioaddr->error_addr);
+                        tf->hob_nsect = ioread8(ioaddr->nsect_addr);
+                        tf->hob_lbal = ioread8(ioaddr->lbal_addr);
+                        tf->hob_lbam = ioread8(ioaddr->lbam_addr);
+                        tf->hob_lbah = ioread8(ioaddr->lbah_addr);
+                        iowrite8(tf->ctl, ioaddr->ctl_addr);
+                        ap->last_ctl = tf->ctl;
+                } else
+                        WARN_ON(1);
         }
 }
 
@@ -352,7 +358,8 @@ void ata_bmdma_freeze(struct ata_port *ap)
         ap->ctl |= ATA_NIEN;
         ap->last_ctl = ap->ctl;
 
-        iowrite8(ap->ctl, ioaddr->ctl_addr);
+        if (ioaddr->ctl_addr)
+                iowrite8(ap->ctl, ioaddr->ctl_addr);
 
         /* Under certain circumstances, some controllers raise IRQ on
          * ATA_NIEN manipulation.  Also, many controllers fail to mask
@@ -459,13 +466,14 @@ void ata_bmdma_drive_eh(struct ata_port *ap, ata_prereset_fn_t prereset,
  */
 void ata_bmdma_error_handler(struct ata_port *ap)
 {
-        ata_reset_fn_t hardreset;
+        ata_reset_fn_t softreset = NULL, hardreset = NULL;
 
-        hardreset = NULL;
+        if (ap->ioaddr.ctl_addr)
+                softreset = ata_std_softreset;
         if (sata_scr_valid(&ap->link))
                 hardreset = sata_std_hardreset;
 
-        ata_bmdma_drive_eh(ap, ata_std_prereset, ata_std_softreset, hardreset,
+        ata_bmdma_drive_eh(ap, ata_std_prereset, softreset, hardreset,
                            ata_std_postreset);
 }
 
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index 6036dedfe377..aa884f71a12a 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -56,7 +56,6 @@ enum {
 extern unsigned int ata_print_id;
 extern struct workqueue_struct *ata_aux_wq;
 extern int atapi_enabled;
-extern int atapi_dmadir;
 extern int atapi_passthru16;
 extern int libata_fua;
 extern int libata_noacpi;
diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
index 0713872cf65c..a742efa0da2b 100644
--- a/drivers/ata/pata_hpt366.c
+++ b/drivers/ata/pata_hpt366.c
@@ -27,7 +27,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt366"
-#define DRV_VERSION     "0.6.1"
+#define DRV_VERSION     "0.6.2"
 
 struct hpt_clock {
         u8      xfer_speed;
@@ -180,9 +180,9 @@ static unsigned long hpt366_filter(struct ata_device *adev, unsigned long mask)
                 if (hpt_dma_blacklisted(adev, "UDMA",  bad_ata33))
                         mask &= ~ATA_MASK_UDMA;
                 if (hpt_dma_blacklisted(adev, "UDMA3", bad_ata66_3))
-                        mask &= ~(0x07 << ATA_SHIFT_UDMA);
+                        mask &= ~(0xF8 << ATA_SHIFT_UDMA);
                 if (hpt_dma_blacklisted(adev, "UDMA4", bad_ata66_4))
-                        mask &= ~(0x0F << ATA_SHIFT_UDMA);
+                        mask &= ~(0xF0 << ATA_SHIFT_UDMA);
         }
         return ata_pci_default_filter(adev, mask);
 }
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index 68eb34929cec..9a10878b2ad8 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -24,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt37x"
-#define DRV_VERSION     "0.6.9"
+#define DRV_VERSION     "0.6.11"
 
 struct hpt_clock {
         u8      xfer_speed;
@@ -281,7 +281,7 @@ static unsigned long hpt370_filter(struct ata_device *adev, unsigned long mask)
                 if (hpt_dma_blacklisted(adev, "UDMA", bad_ata33))
                         mask &= ~ATA_MASK_UDMA;
                 if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
-                        mask &= ~(0x1F << ATA_SHIFT_UDMA);
+                        mask &= ~(0xE0 << ATA_SHIFT_UDMA);
         }
         return ata_pci_default_filter(adev, mask);
 }
@@ -297,7 +297,7 @@ static unsigned long hpt370a_filter(struct ata_device *adev, unsigned long mask)
 {
         if (adev->class == ATA_DEV_ATA) {
                 if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
-                        mask &= ~ (0x1F << ATA_SHIFT_UDMA);
+                        mask &= ~(0xE0 << ATA_SHIFT_UDMA);
         }
         return ata_pci_default_filter(adev, mask);
 }
diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
index 028af5dbeed6..511c89b9bae8 100644
--- a/drivers/ata/pata_pdc2027x.c
+++ b/drivers/ata/pata_pdc2027x.c
@@ -39,7 +39,7 @@
 #undef PDC_DEBUG
 
 #ifdef PDC_DEBUG
-#define PDPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __FUNCTION__, ## args)
+#define PDPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
 #else
 #define PDPRINTK(fmt, args...)
 #endif
diff --git a/drivers/ata/pata_rb500_cf.c b/drivers/ata/pata_rb500_cf.c
new file mode 100644
index 000000000000..4ce9b03fe6c8
--- /dev/null
+++ b/drivers/ata/pata_rb500_cf.c
@@ -0,0 +1,314 @@
+/*
+ *  A low-level PATA driver to handle a Compact Flash connected on the
+ *  Mikrotik's RouterBoard 532 board.
+ *
+ *  Copyright (C) 2007 Gabor Juhos <juhosg at openwrt.org>
+ *  Copyright (C) 2008 Florian Fainelli <florian@openwrt.org>
+ *
+ *  This file was based on: drivers/ata/pata_ixp4xx_cf.c
+ *      Copyright (C) 2006-07 Tower Technologies
+ *      Author: Alessandro Zummo <a.zummo@towertech.it>
+ *
+ *  Also was based on the driver for Linux 2.4.xx published by Mikrotik for
+ *  their RouterBoard 1xx and 5xx series devices. The original Mikrotik code
+ *  seems not to have a license.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <linux/io.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+
+#include <linux/libata.h>
+#include <scsi/scsi_host.h>
+
+#include <asm/gpio.h>
+
+#define DRV_NAME        "pata-rb500-cf"
+#define DRV_VERSION     "0.1.0"
+#define DRV_DESC        "PATA driver for RouterBOARD 532 Compact Flash"
+
+#define RB500_CF_MAXPORTS       1
+#define RB500_CF_IO_DELAY       400
+
+#define RB500_CF_REG_CMD        0x0800
+#define RB500_CF_REG_CTRL       0x080E
+#define RB500_CF_REG_DATA       0x0C00
+
+struct rb500_cf_info {
+        void __iomem    *iobase;
+        unsigned int    gpio_line;
+        int             frozen;
+        unsigned int    irq;
+};
+
+/* ------------------------------------------------------------------------ */
+
+static inline void rb500_pata_finish_io(struct ata_port *ap)
+{
+        struct ata_host *ah = ap->host;
+        struct rb500_cf_info *info = ah->private_data;
+
+        ata_altstatus(ap);
+        ndelay(RB500_CF_IO_DELAY);
+
+        set_irq_type(info->irq, IRQ_TYPE_LEVEL_HIGH);
+}
+
+static void rb500_pata_exec_command(struct ata_port *ap,
+                                const struct ata_taskfile *tf)
+{
+        writeb(tf->command, ap->ioaddr.command_addr);
+        rb500_pata_finish_io(ap);
+}
+
+static void rb500_pata_data_xfer(struct ata_device *adev, unsigned char *buf,
+                                unsigned int buflen, int write_data)
+{
+        struct ata_port *ap = adev->link->ap;
+        void __iomem *ioaddr = ap->ioaddr.data_addr;
+
+        if (write_data) {
+                for (; buflen > 0; buflen--, buf++)
+                        writeb(*buf, ioaddr);
+        } else {
+                for (; buflen > 0; buflen--, buf++)
+                        *buf = readb(ioaddr);
+        }
+
+        rb500_pata_finish_io(adev->link->ap);
+}
+
+static void rb500_pata_freeze(struct ata_port *ap)
+{
+        struct rb500_cf_info *info = ap->host->private_data;
+
+        info->frozen = 1;
+}
+
+static void rb500_pata_thaw(struct ata_port *ap)
+{
+        struct rb500_cf_info *info = ap->host->private_data;
+
+        info->frozen = 0;
+}
+
+static irqreturn_t rb500_pata_irq_handler(int irq, void *dev_instance)
+{
+        struct ata_host *ah = dev_instance;
+        struct rb500_cf_info *info = ah->private_data;
+
+        if (gpio_get_value(info->gpio_line)) {
+                set_irq_type(info->irq, IRQ_TYPE_LEVEL_LOW);
+                if (!info->frozen)
+                        ata_interrupt(info->irq, dev_instance);
+        } else {
+                set_irq_type(info->irq, IRQ_TYPE_LEVEL_HIGH);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static void rb500_pata_irq_clear(struct ata_port *ap)
+{
+}
+
+static int rb500_pata_port_start(struct ata_port *ap)
+{
+        return 0;
+}
+
+static struct ata_port_operations rb500_pata_port_ops = {
+        .tf_load                = ata_tf_load,
+        .tf_read                = ata_tf_read,
+
+        .exec_command           = rb500_pata_exec_command,
+        .check_status           = ata_check_status,
+        .dev_select             = ata_std_dev_select,
+
+        .data_xfer              = rb500_pata_data_xfer,
+
+        .qc_prep                = ata_qc_prep,
+        .qc_issue               = ata_qc_issue_prot,
+
+        .freeze                 = rb500_pata_freeze,
+        .thaw                   = rb500_pata_thaw,
+        .error_handler          = ata_bmdma_error_handler,
+
+        .irq_handler            = rb500_pata_irq_handler,
+        .irq_clear              = rb500_pata_irq_clear,
+        .irq_on                 = ata_irq_on,
+
+        .port_start             = rb500_pata_port_start,
+};
+
+/* ------------------------------------------------------------------------ */
+
+static struct scsi_host_template rb500_pata_sht = {
+        .module                 = THIS_MODULE,
+        .name                   = DRV_NAME,
+        .ioctl                  = ata_scsi_ioctl,
+        .queuecommand           = ata_scsi_queuecmd,
+        .slave_configure        = ata_scsi_slave_config,
+        .slave_destroy          = ata_scsi_slave_destroy,
+        .bios_param             = ata_std_bios_param,
+        .proc_name              = DRV_NAME,
+
+        .can_queue              = ATA_DEF_QUEUE,
+        .this_id                = ATA_SHT_THIS_ID,
+        .sg_tablesize           = LIBATA_MAX_PRD,
+        .dma_boundary           = ATA_DMA_BOUNDARY,
+        .cmd_per_lun            = ATA_SHT_CMD_PER_LUN,
+        .emulated               = ATA_SHT_EMULATED,
+        .use_clustering         = ATA_SHT_USE_CLUSTERING,
+};
+
+/* ------------------------------------------------------------------------ */
+
+static void rb500_pata_setup_ports(struct ata_host *ah)
+{
+        struct rb500_cf_info *info = ah->private_data;
+        struct ata_port *ap;
+
+        ap = ah->ports[0];
+
+        ap->ops         = &rb500_pata_port_ops;
+        ap->pio_mask    = 0x1f; /* PIO4 */
+        ap->flags       = ATA_FLAG_NO_LEGACY | ATA_FLAG_MMIO;
+
+        ap->ioaddr.cmd_addr     = info->iobase + RB500_CF_REG_CMD;
+        ap->ioaddr.ctl_addr     = info->iobase + RB500_CF_REG_CTRL;
+        ap->ioaddr.altstatus_addr = info->iobase + RB500_CF_REG_CTRL;
+
+        ata_std_ports(&ap->ioaddr);
+
+        ap->ioaddr.data_addr    = info->iobase + RB500_CF_REG_DATA;
+}
+
+static __devinit int rb500_pata_driver_probe(struct platform_device *pdev)
+{
+        unsigned int irq;
+        int gpio;
+        struct resource *res;
+        struct ata_host *ah;
+        struct rb500_cf_info *info;
+        int ret;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "no IOMEM resource found\n");
+                return -EINVAL;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq <= 0) {
+                dev_err(&pdev->dev, "no IRQ resource found\n");
+                return -ENOENT;
+        }
+
+        gpio = irq_to_gpio(irq);
+        if (gpio < 0) {
+                dev_err(&pdev->dev, "no GPIO found for irq%d\n", irq);
+                return -ENOENT;
+        }
+
+        ret = gpio_request(gpio, DRV_NAME);
+        if (ret) {
+                dev_err(&pdev->dev, "GPIO request failed\n");
+                return ret;
+        }
+
+        /* allocate host */
+        ah = ata_host_alloc(&pdev->dev, RB500_CF_MAXPORTS);
+        if (!ah)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, ah);
+
+        info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        ah->private_data = info;
+        info->gpio_line = gpio;
+        info->irq = irq;
+
+        info->iobase = devm_ioremap_nocache(&pdev->dev, res->start,
+                                res->end - res->start + 1);
+        if (!info->iobase)
+                return -ENOMEM;
+
+        ret = gpio_direction_input(gpio);
+        if (ret) {
+                dev_err(&pdev->dev, "unable to set GPIO direction, err=%d\n",
+                                ret);
+                goto err_free_gpio;
+        }
+
+        rb500_pata_setup_ports(ah);
+
+        ret = ata_host_activate(ah, irq, rb500_pata_irq_handler,
+                                IRQF_TRIGGER_LOW, &rb500_pata_sht);
+        if (ret)
+                goto err_free_gpio;
+
+        return 0;
+
+err_free_gpio:
+        gpio_free(gpio);
+
+        return ret;
+}
+
+static __devexit int rb500_pata_driver_remove(struct platform_device *pdev)
+{
+        struct ata_host *ah = platform_get_drvdata(pdev);
+        struct rb500_cf_info *info = ah->private_data;
+
+        ata_host_detach(ah);
+        gpio_free(info->gpio_line);
+
+        return 0;
+}
+
+static struct platform_driver rb500_pata_platform_driver = {
+        .probe          = rb500_pata_driver_probe,
+        .remove         = __devexit_p(rb500_pata_driver_remove),
+        .driver  = {
+                .name   = DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+
+/* ------------------------------------------------------------------------ */
+
+#define DRV_INFO DRV_DESC " version " DRV_VERSION
+
+static int __init rb500_pata_module_init(void)
+{
+        printk(KERN_INFO DRV_INFO "\n");
+
+        return platform_driver_register(&rb500_pata_platform_driver);
+}
+
+static void __exit rb500_pata_module_exit(void)
+{
+        platform_driver_unregister(&rb500_pata_platform_driver);
+}
+
+MODULE_AUTHOR("Gabor Juhos <juhosg at openwrt.org>");
+MODULE_AUTHOR("Florian Fainelli <florian@openwrt.org>");
+MODULE_DESCRIPTION(DRV_DESC);
+MODULE_VERSION(DRV_VERSION);
+MODULE_LICENSE("GPL");
+
+module_init(rb500_pata_module_init);
+module_exit(rb500_pata_module_exit);
diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
index 9c523fbf529e..a589c0fa0dbb 100644
--- a/drivers/ata/pata_serverworks.c
+++ b/drivers/ata/pata_serverworks.c
@@ -226,7 +226,7 @@ static unsigned long serverworks_csb_filter(struct ata_device *adev, unsigned lo
 
         for (i = 0; (p = csb_bad_ata100[i]) != NULL; i++) {
                 if (!strcmp(p, model_num))
-                        mask &= ~(0x1F << ATA_SHIFT_UDMA);
+                        mask &= ~(0xE0 << ATA_SHIFT_UDMA);
         }
         return ata_pci_default_filter(adev, mask);
 }
diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
index 69f651e0bc98..840d1c4a7850 100644
--- a/drivers/ata/sata_svw.c
+++ b/drivers/ata/sata_svw.c
@@ -45,6 +45,8 @@
 #include <linux/interrupt.h>
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi.h>
 #include <linux/libata.h>
 
 #ifdef CONFIG_PPC_OF
@@ -59,6 +61,7 @@ enum {
         /* ap->flags bits */
         K2_FLAG_SATA_8_PORTS            = (1 << 24),
         K2_FLAG_NO_ATAPI_DMA            = (1 << 25),
+        K2_FLAG_BAR_POS_3                       = (1 << 26),
 
         /* Taskfile registers offsets */
         K2_SATA_TF_CMD_OFFSET           = 0x00,
@@ -88,8 +91,10 @@ enum {
         /* Port stride */
         K2_SATA_PORT_OFFSET             = 0x100,
 
-        board_svw4                      = 0,
-        board_svw8                      = 1,
+        chip_svw4                       = 0,
+        chip_svw8                       = 1,
+        chip_svw42                      = 2,    /* bar 3 */
+        chip_svw43                      = 3,    /* bar 5 */
 };
 
 static u8 k2_stat_check_status(struct ata_port *ap);
@@ -97,10 +102,25 @@ static u8 k2_stat_check_status(struct ata_port *ap);
 
 static int k2_sata_check_atapi_dma(struct ata_queued_cmd *qc)
 {
+        u8 cmnd = qc->scsicmd->cmnd[0];
+
         if (qc->ap->flags & K2_FLAG_NO_ATAPI_DMA)
                 return -1;      /* ATAPI DMA not supported */
+        else {
+                switch (cmnd) {
+                case READ_10:
+                case READ_12:
+                case READ_16:
+                case WRITE_10:
+                case WRITE_12:
+                case WRITE_16:
+                        return 0;
+
+                default:
+                        return -1;
+                }
 
-        return 0;
+        }
 }
 
 static int k2_sata_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
@@ -354,7 +374,7 @@ static const struct ata_port_operations k2_sata_ops = {
 };
 
 static const struct ata_port_info k2_port_info[] = {
-        /* board_svw4 */
+        /* chip_svw4 */
         {
                 .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
                                   ATA_FLAG_MMIO | K2_FLAG_NO_ATAPI_DMA,
@@ -363,7 +383,7 @@ static const struct ata_port_info k2_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &k2_sata_ops,
         },
-        /* board_svw8 */
+        /* chip_svw8 */
         {
                 .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
                                   ATA_FLAG_MMIO | K2_FLAG_NO_ATAPI_DMA |
@@ -373,6 +393,24 @@ static const struct ata_port_info k2_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &k2_sata_ops,
         },
+        /* chip_svw42 */
+        {
+                .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_MMIO | K2_FLAG_BAR_POS_3,
+                .pio_mask       = 0x1f,
+                .mwdma_mask     = 0x07,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &k2_sata_ops,
+        },
+        /* chip_svw43 */
+        {
+                .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_MMIO,
+                .pio_mask       = 0x1f,
+                .mwdma_mask     = 0x07,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &k2_sata_ops,
+        },
 };
 
 static void k2_sata_setup_port(struct ata_ioports *port, void __iomem *base)
@@ -402,7 +440,7 @@ static int k2_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *en
                 { &k2_port_info[ent->driver_data], NULL };
         struct ata_host *host;
         void __iomem *mmio_base;
-        int n_ports, i, rc;
+        int n_ports, i, rc, bar_pos;
 
         if (!printed_version++)
                 dev_printk(KERN_DEBUG, &pdev->dev, "version " DRV_VERSION "\n");
@@ -416,6 +454,9 @@ static int k2_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *en
         if (!host)
                 return -ENOMEM;
 
+        bar_pos = 5;
+        if (ppi[0]->flags & K2_FLAG_BAR_POS_3)
+                bar_pos = 3;
         /*
          * If this driver happens to only be useful on Apple's K2, then
          * we should check that here as it has a normal Serverworks ID
@@ -428,17 +469,23 @@ static int k2_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *en
          * Check if we have resources mapped at all (second function may
          * have been disabled by firmware)
          */
-        if (pci_resource_len(pdev, 5) == 0)
+        if (pci_resource_len(pdev, bar_pos) == 0) {
+                /* In IDE mode we need to pin the device to ensure that
+                        pcim_release does not clear the busmaster bit in config
+                        space, clearing causes busmaster DMA to fail on
+                        ports 3 & 4 */
+                pcim_pin_device(pdev);
                 return -ENODEV;
+        }
 
         /* Request and iomap PCI regions */
-        rc = pcim_iomap_regions(pdev, 1 << 5, DRV_NAME);
+        rc = pcim_iomap_regions(pdev, 1 << bar_pos, DRV_NAME);
         if (rc == -EBUSY)
                 pcim_pin_device(pdev);
         if (rc)
                 return rc;
         host->iomap = pcim_iomap_table(pdev);
-        mmio_base = host->iomap[5];
+        mmio_base = host->iomap[bar_pos];
 
         /* different controllers have different number of ports - currently 4 or 8 */
         /* All ports are on the same function. Multi-function device is no
@@ -483,11 +530,13 @@ static int k2_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *en
  * controller
  * */
 static const struct pci_device_id k2_sata_pci_tbl[] = {
-        { PCI_VDEVICE(SERVERWORKS, 0x0240), board_svw4 },
-        { PCI_VDEVICE(SERVERWORKS, 0x0241), board_svw4 },
-        { PCI_VDEVICE(SERVERWORKS, 0x0242), board_svw8 },
-        { PCI_VDEVICE(SERVERWORKS, 0x024a), board_svw4 },
-        { PCI_VDEVICE(SERVERWORKS, 0x024b), board_svw4 },
+        { PCI_VDEVICE(SERVERWORKS, 0x0240), chip_svw4 },
+        { PCI_VDEVICE(SERVERWORKS, 0x0241), chip_svw4 },
+        { PCI_VDEVICE(SERVERWORKS, 0x0242), chip_svw8 },
+        { PCI_VDEVICE(SERVERWORKS, 0x024a), chip_svw4 },
+        { PCI_VDEVICE(SERVERWORKS, 0x024b), chip_svw4 },
+        { PCI_VDEVICE(SERVERWORKS, 0x0410), chip_svw42 },
+        { PCI_VDEVICE(SERVERWORKS, 0x0411), chip_svw43 },
 
         { }
 };
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index c662d686154a..47c57a4294b7 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -331,8 +331,8 @@ module_param(fs_keystream, int, 0);
 #define FS_DEBUG_QSIZE   0x00001000
 
 
-#define func_enter() fs_dprintk (FS_DEBUG_FLOW, "fs: enter %s\n", __FUNCTION__)
-#define func_exit()  fs_dprintk (FS_DEBUG_FLOW, "fs: exit  %s\n", __FUNCTION__)
+#define func_enter() fs_dprintk(FS_DEBUG_FLOW, "fs: enter %s\n", __func__)
+#define func_exit()  fs_dprintk(FS_DEBUG_FLOW, "fs: exit  %s\n", __func__)
 
 
 static struct fs_dev *fs_boards = NULL;
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index f97e050338f0..9427a61f62b0 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -95,8 +95,8 @@
 #if 1
 #define ASSERT(expr)     if (!(expr)) { \
                              printk(FORE200E "assertion failed! %s[%d]: %s\n", \
-                                    __FUNCTION__, __LINE__, #expr); \
-                             panic(FORE200E "%s", __FUNCTION__); \
+                                    __func__, __LINE__, #expr); \
+                             panic(FORE200E "%s", __func__); \
                          }
 #else
 #define ASSERT(expr)     do {} while (0)
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index eee54c0cde68..b967919fb7e2 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -555,7 +555,7 @@ idt77252_tx_dump(struct idt77252_dev *card)
         struct vc_map *vc;
         int i;
 
-        printk("%s\n", __FUNCTION__);
+        printk("%s\n", __func__);
         for (i = 0; i < card->tct_size; i++) {
                 vc = card->vcs[i];
                 if (!vc)
@@ -1035,7 +1035,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
         skb = sb_pool_skb(card, le32_to_cpu(rsqe->word_2));
         if (skb == NULL) {
                 printk("%s: NULL skb in %s, rsqe: %08x %08x %08x %08x\n",
-                       card->name, __FUNCTION__,
+                       card->name, __func__,
                        le32_to_cpu(rsqe->word_1), le32_to_cpu(rsqe->word_2),
                        le32_to_cpu(rsqe->word_3), le32_to_cpu(rsqe->word_4));
                 return;
@@ -1873,7 +1873,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,
                         return;
 
                 if (sb_pool_add(card, skb, queue)) {
-                        printk("%s: SB POOL full\n", __FUNCTION__);
+                        printk("%s: SB POOL full\n", __func__);
                         goto outfree;
                 }
 
@@ -1883,7 +1883,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,
                 IDT77252_PRV_PADDR(skb) = paddr;
 
                 if (push_rx_skb(card, skb, queue)) {
-                        printk("%s: FB QUEUE full\n", __FUNCTION__);
+                        printk("%s: FB QUEUE full\n", __func__);
                         goto outunmap;
                 }
         }
@@ -3821,12 +3821,12 @@ static int __init idt77252_init(void)
 {
         struct sk_buff *skb;
 
-        printk("%s: at %p\n", __FUNCTION__, idt77252_init);
+        printk("%s: at %p\n", __func__, idt77252_init);
 
         if (sizeof(skb->cb) < sizeof(struct atm_skb_data) +
                               sizeof(struct idt77252_skb_prv)) {
                 printk(KERN_ERR "%s: skb->cb is too small (%lu < %lu)\n",
-                       __FUNCTION__, (unsigned long) sizeof(skb->cb),
+                       __func__, (unsigned long) sizeof(skb->cb),
                        (unsigned long) sizeof(struct atm_skb_data) +
                                        sizeof(struct idt77252_skb_prv));
                 return -EIO;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 9c0070b5bd3e..7de543d1d0b4 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -621,7 +621,8 @@ static struct kobject *get_device_parent(struct device *dev,
 static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
 {
         /* see if we live in a "glue" directory */
-        if (!dev->class || glue_dir->kset != &dev->class->class_dirs)
+        if (!glue_dir || !dev->class ||
+            glue_dir->kset != &dev->class->class_dirs)
                 return;
 
         kobject_put(glue_dir);
@@ -770,17 +771,10 @@ int device_add(struct device *dev)
         struct class_interface *class_intf;
         int error;
 
-        error = pm_sleep_lock();
-        if (error) {
-                dev_warn(dev, "Suspicious %s during suspend\n", __FUNCTION__);
-                dump_stack();
-                return error;
-        }
-
         dev = get_device(dev);
         if (!dev || !strlen(dev->bus_id)) {
                 error = -EINVAL;
-                goto Error;
+                goto Done;
         }
 
         pr_debug("device: '%s': %s\n", dev->bus_id, __FUNCTION__);
@@ -843,11 +837,9 @@ int device_add(struct device *dev)
         }
  Done:
         put_device(dev);
-        pm_sleep_unlock();
         return error;
  BusError:
         device_pm_remove(dev);
-        dpm_sysfs_remove(dev);
  PMError:
         if (dev->bus)
                 blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index efaf282c438c..911ec600fe71 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -648,7 +648,7 @@ u64 dma_get_required_mask(struct device *dev)
                 high_totalram += high_totalram - 1;
                 mask = (((u64)high_totalram) << 32) + 0xffffffff;
         }
-        return mask & *dev->dma_mask;
+        return mask;
 }
 EXPORT_SYMBOL_GPL(dma_get_required_mask);
 #endif
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index ee9d1c8db0d6..d887d5cb5bef 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -48,7 +48,6 @@
  */
 
 LIST_HEAD(dpm_active);
-static LIST_HEAD(dpm_locked);
 static LIST_HEAD(dpm_off);
 static LIST_HEAD(dpm_off_irq);
 static LIST_HEAD(dpm_destroy);
@@ -81,28 +80,6 @@ void device_pm_add(struct device *dev)
  */
 void device_pm_remove(struct device *dev)
 {
-        /*
-         * If this function is called during a suspend, it will be blocked,
-         * because we're holding the device's semaphore at that time, which may
-         * lead to a deadlock.  In that case we want to print a warning.
-         * However, it may also be called by unregister_dropped_devices() with
-         * the device's semaphore released, in which case the warning should
-         * not be printed.
-         */
-        if (down_trylock(&dev->sem)) {
-                if (down_read_trylock(&pm_sleep_rwsem)) {
-                        /* No suspend in progress, wait on dev->sem */
-                        down(&dev->sem);
-                        up_read(&pm_sleep_rwsem);
-                } else {
-                        /* Suspend in progress, we may deadlock */
-                        dev_warn(dev, "Suspicious %s during suspend\n",
-                                __FUNCTION__);
-                        dump_stack();
-                        /* The user has been warned ... */
-                        down(&dev->sem);
-                }
-        }
         pr_debug("PM: Removing info for %s:%s\n",
                  dev->bus ? dev->bus->name : "No Bus",
                  kobject_name(&dev->kobj));
@@ -110,7 +87,6 @@ void device_pm_remove(struct device *dev)
         dpm_sysfs_remove(dev);
         list_del_init(&dev->power.entry);
         mutex_unlock(&dpm_list_mtx);
-        up(&dev->sem);
 }
 
 /**
@@ -230,6 +206,8 @@ static int resume_device(struct device *dev)
         TRACE_DEVICE(dev);
         TRACE_RESUME(0);
 
+        down(&dev->sem);
+
         if (dev->bus && dev->bus->resume) {
                 dev_dbg(dev,"resuming\n");
                 error = dev->bus->resume(dev);
@@ -245,6 +223,8 @@ static int resume_device(struct device *dev)
                 error = dev->class->resume(dev);
         }
 
+        up(&dev->sem);
+
         TRACE_RESUME(error);
         return error;
 }
@@ -266,7 +246,7 @@ static void dpm_resume(void)
                 struct list_head *entry = dpm_off.next;
                 struct device *dev = to_device(entry);
 
-                list_move_tail(entry, &dpm_locked);
+                list_move_tail(entry, &dpm_active);
                 mutex_unlock(&dpm_list_mtx);
                 resume_device(dev);
                 mutex_lock(&dpm_list_mtx);
@@ -275,25 +255,6 @@ static void dpm_resume(void)
 }
 
 /**
- *      unlock_all_devices - Release each device's semaphore
- *
- *      Go through the dpm_off list.  Put each device on the dpm_active
- *      list and unlock it.
- */
-static void unlock_all_devices(void)
-{
-        mutex_lock(&dpm_list_mtx);
-        while (!list_empty(&dpm_locked)) {
-                struct list_head *entry = dpm_locked.prev;
-                struct device *dev = to_device(entry);
-
-                list_move(entry, &dpm_active);
-                up(&dev->sem);
-        }
-        mutex_unlock(&dpm_list_mtx);
-}
-
-/**
  *      unregister_dropped_devices - Unregister devices scheduled for removal
  *
  *      Unregister all devices on the dpm_destroy list.
@@ -305,7 +266,6 @@ static void unregister_dropped_devices(void)
                 struct list_head *entry = dpm_destroy.next;
                 struct device *dev = to_device(entry);
 
-                up(&dev->sem);
                 mutex_unlock(&dpm_list_mtx);
                 /* This also removes the device from the list */
                 device_unregister(dev);
@@ -324,7 +284,6 @@ void device_resume(void)
 {
         might_sleep();
         dpm_resume();
-        unlock_all_devices();
         unregister_dropped_devices();
         up_write(&pm_sleep_rwsem);
 }
@@ -388,18 +347,15 @@ int device_power_down(pm_message_t state)
                 struct list_head *entry = dpm_off.prev;
                 struct device *dev = to_device(entry);
 
-                list_del_init(&dev->power.entry);
                 error = suspend_device_late(dev, state);
                 if (error) {
                         printk(KERN_ERR "Could not power down device %s: "
                                         "error %d\n",
                                         kobject_name(&dev->kobj), error);
-                        if (list_empty(&dev->power.entry))
-                                list_add(&dev->power.entry, &dpm_off);
                         break;
                 }
-                if (list_empty(&dev->power.entry))
-                        list_add(&dev->power.entry, &dpm_off_irq);
+                if (!list_empty(&dev->power.entry))
+                        list_move(&dev->power.entry, &dpm_off_irq);
         }
 
         if (!error)
@@ -419,6 +375,8 @@ static int suspend_device(struct device *dev, pm_message_t state)
 {
         int error = 0;
 
+        down(&dev->sem);
+
         if (dev->power.power_state.event) {
                 dev_dbg(dev, "PM: suspend %d-->%d\n",
                         dev->power.power_state.event, state.event);
@@ -441,6 +399,9 @@ static int suspend_device(struct device *dev, pm_message_t state)
                 error = dev->bus->suspend(dev, state);
                 suspend_report_result(dev->bus->suspend, error);
         }
+
+        up(&dev->sem);
+
         return error;
 }
 
@@ -461,13 +422,13 @@ static int dpm_suspend(pm_message_t state)
         int error = 0;
 
         mutex_lock(&dpm_list_mtx);
-        while (!list_empty(&dpm_locked)) {
-                struct list_head *entry = dpm_locked.prev;
+        while (!list_empty(&dpm_active)) {
+                struct list_head *entry = dpm_active.prev;
                 struct device *dev = to_device(entry);
 
-                list_del_init(&dev->power.entry);
                 mutex_unlock(&dpm_list_mtx);
                 error = suspend_device(dev, state);
+                mutex_lock(&dpm_list_mtx);
                 if (error) {
                         printk(KERN_ERR "Could not suspend device %s: "
                                         "error %d%s\n",
@@ -476,14 +437,10 @@ static int dpm_suspend(pm_message_t state)
                                         (error == -EAGAIN ?
                                         " (please convert to suspend_late)" :
                                         ""));
-                        mutex_lock(&dpm_list_mtx);
-                        if (list_empty(&dev->power.entry))
-                                list_add(&dev->power.entry, &dpm_locked);
                         break;
                 }
-                mutex_lock(&dpm_list_mtx);
-                if (list_empty(&dev->power.entry))
-                        list_add(&dev->power.entry, &dpm_off);
+                if (!list_empty(&dev->power.entry))
+                        list_move(&dev->power.entry, &dpm_off);
         }
         mutex_unlock(&dpm_list_mtx);
 
@@ -491,36 +448,6 @@ static int dpm_suspend(pm_message_t state)
 }
 
 /**
- *      lock_all_devices - Acquire every device's semaphore
- *
- *      Go through the dpm_active list. Carefully lock each device's
- *      semaphore and put it in on the dpm_locked list.
- */
-static void lock_all_devices(void)
-{
-        mutex_lock(&dpm_list_mtx);
-        while (!list_empty(&dpm_active)) {
-                struct list_head *entry = dpm_active.next;
-                struct device *dev = to_device(entry);
-
-                /* Required locking order is dev->sem first,
-                 * then dpm_list_mutex.  Hence this awkward code.
-                 */
-                get_device(dev);
-                mutex_unlock(&dpm_list_mtx);
-                down(&dev->sem);
-                mutex_lock(&dpm_list_mtx);
-
-                if (list_empty(entry))
-                        up(&dev->sem);          /* Device was removed */
-                else
-                        list_move_tail(entry, &dpm_locked);
-                put_device(dev);
-        }
-        mutex_unlock(&dpm_list_mtx);
-}
-
-/**
  *      device_suspend - Save state and stop all devices in system.
  *      @state: new power management state
  *
@@ -533,7 +460,6 @@ int device_suspend(pm_message_t state)
 
         might_sleep();
         down_write(&pm_sleep_rwsem);
-        lock_all_devices();
         error = dpm_suspend(state);
         if (error)
                 device_resume();
diff --git a/drivers/base/sys.c b/drivers/base/sys.c
index 2f79c55acdcc..8e13fd942163 100644
--- a/drivers/base/sys.c
+++ b/drivers/base/sys.c
@@ -133,6 +133,7 @@ int sysdev_class_register(struct sysdev_class * cls)
         pr_debug("Registering sysdev class '%s'\n",
                  kobject_name(&cls->kset.kobj));
         INIT_LIST_HEAD(&cls->drivers);
+        memset(&cls->kset.kobj, 0x00, sizeof(struct kobject));
         cls->kset.kobj.parent = &system_kset->kobj;
         cls->kset.kobj.ktype = &ktype_sysdev_class;
         cls->kset.kobj.kset = system_kset;
@@ -227,6 +228,9 @@ int sysdev_register(struct sys_device * sysdev)
 
         pr_debug("Registering sys device '%s'\n", kobject_name(&sysdev->kobj));
 
+        /* initialize the kobject to 0, in case it had previously been used */
+        memset(&sysdev->kobj, 0x00, sizeof(struct kobject));
+
         /* Make sure the kset is set */
         sysdev->kobj.kset = &cls->kset;
 
diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c
index f25e7c6b2d27..40bca48abc12 100644
--- a/drivers/base/transport_class.c
+++ b/drivers/base/transport_class.c
@@ -126,9 +126,7 @@ static int transport_setup_classdev(struct attribute_container *cont,
 }
 
 /**
- * transport_setup_device - declare a new dev for transport class association
- *                          but don't make it visible yet.
- *
+ * transport_setup_device - declare a new dev for transport class association but don't make it visible yet.
  * @dev: the generic device representing the entity being added
  *
  * Usually, dev represents some component in the HBA system (either
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 9715be3f2487..55bd35c0f082 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -33,6 +33,7 @@
 #include <linux/blkpg.h>
 #include <linux/timer.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/hdreg.h>
 #include <linux/spinlock.h>
@@ -131,7 +132,6 @@ static struct board_type products[] = {
 /*define how many times we will try a command because of bus resets */
 #define MAX_CMD_RETRIES 3
 
-#define READ_AHEAD       1024
 #define MAX_CTLR        32
 
 /* Originally cciss driver only supports 8 major numbers */
@@ -174,8 +174,6 @@ static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
 static void fail_all_cmds(unsigned long ctlr);
 
 #ifdef CONFIG_PROC_FS
-static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
-                               int length, int *eof, void *data);
 static void cciss_procinit(int i);
 #else
 static void cciss_procinit(int i)
@@ -240,24 +238,46 @@ static inline CommandList_struct *removeQ(CommandList_struct **Qptr,
  */
 #define ENG_GIG 1000000000
 #define ENG_GIG_FACTOR (ENG_GIG/512)
+#define ENGAGE_SCSI     "engage scsi"
 static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
         "UNKNOWN"
 };
 
 static struct proc_dir_entry *proc_cciss;
 
-static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
-                               int length, int *eof, void *data)
+static void cciss_seq_show_header(struct seq_file *seq)
 {
-        off_t pos = 0;
-        off_t len = 0;
-        int size, i, ctlr;
-        ctlr_info_t *h = (ctlr_info_t *) data;
-        drive_info_struct *drv;
-        unsigned long flags;
-        sector_t vol_sz, vol_sz_frac;
+        ctlr_info_t *h = seq->private;
+
+        seq_printf(seq, "%s: HP %s Controller\n"
+                "Board ID: 0x%08lx\n"
+                "Firmware Version: %c%c%c%c\n"
+                "IRQ: %d\n"
+                "Logical drives: %d\n"
+                "Current Q depth: %d\n"
+                "Current # commands on controller: %d\n"
+                "Max Q depth since init: %d\n"
+                "Max # commands on controller since init: %d\n"
+                "Max SG entries since init: %d\n",
+                h->devname,
+                h->product_name,
+                (unsigned long)h->board_id,
+                h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
+                h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
+                h->num_luns,
+                h->Qdepth, h->commands_outstanding,
+                h->maxQsinceinit, h->max_outstanding, h->maxSG);
 
-        ctlr = h->ctlr;
+#ifdef CONFIG_CISS_SCSI_TAPE
+        cciss_seq_tape_report(seq, h->ctlr);
+#endif /* CONFIG_CISS_SCSI_TAPE */
+}
+
+static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        ctlr_info_t *h = seq->private;
+        unsigned ctlr = h->ctlr;
+        unsigned long flags;
 
         /* prevent displaying bogus info during configuration
          * or deconfiguration of a logical volume
@@ -265,115 +285,155 @@ static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
         if (h->busy_configuring) {
                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-                return -EBUSY;
+                return ERR_PTR(-EBUSY);
         }
         h->busy_configuring = 1;
         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 
-        size = sprintf(buffer, "%s: HP %s Controller\n"
-                       "Board ID: 0x%08lx\n"
-                       "Firmware Version: %c%c%c%c\n"
-                       "IRQ: %d\n"
-                       "Logical drives: %d\n"
-                       "Max sectors: %d\n"
-                       "Current Q depth: %d\n"
-                       "Current # commands on controller: %d\n"
-                       "Max Q depth since init: %d\n"
-                       "Max # commands on controller since init: %d\n"
-                       "Max SG entries since init: %d\n\n",
-                       h->devname,
-                       h->product_name,
-                       (unsigned long)h->board_id,
-                       h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
-                       h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
-                       h->num_luns,
-                       h->cciss_max_sectors,
-                       h->Qdepth, h->commands_outstanding,
-                       h->maxQsinceinit, h->max_outstanding, h->maxSG);
-
-        pos += size;
-        len += size;
-        cciss_proc_tape_report(ctlr, buffer, &pos, &len);
-        for (i = 0; i <= h->highest_lun; i++) {
-
-                drv = &h->drv[i];
-                if (drv->heads == 0)
-                        continue;
+        if (*pos == 0)
+                cciss_seq_show_header(seq);
 
-                vol_sz = drv->nr_blocks;
-                vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
-                vol_sz_frac *= 100;
-                sector_div(vol_sz_frac, ENG_GIG_FACTOR);
+        return pos;
+}
+
+static int cciss_seq_show(struct seq_file *seq, void *v)
+{
+        sector_t vol_sz, vol_sz_frac;
+        ctlr_info_t *h = seq->private;
+        unsigned ctlr = h->ctlr;
+        loff_t *pos = v;
+        drive_info_struct *drv = &h->drv[*pos];
+
+        if (*pos > h->highest_lun)
+                return 0;
+
+        if (drv->heads == 0)
+                return 0;
+
+        vol_sz = drv->nr_blocks;
+        vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
+        vol_sz_frac *= 100;
+        sector_div(vol_sz_frac, ENG_GIG_FACTOR);
+
+        if (drv->raid_level > 5)
+                drv->raid_level = RAID_UNKNOWN;
+        seq_printf(seq, "cciss/c%dd%d:"
+                        "\t%4u.%02uGB\tRAID %s\n",
+                        ctlr, (int) *pos, (int)vol_sz, (int)vol_sz_frac,
+                        raid_label[drv->raid_level]);
+        return 0;
+}
+
+static void *cciss_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        ctlr_info_t *h = seq->private;
+
+        if (*pos > h->highest_lun)
+                return NULL;
+        *pos += 1;
+
+        return pos;
+}
+
+static void cciss_seq_stop(struct seq_file *seq, void *v)
+{
+        ctlr_info_t *h = seq->private;
+
+        /* Only reset h->busy_configuring if we succeeded in setting
+         * it during cciss_seq_start. */
+        if (v == ERR_PTR(-EBUSY))
+                return;
 
-                if (drv->raid_level > 5)
-                        drv->raid_level = RAID_UNKNOWN;
-                size = sprintf(buffer + len, "cciss/c%dd%d:"
-                               "\t%4u.%02uGB\tRAID %s\n",
-                               ctlr, i, (int)vol_sz, (int)vol_sz_frac,
-                               raid_label[drv->raid_level]);
-                pos += size;
-                len += size;
-        }
-
-        *eof = 1;
-        *start = buffer + offset;
-        len -= offset;
-        if (len > length)
-                len = length;
         h->busy_configuring = 0;
-        return len;
 }
 
-static int
-cciss_proc_write(struct file *file, const char __user *buffer,
-                 unsigned long count, void *data)
+static struct seq_operations cciss_seq_ops = {
+        .start = cciss_seq_start,
+        .show  = cciss_seq_show,
+        .next  = cciss_seq_next,
+        .stop  = cciss_seq_stop,
+};
+
+static int cciss_seq_open(struct inode *inode, struct file *file)
 {
-        unsigned char cmd[80];
-        int len;
-#ifdef CONFIG_CISS_SCSI_TAPE
-        ctlr_info_t *h = (ctlr_info_t *) data;
-        int rc;
+        int ret = seq_open(file, &cciss_seq_ops);
+        struct seq_file *seq = file->private_data;
+
+        if (!ret)
+                seq->private = PDE(inode)->data;
+
+        return ret;
+}
+
+static ssize_t
+cciss_proc_write(struct file *file, const char __user *buf,
+                 size_t length, loff_t *ppos)
+{
+        int err;
+        char *buffer;
+
+#ifndef CONFIG_CISS_SCSI_TAPE
+        return -EINVAL;
 #endif
 
-        if (count > sizeof(cmd) - 1)
+        if (!buf || length > PAGE_SIZE - 1)
                 return -EINVAL;
-        if (copy_from_user(cmd, buffer, count))
-                return -EFAULT;
-        cmd[count] = '\0';
-        len = strlen(cmd);      // above 3 lines ensure safety
-        if (len && cmd[len - 1] == '\n')
-                cmd[--len] = '\0';
-#       ifdef CONFIG_CISS_SCSI_TAPE
-        if (strcmp("engage scsi", cmd) == 0) {
+
+        buffer = (char *)__get_free_page(GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
+        err = -EFAULT;
+        if (copy_from_user(buffer, buf, length))
+                goto out;
+        buffer[length] = '\0';
+
+#ifdef CONFIG_CISS_SCSI_TAPE
+        if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
+                struct seq_file *seq = file->private_data;
+                ctlr_info_t *h = seq->private;
+                int rc;
+
                 rc = cciss_engage_scsi(h->ctlr);
                 if (rc != 0)
-                        return -rc;
-                return count;
-        }
+                        err = -rc;
+                else
+                        err = length;
+        } else
+#endif /* CONFIG_CISS_SCSI_TAPE */
+                err = -EINVAL;
         /* might be nice to have "disengage" too, but it's not
            safely possible. (only 1 module use count, lock issues.) */
-#       endif
-        return -EINVAL;
+
+out:
+        free_page((unsigned long)buffer);
+        return err;
 }
 
-/*
- * Get us a file in /proc/cciss that says something about each controller.
- * Create /proc/cciss if it doesn't exist yet.
- */
+static struct file_operations cciss_proc_fops = {
+        .owner   = THIS_MODULE,
+        .open    = cciss_seq_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release,
+        .write   = cciss_proc_write,
+};
+
 static void __devinit cciss_procinit(int i)
 {
         struct proc_dir_entry *pde;
 
-        if (proc_cciss == NULL) {
+        if (proc_cciss == NULL)
                 proc_cciss = proc_mkdir("cciss", proc_root_driver);
-                if (!proc_cciss)
-                        return;
-        }
+        if (!proc_cciss)
+                return;
+        pde = proc_create(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
+                                        S_IROTH, proc_cciss,
+                                        &cciss_proc_fops);
+        if (!pde)
+                return;
 
-        pde = create_proc_read_entry(hba[i]->devname,
-                                     S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH,
-                                     proc_cciss, cciss_proc_get_info, hba[i]);
-        pde->write_proc = cciss_proc_write;
+        pde->data = hba[i];
 }
 #endif                          /* CONFIG_PROC_FS */
 
@@ -1341,7 +1401,6 @@ geo_inq:
                 disk->private_data = &h->drv[drv_index];
 
                 /* Set up queue information */
-                disk->queue->backing_dev_info.ra_pages = READ_AHEAD;
                 blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
 
                 /* This is a hardware imposed limit. */
@@ -3434,7 +3493,6 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
                 }
                 drv->queue = q;
 
-                q->backing_dev_info.ra_pages = READ_AHEAD;
                 blk_queue_bounce_limit(q, hba[i]->pdev->dma_mask);
 
                 /* This is a hardware imposed limit. */
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 55178e9973a0..45ac09300eb3 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -1404,21 +1404,18 @@ cciss_engage_scsi(int ctlr)
 }
 
 static void
-cciss_proc_tape_report(int ctlr, unsigned char *buffer, off_t *pos, off_t *len)
+cciss_seq_tape_report(struct seq_file *seq, int ctlr)
 {
         unsigned long flags;
-        int size;
-
-        *pos = *pos -1; *len = *len - 1; // cut off the last trailing newline
 
         CPQ_TAPE_LOCK(ctlr, flags);
-        size = sprintf(buffer + *len, 
+        seq_printf(seq,
                 "Sequential access devices: %d\n\n",
                         ccissscsi[ctlr].ndevices);
         CPQ_TAPE_UNLOCK(ctlr, flags);
-        *pos += size; *len += size;
 }
 
+
 /* Need at least one of these error handlers to keep ../scsi/hosts.c from 
  * complaining.  Doing a host- or bus-reset can't do anything good here. 
  * Despite what it might say in scsi_error.c, there may well be commands
@@ -1498,6 +1495,5 @@ static int  cciss_eh_abort_handler(struct scsi_cmnd *scsicmd)
 #define cciss_scsi_setup(cntl_num)
 #define cciss_unregister_scsi(ctlr)
 #define cciss_register_scsi(ctlr)
-#define cciss_proc_tape_report(ctlr, buffer, pos, len)
 
 #endif /* CONFIG_CISS_SCSI_TAPE */
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 674cd66dcaba..18feb1c7c33b 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -849,7 +849,8 @@ static int pkt_flush_cache(struct pktcdvd_device *pd)
 /*
  * speed is given as the normal factor, e.g. 4 for 4x
  */
-static int pkt_set_speed(struct pktcdvd_device *pd, unsigned write_speed, unsigned read_speed)
+static noinline_for_stack int pkt_set_speed(struct pktcdvd_device *pd,
+                                unsigned write_speed, unsigned read_speed)
 {
         struct packet_command cgc;
         struct request_sense sense;
@@ -1776,7 +1777,8 @@ static int pkt_get_track_info(struct pktcdvd_device *pd, __u16 track, __u8 type,
         return pkt_generic_packet(pd, &cgc);
 }
 
-static int pkt_get_last_written(struct pktcdvd_device *pd, long *last_written)
+static noinline_for_stack int pkt_get_last_written(struct pktcdvd_device *pd,
+                                                long *last_written)
 {
         disc_information di;
         track_information ti;
@@ -1813,7 +1815,7 @@ static int pkt_get_last_written(struct pktcdvd_device *pd, long *last_written)
 /*
  * write mode select package based on pd->settings
  */
-static int pkt_set_write_settings(struct pktcdvd_device *pd)
+static noinline_for_stack int pkt_set_write_settings(struct pktcdvd_device *pd)
 {
         struct packet_command cgc;
         struct request_sense sense;
@@ -1972,7 +1974,7 @@ static int pkt_writable_disc(struct pktcdvd_device *pd, disc_information *di)
         return 1;
 }
 
-static int pkt_probe_settings(struct pktcdvd_device *pd)
+static noinline_for_stack int pkt_probe_settings(struct pktcdvd_device *pd)
 {
         struct packet_command cgc;
         unsigned char buf[12];
@@ -2071,7 +2073,8 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
 /*
  * enable/disable write caching on drive
  */
-static int pkt_write_caching(struct pktcdvd_device *pd, int set)
+static noinline_for_stack int pkt_write_caching(struct pktcdvd_device *pd,
+                                                int set)
 {
         struct packet_command cgc;
         struct request_sense sense;
@@ -2116,7 +2119,8 @@ static int pkt_lock_door(struct pktcdvd_device *pd, int lockflag)
 /*
  * Returns drive maximum write speed
  */
-static int pkt_get_max_speed(struct pktcdvd_device *pd, unsigned *write_speed)
+static noinline_for_stack int pkt_get_max_speed(struct pktcdvd_device *pd,
+                                                unsigned *write_speed)
 {
         struct packet_command cgc;
         struct request_sense sense;
@@ -2177,7 +2181,8 @@ static char us_clv_to_speed[16] = {
 /*
  * reads the maximum media speed from ATIP
  */
-static int pkt_media_speed(struct pktcdvd_device *pd, unsigned *speed)
+static noinline_for_stack int pkt_media_speed(struct pktcdvd_device *pd,
+                                                unsigned *speed)
 {
         struct packet_command cgc;
         struct request_sense sense;
@@ -2249,7 +2254,7 @@ static int pkt_media_speed(struct pktcdvd_device *pd, unsigned *speed)
         }
 }
 
-static int pkt_perform_opc(struct pktcdvd_device *pd)
+static noinline_for_stack int pkt_perform_opc(struct pktcdvd_device *pd)
 {
         struct packet_command cgc;
         struct request_sense sense;
diff --git a/drivers/block/viodasd.c b/drivers/block/viodasd.c
index 9e61fca46117..41ca721d2523 100644
--- a/drivers/block/viodasd.c
+++ b/drivers/block/viodasd.c
@@ -528,8 +528,7 @@ static int block_event_to_scatterlist(const struct vioblocklpevent *bevent,
                 numsg = VIOMAXBLOCKDMA;
 
         *total_len = 0;
-        memset(sg, 0, sizeof(sg[0]) * VIOMAXBLOCKDMA);
-
+        sg_init_table(sg, VIOMAXBLOCKDMA);
         for (i = 0; (i < numsg) && (rw_data->dma_info[i].len > 0); ++i) {
                 sg_dma_address(&sg[i]) = rw_data->dma_info[i].token;
                 sg_dma_len(&sg[i]) = rw_data->dma_info[i].len;
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 372c7ef633da..8b884f87d8b7 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -116,6 +116,7 @@ static struct usb_device_id blacklist_ids[] = {
         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = HCI_BCM92035 },
 
         /* Broadcom BCM2045 */
+        { USB_DEVICE(0x0a5c, 0x2039), .driver_info = HCI_RESET | HCI_WRONG_SCO_MTU },
         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = HCI_RESET | HCI_WRONG_SCO_MTU },
 
         /* IBM/Lenovo ThinkPad with Broadcom chip */
@@ -148,6 +149,9 @@ static struct usb_device_id blacklist_ids[] = {
         { USB_DEVICE(0x0400, 0x0807), .driver_info = HCI_BROKEN_ISOC },
         { USB_DEVICE(0x0400, 0x080a), .driver_info = HCI_BROKEN_ISOC },
 
+        /* CONWISE Technology based adapters with buggy SCO support */
+        { USB_DEVICE(0x0e5e, 0x6622), .driver_info = HCI_BROKEN_ISOC },
+
         /* Belkin F8T012 and F8T013 devices */
         { USB_DEVICE(0x050d, 0x0012), .driver_info = HCI_RESET | HCI_WRONG_SCO_MTU },
         { USB_DEVICE(0x050d, 0x0013), .driver_info = HCI_RESET | HCI_WRONG_SCO_MTU },
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index db259e60289b..12f5baea439b 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1152,8 +1152,8 @@ clean_up_and_return:
 /* This code is similar to that in open_for_data. The routine is called
    whenever an audio play operation is requested.
 */
-int check_for_audio_disc(struct cdrom_device_info * cdi,
-                         struct cdrom_device_ops * cdo)
+static int check_for_audio_disc(struct cdrom_device_info * cdi,
+                                struct cdrom_device_ops * cdo)
 {
         int ret;
         tracktype tracks;
diff --git a/drivers/char/defkeymap.c_shipped b/drivers/char/defkeymap.c_shipped
index 0aa419a61767..d2208dfe3f67 100644
--- a/drivers/char/defkeymap.c_shipped
+++ b/drivers/char/defkeymap.c_shipped
@@ -223,40 +223,40 @@ char *func_table[MAX_NR_FUNC] = {
 };
 
 struct kbdiacruc accent_table[MAX_DIACR] = {
-        {'`', 'A', '\300'},     {'`', 'a', '\340'},
-        {'\'', 'A', '\301'},    {'\'', 'a', '\341'},
-        {'^', 'A', '\302'},     {'^', 'a', '\342'},
-        {'~', 'A', '\303'},     {'~', 'a', '\343'},
-        {'"', 'A', '\304'},     {'"', 'a', '\344'},
-        {'O', 'A', '\305'},     {'o', 'a', '\345'},
-        {'0', 'A', '\305'},     {'0', 'a', '\345'},
-        {'A', 'A', '\305'},     {'a', 'a', '\345'},
-        {'A', 'E', '\306'},     {'a', 'e', '\346'},
-        {',', 'C', '\307'},     {',', 'c', '\347'},
-        {'`', 'E', '\310'},     {'`', 'e', '\350'},
-        {'\'', 'E', '\311'},    {'\'', 'e', '\351'},
-        {'^', 'E', '\312'},     {'^', 'e', '\352'},
-        {'"', 'E', '\313'},     {'"', 'e', '\353'},
-        {'`', 'I', '\314'},     {'`', 'i', '\354'},
-        {'\'', 'I', '\315'},    {'\'', 'i', '\355'},
-        {'^', 'I', '\316'},     {'^', 'i', '\356'},
-        {'"', 'I', '\317'},     {'"', 'i', '\357'},
-        {'-', 'D', '\320'},     {'-', 'd', '\360'},
-        {'~', 'N', '\321'},     {'~', 'n', '\361'},
-        {'`', 'O', '\322'},     {'`', 'o', '\362'},
-        {'\'', 'O', '\323'},    {'\'', 'o', '\363'},
-        {'^', 'O', '\324'},     {'^', 'o', '\364'},
-        {'~', 'O', '\325'},     {'~', 'o', '\365'},
-        {'"', 'O', '\326'},     {'"', 'o', '\366'},
-        {'/', 'O', '\330'},     {'/', 'o', '\370'},
-        {'`', 'U', '\331'},     {'`', 'u', '\371'},
-        {'\'', 'U', '\332'},    {'\'', 'u', '\372'},
-        {'^', 'U', '\333'},     {'^', 'u', '\373'},
-        {'"', 'U', '\334'},     {'"', 'u', '\374'},
-        {'\'', 'Y', '\335'},    {'\'', 'y', '\375'},
-        {'T', 'H', '\336'},     {'t', 'h', '\376'},
-        {'s', 's', '\337'},     {'"', 'y', '\377'},
-        {'s', 'z', '\337'},     {'i', 'j', '\377'},
+        {'`', 'A', 0300},       {'`', 'a', 0340},
+        {'\'', 'A', 0301},      {'\'', 'a', 0341},
+        {'^', 'A', 0302},       {'^', 'a', 0342},
+        {'~', 'A', 0303},       {'~', 'a', 0343},
+        {'"', 'A', 0304},       {'"', 'a', 0344},
+        {'O', 'A', 0305},       {'o', 'a', 0345},
+        {'0', 'A', 0305},       {'0', 'a', 0345},
+        {'A', 'A', 0305},       {'a', 'a', 0345},
+        {'A', 'E', 0306},       {'a', 'e', 0346},
+        {',', 'C', 0307},       {',', 'c', 0347},
+        {'`', 'E', 0310},       {'`', 'e', 0350},
+        {'\'', 'E', 0311},      {'\'', 'e', 0351},
+        {'^', 'E', 0312},       {'^', 'e', 0352},
+        {'"', 'E', 0313},       {'"', 'e', 0353},
+        {'`', 'I', 0314},       {'`', 'i', 0354},
+        {'\'', 'I', 0315},      {'\'', 'i', 0355},
+        {'^', 'I', 0316},       {'^', 'i', 0356},
+        {'"', 'I', 0317},       {'"', 'i', 0357},
+        {'-', 'D', 0320},       {'-', 'd', 0360},
+        {'~', 'N', 0321},       {'~', 'n', 0361},
+        {'`', 'O', 0322},       {'`', 'o', 0362},
+        {'\'', 'O', 0323},      {'\'', 'o', 0363},
+        {'^', 'O', 0324},       {'^', 'o', 0364},
+        {'~', 'O', 0325},       {'~', 'o', 0365},
+        {'"', 'O', 0326},       {'"', 'o', 0366},
+        {'/', 'O', 0330},       {'/', 'o', 0370},
+        {'`', 'U', 0331},       {'`', 'u', 0371},
+        {'\'', 'U', 0332},      {'\'', 'u', 0372},
+        {'^', 'U', 0333},       {'^', 'u', 0373},
+        {'"', 'U', 0334},       {'"', 'u', 0374},
+        {'\'', 'Y', 0335},      {'\'', 'y', 0375},
+        {'T', 'H', 0336},       {'t', 'h', 0376},
+        {'s', 's', 0337},       {'"', 'y', 0377},
+        {'s', 'z', 0337},       {'i', 'j', 0377},
 };
 
 unsigned int accent_table_size = 68;
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
index c01e26d9ee5e..f3fe62067344 100644
--- a/drivers/char/esp.c
+++ b/drivers/char/esp.c
@@ -2484,6 +2484,7 @@ static int __init espserial_init(void)
                         return 0;
                 }
 
+                spin_lock_init(&info->lock);
                 /* rx_trigger, tx_trigger are needed by autoconfig */
                 info->config.rx_trigger = rx_trigger;
                 info->config.tx_trigger = tx_trigger;
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 85d596a3c18c..eba2883b630e 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -1527,7 +1527,7 @@ static int __devinit reset_card(struct pci_dev *pdev,
         msleep(10);
 
         portcount = inw(base + 0x2);
-        if (!inw(base + 0xe) & 0x1 || (portcount != 0 && portcount != 4 &&
+        if (!(inw(base + 0xe) & 0x1) || (portcount != 0 && portcount != 4 &&
                                 portcount != 8 && portcount != 16)) {
                 dev_err(&pdev->dev, "ISILoad:PCI Card%d reset failure.\n",
                         card + 1);
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index dfaab2322de3..6d0dc5f9b6bb 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -190,6 +190,14 @@ enum card_type {
         F32_8 = 8192,   /* 3072 bytes downl. + 1024 bytes uplink * 2 -> 8192 */
 };
 
+/* Initialization states a card can be in */
+enum card_state {
+        NOZOMI_STATE_UKNOWN     = 0,
+        NOZOMI_STATE_ENABLED    = 1,    /* pci device enabled */
+        NOZOMI_STATE_ALLOCATED  = 2,    /* config setup done */
+        NOZOMI_STATE_READY      = 3,    /* flowcontrols received */
+};
+
 /* Two different toggle channels exist */
 enum channel_type {
         CH_A = 0,
@@ -385,6 +393,7 @@ struct nozomi {
         spinlock_t spin_mutex;  /* secures access to registers and tty */
 
         unsigned int index_start;
+        enum card_state state;
         u32 open_ttys;
 };
 
@@ -686,6 +695,7 @@ static int nozomi_read_config_table(struct nozomi *dc)
                 dc->last_ier = dc->last_ier | CTRL_DL;
                 writew(dc->last_ier, dc->reg_ier);
 
+                dc->state = NOZOMI_STATE_ALLOCATED;
                 dev_info(&dc->pdev->dev, "Initialization OK!\n");
                 return 1;
         }
@@ -944,6 +954,14 @@ static int receive_flow_control(struct nozomi *dc)
         case CTRL_APP2:
                 port = PORT_APP2;
                 enable_ier = APP2_DL;
+                if (dc->state == NOZOMI_STATE_ALLOCATED) {
+                        /*
+                         * After card initialization the flow control
+                         * received for APP2 is always the last
+                         */
+                        dc->state = NOZOMI_STATE_READY;
+                        dev_info(&dc->pdev->dev, "Device READY!\n");
+                }
                 break;
         default:
                 dev_err(&dc->pdev->dev,
@@ -1366,22 +1384,12 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
 
         dc->pdev = pdev;
 
-        /* Find out what card type it is */
-        nozomi_get_card_type(dc);
-
         ret = pci_enable_device(dc->pdev);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to enable PCI Device\n");
                 goto err_free;
         }
 
-        start = pci_resource_start(dc->pdev, 0);
-        if (start == 0) {
-                dev_err(&pdev->dev, "No I/O address for card detected\n");
-                ret = -ENODEV;
-                goto err_disable_device;
-        }
-
         ret = pci_request_regions(dc->pdev, NOZOMI_NAME);
         if (ret) {
                 dev_err(&pdev->dev, "I/O address 0x%04x already in use\n",
@@ -1389,6 +1397,16 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
                 goto err_disable_device;
         }
 
+        start = pci_resource_start(dc->pdev, 0);
+        if (start == 0) {
+                dev_err(&pdev->dev, "No I/O address for card detected\n");
+                ret = -ENODEV;
+                goto err_rel_regs;
+        }
+
+        /* Find out what card type it is */
+        nozomi_get_card_type(dc);
+
         dc->base_addr = ioremap(start, dc->card_type);
         if (!dc->base_addr) {
                 dev_err(&pdev->dev, "Unable to map card MMIO\n");
@@ -1425,6 +1443,14 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
         dc->index_start = ndev_idx * MAX_PORT;
         ndevs[ndev_idx] = dc;
 
+        pci_set_drvdata(pdev, dc);
+
+        /* Enable RESET interrupt */
+        dc->last_ier = RESET;
+        iowrite16(dc->last_ier, dc->reg_ier);
+
+        dc->state = NOZOMI_STATE_ENABLED;
+
         for (i = 0; i < MAX_PORT; i++) {
                 mutex_init(&dc->port[i].tty_sem);
                 dc->port[i].tty_open_count = 0;
@@ -1433,12 +1459,6 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
                                                         &pdev->dev);
         }
 
-        /* Enable  RESET interrupt. */
-        dc->last_ier = RESET;
-        writew(dc->last_ier, dc->reg_ier);
-
-        pci_set_drvdata(pdev, dc);
-
         return 0;
 
 err_free_sbuf:
@@ -1553,7 +1573,7 @@ static int ntty_open(struct tty_struct *tty, struct file *file)
         struct nozomi *dc = get_dc_by_tty(tty);
         unsigned long flags;
 
-        if (!port || !dc)
+        if (!port || !dc || dc->state != NOZOMI_STATE_READY)
                 return -ENODEV;
 
         if (mutex_lock_interruptible(&port->tty_sem))
@@ -1716,6 +1736,10 @@ static int ntty_tiocmget(struct tty_struct *tty, struct file *file)
 static int ntty_tiocmset(struct tty_struct *tty, struct file *file,
         unsigned int set, unsigned int clear)
 {
+        struct nozomi *dc = get_dc_by_tty(tty);
+        unsigned long flags;
+
+        spin_lock_irqsave(&dc->spin_mutex, flags);
         if (set & TIOCM_RTS)
                 set_rts(tty, 1);
         else if (clear & TIOCM_RTS)
@@ -1725,6 +1749,7 @@ static int ntty_tiocmset(struct tty_struct *tty, struct file *file,
                 set_dtr(tty, 1);
         else if (clear & TIOCM_DTR)
                 set_dtr(tty, 0);
+        spin_unlock_irqrestore(&dc->spin_mutex, flags);
 
         return 0;
 }
@@ -1762,7 +1787,7 @@ static int ntty_ioctl_tiocgicount(struct port *port, void __user *argp)
         icount.brk = cnow.brk;
         icount.buf_overrun = cnow.buf_overrun;
 
-        return copy_to_user(argp, &icount, sizeof(icount));
+        return copy_to_user(argp, &icount, sizeof(icount)) ? -EFAULT : 0;
 }
 
 static int ntty_ioctl(struct tty_struct *tty, struct file *file,
diff --git a/drivers/char/pcmcia/ipwireless/network.c b/drivers/char/pcmcia/ipwireless/network.c
index ff35230058d3..d793e68b3e0d 100644
--- a/drivers/char/pcmcia/ipwireless/network.c
+++ b/drivers/char/pcmcia/ipwireless/network.c
@@ -377,13 +377,16 @@ void ipwireless_network_packet_received(struct ipw_network *network,
         for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) {
                 struct ipw_tty *tty = network->associated_ttys[channel_idx][i];
 
+                if (!tty)
+                        continue;
+
                 /*
                  * If it's associated with a tty (other than the RAS channel
                  * when we're online), then send the data to that tty.  The RAS
                  * channel's data is handled above - it always goes through
                  * ppp_generic.
                  */
-                if (tty && channel_idx == IPW_CHANNEL_RAS
+                if (channel_idx == IPW_CHANNEL_RAS
                                 && (network->ras_control_lines &
                                         IPW_CONTROL_LINE_DCD) != 0
                                 && ipwireless_tty_is_modem(tty)) {
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 8fc4fe4e38f1..589ac6f65b9a 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -1620,14 +1620,8 @@ static int __init rc_init_drivers(void)
 
 static void rc_release_drivers(void)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&riscom_lock, flags);
-
         tty_unregister_driver(riscom_driver);
         put_tty_driver(riscom_driver);
-
-        spin_unlock_irqrestore(&riscom_lock, flags);
 }
 
 #ifndef MODULE
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index 78b151c4d20f..5c3142b6f1fc 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -110,8 +110,8 @@ static int rtc_has_irq = 1;
 #define hpet_set_rtc_irq_bit(arg)               0
 #define hpet_rtc_timer_init()                   do { } while (0)
 #define hpet_rtc_dropped_irq()                  0
-#define hpet_register_irq_handler(h)            0
-#define hpet_unregister_irq_handler(h)          0
+#define hpet_register_irq_handler(h)            ({ 0; })
+#define hpet_unregister_irq_handler(h)          ({ 0; })
 #ifdef RTC_IRQ
 static irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
 {
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index c0e08c7bca2f..5ff83df67b44 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -2109,7 +2109,6 @@ static void sx_throttle(struct tty_struct * tty)
         sx_out(bp, CD186x_CAR, port_No(port));
         spin_unlock_irqrestore(&bp->lock, flags);
         if (I_IXOFF(tty)) {
-                spin_unlock_irqrestore(&bp->lock, flags);
                 sx_wait_CCR(bp);
                 spin_lock_irqsave(&bp->lock, flags);
                 sx_out(bp, CD186x_CCR, CCR_SSCH2);
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 367be9175061..9b58b894f823 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -702,6 +702,7 @@ void redraw_screen(struct vc_data *vc, int is_switch)
         if (is_switch) {
                 set_leds();
                 compute_shiftstate();
+                notify_update(vc);
         }
 }
 
diff --git a/drivers/char/xilinx_hwicap/buffer_icap.c b/drivers/char/xilinx_hwicap/buffer_icap.c
index dfea2bde162b..f577daedb630 100644
--- a/drivers/char/xilinx_hwicap/buffer_icap.c
+++ b/drivers/char/xilinx_hwicap/buffer_icap.c
@@ -73,8 +73,8 @@
 #define XHI_BUFFER_START 0
 
 /**
- * buffer_icap_get_status: Get the contents of the status register.
- * @parameter base_address: is the base address of the device
+ * buffer_icap_get_status - Get the contents of the status register.
+ * @base_address: is the base address of the device
  *
  * The status register contains the ICAP status and the done bit.
  *
@@ -94,9 +94,9 @@ static inline u32 buffer_icap_get_status(void __iomem *base_address)
 }
 
 /**
- * buffer_icap_get_bram: Reads data from the storage buffer bram.
- * @parameter base_address: contains the base address of the component.
- * @parameter offset: The word offset from which the data should be read.
+ * buffer_icap_get_bram - Reads data from the storage buffer bram.
+ * @base_address: contains the base address of the component.
+ * @offset: The word offset from which the data should be read.
  *
  * A bram is used as a configuration memory cache.  One frame of data can
  * be stored in this "storage buffer".
@@ -108,8 +108,8 @@ static inline u32 buffer_icap_get_bram(void __iomem *base_address,
 }
 
 /**
- * buffer_icap_busy: Return true if the icap device is busy
- * @parameter base_address: is the base address of the device
+ * buffer_icap_busy - Return true if the icap device is busy
+ * @base_address: is the base address of the device
  *
  * The queries the low order bit of the status register, which
  * indicates whether the current configuration or readback operation
@@ -121,8 +121,8 @@ static inline bool buffer_icap_busy(void __iomem *base_address)
 }
 
 /**
- * buffer_icap_busy: Return true if the icap device is not busy
- * @parameter base_address: is the base address of the device
+ * buffer_icap_busy - Return true if the icap device is not busy
+ * @base_address: is the base address of the device
  *
  * The queries the low order bit of the status register, which
  * indicates whether the current configuration or readback operation
@@ -134,9 +134,9 @@ static inline bool buffer_icap_done(void __iomem *base_address)
 }
 
 /**
- * buffer_icap_set_size: Set the size register.
- * @parameter base_address: is the base address of the device
- * @parameter data: The size in bytes.
+ * buffer_icap_set_size - Set the size register.
+ * @base_address: is the base address of the device
+ * @data: The size in bytes.
  *
  * The size register holds the number of 8 bit bytes to transfer between
  * bram and the icap (or icap to bram).
@@ -148,9 +148,9 @@ static inline void buffer_icap_set_size(void __iomem *base_address,
 }
 
 /**
- * buffer_icap_mSetoffsetReg: Set the bram offset register.
- * @parameter base_address: contains the base address of the device.
- * @parameter data: is the value to be written to the data register.
+ * buffer_icap_set_offset - Set the bram offset register.
+ * @base_address: contains the base address of the device.
+ * @data: is the value to be written to the data register.
  *
  * The bram offset register holds the starting bram address to transfer
  * data from during configuration or write data to during readback.
@@ -162,9 +162,9 @@ static inline void buffer_icap_set_offset(void __iomem *base_address,
 }
 
 /**
- * buffer_icap_set_rnc: Set the RNC (Readback not Configure) register.
- * @parameter base_address: contains the base address of the device.
- * @parameter data: is the value to be written to the data register.
+ * buffer_icap_set_rnc - Set the RNC (Readback not Configure) register.
+ * @base_address: contains the base address of the device.
+ * @data: is the value to be written to the data register.
  *
  * The RNC register determines the direction of the data transfer.  It
  * controls whether a configuration or readback take place.  Writing to
@@ -178,10 +178,10 @@ static inline void buffer_icap_set_rnc(void __iomem *base_address,
 }
 
 /**
- * buffer_icap_set_bram: Write data to the storage buffer bram.
- * @parameter base_address: contains the base address of the component.
- * @parameter offset: The word offset at which the data should be written.
- * @parameter data: The value to be written to the bram offset.
+ * buffer_icap_set_bram - Write data to the storage buffer bram.
+ * @base_address: contains the base address of the component.
+ * @offset: The word offset at which the data should be written.
+ * @data: The value to be written to the bram offset.
  *
  * A bram is used as a configuration memory cache.  One frame of data can
  * be stored in this "storage buffer".
@@ -193,10 +193,10 @@ static inline void buffer_icap_set_bram(void __iomem *base_address,
 }
 
 /**
- * buffer_icap_device_read: Transfer bytes from ICAP to the storage buffer.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter offset: The storage buffer start address.
- * @parameter count: The number of words (32 bit) to read from the
+ * buffer_icap_device_read - Transfer bytes from ICAP to the storage buffer.
+ * @drvdata: a pointer to the drvdata.
+ * @offset: The storage buffer start address.
+ * @count: The number of words (32 bit) to read from the
  *           device (ICAP).
  **/
 static int buffer_icap_device_read(struct hwicap_drvdata *drvdata,
@@ -227,10 +227,10 @@ static int buffer_icap_device_read(struct hwicap_drvdata *drvdata,
 };
 
 /**
- * buffer_icap_device_write: Transfer bytes from ICAP to the storage buffer.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter offset: The storage buffer start address.
- * @parameter count: The number of words (32 bit) to read from the
+ * buffer_icap_device_write - Transfer bytes from ICAP to the storage buffer.
+ * @drvdata: a pointer to the drvdata.
+ * @offset: The storage buffer start address.
+ * @count: The number of words (32 bit) to read from the
  *           device (ICAP).
  **/
 static int buffer_icap_device_write(struct hwicap_drvdata *drvdata,
@@ -261,8 +261,8 @@ static int buffer_icap_device_write(struct hwicap_drvdata *drvdata,
 };
 
 /**
- * buffer_icap_reset: Reset the logic of the icap device.
- * @parameter drvdata: a pointer to the drvdata.
+ * buffer_icap_reset - Reset the logic of the icap device.
+ * @drvdata: a pointer to the drvdata.
  *
  * Writing to the status register resets the ICAP logic in an internal
  * version of the core.  For the version of the core published in EDK,
@@ -274,10 +274,10 @@ void buffer_icap_reset(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * buffer_icap_set_configuration: Load a partial bitstream from system memory.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter data: Kernel address of the partial bitstream.
- * @parameter size: the size of the partial bitstream in 32 bit words.
+ * buffer_icap_set_configuration - Load a partial bitstream from system memory.
+ * @drvdata: a pointer to the drvdata.
+ * @data: Kernel address of the partial bitstream.
+ * @size: the size of the partial bitstream in 32 bit words.
  **/
 int buffer_icap_set_configuration(struct hwicap_drvdata *drvdata, u32 *data,
                              u32 size)
@@ -333,10 +333,10 @@ int buffer_icap_set_configuration(struct hwicap_drvdata *drvdata, u32 *data,
 };
 
 /**
- * buffer_icap_get_configuration: Read configuration data from the device.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter data: Address of the data representing the partial bitstream
- * @parameter size: the size of the partial bitstream in 32 bit words.
+ * buffer_icap_get_configuration - Read configuration data from the device.
+ * @drvdata: a pointer to the drvdata.
+ * @data: Address of the data representing the partial bitstream
+ * @size: the size of the partial bitstream in 32 bit words.
  **/
 int buffer_icap_get_configuration(struct hwicap_drvdata *drvdata, u32 *data,
                              u32 size)
diff --git a/drivers/char/xilinx_hwicap/fifo_icap.c b/drivers/char/xilinx_hwicap/fifo_icap.c
index 0988314694a6..6f45dbd47125 100644
--- a/drivers/char/xilinx_hwicap/fifo_icap.c
+++ b/drivers/char/xilinx_hwicap/fifo_icap.c
@@ -94,9 +94,9 @@
 
 
 /**
- * fifo_icap_fifo_write: Write data to the write FIFO.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter data: the 32-bit value to be written to the FIFO.
+ * fifo_icap_fifo_write - Write data to the write FIFO.
+ * @drvdata: a pointer to the drvdata.
+ * @data: the 32-bit value to be written to the FIFO.
  *
  * This function will silently fail if the fifo is full.
  **/
@@ -108,8 +108,8 @@ static inline void fifo_icap_fifo_write(struct hwicap_drvdata *drvdata,
 }
 
 /**
- * fifo_icap_fifo_read: Read data from the Read FIFO.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_fifo_read - Read data from the Read FIFO.
+ * @drvdata: a pointer to the drvdata.
  *
  * This function will silently fail if the fifo is empty.
  **/
@@ -121,9 +121,9 @@ static inline u32 fifo_icap_fifo_read(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * fifo_icap_set_read_size: Set the the size register.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter data: the size of the following read transaction, in words.
+ * fifo_icap_set_read_size - Set the the size register.
+ * @drvdata: a pointer to the drvdata.
+ * @data: the size of the following read transaction, in words.
  **/
 static inline void fifo_icap_set_read_size(struct hwicap_drvdata *drvdata,
                 u32 data)
@@ -132,8 +132,8 @@ static inline void fifo_icap_set_read_size(struct hwicap_drvdata *drvdata,
 }
 
 /**
- * fifo_icap_start_config: Initiate a configuration (write) to the device.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_start_config - Initiate a configuration (write) to the device.
+ * @drvdata: a pointer to the drvdata.
  **/
 static inline void fifo_icap_start_config(struct hwicap_drvdata *drvdata)
 {
@@ -142,8 +142,8 @@ static inline void fifo_icap_start_config(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * fifo_icap_start_readback: Initiate a readback from the device.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_start_readback - Initiate a readback from the device.
+ * @drvdata: a pointer to the drvdata.
  **/
 static inline void fifo_icap_start_readback(struct hwicap_drvdata *drvdata)
 {
@@ -152,8 +152,8 @@ static inline void fifo_icap_start_readback(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * fifo_icap_busy: Return true if the ICAP is still processing a transaction.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_busy - Return true if the ICAP is still processing a transaction.
+ * @drvdata: a pointer to the drvdata.
  **/
 static inline u32 fifo_icap_busy(struct hwicap_drvdata *drvdata)
 {
@@ -163,8 +163,8 @@ static inline u32 fifo_icap_busy(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * fifo_icap_write_fifo_vacancy: Query the write fifo available space.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_write_fifo_vacancy - Query the write fifo available space.
+ * @drvdata: a pointer to the drvdata.
  *
  * Return the number of words that can be safely pushed into the write fifo.
  **/
@@ -175,8 +175,8 @@ static inline u32 fifo_icap_write_fifo_vacancy(
 }
 
 /**
- * fifo_icap_read_fifo_occupancy: Query the read fifo available data.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_read_fifo_occupancy - Query the read fifo available data.
+ * @drvdata: a pointer to the drvdata.
  *
  * Return the number of words that can be safely read from the read fifo.
  **/
@@ -187,11 +187,11 @@ static inline u32 fifo_icap_read_fifo_occupancy(
 }
 
 /**
- * fifo_icap_set_configuration: Send configuration data to the ICAP.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter frame_buffer: a pointer to the data to be written to the
+ * fifo_icap_set_configuration - Send configuration data to the ICAP.
+ * @drvdata: a pointer to the drvdata.
+ * @frame_buffer: a pointer to the data to be written to the
  *              ICAP device.
- * @parameter num_words: the number of words (32 bit) to write to the ICAP
+ * @num_words: the number of words (32 bit) to write to the ICAP
  *              device.
 
  * This function writes the given user data to the Write FIFO in
@@ -266,10 +266,10 @@ int fifo_icap_set_configuration(struct hwicap_drvdata *drvdata,
 }
 
 /**
- * fifo_icap_get_configuration: Read configuration data from the device.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter data: Address of the data representing the partial bitstream
- * @parameter size: the size of the partial bitstream in 32 bit words.
+ * fifo_icap_get_configuration - Read configuration data from the device.
+ * @drvdata: a pointer to the drvdata.
+ * @data: Address of the data representing the partial bitstream
+ * @size: the size of the partial bitstream in 32 bit words.
  *
  * This function reads the specified number of words from the ICAP device in
  * the polled mode.
@@ -335,8 +335,8 @@ int fifo_icap_get_configuration(struct hwicap_drvdata *drvdata,
 }
 
 /**
- * buffer_icap_reset: Reset the logic of the icap device.
- * @parameter drvdata: a pointer to the drvdata.
+ * buffer_icap_reset - Reset the logic of the icap device.
+ * @drvdata: a pointer to the drvdata.
  *
  * This function forces the software reset of the complete HWICAP device.
  * All the registers will return to the default value and the FIFO is also
@@ -360,8 +360,8 @@ void fifo_icap_reset(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * fifo_icap_flush_fifo: This function flushes the FIFOs in the device.
- * @parameter drvdata: a pointer to the drvdata.
+ * fifo_icap_flush_fifo - This function flushes the FIFOs in the device.
+ * @drvdata: a pointer to the drvdata.
  */
 void fifo_icap_flush_fifo(struct hwicap_drvdata *drvdata)
 {
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index 24f6aef0fd3c..2284fa2a5a57 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -84,7 +84,7 @@
 #include <linux/init.h>
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 #include <linux/sysctl.h>
 #include <linux/version.h>
 #include <linux/fs.h>
@@ -119,6 +119,7 @@ module_param(xhwicap_minor, int, S_IRUGO);
 
 /* An array, which is set to true when the device is registered. */
 static bool probed_devices[HWICAP_DEVICES];
+static struct mutex icap_sem;
 
 static struct class *icap_class;
 
@@ -199,14 +200,14 @@ static const struct config_registers v5_config_registers = {
 };
 
 /**
- * hwicap_command_desync: Send a DESYNC command to the ICAP port.
- * @parameter drvdata: a pointer to the drvdata.
+ * hwicap_command_desync - Send a DESYNC command to the ICAP port.
+ * @drvdata: a pointer to the drvdata.
  *
  * This command desynchronizes the ICAP After this command, a
  * bitstream containing a NULL packet, followed by a SYNCH packet is
  * required before the ICAP will recognize commands.
  */
-int hwicap_command_desync(struct hwicap_drvdata *drvdata)
+static int hwicap_command_desync(struct hwicap_drvdata *drvdata)
 {
         u32 buffer[4];
         u32 index = 0;
@@ -228,51 +229,18 @@ int hwicap_command_desync(struct hwicap_drvdata *drvdata)
 }
 
 /**
- * hwicap_command_capture: Send a CAPTURE command to the ICAP port.
- * @parameter drvdata: a pointer to the drvdata.
- *
- * This command captures all of the flip flop states so they will be
- * available during readback.  One can use this command instead of
- * enabling the CAPTURE block in the design.
- */
-int hwicap_command_capture(struct hwicap_drvdata *drvdata)
-{
-        u32 buffer[7];
-        u32 index = 0;
-
-        /*
-         * Create the data to be written to the ICAP.
-         */
-        buffer[index++] = XHI_DUMMY_PACKET;
-        buffer[index++] = XHI_SYNC_PACKET;
-        buffer[index++] = XHI_NOOP_PACKET;
-        buffer[index++] = hwicap_type_1_write(drvdata->config_regs->CMD) | 1;
-        buffer[index++] = XHI_CMD_GCAPTURE;
-        buffer[index++] = XHI_DUMMY_PACKET;
-        buffer[index++] = XHI_DUMMY_PACKET;
-
-        /*
-         * Write the data to the FIFO and intiate the transfer of data
-         * present in the FIFO to the ICAP device.
-         */
-        return drvdata->config->set_configuration(drvdata,
-                        &buffer[0], index);
-
-}
-
-/**
- * hwicap_get_configuration_register: Query a configuration register.
- * @parameter drvdata: a pointer to the drvdata.
- * @parameter reg: a constant which represents the configuration
+ * hwicap_get_configuration_register - Query a configuration register.
+ * @drvdata: a pointer to the drvdata.
+ * @reg: a constant which represents the configuration
  *              register value to be returned.
  *              Examples:  XHI_IDCODE, XHI_FLR.
- * @parameter RegData: returns the value of the register.
+ * @reg_data: returns the value of the register.
  *
  * Sends a query packet to the ICAP and then receives the response.
  * The icap is left in Synched state.
  */
-int hwicap_get_configuration_register(struct hwicap_drvdata *drvdata,
-                u32 reg, u32 *RegData)
+static int hwicap_get_configuration_register(struct hwicap_drvdata *drvdata,
+                u32 reg, u32 *reg_data)
 {
         int status;
         u32 buffer[6];
@@ -300,14 +268,14 @@ int hwicap_get_configuration_register(struct hwicap_drvdata *drvdata,
         /*
          * Read the configuration register
          */
-        status = drvdata->config->get_configuration(drvdata, RegData, 1);
+        status = drvdata->config->get_configuration(drvdata, reg_data, 1);
         if (status)
                 return status;
 
         return 0;
 }
 
-int hwicap_initialize_hwicap(struct hwicap_drvdata *drvdata)
+static int hwicap_initialize_hwicap(struct hwicap_drvdata *drvdata)
 {
         int status;
         u32 idcode;
@@ -344,7 +312,7 @@ int hwicap_initialize_hwicap(struct hwicap_drvdata *drvdata)
 }
 
 static ssize_t
-hwicap_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+hwicap_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
         struct hwicap_drvdata *drvdata = file->private_data;
         ssize_t bytes_to_read = 0;
@@ -353,8 +321,9 @@ hwicap_read(struct file *file, char *buf, size_t count, loff_t *ppos)
         u32 bytes_remaining;
         int status;
 
-        if (down_interruptible(&drvdata->sem))
-                return -ERESTARTSYS;
+        status = mutex_lock_interruptible(&drvdata->sem);
+        if (status)
+                return status;
 
         if (drvdata->read_buffer_in_use) {
                 /* If there are leftover bytes in the buffer, just */
@@ -370,8 +339,9 @@ hwicap_read(struct file *file, char *buf, size_t count, loff_t *ppos)
                         goto error;
                 }
                 drvdata->read_buffer_in_use -= bytes_to_read;
-                memcpy(drvdata->read_buffer + bytes_to_read,
-                                drvdata->read_buffer, 4 - bytes_to_read);
+                memmove(drvdata->read_buffer,
+                       drvdata->read_buffer + bytes_to_read,
+                       4 - bytes_to_read);
         } else {
                 /* Get new data from the ICAP, and return was was requested. */
                 kbuf = (u32 *) get_zeroed_page(GFP_KERNEL);
@@ -414,18 +384,20 @@ hwicap_read(struct file *file, char *buf, size_t count, loff_t *ppos)
                         status = -EFAULT;
                         goto error;
                 }
-                memcpy(kbuf, drvdata->read_buffer, bytes_remaining);
+                memcpy(drvdata->read_buffer,
+                       kbuf,
+                       bytes_remaining);
                 drvdata->read_buffer_in_use = bytes_remaining;
                 free_page((unsigned long)kbuf);
         }
         status = bytes_to_read;
  error:
-        up(&drvdata->sem);
+        mutex_unlock(&drvdata->sem);
         return status;
 }
 
 static ssize_t
-hwicap_write(struct file *file, const char *buf,
+hwicap_write(struct file *file, const char __user *buf,
                 size_t count, loff_t *ppos)
 {
         struct hwicap_drvdata *drvdata = file->private_data;
@@ -435,8 +407,9 @@ hwicap_write(struct file *file, const char *buf,
         ssize_t len;
         ssize_t status;
 
-        if (down_interruptible(&drvdata->sem))
-                return -ERESTARTSYS;
+        status = mutex_lock_interruptible(&drvdata->sem);
+        if (status)
+                return status;
 
         left += drvdata->write_buffer_in_use;
 
@@ -465,7 +438,7 @@ hwicap_write(struct file *file, const char *buf,
                         memcpy(kbuf, drvdata->write_buffer,
                                         drvdata->write_buffer_in_use);
                         if (copy_from_user(
-                            (((char *)kbuf) + (drvdata->write_buffer_in_use)),
+                            (((char *)kbuf) + drvdata->write_buffer_in_use),
                             buf + written,
                             len - (drvdata->write_buffer_in_use))) {
                                 free_page((unsigned long)kbuf);
@@ -508,7 +481,7 @@ hwicap_write(struct file *file, const char *buf,
         free_page((unsigned long)kbuf);
         status = written;
  error:
-        up(&drvdata->sem);
+        mutex_unlock(&drvdata->sem);
         return status;
 }
 
@@ -519,8 +492,9 @@ static int hwicap_open(struct inode *inode, struct file *file)
 
         drvdata = container_of(inode->i_cdev, struct hwicap_drvdata, cdev);
 
-        if (down_interruptible(&drvdata->sem))
-                return -ERESTARTSYS;
+        status = mutex_lock_interruptible(&drvdata->sem);
+        if (status)
+                return status;
 
         if (drvdata->is_open) {
                 status = -EBUSY;
@@ -539,7 +513,7 @@ static int hwicap_open(struct inode *inode, struct file *file)
         drvdata->is_open = 1;
 
  error:
-        up(&drvdata->sem);
+        mutex_unlock(&drvdata->sem);
         return status;
 }
 
@@ -549,8 +523,7 @@ static int hwicap_release(struct inode *inode, struct file *file)
         int i;
         int status = 0;
 
-        if (down_interruptible(&drvdata->sem))
-                return -ERESTARTSYS;
+        mutex_lock(&drvdata->sem);
 
         if (drvdata->write_buffer_in_use) {
                 /* Flush write buffer. */
@@ -569,7 +542,7 @@ static int hwicap_release(struct inode *inode, struct file *file)
 
  error:
         drvdata->is_open = 0;
-        up(&drvdata->sem);
+        mutex_unlock(&drvdata->sem);
         return status;
 }
 
@@ -592,31 +565,36 @@ static int __devinit hwicap_setup(struct device *dev, int id,
 
         dev_info(dev, "Xilinx icap port driver\n");
 
+        mutex_lock(&icap_sem);
+
         if (id < 0) {
                 for (id = 0; id < HWICAP_DEVICES; id++)
                         if (!probed_devices[id])
                                 break;
         }
         if (id < 0 || id >= HWICAP_DEVICES) {
+                mutex_unlock(&icap_sem);
                 dev_err(dev, "%s%i too large\n", DRIVER_NAME, id);
                 return -EINVAL;
         }
         if (probed_devices[id]) {
+                mutex_unlock(&icap_sem);
                 dev_err(dev, "cannot assign to %s%i; it is already in use\n",
                         DRIVER_NAME, id);
                 return -EBUSY;
         }
 
         probed_devices[id] = 1;
+        mutex_unlock(&icap_sem);
 
         devt = MKDEV(xhwicap_major, xhwicap_minor + id);
 
-        drvdata = kmalloc(sizeof(struct hwicap_drvdata), GFP_KERNEL);
+        drvdata = kzalloc(sizeof(struct hwicap_drvdata), GFP_KERNEL);
         if (!drvdata) {
                 dev_err(dev, "Couldn't allocate device private record\n");
-                return -ENOMEM;
+                retval = -ENOMEM;
+                goto failed0;
         }
-        memset((void *)drvdata, 0, sizeof(struct hwicap_drvdata));
         dev_set_drvdata(dev, (void *)drvdata);
 
         if (!regs_res) {
@@ -648,7 +626,7 @@ static int __devinit hwicap_setup(struct device *dev, int id,
         drvdata->config = config;
         drvdata->config_regs = config_regs;
 
-        init_MUTEX(&drvdata->sem);
+        mutex_init(&drvdata->sem);
         drvdata->is_open = 0;
 
         dev_info(dev, "ioremap %lx to %p with size %x\n",
@@ -663,7 +641,7 @@ static int __devinit hwicap_setup(struct device *dev, int id,
                 goto failed3;
         }
         /*  devfs_mk_cdev(devt, S_IFCHR|S_IRUGO|S_IWUGO, DRIVER_NAME); */
-        class_device_create(icap_class, NULL, devt, NULL, DRIVER_NAME);
+        device_create(icap_class, dev, devt, "%s%d", DRIVER_NAME, id);
         return 0;               /* success */
 
  failed3:
@@ -675,6 +653,11 @@ static int __devinit hwicap_setup(struct device *dev, int id,
  failed1:
         kfree(drvdata);
 
+ failed0:
+        mutex_lock(&icap_sem);
+        probed_devices[id] = 0;
+        mutex_unlock(&icap_sem);
+
         return retval;
 }
 
@@ -699,14 +682,16 @@ static int __devexit hwicap_remove(struct device *dev)
         if (!drvdata)
                 return 0;
 
-        class_device_destroy(icap_class, drvdata->devt);
+        device_destroy(icap_class, drvdata->devt);
         cdev_del(&drvdata->cdev);
         iounmap(drvdata->base_address);
         release_mem_region(drvdata->mem_start, drvdata->mem_size);
         kfree(drvdata);
         dev_set_drvdata(dev, NULL);
-        probed_devices[MINOR(dev->devt)-xhwicap_minor] = 0;
 
+        mutex_lock(&icap_sem);
+        probed_devices[MINOR(dev->devt)-xhwicap_minor] = 0;
+        mutex_unlock(&icap_sem);
         return 0;               /* success */
 }
 
@@ -821,28 +806,29 @@ static struct of_platform_driver hwicap_of_driver = {
 };
 
 /* Registration helpers to keep the number of #ifdefs to a minimum */
-static inline int __devinit hwicap_of_register(void)
+static inline int __init hwicap_of_register(void)
 {
         pr_debug("hwicap: calling of_register_platform_driver()\n");
         return of_register_platform_driver(&hwicap_of_driver);
 }
 
-static inline void __devexit hwicap_of_unregister(void)
+static inline void __exit hwicap_of_unregister(void)
 {
         of_unregister_platform_driver(&hwicap_of_driver);
 }
 #else /* CONFIG_OF */
 /* CONFIG_OF not enabled; do nothing helpers */
-static inline int __devinit hwicap_of_register(void) { return 0; }
-static inline void __devexit hwicap_of_unregister(void) { }
+static inline int __init hwicap_of_register(void) { return 0; }
+static inline void __exit hwicap_of_unregister(void) { }
 #endif /* CONFIG_OF */
 
-static int __devinit hwicap_module_init(void)
+static int __init hwicap_module_init(void)
 {
         dev_t devt;
         int retval;
 
         icap_class = class_create(THIS_MODULE, "xilinx_config");
+        mutex_init(&icap_sem);
 
         if (xhwicap_major) {
                 devt = MKDEV(xhwicap_major, xhwicap_minor);
@@ -883,7 +869,7 @@ static int __devinit hwicap_module_init(void)
         return retval;
 }
 
-static void __devexit hwicap_module_cleanup(void)
+static void __exit hwicap_module_cleanup(void)
 {
         dev_t devt = MKDEV(xhwicap_major, xhwicap_minor);
 
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.h b/drivers/char/xilinx_hwicap/xilinx_hwicap.h
index ae771cac1629..405fee7e189b 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.h
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.h
@@ -48,9 +48,9 @@ struct hwicap_drvdata {
         u8 write_buffer[4];
         u32 read_buffer_in_use;   /* Always in [0,3] */
         u8 read_buffer[4];
-        u32 mem_start;            /* phys. address of the control registers */
-        u32 mem_end;              /* phys. address of the control registers */
-        u32 mem_size;
+        resource_size_t mem_start;/* phys. address of the control registers */
+        resource_size_t mem_end;  /* phys. address of the control registers */
+        resource_size_t mem_size;
         void __iomem *base_address;/* virt. address of the control registers */
 
         struct device *dev;
@@ -61,7 +61,7 @@ struct hwicap_drvdata {
         const struct config_registers *config_regs;
         void *private_data;
         bool is_open;
-        struct semaphore sem;
+        struct mutex sem;
 };
 
 struct hwicap_driver_config {
@@ -164,29 +164,29 @@ struct config_registers {
 #define XHI_DISABLED_AUTO_CRC       0x0000DEFCUL
 
 /**
- * hwicap_type_1_read: Generates a Type 1 read packet header.
- * @parameter: Register is the address of the register to be read back.
+ * hwicap_type_1_read - Generates a Type 1 read packet header.
+ * @reg: is the address of the register to be read back.
  *
  * Generates a Type 1 read packet header, which is used to indirectly
  * read registers in the configuration logic.  This packet must then
  * be sent through the icap device, and a return packet received with
  * the information.
  **/
-static inline u32 hwicap_type_1_read(u32 Register)
+static inline u32 hwicap_type_1_read(u32 reg)
 {
         return (XHI_TYPE_1 << XHI_TYPE_SHIFT) |
-                (Register << XHI_REGISTER_SHIFT) |
+                (reg << XHI_REGISTER_SHIFT) |
                 (XHI_OP_READ << XHI_OP_SHIFT);
 }
 
 /**
- * hwicap_type_1_write: Generates a Type 1 write packet header
- * @parameter: Register is the address of the register to be read back.
+ * hwicap_type_1_write - Generates a Type 1 write packet header
+ * @reg: is the address of the register to be read back.
  **/
-static inline u32 hwicap_type_1_write(u32 Register)
+static inline u32 hwicap_type_1_write(u32 reg)
 {
         return (XHI_TYPE_1 << XHI_TYPE_SHIFT) |
-                (Register << XHI_REGISTER_SHIFT) |
+                (reg << XHI_REGISTER_SHIFT) |
                 (XHI_OP_WRITE << XHI_OP_SHIFT);
 }
 
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index fea2d3ed9cbd..85e2ba7fcfba 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -47,7 +47,7 @@ static LIST_HEAD(notify_list);
 
 static struct cn_dev cdev;
 
-int cn_already_initialized = 0;
+static int cn_already_initialized;
 
 /*
  * msg->seq and msg->ack are used to determine message genealogy.
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 89a29cd93783..35a26a3e5f68 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -671,13 +671,13 @@ static ssize_t show(struct kobject * kobj, struct attribute * attr ,char * buf)
 {
         struct cpufreq_policy * policy = to_policy(kobj);
         struct freq_attr * fattr = to_attr(attr);
-        ssize_t ret;
+        ssize_t ret = -EINVAL;
         policy = cpufreq_cpu_get(policy->cpu);
         if (!policy)
-                return -EINVAL;
+                goto no_policy;
 
         if (lock_policy_rwsem_read(policy->cpu) < 0)
-                return -EINVAL;
+                goto fail;
 
         if (fattr->show)
                 ret = fattr->show(policy, buf);
@@ -685,8 +685,9 @@ static ssize_t show(struct kobject * kobj, struct attribute * attr ,char * buf)
                 ret = -EIO;
 
         unlock_policy_rwsem_read(policy->cpu);
-
+fail:
         cpufreq_cpu_put(policy);
+no_policy:
         return ret;
 }
 
@@ -695,13 +696,13 @@ static ssize_t store(struct kobject * kobj, struct attribute * attr,
 {
         struct cpufreq_policy * policy = to_policy(kobj);
         struct freq_attr * fattr = to_attr(attr);
-        ssize_t ret;
+        ssize_t ret = -EINVAL;
         policy = cpufreq_cpu_get(policy->cpu);
         if (!policy)
-                return -EINVAL;
+                goto no_policy;
 
         if (lock_policy_rwsem_write(policy->cpu) < 0)
-                return -EINVAL;
+                goto fail;
 
         if (fattr->store)
                 ret = fattr->store(policy, buf, count);
@@ -709,8 +710,9 @@ static ssize_t store(struct kobject * kobj, struct attribute * attr,
                 ret = -EIO;
 
         unlock_policy_rwsem_write(policy->cpu);
-
+fail:
         cpufreq_cpu_put(policy);
+no_policy:
         return ret;
 }
 
@@ -1775,7 +1777,7 @@ static int __cpuinit cpufreq_cpu_callback(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata cpufreq_cpu_notifier =
+static struct notifier_block __refdata cpufreq_cpu_notifier =
 {
     .notifier_call = cpufreq_cpu_callback,
 };
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 1b8312b02006..070421a5480e 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -323,7 +323,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static struct notifier_block cpufreq_stat_cpu_notifier __cpuinitdata =
+static struct notifier_block cpufreq_stat_cpu_notifier __refdata =
 {
         .notifier_call = cpufreq_stat_cpu_callback,
 };
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index a703deffb795..27340a7b19dd 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig DMADEVICES
         bool "DMA Engine support"
-        depends on (PCI && X86) || ARCH_IOP32X || ARCH_IOP33X || ARCH_IOP13XX
+        depends on (PCI && X86) || ARCH_IOP32X || ARCH_IOP33X || ARCH_IOP13XX || PPC
         depends on !HIGHMEM64G
         help
           DMA engines can do asynchronous data transfers without
@@ -37,6 +37,23 @@ config INTEL_IOP_ADMA
         help
           Enable support for the Intel(R) IOP Series RAID engines.
 
+config FSL_DMA
+        bool "Freescale MPC85xx/MPC83xx DMA support"
+        depends on PPC
+        select DMA_ENGINE
+        ---help---
+          Enable support for the Freescale DMA engine. Now, it support
+          MPC8560/40, MPC8555, MPC8548 and MPC8641 processors.
+          The MPC8349, MPC8360 is also supported.
+
+config FSL_DMA_SELFTEST
+        bool "Enable the self test for each DMA channel"
+        depends on FSL_DMA
+        default y
+        ---help---
+          Enable the self test for each DMA channel. A self test will be
+          performed after the channel probed to ensure the DMA works well.
+
 config DMA_ENGINE
         bool
 
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index b152cd84e123..c8036d945902 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -3,3 +3,4 @@ obj-$(CONFIG_NET_DMA) += iovlock.o
 obj-$(CONFIG_INTEL_IOATDMA) += ioatdma.o
 ioatdma-objs := ioat.o ioat_dma.o ioat_dca.o
 obj-$(CONFIG_INTEL_IOP_ADMA) += iop-adma.o
+obj-$(CONFIG_FSL_DMA) += fsldma.o
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
new file mode 100644
index 000000000000..cc9a68158d99
--- /dev/null
+++ b/drivers/dma/fsldma.c
@@ -0,0 +1,1067 @@
+/*
+ * Freescale MPC85xx, MPC83xx DMA Engine support
+ *
+ * Copyright (C) 2007 Freescale Semiconductor, Inc. All rights reserved.
+ *
+ * Author:
+ *   Zhang Wei <wei.zhang@freescale.com>, Jul 2007
+ *   Ebony Zhu <ebony.zhu@freescale.com>, May 2007
+ *
+ * Description:
+ *   DMA engine driver for Freescale MPC8540 DMA controller, which is
+ *   also fit for MPC8560, MPC8555, MPC8548, MPC8641, and etc.
+ *   The support for MPC8349 DMA contorller is also added.
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/dmaengine.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
+#include <linux/of_platform.h>
+
+#include "fsldma.h"
+
+static void dma_init(struct fsl_dma_chan *fsl_chan)
+{
+        /* Reset the channel */
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr, 0, 32);
+
+        switch (fsl_chan->feature & FSL_DMA_IP_MASK) {
+        case FSL_DMA_IP_85XX:
+                /* Set the channel to below modes:
+                 * EIE - Error interrupt enable
+                 * EOSIE - End of segments interrupt enable (basic mode)
+                 * EOLNIE - End of links interrupt enable
+                 */
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr, FSL_DMA_MR_EIE
+                                | FSL_DMA_MR_EOLNIE | FSL_DMA_MR_EOSIE, 32);
+                break;
+        case FSL_DMA_IP_83XX:
+                /* Set the channel to below modes:
+                 * EOTIE - End-of-transfer interrupt enable
+                 */
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr, FSL_DMA_MR_EOTIE,
+                                32);
+                break;
+        }
+
+}
+
+static void set_sr(struct fsl_dma_chan *fsl_chan, dma_addr_t val)
+{
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->sr, val, 32);
+}
+
+static dma_addr_t get_sr(struct fsl_dma_chan *fsl_chan)
+{
+        return DMA_IN(fsl_chan, &fsl_chan->reg_base->sr, 32);
+}
+
+static void set_desc_cnt(struct fsl_dma_chan *fsl_chan,
+                                struct fsl_dma_ld_hw *hw, u32 count)
+{
+        hw->count = CPU_TO_DMA(fsl_chan, count, 32);
+}
+
+static void set_desc_src(struct fsl_dma_chan *fsl_chan,
+                                struct fsl_dma_ld_hw *hw, dma_addr_t src)
+{
+        u64 snoop_bits;
+
+        snoop_bits = ((fsl_chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
+                ? ((u64)FSL_DMA_SATR_SREADTYPE_SNOOP_READ << 32) : 0;
+        hw->src_addr = CPU_TO_DMA(fsl_chan, snoop_bits | src, 64);
+}
+
+static void set_desc_dest(struct fsl_dma_chan *fsl_chan,
+                                struct fsl_dma_ld_hw *hw, dma_addr_t dest)
+{
+        u64 snoop_bits;
+
+        snoop_bits = ((fsl_chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
+                ? ((u64)FSL_DMA_DATR_DWRITETYPE_SNOOP_WRITE << 32) : 0;
+        hw->dst_addr = CPU_TO_DMA(fsl_chan, snoop_bits | dest, 64);
+}
+
+static void set_desc_next(struct fsl_dma_chan *fsl_chan,
+                                struct fsl_dma_ld_hw *hw, dma_addr_t next)
+{
+        u64 snoop_bits;
+
+        snoop_bits = ((fsl_chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_83XX)
+                ? FSL_DMA_SNEN : 0;
+        hw->next_ln_addr = CPU_TO_DMA(fsl_chan, snoop_bits | next, 64);
+}
+
+static void set_cdar(struct fsl_dma_chan *fsl_chan, dma_addr_t addr)
+{
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->cdar, addr | FSL_DMA_SNEN, 64);
+}
+
+static dma_addr_t get_cdar(struct fsl_dma_chan *fsl_chan)
+{
+        return DMA_IN(fsl_chan, &fsl_chan->reg_base->cdar, 64) & ~FSL_DMA_SNEN;
+}
+
+static void set_ndar(struct fsl_dma_chan *fsl_chan, dma_addr_t addr)
+{
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->ndar, addr, 64);
+}
+
+static dma_addr_t get_ndar(struct fsl_dma_chan *fsl_chan)
+{
+        return DMA_IN(fsl_chan, &fsl_chan->reg_base->ndar, 64);
+}
+
+static int dma_is_idle(struct fsl_dma_chan *fsl_chan)
+{
+        u32 sr = get_sr(fsl_chan);
+        return (!(sr & FSL_DMA_SR_CB)) || (sr & FSL_DMA_SR_CH);
+}
+
+static void dma_start(struct fsl_dma_chan *fsl_chan)
+{
+        u32 mr_set = 0;;
+
+        if (fsl_chan->feature & FSL_DMA_CHAN_PAUSE_EXT) {
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->bcr, 0, 32);
+                mr_set |= FSL_DMA_MR_EMP_EN;
+        } else
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32)
+                                & ~FSL_DMA_MR_EMP_EN, 32);
+
+        if (fsl_chan->feature & FSL_DMA_CHAN_START_EXT)
+                mr_set |= FSL_DMA_MR_EMS_EN;
+        else
+                mr_set |= FSL_DMA_MR_CS;
+
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32)
+                        | mr_set, 32);
+}
+
+static void dma_halt(struct fsl_dma_chan *fsl_chan)
+{
+        int i = 0;
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) | FSL_DMA_MR_CA,
+                32);
+        DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) & ~(FSL_DMA_MR_CS
+                | FSL_DMA_MR_EMS_EN | FSL_DMA_MR_CA), 32);
+
+        while (!dma_is_idle(fsl_chan) && (i++ < 100))
+                udelay(10);
+        if (i >= 100 && !dma_is_idle(fsl_chan))
+                dev_err(fsl_chan->dev, "DMA halt timeout!\n");
+}
+
+static void set_ld_eol(struct fsl_dma_chan *fsl_chan,
+                        struct fsl_desc_sw *desc)
+{
+        desc->hw.next_ln_addr = CPU_TO_DMA(fsl_chan,
+                DMA_TO_CPU(fsl_chan, desc->hw.next_ln_addr, 64) | FSL_DMA_EOL,
+                64);
+}
+
+static void append_ld_queue(struct fsl_dma_chan *fsl_chan,
+                struct fsl_desc_sw *new_desc)
+{
+        struct fsl_desc_sw *queue_tail = to_fsl_desc(fsl_chan->ld_queue.prev);
+
+        if (list_empty(&fsl_chan->ld_queue))
+                return;
+
+        /* Link to the new descriptor physical address and
+         * Enable End-of-segment interrupt for
+         * the last link descriptor.
+         * (the previous node's next link descriptor)
+         *
+         * For FSL_DMA_IP_83xx, the snoop enable bit need be set.
+         */
+        queue_tail->hw.next_ln_addr = CPU_TO_DMA(fsl_chan,
+                        new_desc->async_tx.phys | FSL_DMA_EOSIE |
+                        (((fsl_chan->feature & FSL_DMA_IP_MASK)
+                                == FSL_DMA_IP_83XX) ? FSL_DMA_SNEN : 0), 64);
+}
+
+/**
+ * fsl_chan_set_src_loop_size - Set source address hold transfer size
+ * @fsl_chan : Freescale DMA channel
+ * @size     : Address loop size, 0 for disable loop
+ *
+ * The set source address hold transfer size. The source
+ * address hold or loop transfer size is when the DMA transfer
+ * data from source address (SA), if the loop size is 4, the DMA will
+ * read data from SA, SA + 1, SA + 2, SA + 3, then loop back to SA,
+ * SA + 1 ... and so on.
+ */
+static void fsl_chan_set_src_loop_size(struct fsl_dma_chan *fsl_chan, int size)
+{
+        switch (size) {
+        case 0:
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) &
+                        (~FSL_DMA_MR_SAHE), 32);
+                break;
+        case 1:
+        case 2:
+        case 4:
+        case 8:
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) |
+                        FSL_DMA_MR_SAHE | (__ilog2(size) << 14),
+                        32);
+                break;
+        }
+}
+
+/**
+ * fsl_chan_set_dest_loop_size - Set destination address hold transfer size
+ * @fsl_chan : Freescale DMA channel
+ * @size     : Address loop size, 0 for disable loop
+ *
+ * The set destination address hold transfer size. The destination
+ * address hold or loop transfer size is when the DMA transfer
+ * data to destination address (TA), if the loop size is 4, the DMA will
+ * write data to TA, TA + 1, TA + 2, TA + 3, then loop back to TA,
+ * TA + 1 ... and so on.
+ */
+static void fsl_chan_set_dest_loop_size(struct fsl_dma_chan *fsl_chan, int size)
+{
+        switch (size) {
+        case 0:
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) &
+                        (~FSL_DMA_MR_DAHE), 32);
+                break;
+        case 1:
+        case 2:
+        case 4:
+        case 8:
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) |
+                        FSL_DMA_MR_DAHE | (__ilog2(size) << 16),
+                        32);
+                break;
+        }
+}
+
+/**
+ * fsl_chan_toggle_ext_pause - Toggle channel external pause status
+ * @fsl_chan : Freescale DMA channel
+ * @size     : Pause control size, 0 for disable external pause control.
+ *             The maximum is 1024.
+ *
+ * The Freescale DMA channel can be controlled by the external
+ * signal DREQ#. The pause control size is how many bytes are allowed
+ * to transfer before pausing the channel, after which a new assertion
+ * of DREQ# resumes channel operation.
+ */
+static void fsl_chan_toggle_ext_pause(struct fsl_dma_chan *fsl_chan, int size)
+{
+        if (size > 1024)
+                return;
+
+        if (size) {
+                DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
+                        DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32)
+                                | ((__ilog2(size) << 24) & 0x0f000000),
+                        32);
+                fsl_chan->feature |= FSL_DMA_CHAN_PAUSE_EXT;
+        } else
+                fsl_chan->feature &= ~FSL_DMA_CHAN_PAUSE_EXT;
+}
+
+/**
+ * fsl_chan_toggle_ext_start - Toggle channel external start status
+ * @fsl_chan : Freescale DMA channel
+ * @enable   : 0 is disabled, 1 is enabled.
+ *
+ * If enable the external start, the channel can be started by an
+ * external DMA start pin. So the dma_start() does not start the
+ * transfer immediately. The DMA channel will wait for the
+ * control pin asserted.
+ */
+static void fsl_chan_toggle_ext_start(struct fsl_dma_chan *fsl_chan, int enable)
+{
+        if (enable)
+                fsl_chan->feature |= FSL_DMA_CHAN_START_EXT;
+        else
+                fsl_chan->feature &= ~FSL_DMA_CHAN_START_EXT;
+}
+
+static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
+{
+        struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
+        struct fsl_dma_chan *fsl_chan = to_fsl_chan(tx->chan);
+        unsigned long flags;
+        dma_cookie_t cookie;
+
+        /* cookie increment and adding to ld_queue must be atomic */
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+
+        cookie = fsl_chan->common.cookie;
+        cookie++;
+        if (cookie < 0)
+                cookie = 1;
+        desc->async_tx.cookie = cookie;
+        fsl_chan->common.cookie = desc->async_tx.cookie;
+
+        append_ld_queue(fsl_chan, desc);
+        list_splice_init(&desc->async_tx.tx_list, fsl_chan->ld_queue.prev);
+
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+
+        return cookie;
+}
+
+/**
+ * fsl_dma_alloc_descriptor - Allocate descriptor from channel's DMA pool.
+ * @fsl_chan : Freescale DMA channel
+ *
+ * Return - The descriptor allocated. NULL for failed.
+ */
+static struct fsl_desc_sw *fsl_dma_alloc_descriptor(
+                                        struct fsl_dma_chan *fsl_chan)
+{
+        dma_addr_t pdesc;
+        struct fsl_desc_sw *desc_sw;
+
+        desc_sw = dma_pool_alloc(fsl_chan->desc_pool, GFP_ATOMIC, &pdesc);
+        if (desc_sw) {
+                memset(desc_sw, 0, sizeof(struct fsl_desc_sw));
+                dma_async_tx_descriptor_init(&desc_sw->async_tx,
+                                                &fsl_chan->common);
+                desc_sw->async_tx.tx_submit = fsl_dma_tx_submit;
+                INIT_LIST_HEAD(&desc_sw->async_tx.tx_list);
+                desc_sw->async_tx.phys = pdesc;
+        }
+
+        return desc_sw;
+}
+
+
+/**
+ * fsl_dma_alloc_chan_resources - Allocate resources for DMA channel.
+ * @fsl_chan : Freescale DMA channel
+ *
+ * This function will create a dma pool for descriptor allocation.
+ *
+ * Return - The number of descriptors allocated.
+ */
+static int fsl_dma_alloc_chan_resources(struct dma_chan *chan)
+{
+        struct fsl_dma_chan *fsl_chan = to_fsl_chan(chan);
+        LIST_HEAD(tmp_list);
+
+        /* We need the descriptor to be aligned to 32bytes
+         * for meeting FSL DMA specification requirement.
+         */
+        fsl_chan->desc_pool = dma_pool_create("fsl_dma_engine_desc_pool",
+                        fsl_chan->dev, sizeof(struct fsl_desc_sw),
+                        32, 0);
+        if (!fsl_chan->desc_pool) {
+                dev_err(fsl_chan->dev, "No memory for channel %d "
+                        "descriptor dma pool.\n", fsl_chan->id);
+                return 0;
+        }
+
+        return 1;
+}
+
+/**
+ * fsl_dma_free_chan_resources - Free all resources of the channel.
+ * @fsl_chan : Freescale DMA channel
+ */
+static void fsl_dma_free_chan_resources(struct dma_chan *chan)
+{
+        struct fsl_dma_chan *fsl_chan = to_fsl_chan(chan);
+        struct fsl_desc_sw *desc, *_desc;
+        unsigned long flags;
+
+        dev_dbg(fsl_chan->dev, "Free all channel resources.\n");
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+        list_for_each_entry_safe(desc, _desc, &fsl_chan->ld_queue, node) {
+#ifdef FSL_DMA_LD_DEBUG
+                dev_dbg(fsl_chan->dev,
+                                "LD %p will be released.\n", desc);
+#endif
+                list_del(&desc->node);
+                /* free link descriptor */
+                dma_pool_free(fsl_chan->desc_pool, desc, desc->async_tx.phys);
+        }
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+        dma_pool_destroy(fsl_chan->desc_pool);
+}
+
+static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
+        struct dma_chan *chan, dma_addr_t dma_dest, dma_addr_t dma_src,
+        size_t len, unsigned long flags)
+{
+        struct fsl_dma_chan *fsl_chan;
+        struct fsl_desc_sw *first = NULL, *prev = NULL, *new;
+        size_t copy;
+        LIST_HEAD(link_chain);
+
+        if (!chan)
+                return NULL;
+
+        if (!len)
+                return NULL;
+
+        fsl_chan = to_fsl_chan(chan);
+
+        do {
+
+                /* Allocate the link descriptor from DMA pool */
+                new = fsl_dma_alloc_descriptor(fsl_chan);
+                if (!new) {
+                        dev_err(fsl_chan->dev,
+                                        "No free memory for link descriptor\n");
+                        return NULL;
+                }
+#ifdef FSL_DMA_LD_DEBUG
+                dev_dbg(fsl_chan->dev, "new link desc alloc %p\n", new);
+#endif
+
+                copy = min(len, FSL_DMA_BCR_MAX_CNT);
+
+                set_desc_cnt(fsl_chan, &new->hw, copy);
+                set_desc_src(fsl_chan, &new->hw, dma_src);
+                set_desc_dest(fsl_chan, &new->hw, dma_dest);
+
+                if (!first)
+                        first = new;
+                else
+                        set_desc_next(fsl_chan, &prev->hw, new->async_tx.phys);
+
+                new->async_tx.cookie = 0;
+                new->async_tx.ack = 1;
+
+                prev = new;
+                len -= copy;
+                dma_src += copy;
+                dma_dest += copy;
+
+                /* Insert the link descriptor to the LD ring */
+                list_add_tail(&new->node, &first->async_tx.tx_list);
+        } while (len);
+
+        new->async_tx.ack = 0; /* client is in control of this ack */
+        new->async_tx.cookie = -EBUSY;
+
+        /* Set End-of-link to the last link descriptor of new list*/
+        set_ld_eol(fsl_chan, new);
+
+        return first ? &first->async_tx : NULL;
+}
+
+/**
+ * fsl_dma_update_completed_cookie - Update the completed cookie.
+ * @fsl_chan : Freescale DMA channel
+ */
+static void fsl_dma_update_completed_cookie(struct fsl_dma_chan *fsl_chan)
+{
+        struct fsl_desc_sw *cur_desc, *desc;
+        dma_addr_t ld_phy;
+
+        ld_phy = get_cdar(fsl_chan) & FSL_DMA_NLDA_MASK;
+
+        if (ld_phy) {
+                cur_desc = NULL;
+                list_for_each_entry(desc, &fsl_chan->ld_queue, node)
+                        if (desc->async_tx.phys == ld_phy) {
+                                cur_desc = desc;
+                                break;
+                        }
+
+                if (cur_desc && cur_desc->async_tx.cookie) {
+                        if (dma_is_idle(fsl_chan))
+                                fsl_chan->completed_cookie =
+                                        cur_desc->async_tx.cookie;
+                        else
+                                fsl_chan->completed_cookie =
+                                        cur_desc->async_tx.cookie - 1;
+                }
+        }
+}
+
+/**
+ * fsl_chan_ld_cleanup - Clean up link descriptors
+ * @fsl_chan : Freescale DMA channel
+ *
+ * This function clean up the ld_queue of DMA channel.
+ * If 'in_intr' is set, the function will move the link descriptor to
+ * the recycle list. Otherwise, free it directly.
+ */
+static void fsl_chan_ld_cleanup(struct fsl_dma_chan *fsl_chan)
+{
+        struct fsl_desc_sw *desc, *_desc;
+        unsigned long flags;
+
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+
+        fsl_dma_update_completed_cookie(fsl_chan);
+        dev_dbg(fsl_chan->dev, "chan completed_cookie = %d\n",
+                        fsl_chan->completed_cookie);
+        list_for_each_entry_safe(desc, _desc, &fsl_chan->ld_queue, node) {
+                dma_async_tx_callback callback;
+                void *callback_param;
+
+                if (dma_async_is_complete(desc->async_tx.cookie,
+                            fsl_chan->completed_cookie, fsl_chan->common.cookie)
+                                == DMA_IN_PROGRESS)
+                        break;
+
+                callback = desc->async_tx.callback;
+                callback_param = desc->async_tx.callback_param;
+
+                /* Remove from ld_queue list */
+                list_del(&desc->node);
+
+                dev_dbg(fsl_chan->dev, "link descriptor %p will be recycle.\n",
+                                desc);
+                dma_pool_free(fsl_chan->desc_pool, desc, desc->async_tx.phys);
+
+                /* Run the link descriptor callback function */
+                if (callback) {
+                        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+                        dev_dbg(fsl_chan->dev, "link descriptor %p callback\n",
+                                        desc);
+                        callback(callback_param);
+                        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+                }
+        }
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+}
+
+/**
+ * fsl_chan_xfer_ld_queue - Transfer link descriptors in channel ld_queue.
+ * @fsl_chan : Freescale DMA channel
+ */
+static void fsl_chan_xfer_ld_queue(struct fsl_dma_chan *fsl_chan)
+{
+        struct list_head *ld_node;
+        dma_addr_t next_dest_addr;
+        unsigned long flags;
+
+        if (!dma_is_idle(fsl_chan))
+                return;
+
+        dma_halt(fsl_chan);
+
+        /* If there are some link descriptors
+         * not transfered in queue. We need to start it.
+         */
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+
+        /* Find the first un-transfer desciptor */
+        for (ld_node = fsl_chan->ld_queue.next;
+                (ld_node != &fsl_chan->ld_queue)
+                        && (dma_async_is_complete(
+                                to_fsl_desc(ld_node)->async_tx.cookie,
+                                fsl_chan->completed_cookie,
+                                fsl_chan->common.cookie) == DMA_SUCCESS);
+                ld_node = ld_node->next);
+
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+
+        if (ld_node != &fsl_chan->ld_queue) {
+                /* Get the ld start address from ld_queue */
+                next_dest_addr = to_fsl_desc(ld_node)->async_tx.phys;
+                dev_dbg(fsl_chan->dev, "xfer LDs staring from 0x%016llx\n",
+                                (u64)next_dest_addr);
+                set_cdar(fsl_chan, next_dest_addr);
+                dma_start(fsl_chan);
+        } else {
+                set_cdar(fsl_chan, 0);
+                set_ndar(fsl_chan, 0);
+        }
+}
+
+/**
+ * fsl_dma_memcpy_issue_pending - Issue the DMA start command
+ * @fsl_chan : Freescale DMA channel
+ */
+static void fsl_dma_memcpy_issue_pending(struct dma_chan *chan)
+{
+        struct fsl_dma_chan *fsl_chan = to_fsl_chan(chan);
+
+#ifdef FSL_DMA_LD_DEBUG
+        struct fsl_desc_sw *ld;
+        unsigned long flags;
+
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+        if (list_empty(&fsl_chan->ld_queue)) {
+                spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+                return;
+        }
+
+        dev_dbg(fsl_chan->dev, "--memcpy issue--\n");
+        list_for_each_entry(ld, &fsl_chan->ld_queue, node) {
+                int i;
+                dev_dbg(fsl_chan->dev, "Ch %d, LD %08x\n",
+                                fsl_chan->id, ld->async_tx.phys);
+                for (i = 0; i < 8; i++)
+                        dev_dbg(fsl_chan->dev, "LD offset %d: %08x\n",
+                                        i, *(((u32 *)&ld->hw) + i));
+        }
+        dev_dbg(fsl_chan->dev, "----------------\n");
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
+#endif
+
+        fsl_chan_xfer_ld_queue(fsl_chan);
+}
+
+static void fsl_dma_dependency_added(struct dma_chan *chan)
+{
+        struct fsl_dma_chan *fsl_chan = to_fsl_chan(chan);
+
+        fsl_chan_ld_cleanup(fsl_chan);
+}
+
+/**
+ * fsl_dma_is_complete - Determine the DMA status
+ * @fsl_chan : Freescale DMA channel
+ */
+static enum dma_status fsl_dma_is_complete(struct dma_chan *chan,
+                                        dma_cookie_t cookie,
+                                        dma_cookie_t *done,
+                                        dma_cookie_t *used)
+{
+        struct fsl_dma_chan *fsl_chan = to_fsl_chan(chan);
+        dma_cookie_t last_used;
+        dma_cookie_t last_complete;
+
+        fsl_chan_ld_cleanup(fsl_chan);
+
+        last_used = chan->cookie;
+        last_complete = fsl_chan->completed_cookie;
+
+        if (done)
+                *done = last_complete;
+
+        if (used)
+                *used = last_used;
+
+        return dma_async_is_complete(cookie, last_complete, last_used);
+}
+
+static irqreturn_t fsl_dma_chan_do_interrupt(int irq, void *data)
+{
+        struct fsl_dma_chan *fsl_chan = (struct fsl_dma_chan *)data;
+        dma_addr_t stat;
+
+        stat = get_sr(fsl_chan);
+        dev_dbg(fsl_chan->dev, "event: channel %d, stat = 0x%x\n",
+                                                fsl_chan->id, stat);
+        set_sr(fsl_chan, stat);         /* Clear the event register */
+
+        stat &= ~(FSL_DMA_SR_CB | FSL_DMA_SR_CH);
+        if (!stat)
+                return IRQ_NONE;
+
+        if (stat & FSL_DMA_SR_TE)
+                dev_err(fsl_chan->dev, "Transfer Error!\n");
+
+        /* If the link descriptor segment transfer finishes,
+         * we will recycle the used descriptor.
+         */
+        if (stat & FSL_DMA_SR_EOSI) {
+                dev_dbg(fsl_chan->dev, "event: End-of-segments INT\n");
+                dev_dbg(fsl_chan->dev, "event: clndar 0x%016llx, "
+                                "nlndar 0x%016llx\n", (u64)get_cdar(fsl_chan),
+                                (u64)get_ndar(fsl_chan));
+                stat &= ~FSL_DMA_SR_EOSI;
+        }
+
+        /* If it current transfer is the end-of-transfer,
+         * we should clear the Channel Start bit for
+         * prepare next transfer.
+         */
+        if (stat & (FSL_DMA_SR_EOLNI | FSL_DMA_SR_EOCDI)) {
+                dev_dbg(fsl_chan->dev, "event: End-of-link INT\n");
+                stat &= ~FSL_DMA_SR_EOLNI;
+                fsl_chan_xfer_ld_queue(fsl_chan);
+        }
+
+        if (stat)
+                dev_dbg(fsl_chan->dev, "event: unhandled sr 0x%02x\n",
+                                        stat);
+
+        dev_dbg(fsl_chan->dev, "event: Exit\n");
+        tasklet_schedule(&fsl_chan->tasklet);
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t fsl_dma_do_interrupt(int irq, void *data)
+{
+        struct fsl_dma_device *fdev = (struct fsl_dma_device *)data;
+        u32 gsr;
+        int ch_nr;
+
+        gsr = (fdev->feature & FSL_DMA_BIG_ENDIAN) ? in_be32(fdev->reg_base)
+                        : in_le32(fdev->reg_base);
+        ch_nr = (32 - ffs(gsr)) / 8;
+
+        return fdev->chan[ch_nr] ? fsl_dma_chan_do_interrupt(irq,
+                        fdev->chan[ch_nr]) : IRQ_NONE;
+}
+
+static void dma_do_tasklet(unsigned long data)
+{
+        struct fsl_dma_chan *fsl_chan = (struct fsl_dma_chan *)data;
+        fsl_chan_ld_cleanup(fsl_chan);
+}
+
+static void fsl_dma_callback_test(struct fsl_dma_chan *fsl_chan)
+{
+        if (fsl_chan)
+                dev_info(fsl_chan->dev, "selftest: callback is ok!\n");
+}
+
+static int fsl_dma_self_test(struct fsl_dma_chan *fsl_chan)
+{
+        struct dma_chan *chan;
+        int err = 0;
+        dma_addr_t dma_dest, dma_src;
+        dma_cookie_t cookie;
+        u8 *src, *dest;
+        int i;
+        size_t test_size;
+        struct dma_async_tx_descriptor *tx1, *tx2, *tx3;
+
+        test_size = 4096;
+
+        src = kmalloc(test_size * 2, GFP_KERNEL);
+        if (!src) {
+                dev_err(fsl_chan->dev,
+                                "selftest: Cannot alloc memory for test!\n");
+                err = -ENOMEM;
+                goto out;
+        }
+
+        dest = src + test_size;
+
+        for (i = 0; i < test_size; i++)
+                src[i] = (u8) i;
+
+        chan = &fsl_chan->common;
+
+        if (fsl_dma_alloc_chan_resources(chan) < 1) {
+                dev_err(fsl_chan->dev,
+                                "selftest: Cannot alloc resources for DMA\n");
+                err = -ENODEV;
+                goto out;
+        }
+
+        /* TX 1 */
+        dma_src = dma_map_single(fsl_chan->dev, src, test_size / 2,
+                                 DMA_TO_DEVICE);
+        dma_dest = dma_map_single(fsl_chan->dev, dest, test_size / 2,
+                                  DMA_FROM_DEVICE);
+        tx1 = fsl_dma_prep_memcpy(chan, dma_dest, dma_src, test_size / 2, 0);
+        async_tx_ack(tx1);
+
+        cookie = fsl_dma_tx_submit(tx1);
+        fsl_dma_memcpy_issue_pending(chan);
+        msleep(2);
+
+        if (fsl_dma_is_complete(chan, cookie, NULL, NULL) != DMA_SUCCESS) {
+                dev_err(fsl_chan->dev, "selftest: Time out!\n");
+                err = -ENODEV;
+                goto out;
+        }
+
+        /* Test free and re-alloc channel resources */
+        fsl_dma_free_chan_resources(chan);
+
+        if (fsl_dma_alloc_chan_resources(chan) < 1) {
+                dev_err(fsl_chan->dev,
+                                "selftest: Cannot alloc resources for DMA\n");
+                err = -ENODEV;
+                goto free_resources;
+        }
+
+        /* Continue to test
+         * TX 2
+         */
+        dma_src = dma_map_single(fsl_chan->dev, src + test_size / 2,
+                                        test_size / 4, DMA_TO_DEVICE);
+        dma_dest = dma_map_single(fsl_chan->dev, dest + test_size / 2,
+                                        test_size / 4, DMA_FROM_DEVICE);
+        tx2 = fsl_dma_prep_memcpy(chan, dma_dest, dma_src, test_size / 4, 0);
+        async_tx_ack(tx2);
+
+        /* TX 3 */
+        dma_src = dma_map_single(fsl_chan->dev, src + test_size * 3 / 4,
+                                        test_size / 4, DMA_TO_DEVICE);
+        dma_dest = dma_map_single(fsl_chan->dev, dest + test_size * 3 / 4,
+                                        test_size / 4, DMA_FROM_DEVICE);
+        tx3 = fsl_dma_prep_memcpy(chan, dma_dest, dma_src, test_size / 4, 0);
+        async_tx_ack(tx3);
+
+        /* Test exchanging the prepared tx sort */
+        cookie = fsl_dma_tx_submit(tx3);
+        cookie = fsl_dma_tx_submit(tx2);
+
+#ifdef FSL_DMA_CALLBACKTEST
+        if (dma_has_cap(DMA_INTERRUPT, ((struct fsl_dma_device *)
+            dev_get_drvdata(fsl_chan->dev->parent))->common.cap_mask)) {
+                tx3->callback = fsl_dma_callback_test;
+                tx3->callback_param = fsl_chan;
+        }
+#endif
+        fsl_dma_memcpy_issue_pending(chan);
+        msleep(2);
+
+        if (fsl_dma_is_complete(chan, cookie, NULL, NULL) != DMA_SUCCESS) {
+                dev_err(fsl_chan->dev, "selftest: Time out!\n");
+                err = -ENODEV;
+                goto free_resources;
+        }
+
+        err = memcmp(src, dest, test_size);
+        if (err) {
+                for (i = 0; (*(src + i) == *(dest + i)) && (i < test_size);
+                                i++);
+                dev_err(fsl_chan->dev, "selftest: Test failed, data %d/%d is "
+                                "error! src 0x%x, dest 0x%x\n",
+                                i, test_size, *(src + i), *(dest + i));
+        }
+
+free_resources:
+        fsl_dma_free_chan_resources(chan);
+out:
+        kfree(src);
+        return err;
+}
+
+static int __devinit of_fsl_dma_chan_probe(struct of_device *dev,
+                        const struct of_device_id *match)
+{
+        struct fsl_dma_device *fdev;
+        struct fsl_dma_chan *new_fsl_chan;
+        int err;
+
+        fdev = dev_get_drvdata(dev->dev.parent);
+        BUG_ON(!fdev);
+
+        /* alloc channel */
+        new_fsl_chan = kzalloc(sizeof(struct fsl_dma_chan), GFP_KERNEL);
+        if (!new_fsl_chan) {
+                dev_err(&dev->dev, "No free memory for allocating "
+                                "dma channels!\n");
+                err = -ENOMEM;
+                goto err;
+        }
+
+        /* get dma channel register base */
+        err = of_address_to_resource(dev->node, 0, &new_fsl_chan->reg);
+        if (err) {
+                dev_err(&dev->dev, "Can't get %s property 'reg'\n",
+                                dev->node->full_name);
+                goto err;
+        }
+
+        new_fsl_chan->feature = *(u32 *)match->data;
+
+        if (!fdev->feature)
+                fdev->feature = new_fsl_chan->feature;
+
+        /* If the DMA device's feature is different than its channels',
+         * report the bug.
+         */
+        WARN_ON(fdev->feature != new_fsl_chan->feature);
+
+        new_fsl_chan->dev = &dev->dev;
+        new_fsl_chan->reg_base = ioremap(new_fsl_chan->reg.start,
+                        new_fsl_chan->reg.end - new_fsl_chan->reg.start + 1);
+
+        new_fsl_chan->id = ((new_fsl_chan->reg.start - 0x100) & 0xfff) >> 7;
+        if (new_fsl_chan->id > FSL_DMA_MAX_CHANS_PER_DEVICE) {
+                dev_err(&dev->dev, "There is no %d channel!\n",
+                                new_fsl_chan->id);
+                err = -EINVAL;
+                goto err;
+        }
+        fdev->chan[new_fsl_chan->id] = new_fsl_chan;
+        tasklet_init(&new_fsl_chan->tasklet, dma_do_tasklet,
+                        (unsigned long)new_fsl_chan);
+
+        /* Init the channel */
+        dma_init(new_fsl_chan);
+
+        /* Clear cdar registers */
+        set_cdar(new_fsl_chan, 0);
+
+        switch (new_fsl_chan->feature & FSL_DMA_IP_MASK) {
+        case FSL_DMA_IP_85XX:
+                new_fsl_chan->toggle_ext_start = fsl_chan_toggle_ext_start;
+                new_fsl_chan->toggle_ext_pause = fsl_chan_toggle_ext_pause;
+        case FSL_DMA_IP_83XX:
+                new_fsl_chan->set_src_loop_size = fsl_chan_set_src_loop_size;
+                new_fsl_chan->set_dest_loop_size = fsl_chan_set_dest_loop_size;
+        }
+
+        spin_lock_init(&new_fsl_chan->desc_lock);
+        INIT_LIST_HEAD(&new_fsl_chan->ld_queue);
+
+        new_fsl_chan->common.device = &fdev->common;
+
+        /* Add the channel to DMA device channel list */
+        list_add_tail(&new_fsl_chan->common.device_node,
+                        &fdev->common.channels);
+        fdev->common.chancnt++;
+
+        new_fsl_chan->irq = irq_of_parse_and_map(dev->node, 0);
+        if (new_fsl_chan->irq != NO_IRQ) {
+                err = request_irq(new_fsl_chan->irq,
+                                        &fsl_dma_chan_do_interrupt, IRQF_SHARED,
+                                        "fsldma-channel", new_fsl_chan);
+                if (err) {
+                        dev_err(&dev->dev, "DMA channel %s request_irq error "
+                                "with return %d\n", dev->node->full_name, err);
+                        goto err;
+                }
+        }
+
+#ifdef CONFIG_FSL_DMA_SELFTEST
+        err = fsl_dma_self_test(new_fsl_chan);
+        if (err)
+                goto err;
+#endif
+
+        dev_info(&dev->dev, "#%d (%s), irq %d\n", new_fsl_chan->id,
+                                match->compatible, new_fsl_chan->irq);
+
+        return 0;
+err:
+        dma_halt(new_fsl_chan);
+        iounmap(new_fsl_chan->reg_base);
+        free_irq(new_fsl_chan->irq, new_fsl_chan);
+        list_del(&new_fsl_chan->common.device_node);
+        kfree(new_fsl_chan);
+        return err;
+}
+
+const u32 mpc8540_dma_ip_feature = FSL_DMA_IP_85XX | FSL_DMA_BIG_ENDIAN;
+const u32 mpc8349_dma_ip_feature = FSL_DMA_IP_83XX | FSL_DMA_LITTLE_ENDIAN;
+
+static struct of_device_id of_fsl_dma_chan_ids[] = {
+        {
+                .compatible = "fsl,mpc8540-dma-channel",
+                .data = (void *)&mpc8540_dma_ip_feature,
+        },
+        {
+                .compatible = "fsl,mpc8349-dma-channel",
+                .data = (void *)&mpc8349_dma_ip_feature,
+        },
+        {}
+};
+
+static struct of_platform_driver of_fsl_dma_chan_driver = {
+        .name = "of-fsl-dma-channel",
+        .match_table = of_fsl_dma_chan_ids,
+        .probe = of_fsl_dma_chan_probe,
+};
+
+static __init int of_fsl_dma_chan_init(void)
+{
+        return of_register_platform_driver(&of_fsl_dma_chan_driver);
+}
+
+static int __devinit of_fsl_dma_probe(struct of_device *dev,
+                        const struct of_device_id *match)
+{
+        int err;
+        unsigned int irq;
+        struct fsl_dma_device *fdev;
+
+        fdev = kzalloc(sizeof(struct fsl_dma_device), GFP_KERNEL);
+        if (!fdev) {
+                dev_err(&dev->dev, "No enough memory for 'priv'\n");
+                err = -ENOMEM;
+                goto err;
+        }
+        fdev->dev = &dev->dev;
+        INIT_LIST_HEAD(&fdev->common.channels);
+
+        /* get DMA controller register base */
+        err = of_address_to_resource(dev->node, 0, &fdev->reg);
+        if (err) {
+                dev_err(&dev->dev, "Can't get %s property 'reg'\n",
+                                dev->node->full_name);
+                goto err;
+        }
+
+        dev_info(&dev->dev, "Probe the Freescale DMA driver for %s "
+                        "controller at 0x%08x...\n",
+                        match->compatible, fdev->reg.start);
+        fdev->reg_base = ioremap(fdev->reg.start, fdev->reg.end
+                                                - fdev->reg.start + 1);
+
+        dma_cap_set(DMA_MEMCPY, fdev->common.cap_mask);
+        dma_cap_set(DMA_INTERRUPT, fdev->common.cap_mask);
+        fdev->common.device_alloc_chan_resources = fsl_dma_alloc_chan_resources;
+        fdev->common.device_free_chan_resources = fsl_dma_free_chan_resources;
+        fdev->common.device_prep_dma_memcpy = fsl_dma_prep_memcpy;
+        fdev->common.device_is_tx_complete = fsl_dma_is_complete;
+        fdev->common.device_issue_pending = fsl_dma_memcpy_issue_pending;
+        fdev->common.device_dependency_added = fsl_dma_dependency_added;
+        fdev->common.dev = &dev->dev;
+
+        irq = irq_of_parse_and_map(dev->node, 0);
+        if (irq != NO_IRQ) {
+                err = request_irq(irq, &fsl_dma_do_interrupt, IRQF_SHARED,
+                                        "fsldma-device", fdev);
+                if (err) {
+                        dev_err(&dev->dev, "DMA device request_irq error "
+                                "with return %d\n", err);
+                        goto err;
+                }
+        }
+
+        dev_set_drvdata(&(dev->dev), fdev);
+        of_platform_bus_probe(dev->node, of_fsl_dma_chan_ids, &dev->dev);
+
+        dma_async_device_register(&fdev->common);
+        return 0;
+
+err:
+        iounmap(fdev->reg_base);
+        kfree(fdev);
+        return err;
+}
+
+static struct of_device_id of_fsl_dma_ids[] = {
+        { .compatible = "fsl,mpc8540-dma", },
+        { .compatible = "fsl,mpc8349-dma", },
+        {}
+};
+
+static struct of_platform_driver of_fsl_dma_driver = {
+        .name = "of-fsl-dma",
+        .match_table = of_fsl_dma_ids,
+        .probe = of_fsl_dma_probe,
+};
+
+static __init int of_fsl_dma_init(void)
+{
+        return of_register_platform_driver(&of_fsl_dma_driver);
+}
+
+subsys_initcall(of_fsl_dma_chan_init);
+subsys_initcall(of_fsl_dma_init);
diff --git a/drivers/dma/fsldma.h b/drivers/dma/fsldma.h
new file mode 100644
index 000000000000..ba78c42121ba
--- /dev/null
+++ b/drivers/dma/fsldma.h
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2007 Freescale Semiconductor, Inc. All rights reserved.
+ *
+ * Author:
+ *   Zhang Wei <wei.zhang@freescale.com>, Jul 2007
+ *   Ebony Zhu <ebony.zhu@freescale.com>, May 2007
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+#ifndef __DMA_FSLDMA_H
+#define __DMA_FSLDMA_H
+
+#include <linux/device.h>
+#include <linux/dmapool.h>
+#include <linux/dmaengine.h>
+
+/* Define data structures needed by Freescale
+ * MPC8540 and MPC8349 DMA controller.
+ */
+#define FSL_DMA_MR_CS           0x00000001
+#define FSL_DMA_MR_CC           0x00000002
+#define FSL_DMA_MR_CA           0x00000008
+#define FSL_DMA_MR_EIE          0x00000040
+#define FSL_DMA_MR_XFE          0x00000020
+#define FSL_DMA_MR_EOLNIE       0x00000100
+#define FSL_DMA_MR_EOLSIE       0x00000080
+#define FSL_DMA_MR_EOSIE        0x00000200
+#define FSL_DMA_MR_CDSM         0x00000010
+#define FSL_DMA_MR_CTM          0x00000004
+#define FSL_DMA_MR_EMP_EN       0x00200000
+#define FSL_DMA_MR_EMS_EN       0x00040000
+#define FSL_DMA_MR_DAHE         0x00002000
+#define FSL_DMA_MR_SAHE         0x00001000
+
+/* Special MR definition for MPC8349 */
+#define FSL_DMA_MR_EOTIE        0x00000080
+
+#define FSL_DMA_SR_CH           0x00000020
+#define FSL_DMA_SR_CB           0x00000004
+#define FSL_DMA_SR_TE           0x00000080
+#define FSL_DMA_SR_EOSI         0x00000002
+#define FSL_DMA_SR_EOLSI        0x00000001
+#define FSL_DMA_SR_EOCDI        0x00000001
+#define FSL_DMA_SR_EOLNI        0x00000008
+
+#define FSL_DMA_SATR_SBPATMU                    0x20000000
+#define FSL_DMA_SATR_STRANSINT_RIO              0x00c00000
+#define FSL_DMA_SATR_SREADTYPE_SNOOP_READ       0x00050000
+#define FSL_DMA_SATR_SREADTYPE_BP_IORH          0x00020000
+#define FSL_DMA_SATR_SREADTYPE_BP_NREAD         0x00040000
+#define FSL_DMA_SATR_SREADTYPE_BP_MREAD         0x00070000
+
+#define FSL_DMA_DATR_DBPATMU                    0x20000000
+#define FSL_DMA_DATR_DTRANSINT_RIO              0x00c00000
+#define FSL_DMA_DATR_DWRITETYPE_SNOOP_WRITE     0x00050000
+#define FSL_DMA_DATR_DWRITETYPE_BP_FLUSH        0x00010000
+
+#define FSL_DMA_EOL             ((u64)0x1)
+#define FSL_DMA_SNEN            ((u64)0x10)
+#define FSL_DMA_EOSIE           0x8
+#define FSL_DMA_NLDA_MASK       (~(u64)0x1f)
+
+#define FSL_DMA_BCR_MAX_CNT     0x03ffffffu
+
+#define FSL_DMA_DGSR_TE         0x80
+#define FSL_DMA_DGSR_CH         0x20
+#define FSL_DMA_DGSR_PE         0x10
+#define FSL_DMA_DGSR_EOLNI      0x08
+#define FSL_DMA_DGSR_CB         0x04
+#define FSL_DMA_DGSR_EOSI       0x02
+#define FSL_DMA_DGSR_EOLSI      0x01
+
+struct fsl_dma_ld_hw {
+        u64 __bitwise   src_addr;
+        u64 __bitwise   dst_addr;
+        u64 __bitwise   next_ln_addr;
+        u32 __bitwise   count;
+        u32 __bitwise   reserve;
+} __attribute__((aligned(32)));
+
+struct fsl_desc_sw {
+        struct fsl_dma_ld_hw hw;
+        struct list_head node;
+        struct dma_async_tx_descriptor async_tx;
+        struct list_head *ld;
+        void *priv;
+} __attribute__((aligned(32)));
+
+struct fsl_dma_chan_regs {
+        u32 __bitwise   mr;     /* 0x00 - Mode Register */
+        u32 __bitwise   sr;     /* 0x04 - Status Register */
+        u64 __bitwise   cdar;   /* 0x08 - Current descriptor address register */
+        u64 __bitwise   sar;    /* 0x10 - Source Address Register */
+        u64 __bitwise   dar;    /* 0x18 - Destination Address Register */
+        u32 __bitwise   bcr;    /* 0x20 - Byte Count Register */
+        u64 __bitwise   ndar;   /* 0x24 - Next Descriptor Address Register */
+};
+
+struct fsl_dma_chan;
+#define FSL_DMA_MAX_CHANS_PER_DEVICE 4
+
+struct fsl_dma_device {
+        void __iomem *reg_base; /* DGSR register base */
+        struct resource reg;    /* Resource for register */
+        struct device *dev;
+        struct dma_device common;
+        struct fsl_dma_chan *chan[FSL_DMA_MAX_CHANS_PER_DEVICE];
+        u32 feature;            /* The same as DMA channels */
+};
+
+/* Define macros for fsl_dma_chan->feature property */
+#define FSL_DMA_LITTLE_ENDIAN   0x00000000
+#define FSL_DMA_BIG_ENDIAN      0x00000001
+
+#define FSL_DMA_IP_MASK         0x00000ff0
+#define FSL_DMA_IP_85XX         0x00000010
+#define FSL_DMA_IP_83XX         0x00000020
+
+#define FSL_DMA_CHAN_PAUSE_EXT  0x00001000
+#define FSL_DMA_CHAN_START_EXT  0x00002000
+
+struct fsl_dma_chan {
+        struct fsl_dma_chan_regs __iomem *reg_base;
+        dma_cookie_t completed_cookie;  /* The maximum cookie completed */
+        spinlock_t desc_lock;           /* Descriptor operation lock */
+        struct list_head ld_queue;      /* Link descriptors queue */
+        struct dma_chan common;         /* DMA common channel */
+        struct dma_pool *desc_pool;     /* Descriptors pool */
+        struct device *dev;             /* Channel device */
+        struct resource reg;            /* Resource for register */
+        int irq;                        /* Channel IRQ */
+        int id;                         /* Raw id of this channel */
+        struct tasklet_struct tasklet;
+        u32 feature;
+
+        void (*toggle_ext_pause)(struct fsl_dma_chan *fsl_chan, int size);
+        void (*toggle_ext_start)(struct fsl_dma_chan *fsl_chan, int enable);
+        void (*set_src_loop_size)(struct fsl_dma_chan *fsl_chan, int size);
+        void (*set_dest_loop_size)(struct fsl_dma_chan *fsl_chan, int size);
+};
+
+#define to_fsl_chan(chan) container_of(chan, struct fsl_dma_chan, common)
+#define to_fsl_desc(lh) container_of(lh, struct fsl_desc_sw, node)
+#define tx_to_fsl_desc(tx) container_of(tx, struct fsl_desc_sw, async_tx)
+
+#ifndef __powerpc64__
+static u64 in_be64(const u64 __iomem *addr)
+{
+        return ((u64)in_be32((u32 *)addr) << 32) | (in_be32((u32 *)addr + 1));
+}
+
+static void out_be64(u64 __iomem *addr, u64 val)
+{
+        out_be32((u32 *)addr, val >> 32);
+        out_be32((u32 *)addr + 1, (u32)val);
+}
+
+/* There is no asm instructions for 64 bits reverse loads and stores */
+static u64 in_le64(const u64 __iomem *addr)
+{
+        return ((u64)in_le32((u32 *)addr + 1) << 32) | (in_le32((u32 *)addr));
+}
+
+static void out_le64(u64 __iomem *addr, u64 val)
+{
+        out_le32((u32 *)addr + 1, val >> 32);
+        out_le32((u32 *)addr, (u32)val);
+}
+#endif
+
+#define DMA_IN(fsl_chan, addr, width)                                   \
+                (((fsl_chan)->feature & FSL_DMA_BIG_ENDIAN) ?           \
+                        in_be##width(addr) : in_le##width(addr))
+#define DMA_OUT(fsl_chan, addr, val, width)                             \
+                (((fsl_chan)->feature & FSL_DMA_BIG_ENDIAN) ?           \
+                        out_be##width(addr, val) : out_le##width(addr, val))
+
+#define DMA_TO_CPU(fsl_chan, d, width)                                  \
+                (((fsl_chan)->feature & FSL_DMA_BIG_ENDIAN) ?           \
+                        be##width##_to_cpu(d) : le##width##_to_cpu(d))
+#define CPU_TO_DMA(fsl_chan, c, width)                                  \
+                (((fsl_chan)->feature & FSL_DMA_BIG_ENDIAN) ?           \
+                        cpu_to_be##width(c) : cpu_to_le##width(c))
+
+#endif  /* __DMA_FSLDMA_H */
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index dff38accc5c1..4017d9e7acd2 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -714,6 +714,7 @@ static struct dma_async_tx_descriptor *ioat1_dma_prep_memcpy(
                 new->len = len;
                 new->dst = dma_dest;
                 new->src = dma_src;
+                new->async_tx.ack = 0;
                 return &new->async_tx;
         } else
                 return NULL;
@@ -741,6 +742,7 @@ static struct dma_async_tx_descriptor *ioat2_dma_prep_memcpy(
                 new->len = len;
                 new->dst = dma_dest;
                 new->src = dma_src;
+                new->async_tx.ack = 0;
                 return &new->async_tx;
         } else
                 return NULL;
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 3e9719948a8e..a03462750b95 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -18,6 +18,7 @@
 
 #include <linux/module.h>
 #include <linux/errno.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/mutex.h>
 #include <linux/crc-itu-t.h>
@@ -214,17 +215,29 @@ static void
 fw_card_bm_work(struct work_struct *work)
 {
         struct fw_card *card = container_of(work, struct fw_card, work.work);
-        struct fw_device *root;
+        struct fw_device *root_device;
+        struct fw_node *root_node, *local_node;
         struct bm_data bmd;
         unsigned long flags;
         int root_id, new_root_id, irm_id, gap_count, generation, grace;
         int do_reset = 0;
 
         spin_lock_irqsave(&card->lock, flags);
+        local_node = card->local_node;
+        root_node  = card->root_node;
+
+        if (local_node == NULL) {
+                spin_unlock_irqrestore(&card->lock, flags);
+                return;
+        }
+        fw_node_get(local_node);
+        fw_node_get(root_node);
 
         generation = card->generation;
-        root = card->root_node->data;
-        root_id = card->root_node->node_id;
+        root_device = root_node->data;
+        if (root_device)
+                fw_device_get(root_device);
+        root_id = root_node->node_id;
         grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 10));
 
         if (card->bm_generation + 1 == generation ||
@@ -243,14 +256,14 @@ fw_card_bm_work(struct work_struct *work)
 
                 irm_id = card->irm_node->node_id;
                 if (!card->irm_node->link_on) {
-                        new_root_id = card->local_node->node_id;
+                        new_root_id = local_node->node_id;
                         fw_notify("IRM has link off, making local node (%02x) root.\n",
                                   new_root_id);
                         goto pick_me;
                 }
 
                 bmd.lock.arg = cpu_to_be32(0x3f);
-                bmd.lock.data = cpu_to_be32(card->local_node->node_id);
+                bmd.lock.data = cpu_to_be32(local_node->node_id);
 
                 spin_unlock_irqrestore(&card->lock, flags);
 
@@ -267,12 +280,12 @@ fw_card_bm_work(struct work_struct *work)
                          * Another bus reset happened. Just return,
                          * the BM work has been rescheduled.
                          */
-                        return;
+                        goto out;
                 }
 
                 if (bmd.rcode == RCODE_COMPLETE && bmd.old != 0x3f)
                         /* Somebody else is BM, let them do the work. */
-                        return;
+                        goto out;
 
                 spin_lock_irqsave(&card->lock, flags);
                 if (bmd.rcode != RCODE_COMPLETE) {
@@ -282,7 +295,7 @@ fw_card_bm_work(struct work_struct *work)
                          * do a bus reset and pick the local node as
                          * root, and thus, IRM.
                          */
-                        new_root_id = card->local_node->node_id;
+                        new_root_id = local_node->node_id;
                         fw_notify("BM lock failed, making local node (%02x) root.\n",
                                   new_root_id);
                         goto pick_me;
@@ -295,7 +308,7 @@ fw_card_bm_work(struct work_struct *work)
                  */
                 spin_unlock_irqrestore(&card->lock, flags);
                 schedule_delayed_work(&card->work, DIV_ROUND_UP(HZ, 10));
-                return;
+                goto out;
         }
 
         /*
@@ -305,20 +318,20 @@ fw_card_bm_work(struct work_struct *work)
          */
         card->bm_generation = generation;
 
-        if (root == NULL) {
+        if (root_device == NULL) {
                 /*
                  * Either link_on is false, or we failed to read the
                  * config rom.  In either case, pick another root.
                  */
-                new_root_id = card->local_node->node_id;
-        } else if (atomic_read(&root->state) != FW_DEVICE_RUNNING) {
+                new_root_id = local_node->node_id;
+        } else if (atomic_read(&root_device->state) != FW_DEVICE_RUNNING) {
                 /*
                  * If we haven't probed this device yet, bail out now
                  * and let's try again once that's done.
                  */
                 spin_unlock_irqrestore(&card->lock, flags);
-                return;
-        } else if (root->config_rom[2] & BIB_CMC) {
+                goto out;
+        } else if (root_device->config_rom[2] & BIB_CMC) {
                 /*
                  * FIXME: I suppose we should set the cmstr bit in the
                  * STATE_CLEAR register of this node, as described in
@@ -332,7 +345,7 @@ fw_card_bm_work(struct work_struct *work)
                  * successfully read the config rom, but it's not
                  * cycle master capable.
                  */
-                new_root_id = card->local_node->node_id;
+                new_root_id = local_node->node_id;
         }
 
  pick_me:
@@ -341,8 +354,8 @@ fw_card_bm_work(struct work_struct *work)
          * the typically much larger 1394b beta repeater delays though.
          */
         if (!card->beta_repeaters_present &&
-            card->root_node->max_hops < ARRAY_SIZE(gap_count_table))
-                gap_count = gap_count_table[card->root_node->max_hops];
+            root_node->max_hops < ARRAY_SIZE(gap_count_table))
+                gap_count = gap_count_table[root_node->max_hops];
         else
                 gap_count = 63;
 
@@ -364,6 +377,11 @@ fw_card_bm_work(struct work_struct *work)
                 fw_send_phy_config(card, new_root_id, generation, gap_count);
                 fw_core_initiate_bus_reset(card, 1);
         }
+ out:
+        if (root_device)
+                fw_device_put(root_device);
+        fw_node_put(root_node);
+        fw_node_put(local_node);
 }
 
 static void
@@ -381,6 +399,7 @@ fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
         static atomic_t index = ATOMIC_INIT(-1);
 
         kref_init(&card->kref);
+        atomic_set(&card->device_count, 0);
         card->index = atomic_inc_return(&index);
         card->driver = driver;
         card->device = device;
@@ -511,8 +530,14 @@ fw_core_remove_card(struct fw_card *card)
         card->driver = &dummy_driver;
 
         fw_destroy_nodes(card);
-        flush_scheduled_work();
+        /*
+         * Wait for all device workqueue jobs to finish.  Otherwise the
+         * firewire-core module could be unloaded before the jobs ran.
+         */
+        while (atomic_read(&card->device_count) > 0)
+                msleep(100);
 
+        cancel_delayed_work_sync(&card->work);
         fw_flush_transactions(card);
         del_timer_sync(&card->flush_timer);
 
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index 7e73cbaa4121..46bc197a047f 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -109,15 +109,17 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
         struct client *client;
         unsigned long flags;
 
-        device = fw_device_from_devt(inode->i_rdev);
+        device = fw_device_get_by_devt(inode->i_rdev);
         if (device == NULL)
                 return -ENODEV;
 
         client = kzalloc(sizeof(*client), GFP_KERNEL);
-        if (client == NULL)
+        if (client == NULL) {
+                fw_device_put(device);
                 return -ENOMEM;
+        }
 
-        client->device = fw_device_get(device);
+        client->device = device;
         INIT_LIST_HEAD(&client->event_list);
         INIT_LIST_HEAD(&client->resource_list);
         spin_lock_init(&client->lock);
@@ -644,6 +646,10 @@ static int ioctl_create_iso_context(struct client *client, void *buffer)
         struct fw_cdev_create_iso_context *request = buffer;
         struct fw_iso_context *context;
 
+        /* We only support one context at this time. */
+        if (client->iso_context != NULL)
+                return -EBUSY;
+
         if (request->channel > 63)
                 return -EINVAL;
 
@@ -790,8 +796,9 @@ static int ioctl_start_iso(struct client *client, void *buffer)
 {
         struct fw_cdev_start_iso *request = buffer;
 
-        if (request->handle != 0)
+        if (client->iso_context == NULL || request->handle != 0)
                 return -EINVAL;
+
         if (client->iso_context->type == FW_ISO_CONTEXT_RECEIVE) {
                 if (request->tags == 0 || request->tags > 15)
                         return -EINVAL;
@@ -808,7 +815,7 @@ static int ioctl_stop_iso(struct client *client, void *buffer)
 {
         struct fw_cdev_stop_iso *request = buffer;
 
-        if (request->handle != 0)
+        if (client->iso_context == NULL || request->handle != 0)
                 return -EINVAL;
 
         return fw_iso_context_stop(client->iso_context);
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index de9066e69adf..870125a3638e 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -150,21 +150,10 @@ struct bus_type fw_bus_type = {
 };
 EXPORT_SYMBOL(fw_bus_type);
 
-struct fw_device *fw_device_get(struct fw_device *device)
-{
-        get_device(&device->device);
-
-        return device;
-}
-
-void fw_device_put(struct fw_device *device)
-{
-        put_device(&device->device);
-}
-
 static void fw_device_release(struct device *dev)
 {
         struct fw_device *device = fw_device(dev);
+        struct fw_card *card = device->card;
         unsigned long flags;
 
         /*
@@ -176,9 +165,9 @@ static void fw_device_release(struct device *dev)
         spin_unlock_irqrestore(&device->card->lock, flags);
 
         fw_node_put(device->node);
-        fw_card_put(device->card);
         kfree(device->config_rom);
         kfree(device);
+        atomic_dec(&card->device_count);
 }
 
 int fw_device_enable_phys_dma(struct fw_device *device)
@@ -358,12 +347,9 @@ static ssize_t
 guid_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct fw_device *device = fw_device(dev);
-        u64 guid;
-
-        guid = ((u64)device->config_rom[3] << 32) | device->config_rom[4];
 
-        return snprintf(buf, PAGE_SIZE, "0x%016llx\n",
-                        (unsigned long long)guid);
+        return snprintf(buf, PAGE_SIZE, "0x%08x%08x\n",
+                        device->config_rom[3], device->config_rom[4]);
 }
 
 static struct device_attribute fw_device_attributes[] = {
@@ -610,12 +596,14 @@ static DECLARE_RWSEM(idr_rwsem);
 static DEFINE_IDR(fw_device_idr);
 int fw_cdev_major;
 
-struct fw_device *fw_device_from_devt(dev_t devt)
+struct fw_device *fw_device_get_by_devt(dev_t devt)
 {
         struct fw_device *device;
 
         down_read(&idr_rwsem);
         device = idr_find(&fw_device_idr, MINOR(devt));
+        if (device)
+                fw_device_get(device);
         up_read(&idr_rwsem);
 
         return device;
@@ -627,13 +615,14 @@ static void fw_device_shutdown(struct work_struct *work)
                 container_of(work, struct fw_device, work.work);
         int minor = MINOR(device->device.devt);
 
-        down_write(&idr_rwsem);
-        idr_remove(&fw_device_idr, minor);
-        up_write(&idr_rwsem);
-
         fw_device_cdev_remove(device);
         device_for_each_child(&device->device, NULL, shutdown_unit);
         device_unregister(&device->device);
+
+        down_write(&idr_rwsem);
+        idr_remove(&fw_device_idr, minor);
+        up_write(&idr_rwsem);
+        fw_device_put(device);
 }
 
 static struct device_type fw_device_type = {
@@ -668,7 +657,8 @@ static void fw_device_init(struct work_struct *work)
          */
 
         if (read_bus_info_block(device, device->generation) < 0) {
-                if (device->config_rom_retries < MAX_RETRIES) {
+                if (device->config_rom_retries < MAX_RETRIES &&
+                    atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
                         device->config_rom_retries++;
                         schedule_delayed_work(&device->work, RETRY_DELAY);
                 } else {
@@ -682,10 +672,13 @@ static void fw_device_init(struct work_struct *work)
         }
 
         err = -ENOMEM;
+
+        fw_device_get(device);
         down_write(&idr_rwsem);
         if (idr_pre_get(&fw_device_idr, GFP_KERNEL))
                 err = idr_get_new(&fw_device_idr, device, &minor);
         up_write(&idr_rwsem);
+
         if (err < 0)
                 goto error;
 
@@ -717,13 +710,22 @@ static void fw_device_init(struct work_struct *work)
          */
         if (atomic_cmpxchg(&device->state,
                     FW_DEVICE_INITIALIZING,
-                    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
+                    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN) {
                 fw_device_shutdown(&device->work.work);
-        else
-                fw_notify("created new fw device %s "
-                          "(%d config rom retries, S%d00)\n",
-                          device->device.bus_id, device->config_rom_retries,
-                          1 << device->max_speed);
+        } else {
+                if (device->config_rom_retries)
+                        fw_notify("created device %s: GUID %08x%08x, S%d00, "
+                                  "%d config ROM retries\n",
+                                  device->device.bus_id,
+                                  device->config_rom[3], device->config_rom[4],
+                                  1 << device->max_speed,
+                                  device->config_rom_retries);
+                else
+                        fw_notify("created device %s: GUID %08x%08x, S%d00\n",
+                                  device->device.bus_id,
+                                  device->config_rom[3], device->config_rom[4],
+                                  1 << device->max_speed);
+        }
 
         /*
          * Reschedule the IRM work if we just finished reading the
@@ -741,7 +743,9 @@ static void fw_device_init(struct work_struct *work)
         idr_remove(&fw_device_idr, minor);
         up_write(&idr_rwsem);
  error:
-        put_device(&device->device);
+        fw_device_put(device);          /* fw_device_idr's reference */
+
+        put_device(&device->device);    /* our reference */
 }
 
 static int update_unit(struct device *dev, void *data)
@@ -791,7 +795,8 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                  */
                 device_initialize(&device->device);
                 atomic_set(&device->state, FW_DEVICE_INITIALIZING);
-                device->card = fw_card_get(card);
+                atomic_inc(&card->device_count);
+                device->card = card;
                 device->node = fw_node_get(node);
                 device->node_id = node->node_id;
                 device->generation = card->generation;
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index 0854fe2bc110..78ecd3991b7f 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -76,14 +76,26 @@ fw_device_is_shutdown(struct fw_device *device)
         return atomic_read(&device->state) == FW_DEVICE_SHUTDOWN;
 }
 
-struct fw_device *fw_device_get(struct fw_device *device);
-void fw_device_put(struct fw_device *device);
+static inline struct fw_device *
+fw_device_get(struct fw_device *device)
+{
+        get_device(&device->device);
+
+        return device;
+}
+
+static inline void
+fw_device_put(struct fw_device *device)
+{
+        put_device(&device->device);
+}
+
+struct fw_device *fw_device_get_by_devt(dev_t devt);
 int fw_device_enable_phys_dma(struct fw_device *device);
 
 void fw_device_cdev_update(struct fw_device *device);
 void fw_device_cdev_remove(struct fw_device *device);
 
-struct fw_device *fw_device_from_devt(dev_t devt);
 extern int fw_cdev_major;
 
 struct fw_unit {
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index 19ece9b6d742..03069a454c07 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -28,14 +28,15 @@
  * and many others.
  */
 
+#include <linux/blkdev.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/mod_devicetable.h>
-#include <linux/device.h>
 #include <linux/scatterlist.h>
-#include <linux/dma-mapping.h>
-#include <linux/blkdev.h>
 #include <linux/string.h>
 #include <linux/stringify.h>
 #include <linux/timer.h>
@@ -47,9 +48,9 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 
-#include "fw-transaction.h"
-#include "fw-topology.h"
 #include "fw-device.h"
+#include "fw-topology.h"
+#include "fw-transaction.h"
 
 /*
  * So far only bridges from Oxford Semiconductor are known to support
@@ -82,6 +83,9 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
  *   Avoids access beyond actual disk limits on devices with an off-by-one bug.
  *   Don't use this with devices which don't have this bug.
  *
+ * - delay inquiry
+ *   Wait extra SBP2_INQUIRY_DELAY seconds after login before SCSI inquiry.
+ *
  * - override internal blacklist
  *   Instead of adding to the built-in blacklist, use only the workarounds
  *   specified in the module load parameter.
@@ -91,6 +95,8 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
 #define SBP2_WORKAROUND_INQUIRY_36      0x2
 #define SBP2_WORKAROUND_MODE_SENSE_8    0x4
 #define SBP2_WORKAROUND_FIX_CAPACITY    0x8
+#define SBP2_WORKAROUND_DELAY_INQUIRY   0x10
+#define SBP2_INQUIRY_DELAY              12
 #define SBP2_WORKAROUND_OVERRIDE        0x100
 
 static int sbp2_param_workarounds;
@@ -100,6 +106,7 @@ MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
         ", 36 byte inquiry = "    __stringify(SBP2_WORKAROUND_INQUIRY_36)
         ", skip mode page 8 = "   __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
         ", fix capacity = "       __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
+        ", delay inquiry = "      __stringify(SBP2_WORKAROUND_DELAY_INQUIRY)
         ", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
         ", or a combination)");
 
@@ -115,7 +122,6 @@ static const char sbp2_driver_name[] = "sbp2";
 struct sbp2_logical_unit {
         struct sbp2_target *tgt;
         struct list_head link;
-        struct scsi_device *sdev;
         struct fw_address_handler address_handler;
         struct list_head orb_list;
 
@@ -132,6 +138,8 @@ struct sbp2_logical_unit {
         int generation;
         int retries;
         struct delayed_work work;
+        bool has_sdev;
+        bool blocked;
 };
 
 /*
@@ -141,16 +149,18 @@ struct sbp2_logical_unit {
 struct sbp2_target {
         struct kref kref;
         struct fw_unit *unit;
+        const char *bus_id;
+        struct list_head lu_list;
 
         u64 management_agent_address;
         int directory_id;
         int node_id;
         int address_high;
-
-        unsigned workarounds;
-        struct list_head lu_list;
-
+        unsigned int workarounds;
         unsigned int mgt_orb_timeout;
+
+        int dont_block; /* counter for each logical unit */
+        int blocked;    /* ditto */
 };
 
 /*
@@ -160,7 +170,7 @@ struct sbp2_target {
  */
 #define SBP2_MIN_LOGIN_ORB_TIMEOUT      5000U   /* Timeout in ms */
 #define SBP2_MAX_LOGIN_ORB_TIMEOUT      40000U  /* Timeout in ms */
-#define SBP2_ORB_TIMEOUT                2000    /* Timeout in ms */
+#define SBP2_ORB_TIMEOUT                2000U   /* Timeout in ms */
 #define SBP2_ORB_NULL                   0x80000000
 #define SBP2_MAX_SG_ELEMENT_LENGTH      0xf000
 
@@ -297,7 +307,7 @@ struct sbp2_command_orb {
 static const struct {
         u32 firmware_revision;
         u32 model;
-        unsigned workarounds;
+        unsigned int workarounds;
 } sbp2_workarounds_table[] = {
         /* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
                 .firmware_revision      = 0x002800,
@@ -305,6 +315,11 @@ static const struct {
                 .workarounds            = SBP2_WORKAROUND_INQUIRY_36 |
                                           SBP2_WORKAROUND_MODE_SENSE_8,
         },
+        /* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
+                .firmware_revision      = 0x002800,
+                .model                  = 0x000000,
+                .workarounds            = SBP2_WORKAROUND_DELAY_INQUIRY,
+        },
         /* Initio bridges, actually only needed for some older ones */ {
                 .firmware_revision      = 0x000200,
                 .model                  = ~0,
@@ -501,6 +516,9 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
         unsigned int timeout;
         int retval = -ENOMEM;
 
+        if (function == SBP2_LOGOUT_REQUEST && fw_device_is_shutdown(device))
+                return 0;
+
         orb = kzalloc(sizeof(*orb), GFP_ATOMIC);
         if (orb == NULL)
                 return -ENOMEM;
@@ -553,20 +571,20 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
 
         retval = -EIO;
         if (sbp2_cancel_orbs(lu) == 0) {
-                fw_error("orb reply timed out, rcode=0x%02x\n",
-                         orb->base.rcode);
+                fw_error("%s: orb reply timed out, rcode=0x%02x\n",
+                         lu->tgt->bus_id, orb->base.rcode);
                 goto out;
         }
 
         if (orb->base.rcode != RCODE_COMPLETE) {
-                fw_error("management write failed, rcode 0x%02x\n",
-                         orb->base.rcode);
+                fw_error("%s: management write failed, rcode 0x%02x\n",
+                         lu->tgt->bus_id, orb->base.rcode);
                 goto out;
         }
 
         if (STATUS_GET_RESPONSE(orb->status) != 0 ||
             STATUS_GET_SBP_STATUS(orb->status) != 0) {
-                fw_error("error status: %d:%d\n",
+                fw_error("%s: error status: %d:%d\n", lu->tgt->bus_id,
                          STATUS_GET_RESPONSE(orb->status),
                          STATUS_GET_SBP_STATUS(orb->status));
                 goto out;
@@ -590,29 +608,158 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
 
 static void
 complete_agent_reset_write(struct fw_card *card, int rcode,
-                           void *payload, size_t length, void *data)
+                           void *payload, size_t length, void *done)
 {
-        struct fw_transaction *t = data;
+        complete(done);
+}
 
-        kfree(t);
+static void sbp2_agent_reset(struct sbp2_logical_unit *lu)
+{
+        struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
+        DECLARE_COMPLETION_ONSTACK(done);
+        struct fw_transaction t;
+        static u32 z;
+
+        fw_send_request(device->card, &t, TCODE_WRITE_QUADLET_REQUEST,
+                        lu->tgt->node_id, lu->generation, device->max_speed,
+                        lu->command_block_agent_address + SBP2_AGENT_RESET,
+                        &z, sizeof(z), complete_agent_reset_write, &done);
+        wait_for_completion(&done);
+}
+
+static void
+complete_agent_reset_write_no_wait(struct fw_card *card, int rcode,
+                                   void *payload, size_t length, void *data)
+{
+        kfree(data);
 }
 
-static int sbp2_agent_reset(struct sbp2_logical_unit *lu)
+static void sbp2_agent_reset_no_wait(struct sbp2_logical_unit *lu)
 {
         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
         struct fw_transaction *t;
-        static u32 zero;
+        static u32 z;
 
-        t = kzalloc(sizeof(*t), GFP_ATOMIC);
+        t = kmalloc(sizeof(*t), GFP_ATOMIC);
         if (t == NULL)
-                return -ENOMEM;
+                return;
 
         fw_send_request(device->card, t, TCODE_WRITE_QUADLET_REQUEST,
                         lu->tgt->node_id, lu->generation, device->max_speed,
                         lu->command_block_agent_address + SBP2_AGENT_RESET,
-                        &zero, sizeof(zero), complete_agent_reset_write, t);
+                        &z, sizeof(z), complete_agent_reset_write_no_wait, t);
+}
 
-        return 0;
+static void sbp2_set_generation(struct sbp2_logical_unit *lu, int generation)
+{
+        struct fw_card *card = fw_device(lu->tgt->unit->device.parent)->card;
+        unsigned long flags;
+
+        /* serialize with comparisons of lu->generation and card->generation */
+        spin_lock_irqsave(&card->lock, flags);
+        lu->generation = generation;
+        spin_unlock_irqrestore(&card->lock, flags);
+}
+
+static inline void sbp2_allow_block(struct sbp2_logical_unit *lu)
+{
+        /*
+         * We may access dont_block without taking card->lock here:
+         * All callers of sbp2_allow_block() and all callers of sbp2_unblock()
+         * are currently serialized against each other.
+         * And a wrong result in sbp2_conditionally_block()'s access of
+         * dont_block is rather harmless, it simply misses its first chance.
+         */
+        --lu->tgt->dont_block;
+}
+
+/*
+ * Blocks lu->tgt if all of the following conditions are met:
+ *   - Login, INQUIRY, and high-level SCSI setup of all of the target's
+ *     logical units have been finished (indicated by dont_block == 0).
+ *   - lu->generation is stale.
+ *
+ * Note, scsi_block_requests() must be called while holding card->lock,
+ * otherwise it might foil sbp2_[conditionally_]unblock()'s attempt to
+ * unblock the target.
+ */
+static void sbp2_conditionally_block(struct sbp2_logical_unit *lu)
+{
+        struct sbp2_target *tgt = lu->tgt;
+        struct fw_card *card = fw_device(tgt->unit->device.parent)->card;
+        struct Scsi_Host *shost =
+                container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
+        unsigned long flags;
+
+        spin_lock_irqsave(&card->lock, flags);
+        if (!tgt->dont_block && !lu->blocked &&
+            lu->generation != card->generation) {
+                lu->blocked = true;
+                if (++tgt->blocked == 1) {
+                        scsi_block_requests(shost);
+                        fw_notify("blocked %s\n", lu->tgt->bus_id);
+                }
+        }
+        spin_unlock_irqrestore(&card->lock, flags);
+}
+
+/*
+ * Unblocks lu->tgt as soon as all its logical units can be unblocked.
+ * Note, it is harmless to run scsi_unblock_requests() outside the
+ * card->lock protected section.  On the other hand, running it inside
+ * the section might clash with shost->host_lock.
+ */
+static void sbp2_conditionally_unblock(struct sbp2_logical_unit *lu)
+{
+        struct sbp2_target *tgt = lu->tgt;
+        struct fw_card *card = fw_device(tgt->unit->device.parent)->card;
+        struct Scsi_Host *shost =
+                container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
+        unsigned long flags;
+        bool unblock = false;
+
+        spin_lock_irqsave(&card->lock, flags);
+        if (lu->blocked && lu->generation == card->generation) {
+                lu->blocked = false;
+                unblock = --tgt->blocked == 0;
+        }
+        spin_unlock_irqrestore(&card->lock, flags);
+
+        if (unblock) {
+                scsi_unblock_requests(shost);
+                fw_notify("unblocked %s\n", lu->tgt->bus_id);
+        }
+}
+
+/*
+ * Prevents future blocking of tgt and unblocks it.
+ * Note, it is harmless to run scsi_unblock_requests() outside the
+ * card->lock protected section.  On the other hand, running it inside
+ * the section might clash with shost->host_lock.
+ */
+static void sbp2_unblock(struct sbp2_target *tgt)
+{
+        struct fw_card *card = fw_device(tgt->unit->device.parent)->card;
+        struct Scsi_Host *shost =
+                container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
+        unsigned long flags;
+
+        spin_lock_irqsave(&card->lock, flags);
+        ++tgt->dont_block;
+        spin_unlock_irqrestore(&card->lock, flags);
+
+        scsi_unblock_requests(shost);
+}
+
+static int sbp2_lun2int(u16 lun)
+{
+        struct scsi_lun eight_bytes_lun;
+
+        memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
+        eight_bytes_lun.scsi_lun[0] = (lun >> 8) & 0xff;
+        eight_bytes_lun.scsi_lun[1] = lun & 0xff;
+
+        return scsilun_to_int(&eight_bytes_lun);
 }
 
 static void sbp2_release_target(struct kref *kref)
@@ -621,26 +768,31 @@ static void sbp2_release_target(struct kref *kref)
         struct sbp2_logical_unit *lu, *next;
         struct Scsi_Host *shost =
                 container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
+        struct scsi_device *sdev;
         struct fw_device *device = fw_device(tgt->unit->device.parent);
 
-        list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
-                if (lu->sdev)
-                        scsi_remove_device(lu->sdev);
+        /* prevent deadlocks */
+        sbp2_unblock(tgt);
 
-                if (!fw_device_is_shutdown(device))
-                        sbp2_send_management_orb(lu, tgt->node_id,
-                                        lu->generation, SBP2_LOGOUT_REQUEST,
-                                        lu->login_id, NULL);
+        list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
+                sdev = scsi_device_lookup(shost, 0, 0, sbp2_lun2int(lu->lun));
+                if (sdev) {
+                        scsi_remove_device(sdev);
+                        scsi_device_put(sdev);
+                }
+                sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
+                                SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
 
                 fw_core_remove_address_handler(&lu->address_handler);
                 list_del(&lu->link);
                 kfree(lu);
         }
         scsi_remove_host(shost);
-        fw_notify("released %s\n", tgt->unit->device.bus_id);
+        fw_notify("released %s\n", tgt->bus_id);
 
         put_device(&tgt->unit->device);
         scsi_host_put(shost);
+        fw_device_put(device);
 }
 
 static struct workqueue_struct *sbp2_wq;
@@ -666,33 +818,42 @@ static void sbp2_login(struct work_struct *work)
 {
         struct sbp2_logical_unit *lu =
                 container_of(work, struct sbp2_logical_unit, work.work);
-        struct Scsi_Host *shost =
-                container_of((void *)lu->tgt, struct Scsi_Host, hostdata[0]);
+        struct sbp2_target *tgt = lu->tgt;
+        struct fw_device *device = fw_device(tgt->unit->device.parent);
+        struct Scsi_Host *shost;
         struct scsi_device *sdev;
-        struct scsi_lun eight_bytes_lun;
-        struct fw_unit *unit = lu->tgt->unit;
-        struct fw_device *device = fw_device(unit->device.parent);
         struct sbp2_login_response response;
         int generation, node_id, local_node_id;
 
+        if (fw_device_is_shutdown(device))
+                goto out;
+
         generation    = device->generation;
         smp_rmb();    /* node_id must not be older than generation */
         node_id       = device->node_id;
         local_node_id = device->card->node_id;
 
+        /* If this is a re-login attempt, log out, or we might be rejected. */
+        if (lu->has_sdev)
+                sbp2_send_management_orb(lu, device->node_id, generation,
+                                SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
+
         if (sbp2_send_management_orb(lu, node_id, generation,
                                 SBP2_LOGIN_REQUEST, lu->lun, &response) < 0) {
-                if (lu->retries++ < 5)
+                if (lu->retries++ < 5) {
                         sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
-                else
-                        fw_error("failed to login to %s LUN %04x\n",
-                                 unit->device.bus_id, lu->lun);
+                } else {
+                        fw_error("%s: failed to login to LUN %04x\n",
+                                 tgt->bus_id, lu->lun);
+                        /* Let any waiting I/O fail from now on. */
+                        sbp2_unblock(lu->tgt);
+                }
                 goto out;
         }
 
-        lu->generation        = generation;
-        lu->tgt->node_id      = node_id;
-        lu->tgt->address_high = local_node_id << 16;
+        tgt->node_id      = node_id;
+        tgt->address_high = local_node_id << 16;
+        sbp2_set_generation(lu, generation);
 
         /* Get command block agent offset and login id. */
         lu->command_block_agent_address =
@@ -700,8 +861,8 @@ static void sbp2_login(struct work_struct *work)
                 response.command_block_agent.low;
         lu->login_id = LOGIN_RESPONSE_GET_LOGIN_ID(response);
 
-        fw_notify("logged in to %s LUN %04x (%d retries)\n",
-                  unit->device.bus_id, lu->lun, lu->retries);
+        fw_notify("%s: logged in to LUN %04x (%d retries)\n",
+                  tgt->bus_id, lu->lun, lu->retries);
 
 #if 0
         /* FIXME: The linux1394 sbp2 does this last step. */
@@ -711,26 +872,58 @@ static void sbp2_login(struct work_struct *work)
         PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
         sbp2_agent_reset(lu);
 
-        memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
-        eight_bytes_lun.scsi_lun[0] = (lu->lun >> 8) & 0xff;
-        eight_bytes_lun.scsi_lun[1] = lu->lun & 0xff;
+        /* This was a re-login. */
+        if (lu->has_sdev) {
+                sbp2_cancel_orbs(lu);
+                sbp2_conditionally_unblock(lu);
+                goto out;
+        }
 
-        sdev = __scsi_add_device(shost, 0, 0,
-                                 scsilun_to_int(&eight_bytes_lun), lu);
-        if (IS_ERR(sdev)) {
-                sbp2_send_management_orb(lu, node_id, generation,
-                                SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
-                /*
-                 * Set this back to sbp2_login so we fall back and
-                 * retry login on bus reset.
-                 */
-                PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
-        } else {
-                lu->sdev = sdev;
+        if (lu->tgt->workarounds & SBP2_WORKAROUND_DELAY_INQUIRY)
+                ssleep(SBP2_INQUIRY_DELAY);
+
+        shost = container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
+        sdev = __scsi_add_device(shost, 0, 0, sbp2_lun2int(lu->lun), lu);
+        /*
+         * FIXME:  We are unable to perform reconnects while in sbp2_login().
+         * Therefore __scsi_add_device() will get into trouble if a bus reset
+         * happens in parallel.  It will either fail or leave us with an
+         * unusable sdev.  As a workaround we check for this and retry the
+         * whole login and SCSI probing.
+         */
+
+        /* Reported error during __scsi_add_device() */
+        if (IS_ERR(sdev))
+                goto out_logout_login;
+
+        /* Unreported error during __scsi_add_device() */
+        smp_rmb(); /* get current card generation */
+        if (generation != device->card->generation) {
+                scsi_remove_device(sdev);
                 scsi_device_put(sdev);
+                goto out_logout_login;
         }
+
+        /* No error during __scsi_add_device() */
+        lu->has_sdev = true;
+        scsi_device_put(sdev);
+        sbp2_allow_block(lu);
+        goto out;
+
+ out_logout_login:
+        smp_rmb(); /* generation may have changed */
+        generation = device->generation;
+        smp_rmb(); /* node_id must not be older than generation */
+
+        sbp2_send_management_orb(lu, device->node_id, generation,
+                                 SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
+        /*
+         * If a bus reset happened, sbp2_update will have requeued
+         * lu->work already.  Reset the work from reconnect to login.
+         */
+        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
  out:
-        sbp2_target_put(lu->tgt);
+        sbp2_target_put(tgt);
 }
 
 static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
@@ -751,10 +944,12 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
                 return -ENOMEM;
         }
 
-        lu->tgt  = tgt;
-        lu->sdev = NULL;
-        lu->lun  = lun_entry & 0xffff;
-        lu->retries = 0;
+        lu->tgt      = tgt;
+        lu->lun      = lun_entry & 0xffff;
+        lu->retries  = 0;
+        lu->has_sdev = false;
+        lu->blocked  = false;
+        ++tgt->dont_block;
         INIT_LIST_HEAD(&lu->orb_list);
         INIT_DELAYED_WORK(&lu->work, sbp2_login);
 
@@ -813,7 +1008,7 @@ static int sbp2_scan_unit_dir(struct sbp2_target *tgt, u32 *directory,
                         if (timeout > tgt->mgt_orb_timeout)
                                 fw_notify("%s: config rom contains %ds "
                                           "management ORB timeout, limiting "
-                                          "to %ds\n", tgt->unit->device.bus_id,
+                                          "to %ds\n", tgt->bus_id,
                                           timeout / 1000,
                                           tgt->mgt_orb_timeout / 1000);
                         break;
@@ -836,12 +1031,12 @@ static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
                                   u32 firmware_revision)
 {
         int i;
-        unsigned w = sbp2_param_workarounds;
+        unsigned int w = sbp2_param_workarounds;
 
         if (w)
                 fw_notify("Please notify linux1394-devel@lists.sourceforge.net "
                           "if you need the workarounds parameter for %s\n",
-                          tgt->unit->device.bus_id);
+                          tgt->bus_id);
 
         if (w & SBP2_WORKAROUND_OVERRIDE)
                 goto out;
@@ -863,8 +1058,7 @@ static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
         if (w)
                 fw_notify("Workarounds for %s: 0x%x "
                           "(firmware_revision 0x%06x, model_id 0x%06x)\n",
-                          tgt->unit->device.bus_id,
-                          w, firmware_revision, model);
+                          tgt->bus_id, w, firmware_revision, model);
         tgt->workarounds = w;
 }
 
@@ -888,6 +1082,7 @@ static int sbp2_probe(struct device *dev)
         tgt->unit = unit;
         kref_init(&tgt->kref);
         INIT_LIST_HEAD(&tgt->lu_list);
+        tgt->bus_id = unit->device.bus_id;
 
         if (fw_device_enable_phys_dma(device) < 0)
                 goto fail_shost_put;
@@ -895,6 +1090,8 @@ static int sbp2_probe(struct device *dev)
         if (scsi_add_host(shost, &unit->device) < 0)
                 goto fail_shost_put;
 
+        fw_device_get(device);
+
         /* Initialize to values that won't match anything in our table. */
         firmware_revision = 0xff000000;
         model = 0xff000000;
@@ -938,10 +1135,13 @@ static void sbp2_reconnect(struct work_struct *work)
 {
         struct sbp2_logical_unit *lu =
                 container_of(work, struct sbp2_logical_unit, work.work);
-        struct fw_unit *unit = lu->tgt->unit;
-        struct fw_device *device = fw_device(unit->device.parent);
+        struct sbp2_target *tgt = lu->tgt;
+        struct fw_device *device = fw_device(tgt->unit->device.parent);
         int generation, node_id, local_node_id;
 
+        if (fw_device_is_shutdown(device))
+                goto out;
+
         generation    = device->generation;
         smp_rmb();    /* node_id must not be older than generation */
         node_id       = device->node_id;
@@ -950,10 +1150,17 @@ static void sbp2_reconnect(struct work_struct *work)
         if (sbp2_send_management_orb(lu, node_id, generation,
                                      SBP2_RECONNECT_REQUEST,
                                      lu->login_id, NULL) < 0) {
-                if (lu->retries++ >= 5) {
-                        fw_error("failed to reconnect to %s\n",
-                                 unit->device.bus_id);
-                        /* Fall back and try to log in again. */
+                /*
+                 * If reconnect was impossible even though we are in the
+                 * current generation, fall back and try to log in again.
+                 *
+                 * We could check for "Function rejected" status, but
+                 * looking at the bus generation as simpler and more general.
+                 */
+                smp_rmb(); /* get current card generation */
+                if (generation == device->card->generation ||
+                    lu->retries++ >= 5) {
+                        fw_error("%s: failed to reconnect\n", tgt->bus_id);
                         lu->retries = 0;
                         PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
                 }
@@ -961,17 +1168,18 @@ static void sbp2_reconnect(struct work_struct *work)
                 goto out;
         }
 
-        lu->generation        = generation;
-        lu->tgt->node_id      = node_id;
-        lu->tgt->address_high = local_node_id << 16;
+        tgt->node_id      = node_id;
+        tgt->address_high = local_node_id << 16;
+        sbp2_set_generation(lu, generation);
 
-        fw_notify("reconnected to %s LUN %04x (%d retries)\n",
-                  unit->device.bus_id, lu->lun, lu->retries);
+        fw_notify("%s: reconnected to LUN %04x (%d retries)\n",
+                  tgt->bus_id, lu->lun, lu->retries);
 
         sbp2_agent_reset(lu);
         sbp2_cancel_orbs(lu);
+        sbp2_conditionally_unblock(lu);
  out:
-        sbp2_target_put(lu->tgt);
+        sbp2_target_put(tgt);
 }
 
 static void sbp2_update(struct fw_unit *unit)
@@ -986,6 +1194,7 @@ static void sbp2_update(struct fw_unit *unit)
          * Iteration over tgt->lu_list is therefore safe here.
          */
         list_for_each_entry(lu, &tgt->lu_list, link) {
+                sbp2_conditionally_block(lu);
                 lu->retries = 0;
                 sbp2_queue_work(lu, 0);
         }
@@ -1063,7 +1272,7 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
 
         if (status != NULL) {
                 if (STATUS_GET_DEAD(*status))
-                        sbp2_agent_reset(orb->lu);
+                        sbp2_agent_reset_no_wait(orb->lu);
 
                 switch (STATUS_GET_RESPONSE(*status)) {
                 case SBP2_STATUS_REQUEST_COMPLETE:
@@ -1089,6 +1298,7 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
                  * or when sending the write (less likely).
                  */
                 result = DID_BUS_BUSY << 16;
+                sbp2_conditionally_block(orb->lu);
         }
 
         dma_unmap_single(device->card->device, orb->base.request_bus,
@@ -1197,7 +1407,7 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
         struct sbp2_logical_unit *lu = cmd->device->hostdata;
         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
         struct sbp2_command_orb *orb;
-        unsigned max_payload;
+        unsigned int max_payload;
         int retval = SCSI_MLQUEUE_HOST_BUSY;
 
         /*
@@ -1275,6 +1485,10 @@ static int sbp2_scsi_slave_alloc(struct scsi_device *sdev)
 {
         struct sbp2_logical_unit *lu = sdev->hostdata;
 
+        /* (Re-)Adding logical units via the SCSI stack is not supported. */
+        if (!lu)
+                return -ENOSYS;
+
         sdev->allow_restart = 1;
 
         /*
@@ -1319,7 +1533,7 @@ static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
 {
         struct sbp2_logical_unit *lu = cmd->device->hostdata;
 
-        fw_notify("sbp2_scsi_abort\n");
+        fw_notify("%s: sbp2_scsi_abort\n", lu->tgt->bus_id);
         sbp2_agent_reset(lu);
         sbp2_cancel_orbs(lu);
 
diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
index 172c1867e9aa..e47bb040197a 100644
--- a/drivers/firewire/fw-topology.c
+++ b/drivers/firewire/fw-topology.c
@@ -383,6 +383,7 @@ void fw_destroy_nodes(struct fw_card *card)
         card->color++;
         if (card->local_node != NULL)
                 for_each_fw_node(card, card->local_node, report_lost_node);
+        card->local_node = NULL;
         spin_unlock_irqrestore(&card->lock, flags);
 }
 
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index fa7967b57408..09cb72870454 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -26,6 +26,7 @@
 #include <linux/fs.h>
 #include <linux/dma-mapping.h>
 #include <linux/firewire-constants.h>
+#include <asm/atomic.h>
 
 #define TCODE_IS_READ_REQUEST(tcode)    (((tcode) & ~1) == 4)
 #define TCODE_IS_BLOCK_PACKET(tcode)    (((tcode) &  1) != 0)
@@ -219,6 +220,7 @@ extern struct bus_type fw_bus_type;
 struct fw_card {
         const struct fw_card_driver *driver;
         struct device *device;
+        atomic_t device_count;
         struct kref kref;
 
         int node_id;
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 92583cd4bffd..6e72fd31184d 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -184,6 +184,7 @@ static void pca953x_setup_gpio(struct pca953x_chip *chip, int gpios)
         gc->direction_output = pca953x_gpio_direction_output;
         gc->get = pca953x_gpio_get_value;
         gc->set = pca953x_gpio_set_value;
+        gc->can_sleep = 1;
 
         gc->base = chip->gpio_start;
         gc->ngpio = gpios;
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 573abe440842..2fa43183d375 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -335,7 +335,7 @@ static int __devinit amd756_probe(struct pci_dev *pdev,
         u8 temp;
         
         /* driver_data might come from user-space, so check it */
-        if (id->driver_data > ARRAY_SIZE(chipname))
+        if (id->driver_data >= ARRAY_SIZE(chipname))
                 return -EINVAL;
 
         if (amd756_ioport) {
diff --git a/drivers/i2c/chips/Makefile b/drivers/i2c/chips/Makefile
index 501f00cea782..e47aca0ca5ae 100644
--- a/drivers/i2c/chips/Makefile
+++ b/drivers/i2c/chips/Makefile
@@ -1,6 +1,13 @@
 #
 # Makefile for miscellaneous I2C chip drivers.
 #
+# Think twice before you add a new driver to this directory.
+# Device drivers are better grouped according to the functionality they
+# implement rather than to the bus they are connected to. In particular:
+# * Hardware monitoring chip drivers go to drivers/hwmon
+# * RTC chip drivers go to drivers/rtc
+# * I/O expander drivers go to drivers/gpio
+#
 
 obj-$(CONFIG_DS1682)            += ds1682.o
 obj-$(CONFIG_SENSORS_EEPROM)    += eeprom.o
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 96da22e9a5a4..fd84b2a36338 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -90,12 +90,16 @@ static int i2c_device_probe(struct device *dev)
 {
         struct i2c_client       *client = to_i2c_client(dev);
         struct i2c_driver       *driver = to_i2c_driver(dev->driver);
+        int status;
 
         if (!driver->probe)
                 return -ENODEV;
         client->driver = driver;
         dev_dbg(dev, "probe\n");
-        return driver->probe(client);
+        status = driver->probe(client);
+        if (status)
+                client->driver = NULL;
+        return status;
 }
 
 static int i2c_device_remove(struct device *dev)
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index df752e690e47..eed6d8e1b5c7 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -50,7 +50,7 @@ menuconfig IDE
           To compile this driver as a module, choose M here: the
           module will be called ide.
 
-          For further information, please read <file:Documentation/ide.txt>.
+          For further information, please read <file:Documentation/ide/ide.txt>.
 
           If unsure, say Y.
 
@@ -77,7 +77,7 @@ config BLK_DEV_IDE
           Useful information about large (>540 MB) IDE disks, multiple
           interfaces, what to do if ATA/IDE devices are not automatically
           detected, sound card ATA/IDE ports, module support, and other
-          topics, is contained in <file:Documentation/ide.txt>. For detailed
+          topics, is contained in <file:Documentation/ide/ide.txt>. For detailed
           information about hard drives, consult the Disk-HOWTO and the
           Multi-Disk-HOWTO, available from
           <http://www.tldp.org/docs.html#howto>.
@@ -87,7 +87,7 @@ config BLK_DEV_IDE
           <ftp://ibiblio.org/pub/Linux/system/hardware/>.
 
           To compile this driver as a module, choose M here and read
-          <file:Documentation/ide.txt>. The module will be called ide-mod.
+          <file:Documentation/ide/ide.txt>. The module will be called ide-mod.
           Do not compile this driver as a module if your root file system (the
           one containing the directory /) is located on an IDE device.
 
@@ -98,7 +98,7 @@ config BLK_DEV_IDE
 
 if BLK_DEV_IDE
 
-comment "Please see Documentation/ide.txt for help/info on IDE drives"
+comment "Please see Documentation/ide/ide.txt for help/info on IDE drives"
 
 config BLK_DEV_IDE_SATA
         bool "Support for SATA (deprecated; conflicts with libata SATA driver)"
@@ -235,8 +235,8 @@ config BLK_DEV_IDETAPE
           along with other IDE devices, as "hdb" or "hdc", or something
           similar, and will be mapped to a character device such as "ht0"
           (check the boot messages with dmesg).  Be sure to consult the
-          <file:drivers/ide/ide-tape.c> and <file:Documentation/ide.txt> files
-          for usage information.
+          <file:drivers/ide/ide-tape.c> and <file:Documentation/ide/ide.txt>
+          files for usage information.
 
           To compile this driver as a module, choose M here: the
           module will be called ide-tape.
@@ -358,7 +358,7 @@ config BLK_DEV_CMD640
 
           The CMD640 chip is also used on add-in cards by Acculogic, and on
           the "CSA-6400E PCI to IDE controller" that some people have. For
-          details, read <file:Documentation/ide.txt>.
+          details, read <file:Documentation/ide/ide.txt>.
 
 config BLK_DEV_CMD640_ENHANCED
         bool "CMD640 enhanced support"
@@ -366,7 +366,7 @@ config BLK_DEV_CMD640_ENHANCED
         help
           This option includes support for setting/autotuning PIO modes and
           prefetch on CMD640 IDE interfaces.  For details, read
-          <file:Documentation/ide.txt>. If you have a CMD640 IDE interface
+          <file:Documentation/ide/ide.txt>. If you have a CMD640 IDE interface
           and your BIOS does not already do this for you, then say Y here.
           Otherwise say N.
 
@@ -1069,9 +1069,9 @@ config BLK_DEV_ALI14XX
           This driver is enabled at runtime using the "ali14xx.probe" kernel
           boot parameter.  It enables support for the secondary IDE interface
           of the ALI M1439/1443/1445/1487/1489 chipsets, and permits faster
-          I/O speeds to be set as well.  See the files
-          <file:Documentation/ide.txt> and <file:drivers/ide/legacy/ali14xx.c>
-          for more info.
+          I/O speeds to be set as well.
+          See the files <file:Documentation/ide/ide.txt> and
+          <file:drivers/ide/legacy/ali14xx.c> for more info.
 
 config BLK_DEV_DTC2278
         tristate "DTC-2278 support"
@@ -1079,7 +1079,7 @@ config BLK_DEV_DTC2278
           This driver is enabled at runtime using the "dtc2278.probe" kernel
           boot parameter. It enables support for the secondary IDE interface
           of the DTC-2278 card, and permits faster I/O speeds to be set as
-          well. See the <file:Documentation/ide.txt> and
+          well. See the <file:Documentation/ide/ide.txt> and
           <file:drivers/ide/legacy/dtc2278.c> files for more info.
 
 config BLK_DEV_HT6560B
@@ -1088,7 +1088,7 @@ config BLK_DEV_HT6560B
           This driver is enabled at runtime using the "ht6560b.probe" kernel
           boot parameter. It enables support for the secondary IDE interface
           of the Holtek card, and permits faster I/O speeds to be set as well.
-          See the <file:Documentation/ide.txt> and
+          See the <file:Documentation/ide/ide.txt> and
           <file:drivers/ide/legacy/ht6560b.c> files for more info.
 
 config BLK_DEV_QD65XX
@@ -1096,7 +1096,7 @@ config BLK_DEV_QD65XX
         help
           This driver is enabled at runtime using the "qd65xx.probe" kernel
           boot parameter.  It permits faster I/O speeds to be set.  See the
-          <file:Documentation/ide.txt> and <file:drivers/ide/legacy/qd65xx.c>
+          <file:Documentation/ide/ide.txt> and <file:drivers/ide/legacy/qd65xx.c>
           for more info.
 
 config BLK_DEV_UMC8672
@@ -1105,7 +1105,7 @@ config BLK_DEV_UMC8672
           This driver is enabled at runtime using the "umc8672.probe" kernel
           boot parameter. It enables support for the secondary IDE interface
           of the UMC-8672, and permits faster I/O speeds to be set as well.
-          See the files <file:Documentation/ide.txt> and
+          See the files <file:Documentation/ide/ide.txt> and
           <file:drivers/ide/legacy/umc8672.c> for more info.
 
 endif
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 310e497b5838..c8d0e8715997 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -670,8 +670,8 @@ static void cdrom_buffer_sectors (ide_drive_t *drive, unsigned long sector,
  * and attempt to recover if there are problems.  Returns  0 if everything's
  * ok; nonzero if the request has been terminated.
  */
-static
-int ide_cd_check_ireason(ide_drive_t *drive, int len, int ireason, int rw)
+static int ide_cd_check_ireason(ide_drive_t *drive, struct request *rq,
+                                int len, int ireason, int rw)
 {
         /*
          * ireason == 0: the drive wants to receive data from us
@@ -701,6 +701,9 @@ int ide_cd_check_ireason(ide_drive_t *drive, int len, int ireason, int rw)
                                 drive->name, __FUNCTION__, ireason);
         }
 
+        if (rq->cmd_type == REQ_TYPE_ATA_PC)
+                rq->cmd_flags |= REQ_FAILED;
+
         cdrom_end_request(drive, 0);
         return -1;
 }
@@ -1071,11 +1074,11 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
         /*
          * check which way to transfer data
          */
-        if (blk_fs_request(rq) || blk_pc_request(rq)) {
-                if (ide_cd_check_ireason(drive, len, ireason, write))
-                        return ide_stopped;
+        if (ide_cd_check_ireason(drive, rq, len, ireason, write))
+                return ide_stopped;
 
-                if (blk_fs_request(rq) && write == 0) {
+        if (blk_fs_request(rq)) {
+                if (write == 0) {
                         int nskip;
 
                         if (ide_cd_check_transfer_size(drive, len)) {
@@ -1101,16 +1104,9 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
         if (ireason == 0) {
                 write = 1;
                 xferfunc = HWIF(drive)->atapi_output_bytes;
-        } else if (ireason == 2 || (ireason == 1 &&
-                   (blk_fs_request(rq) || blk_pc_request(rq)))) {
+        } else {
                 write = 0;
                 xferfunc = HWIF(drive)->atapi_input_bytes;
-        } else {
-                printk(KERN_ERR "%s: %s: The drive "
-                                "appears confused (ireason = 0x%02x). "
-                                "Trying to recover by ending request.\n",
-                                drive->name, __FUNCTION__, ireason);
-                goto end_request;
         }
 
         /*
@@ -1182,11 +1178,10 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
                         else
                                 rq->data += blen;
                 }
+                if (!write && blk_sense_request(rq))
+                        rq->sense_len += blen;
         }
 
-        if (write && blk_sense_request(rq))
-                rq->sense_len += thislen;
-
         /*
          * pad, if necessary
          */
@@ -1931,6 +1926,7 @@ static const struct cd_list_entry ide_cd_quirks_list[] = {
         { "MATSHITADVD-ROM SR-8186", NULL,   IDE_CD_FLAG_PLAY_AUDIO_OK      },
         { "MATSHITADVD-ROM SR-8176", NULL,   IDE_CD_FLAG_PLAY_AUDIO_OK      },
         { "MATSHITADVD-ROM SR-8174", NULL,   IDE_CD_FLAG_PLAY_AUDIO_OK      },
+        { "Optiarc DVD RW AD-5200A", NULL,   IDE_CD_FLAG_PLAY_AUDIO_OK      },
         { NULL, NULL, 0 }
 };
 
diff --git a/drivers/ide/ide-cd_ioctl.c b/drivers/ide/ide-cd_ioctl.c
index b68284de4e85..6d147ce6782f 100644
--- a/drivers/ide/ide-cd_ioctl.c
+++ b/drivers/ide/ide-cd_ioctl.c
@@ -457,6 +457,10 @@ int ide_cdrom_packet(struct cdrom_device_info *cdi,
            layer. the packet must be complete, as we do not
            touch it at all. */
         ide_cd_init_rq(drive, &req);
+
+        if (cgc->data_direction == CGC_DATA_WRITE)
+                req.cmd_flags |= REQ_RW;
+
         memcpy(req.cmd, cgc->cmd, CDROM_PACKET_SIZE);
         if (cgc->sense)
                 memset(cgc->sense, 0, sizeof(struct request_sense));
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 8f5bed471050..39501d130256 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -867,7 +867,7 @@ static void idedisk_setup (ide_drive_t *drive)
 
         /* Only print cache size when it was specified */
         if (id->buf_size)
-                printk (" w/%dKiB Cache", id->buf_size/2);
+                printk(KERN_CONT " w/%dKiB Cache", id->buf_size / 2);
 
         printk(KERN_CONT ", CHS=%d/%d/%d\n",
                          drive->bios_cyl, drive->bios_head, drive->bios_sect);
@@ -949,7 +949,8 @@ static void ide_device_shutdown(ide_drive_t *drive)
                 return;
         }
 
-        printk("Shutdown: %s\n", drive->name);
+        printk(KERN_INFO "Shutdown: %s\n", drive->name);
+
         drive->gendev.bus->suspend(&drive->gendev, PMSG_SUSPEND);
 }
 
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index d0e7b537353e..d61e5788d310 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -1,9 +1,13 @@
 /*
+ *  IDE DMA support (including IDE PCI BM-DMA).
+ *
  *  Copyright (C) 1995-1998   Mark Lord
  *  Copyright (C) 1999-2000   Andre Hedrick <andre@linux-ide.org>
  *  Copyright (C) 2004, 2007  Bartlomiej Zolnierkiewicz
  *
  *  May be copied or modified under the terms of the GNU General Public License
+ *
+ *  DMA is supported for all IDE devices (disk drives, cdroms, tapes, floppies).
  */
 
 /*
@@ -11,49 +15,6 @@
  */
 
 /*
- * This module provides support for the bus-master IDE DMA functions
- * of various PCI chipsets, including the Intel PIIX (i82371FB for
- * the 430 FX chipset), the PIIX3 (i82371SB for the 430 HX/VX and 
- * 440 chipsets), and the PIIX4 (i82371AB for the 430 TX chipset)
- * ("PIIX" stands for "PCI ISA IDE Xcellerator").
- *
- * Pretty much the same code works for other IDE PCI bus-mastering chipsets.
- *
- * DMA is supported for all IDE devices (disk drives, cdroms, tapes, floppies).
- *
- * By default, DMA support is prepared for use, but is currently enabled only
- * for drives which already have DMA enabled (UltraDMA or mode 2 multi/single),
- * or which are recognized as "good" (see table below).  Drives with only mode0
- * or mode1 (multi/single) DMA should also work with this chipset/driver
- * (eg. MC2112A) but are not enabled by default.
- *
- * Use "hdparm -i" to view modes supported by a given drive.
- *
- * The hdparm-3.5 (or later) utility can be used for manually enabling/disabling
- * DMA support, but must be (re-)compiled against this kernel version or later.
- *
- * To enable DMA, use "hdparm -d1 /dev/hd?" on a per-drive basis after booting.
- * If problems arise, ide.c will disable DMA operation after a few retries.
- * This error recovery mechanism works and has been extremely well exercised.
- *
- * IDE drives, depending on their vintage, may support several different modes
- * of DMA operation.  The boot-time modes are indicated with a "*" in
- * the "hdparm -i" listing, and can be changed with *knowledgeable* use of
- * the "hdparm -X" feature.  There is seldom a need to do this, as drives
- * normally power-up with their "best" PIO/DMA modes enabled.
- *
- * Testing has been done with a rather extensive number of drives,
- * with Quantum & Western Digital models generally outperforming the pack,
- * and Fujitsu & Conner (and some Seagate which are really Conner) drives
- * showing more lackluster throughput.
- *
- * Keep an eye on /var/adm/messages for "DMA disabled" messages.
- *
- * Some people have reported trouble with Intel Zappa motherboards.
- * This can be fixed by upgrading the AMI BIOS to version 1.00.04.BS0,
- * available from ftp://ftp.intel.com/pub/bios/10004bs0.exe
- * (thanks to Glen Morrell <glen@spin.Stanford.edu> for researching this).
- *
  * Thanks to "Christopher J. Reimer" <reimer@doe.carleton.ca> for
  * fixing the problem with the BIOS on some Acer motherboards.
  *
@@ -65,11 +26,6 @@
  *
  * Most importantly, thanks to Robert Bringman <rob@mars.trion.com>
  * for supplying a Promise UDMA board & WD UDMA drive for this work!
- *
- * And, yes, Intel Zappa boards really *do* use both PIIX IDE ports.
- *
- * ATA-66/100 and recovery functions, I forgot the rest......
- *
  */
 
 #include <linux/module.h>
@@ -757,7 +713,7 @@ static int ide_tune_dma(ide_drive_t *drive)
         }
 
         if (hwif->host_flags & IDE_HFLAG_NO_SET_MODE)
-                return 0;
+                return 1;
 
         if (ide_set_dma_mode(drive, speed))
                 return 0;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 4a2cb2868226..194ecb0049eb 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -756,7 +756,8 @@ static int ide_probe_port(ide_hwif_t *hwif)
 
         BUG_ON(hwif->present);
 
-        if (hwif->noprobe)
+        if (hwif->noprobe ||
+            (hwif->drives[0].noprobe && hwif->drives[1].noprobe))
                 return -EACCES;
 
         /*
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 0598ecfd5f37..43e0e0557776 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -3765,6 +3765,11 @@ static int ide_tape_probe(ide_drive_t *drive)
         g->fops = &idetape_block_ops;
         ide_register_region(g);
 
+        printk(KERN_WARNING "It is possible that this driver does not have any"
+                " users anymore and, as a result, it will be REMOVED soon."
+                " Please notify Bart <bzolnier@gmail.com> or Boris"
+                " <petkovbb@gmail.com> in case you still need it.\n");
+
         return 0;
 
 out_free_tape:
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 477833f0daf5..9976f9d627d4 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -590,11 +590,6 @@ void ide_unregister(unsigned int index, int init_default, int restore)
                 hwif->extra_ports = 0;
         }
 
-        /*
-         * Note that we only release the standard ports,
-         * and do not even try to handle any extra ports
-         * allocated for weird IDE interface chipsets.
-         */
         ide_hwif_release_regions(hwif);
 
         /* copy original settings */
@@ -672,7 +667,6 @@ int ide_register_hw(hw_regs_t *hw, void (*quirkproc)(ide_drive_t *),
 
         do {
                 hwif = ide_deprecated_find_port(hw->io_ports[IDE_DATA_OFFSET]);
-                index = hwif->index;
                 if (hwif)
                         goto found;
                 for (index = 0; index < MAX_HWIFS; index++)
@@ -680,6 +674,7 @@ int ide_register_hw(hw_regs_t *hw, void (*quirkproc)(ide_drive_t *),
         } while (retry--);
         return -1;
 found:
+        index = hwif->index;
         if (hwif->present)
                 ide_unregister(index, 0, 1);
         else if (!hwif->hold)
@@ -1036,10 +1031,9 @@ int generic_ide_ioctl(ide_drive_t *drive, struct file *file, struct block_device
                         drive->nice1 = (arg >> IDE_NICE_1) & 1;
                         return 0;
                 case HDIO_DRIVE_RESET:
-                {
-                        unsigned long flags;
-                        if (!capable(CAP_SYS_ADMIN)) return -EACCES;
-                        
+                        if (!capable(CAP_SYS_ADMIN))
+                                return -EACCES;
+
                         /*
                          *      Abort the current command on the
                          *      group if there is one, taking
@@ -1058,17 +1052,15 @@ int generic_ide_ioctl(ide_drive_t *drive, struct file *file, struct block_device
                         ide_abort(drive, "drive reset");
 
                         BUG_ON(HWGROUP(drive)->handler);
-                                
+
                         /* Ensure nothing gets queued after we
                            drop the lock. Reset will clear the busy */
-                   
+
                         HWGROUP(drive)->busy = 1;
                         spin_unlock_irqrestore(&ide_lock, flags);
                         (void) ide_do_reset(drive);
 
                         return 0;
-                }
-
                 case HDIO_GET_BUSSTATE:
                         if (!capable(CAP_SYS_ADMIN))
                                 return -EACCES;
@@ -1188,7 +1180,7 @@ static int __initdata is_chipset_set[MAX_HWIFS];
  * ide_setup() gets called VERY EARLY during initialization,
  * to handle kernel "command line" strings beginning with "hdx=" or "ide".
  *
- * Remember to update Documentation/ide.txt if you change something here.
+ * Remember to update Documentation/ide/ide.txt if you change something here.
  */
 static int __init ide_setup(char *s)
 {
@@ -1449,7 +1441,7 @@ static int __init ide_setup(char *s)
 
                         case -1: /* "noprobe" */
                                 hwif->noprobe = 1;
-                                goto done;
+                                goto obsolete_option;
 
                         case 1: /* base */
                                 vals[1] = vals[0] + 0x206; /* default ctl */
diff --git a/drivers/ide/legacy/qd65xx.c b/drivers/ide/legacy/qd65xx.c
index bba29df5f21d..2f4f47ad602f 100644
--- a/drivers/ide/legacy/qd65xx.c
+++ b/drivers/ide/legacy/qd65xx.c
@@ -334,43 +334,6 @@ static void __init qd6580_port_init_devs(ide_hwif_t *hwif)
         hwif->drives[1].drive_data = t2;
 }
 
-/*
- * qd_unsetup:
- *
- * called to unsetup an ata channel : back to default values, unlinks tuning
- */
-/*
-static void __exit qd_unsetup(ide_hwif_t *hwif)
-{
-        u8 config = hwif->config_data;
-        int base = hwif->select_data;
-        void *set_pio_mode = (void *)hwif->set_pio_mode;
-
-        if (hwif->chipset != ide_qd65xx)
-                return;
-
-        printk(KERN_NOTICE "%s: back to defaults\n", hwif->name);
-
-        hwif->selectproc = NULL;
-        hwif->set_pio_mode = NULL;
-
-        if (set_pio_mode == (void *)qd6500_set_pio_mode) {
-                // will do it for both
-                outb(QD6500_DEF_DATA, QD_TIMREG(&hwif->drives[0]));
-        } else if (set_pio_mode == (void *)qd6580_set_pio_mode) {
-                if (QD_CONTROL(hwif) & QD_CONTR_SEC_DISABLED) {
-                        outb(QD6580_DEF_DATA, QD_TIMREG(&hwif->drives[0]));
-                        outb(QD6580_DEF_DATA2, QD_TIMREG(&hwif->drives[1]));
-                } else {
-                        outb(hwif->channel ? QD6580_DEF_DATA2 : QD6580_DEF_DATA, QD_TIMREG(&hwif->drives[0]));
-                }
-        } else {
-                printk(KERN_WARNING "Unknown qd65xx tuning fonction !\n");
-                printk(KERN_WARNING "keeping settings !\n");
-        }
-}
-*/
-
 static const struct ide_port_info qd65xx_port_info __initdata = {
         .chipset                = ide_qd65xx,
         .host_flags             = IDE_HFLAG_IO_32BIT |
@@ -444,6 +407,8 @@ static int __init qd_probe(int base)
                 printk(KERN_DEBUG "qd6580: config=%#x, control=%#x, ID3=%u\n",
                         config, control, QD_ID3);
 
+                outb(QD_DEF_CONTR, QD_CONTROL_PORT);
+
                 if (control & QD_CONTR_SEC_DISABLED) {
                         /* secondary disabled */
 
@@ -460,8 +425,6 @@ static int __init qd_probe(int base)
 
                         ide_device_add(idx, &qd65xx_port_info);
 
-                        outb(QD_DEF_CONTR, QD_CONTROL_PORT);
-
                         return 1;
                 } else {
                         ide_hwif_t *mate;
@@ -487,8 +450,6 @@ static int __init qd_probe(int base)
 
                         ide_device_add(idx, &qd65xx_port_info);
 
-                        outb(QD_DEF_CONTR, QD_CONTROL_PORT);
-
                         return 0; /* no other qd65xx possible */
                 }
         }
diff --git a/drivers/ide/pci/cmd640.c b/drivers/ide/pci/cmd640.c
index bd24dad3cfc6..ec667982809c 100644
--- a/drivers/ide/pci/cmd640.c
+++ b/drivers/ide/pci/cmd640.c
@@ -787,7 +787,8 @@ static int __init cmd640x_init(void)
         /*
          * Try to enable the secondary interface, if not already enabled
          */
-        if (cmd_hwif1->noprobe) {
+        if (cmd_hwif1->noprobe ||
+            (cmd_hwif1->drives[0].noprobe && cmd_hwif1->drives[1].noprobe)) {
                 port2 = "not probed";
         } else {
                 b = get_cmd640_reg(CNTRL);
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index d0f7bb8b8adf..6357bb6269ab 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -1570,10 +1570,12 @@ static int __devinit hpt366_init_one(struct pci_dev *dev, const struct pci_devic
                 if (rev < 3)
                         info = &hpt36x;
                 else {
-                        static const struct hpt_info *hpt37x_info[] =
-                                { &hpt370, &hpt370a, &hpt372, &hpt372n };
-
-                        info = hpt37x_info[min_t(u8, rev, 6) - 3];
+                        switch (min_t(u8, rev, 6)) {
+                        case 3: info = &hpt370;  break;
+                        case 4: info = &hpt370a; break;
+                        case 5: info = &hpt372;  break;
+                        case 6: info = &hpt372n; break;
+                        }
                         idx++;
                 }
                 break;
@@ -1626,7 +1628,7 @@ static int __devinit hpt366_init_one(struct pci_dev *dev, const struct pci_devic
         return ide_setup_pci_device(dev, &d);
 }
 
-static const struct pci_device_id hpt366_pci_tbl[] = {
+static const struct pci_device_id hpt366_pci_tbl[] __devinitconst = {
         { PCI_VDEVICE(TTI, PCI_DEVICE_ID_TTI_HPT366),  0 },
         { PCI_VDEVICE(TTI, PCI_DEVICE_ID_TTI_HPT372),  1 },
         { PCI_VDEVICE(TTI, PCI_DEVICE_ID_TTI_HPT302),  2 },
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 28e155a9e2a5..9e2b1964d71a 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -183,6 +183,9 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
  *   Avoids access beyond actual disk limits on devices with an off-by-one bug.
  *   Don't use this with devices which don't have this bug.
  *
+ * - delay inquiry
+ *   Wait extra SBP2_INQUIRY_DELAY seconds after login before SCSI inquiry.
+ *
  * - override internal blacklist
  *   Instead of adding to the built-in blacklist, use only the workarounds
  *   specified in the module load parameter.
@@ -195,6 +198,7 @@ MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
         ", 36 byte inquiry = "    __stringify(SBP2_WORKAROUND_INQUIRY_36)
         ", skip mode page 8 = "   __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
         ", fix capacity = "       __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
+        ", delay inquiry = "      __stringify(SBP2_WORKAROUND_DELAY_INQUIRY)
         ", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
         ", or a combination)");
 
@@ -357,6 +361,11 @@ static const struct {
                 .workarounds            = SBP2_WORKAROUND_INQUIRY_36 |
                                           SBP2_WORKAROUND_MODE_SENSE_8,
         },
+        /* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
+                .firmware_revision      = 0x002800,
+                .model_id               = 0x000000,
+                .workarounds            = SBP2_WORKAROUND_DELAY_INQUIRY,
+        },
         /* Initio bridges, actually only needed for some older ones */ {
                 .firmware_revision      = 0x000200,
                 .model_id               = SBP2_ROM_VALUE_WILDCARD,
@@ -914,6 +923,9 @@ static int sbp2_start_device(struct sbp2_lu *lu)
         sbp2_agent_reset(lu, 1);
         sbp2_max_speed_and_size(lu);
 
+        if (lu->workarounds & SBP2_WORKAROUND_DELAY_INQUIRY)
+                ssleep(SBP2_INQUIRY_DELAY);
+
         error = scsi_add_device(lu->shost, 0, lu->ud->id, 0);
         if (error) {
                 SBP2_ERR("scsi_add_device failed");
@@ -1962,6 +1974,9 @@ static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
 {
         struct sbp2_lu *lu = (struct sbp2_lu *)sdev->host->hostdata[0];
 
+        if (sdev->lun != 0 || sdev->id != lu->ud->id || sdev->channel != 0)
+                return -ENODEV;
+
         lu->sdev = sdev;
         sdev->allow_restart = 1;
 
diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
index d2ecb0d8a1bb..80d8e097b065 100644
--- a/drivers/ieee1394/sbp2.h
+++ b/drivers/ieee1394/sbp2.h
@@ -343,6 +343,8 @@ enum sbp2lu_state_types {
 #define SBP2_WORKAROUND_INQUIRY_36      0x2
 #define SBP2_WORKAROUND_MODE_SENSE_8    0x4
 #define SBP2_WORKAROUND_FIX_CAPACITY    0x8
+#define SBP2_WORKAROUND_DELAY_INQUIRY   0x10
+#define SBP2_INQUIRY_DELAY              12
 #define SBP2_WORKAROUND_OVERRIDE        0x100
 
 #endif /* SBP2_H */
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index b10ade92efed..4df405157086 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -3759,6 +3759,7 @@ static void cm_remove_one(struct ib_device *device)
                 port = cm_dev->port[i-1];
                 ib_modify_port(device, port->port_num, 0, &port_modify);
                 ib_unregister_mad_agent(port->mad_agent);
+                flush_workqueue(cm.wq);
                 cm_remove_port_fs(port);
         }
         kobject_put(&cm_dev->dev_obj);
@@ -3813,6 +3814,7 @@ static void __exit ib_cm_cleanup(void)
                 cancel_delayed_work(&timewait_info->work.work);
         spin_unlock_irq(&cm.lock);
 
+        ib_unregister_client(&cm_client);
         destroy_workqueue(cm.wq);
 
         list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
@@ -3820,7 +3822,6 @@ static void __exit ib_cm_cleanup(void)
                 kfree(timewait_info);
         }
 
-        ib_unregister_client(&cm_client);
         class_unregister(&cm_class);
         idr_destroy(&cm.local_id_table);
 }
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 7f00347364f7..06d502c06a4d 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -139,7 +139,7 @@ static inline struct ib_pool_fmr *ib_fmr_cache_lookup(struct ib_fmr_pool *pool,
 static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 {
         int                 ret;
-        struct ib_pool_fmr *fmr, *next;
+        struct ib_pool_fmr *fmr;
         LIST_HEAD(unmap_list);
         LIST_HEAD(fmr_list);
 
@@ -158,20 +158,6 @@ static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 #endif
         }
 
-        /*
-         * The free_list may hold FMRs that have been put there
-         * because they haven't reached the max_remap count.
-         * Invalidate their mapping as well.
-         */
-        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
-                if (fmr->remap_count == 0)
-                        continue;
-                hlist_del_init(&fmr->cache_node);
-                fmr->remap_count = 0;
-                list_add_tail(&fmr->fmr->list, &fmr_list);
-                list_move(&fmr->list, &unmap_list);
-        }
-
         list_splice(&pool->dirty_list, &unmap_list);
         INIT_LIST_HEAD(&pool->dirty_list);
         pool->dirty_len = 0;
@@ -384,6 +370,11 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         i = 0;
         list_for_each_entry_safe(fmr, tmp, &pool->free_list, list) {
+                if (fmr->remap_count) {
+                        INIT_LIST_HEAD(&fmr_list);
+                        list_add_tail(&fmr->fmr->list, &fmr_list);
+                        ib_unmap_fmr(&fmr_list);
+                }
                 ib_dealloc_fmr(fmr->fmr);
                 list_del(&fmr->list);
                 kfree(fmr);
@@ -407,8 +398,23 @@ EXPORT_SYMBOL(ib_destroy_fmr_pool);
  */
 int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
 {
-        int serial = atomic_inc_return(&pool->req_ser);
+        int serial;
+        struct ib_pool_fmr *fmr, *next;
+
+        /*
+         * The free_list holds FMRs that may have been used
+         * but have not been remapped enough times to be dirty.
+         * Put them on the dirty list now so that the cleanup
+         * thread will reap them too.
+         */
+        spin_lock_irq(&pool->pool_lock);
+        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
+                if (fmr->remap_count > 0)
+                        list_move(&fmr->list, &pool->dirty_list);
+        }
+        spin_unlock_irq(&pool->pool_lock);
 
+        serial = atomic_inc_return(&pool->req_ser);
         wake_up_process(pool->thread);
 
         if (wait_event_interruptible(pool->force_wait,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index 223b1aa7d92b..81c9195b512a 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -839,6 +839,7 @@ static void cm_work_handler(struct work_struct *_work)
         unsigned long flags;
         int empty;
         int ret = 0;
+        int destroy_id;
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
         empty = list_empty(&cm_id_priv->work_list);
@@ -857,9 +858,9 @@ static void cm_work_handler(struct work_struct *_work)
                         destroy_cm_id(&cm_id_priv->id);
                 }
                 BUG_ON(atomic_read(&cm_id_priv->refcount)==0);
+                destroy_id = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
                 if (iwcm_deref_id(cm_id_priv)) {
-                        if (test_bit(IWCM_F_CALLBACK_DESTROY,
-                                     &cm_id_priv->flags)) {
+                        if (destroy_id) {
                                 BUG_ON(!list_empty(&cm_id_priv->work_list));
                                 free_cm_id(cm_id_priv);
                         }
diff --git a/drivers/infiniband/hw/cxgb3/iwch_mem.c b/drivers/infiniband/hw/cxgb3/iwch_mem.c
index 73bfd1656f86..b8797c66676d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_mem.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_mem.c
@@ -136,14 +136,8 @@ int build_phys_page_list(struct ib_phys_buf *buffer_list,
 
         /* Find largest page shift we can use to cover buffers */
         for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
-                if (num_phys_buf > 1) {
-                        if ((1ULL << *shift) & mask)
-                                break;
-                } else
-                        if (1ULL << *shift >=
-                            buffer_list[0].size +
-                            (buffer_list[0].addr & ((1ULL << *shift) - 1)))
-                                break;
+                if ((1ULL << *shift) & mask)
+                        break;
 
         buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
         buffer_list[0].addr &= ~0ull << *shift;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index df1838f8f94d..b2ea9210467f 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -189,7 +189,7 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
                 return ERR_PTR(-ENOMEM);
         }
         chp->rhp = rhp;
-        chp->ibcq.cqe = (1 << chp->cq.size_log2) - 1;
+        chp->ibcq.cqe = 1 << chp->cq.size_log2;
         spin_lock_init(&chp->lock);
         atomic_set(&chp->refcnt, 1);
         init_waitqueue_head(&chp->wait);
@@ -819,8 +819,11 @@ static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
                 kfree(qhp);
                 return ERR_PTR(-ENOMEM);
         }
+
         attrs->cap.max_recv_wr = rqsize - 1;
         attrs->cap.max_send_wr = sqsize;
+        attrs->cap.max_inline_data = T3_MAX_INLINE;
+
         qhp->rhp = rhp;
         qhp->attr.pd = php->pdid;
         qhp->attr.scq = ((struct iwch_cq *) attrs->send_cq)->cq.cqid;
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index 7f8853b44ee1..b2112f5a422f 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -567,12 +567,12 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
 
         /* Init the adapter */
         nesdev->nesadapter = nes_init_adapter(nesdev, hw_rev);
-        nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
         if (!nesdev->nesadapter) {
                 printk(KERN_ERR PFX "Unable to initialize adapter.\n");
                 ret = -ENOMEM;
                 goto bail5;
         }
+        nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
 
         /* nesdev->base_doorbell_index =
                         nesdev->nesadapter->pd_config_base[PCI_FUNC(nesdev->pcidev->devfn)]; */
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index fd57e8a1582f..a48b288618ec 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -285,6 +285,21 @@ struct nes_device {
 };
 
 
+static inline __le32 get_crc_value(struct nes_v4_quad *nes_quad)
+{
+        u32 crc_value;
+        crc_value = crc32c(~0, (void *)nes_quad, sizeof (struct nes_v4_quad));
+
+        /*
+         * With commit ef19454b ("[LIB] crc32c: Keep intermediate crc
+         * state in cpu order"), behavior of crc32c changes on
+         * big-endian platforms.  Our algorithm expects the previous
+         * behavior; otherwise we have RDMA connection establishment
+         * issue on big-endian.
+         */
+        return cpu_to_le32(crc_value);
+}
+
 static inline void
 set_wqe_64bit_value(__le32 *wqe_words, u32 index, u64 value)
 {
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index bd5cfeaac203..39adb267fb15 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -370,11 +370,11 @@ int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
         int ret = 0;
         u32 was_timer_set;
 
+        if (!cm_node)
+                return -EINVAL;
         new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
         if (!new_send)
                 return -1;
-        if (!cm_node)
-                return -EINVAL;
 
         /* new_send->timetosend = currenttime */
         new_send->retrycount = NES_DEFAULT_RETRYS;
@@ -947,6 +947,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
                 nes_debug(NES_DBG_CM, "destroying listener (%p)\n", listener);
 
                 kfree(listener);
+                listener = NULL;
                 ret = 0;
                 cm_listens_destroyed++;
         } else {
@@ -2319,6 +2320,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         struct iw_cm_event cm_event;
         struct nes_hw_qp_wqe *wqe;
         struct nes_v4_quad nes_quad;
+        u32 crc_value;
         int ret;
 
         ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
@@ -2435,8 +2437,8 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         nes_quad.TcpPorts[1]   = cm_id->local_addr.sin_port;
 
         /* Produce hash key */
-        nesqp->hte_index = cpu_to_be32(
-                        crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
+        crc_value = get_crc_value(&nes_quad);
+        nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
         nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, CRC = 0x%08X\n",
                         nesqp->hte_index, nesqp->hte_index & adapter->hte_index_mask);
 
@@ -2750,6 +2752,7 @@ void cm_event_connected(struct nes_cm_event *event)
         struct iw_cm_event cm_event;
         struct nes_hw_qp_wqe *wqe;
         struct nes_v4_quad nes_quad;
+        u32 crc_value;
         int ret;
 
         /* get all our handles */
@@ -2827,8 +2830,8 @@ void cm_event_connected(struct nes_cm_event *event)
         nes_quad.TcpPorts[1] = cm_id->local_addr.sin_port;
 
         /* Produce hash key */
-        nesqp->hte_index = cpu_to_be32(
-                        crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
+        crc_value = get_crc_value(&nes_quad);
+        nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
         nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, After CRC = 0x%08X\n",
                         nesqp->hte_index, nesqp->hte_index & nesadapter->hte_index_mask);
 
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 7c4c0fbf0abd..49e53e4c1ebe 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -156,15 +156,14 @@ static void nes_nic_tune_timer(struct nes_device *nesdev)
 
         spin_lock_irqsave(&nesadapter->periodic_timer_lock, flags);
 
-        if (shared_timer->cq_count_old < cq_count) {
-                if (cq_count > shared_timer->threshold_low)
-                        shared_timer->cq_direction_downward=0;
-        }
-        if (shared_timer->cq_count_old >= cq_count)
+        if (shared_timer->cq_count_old <= cq_count)
+                shared_timer->cq_direction_downward = 0;
+        else
                 shared_timer->cq_direction_downward++;
         shared_timer->cq_count_old = cq_count;
         if (shared_timer->cq_direction_downward > NES_NIC_CQ_DOWNWARD_TREND) {
-                if (cq_count <= shared_timer->threshold_low) {
+                if (cq_count <= shared_timer->threshold_low &&
+                    shared_timer->threshold_low > 4) {
                         shared_timer->threshold_low = shared_timer->threshold_low/2;
                         shared_timer->cq_direction_downward=0;
                         nesdev->currcq_count = 0;
@@ -1728,7 +1727,6 @@ int nes_napi_isr(struct nes_device *nesdev)
                         nesdev->int_req &= ~NES_INT_TIMER;
                         nes_write32(nesdev->regs+NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
                         nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
-                        nesadapter->tune_timer.timer_in_use_old = 0;
                 }
                 nesdev->deepcq_count = 0;
                 return 1;
@@ -1867,7 +1865,6 @@ void nes_dpc(unsigned long param)
                                         nesdev->int_req &= ~NES_INT_TIMER;
                                         nes_write32(nesdev->regs + NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
                                         nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
-                                        nesdev->nesadapter->tune_timer.timer_in_use_old = 0;
                                 } else {
                                         nes_write32(nesdev->regs+NES_INT_MASK, 0x0000ffff|(~nesdev->int_req));
                                 }
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index 1e10df550c9e..b7e2844f096b 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -962,7 +962,7 @@ struct nes_arp_entry {
 #define DEFAULT_JUMBO_NES_QL_LOW    12
 #define DEFAULT_JUMBO_NES_QL_TARGET 40
 #define DEFAULT_JUMBO_NES_QL_HIGH   128
-#define NES_NIC_CQ_DOWNWARD_TREND   8
+#define NES_NIC_CQ_DOWNWARD_TREND   16
 
 struct nes_hw_tune_timer {
     //u16 cq_count;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 4dafbe16e82a..a651e9d9f0ef 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -929,7 +929,7 @@ static struct ib_pd *nes_alloc_pd(struct ib_device *ibdev,
                                 NES_MAX_USER_DB_REGIONS, nesucontext->first_free_db);
                 nes_debug(NES_DBG_PD, "find_first_zero_biton doorbells returned %u, mapping pd_id %u.\n",
                                 nespd->mmap_db_index, nespd->pd_id);
-                if (nespd->mmap_db_index > NES_MAX_USER_DB_REGIONS) {
+                if (nespd->mmap_db_index >= NES_MAX_USER_DB_REGIONS) {
                         nes_debug(NES_DBG_PD, "mmap_db_index > MAX\n");
                         nes_free_resource(nesadapter, nesadapter->allocated_pds, pd_num);
                         kfree(nespd);
@@ -1327,7 +1327,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                                                   (long long unsigned int)req.user_wqe_buffers);
                                                         nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
                                                         kfree(nesqp->allocated_buffer);
-                                                        return ERR_PTR(-ENOMEM);
+                                                        return ERR_PTR(-EFAULT);
                                                 }
                                         }
 
@@ -1674,6 +1674,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 }
                 nes_debug(NES_DBG_CQ, "CQ Virtual Address = %08lX, size = %u.\n",
                                 (unsigned long)req.user_cq_buffer, entries);
+                err = 1;
                 list_for_each_entry(nespbl, &nes_ucontext->cq_reg_mem_list, list) {
                         if (nespbl->user_base == (unsigned long )req.user_cq_buffer) {
                                 list_del(&nespbl->list);
@@ -1686,7 +1687,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 if (err) {
                         nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                         kfree(nescq);
-                        return ERR_PTR(err);
+                        return ERR_PTR(-EFAULT);
                 }
 
                 pbl_entries = nespbl->pbl_size >> 3;
@@ -1831,9 +1832,6 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                                 spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
                         }
                 }
-                nes_debug(NES_DBG_CQ, "iWARP CQ%u create timeout expired, major code = 0x%04X,"
-                                " minor code = 0x%04X\n",
-                                nescq->hw_cq.cq_number, cqp_request->major_code, cqp_request->minor_code);
                 if (!context)
                         pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
                                         nescq->hw_cq.cq_pbase);
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 714b8db02b29..993f0a8ff28f 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -237,36 +237,32 @@ static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
 static
 struct iser_device *iser_device_find_by_ib_device(struct rdma_cm_id *cma_id)
 {
-        struct list_head    *p_list;
-        struct iser_device  *device = NULL;
+        struct iser_device *device;
 
         mutex_lock(&ig.device_list_mutex);
 
-        p_list = ig.device_list.next;
-        while (p_list != &ig.device_list) {
-                device = list_entry(p_list, struct iser_device, ig_list);
+        list_for_each_entry(device, &ig.device_list, ig_list)
                 /* find if there's a match using the node GUID */
                 if (device->ib_device->node_guid == cma_id->device->node_guid)
-                        break;
-        }
+                        goto inc_refcnt;
 
-        if (device == NULL) {
-                device = kzalloc(sizeof *device, GFP_KERNEL);
-                if (device == NULL)
-                        goto out;
-                /* assign this device to the device */
-                device->ib_device = cma_id->device;
-                /* init the device and link it into ig device list */
-                if (iser_create_device_ib_res(device)) {
-                        kfree(device);
-                        device = NULL;
-                        goto out;
-                }
-                list_add(&device->ig_list, &ig.device_list);
+        device = kzalloc(sizeof *device, GFP_KERNEL);
+        if (device == NULL)
+                goto out;
+
+        /* assign this device to the device */
+        device->ib_device = cma_id->device;
+        /* init the device and link it into ig device list */
+        if (iser_create_device_ib_res(device)) {
+                kfree(device);
+                device = NULL;
+                goto out;
         }
-out:
-        BUG_ON(device == NULL);
+        list_add(&device->ig_list, &ig.device_list);
+
+inc_refcnt:
         device->refcount++;
+out:
         mutex_unlock(&ig.device_list_mutex);
         return device;
 }
@@ -372,6 +368,12 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         int    ret;
 
         device = iser_device_find_by_ib_device(cma_id);
+        if (!device) {
+                iser_err("device lookup/creation failed\n");
+                iser_connect_error(cma_id);
+                return;
+        }
+
         ib_conn = (struct iser_conn *)cma_id->context;
         ib_conn->device = device;
 
@@ -380,7 +382,6 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
                 iser_err("resolve route failed: %d\n", ret);
                 iser_connect_error(cma_id);
         }
-        return;
 }
 
 static void iser_route_handler(struct rdma_cm_id *cma_id)
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 8b10d9f23bef..c5263d63aca3 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -42,14 +42,14 @@ config INPUT_M68K_BEEP
 
 config INPUT_APANEL
         tristate "Fujitsu Lifebook Application Panel buttons"
-        depends on X86
-        select I2C_I801
+        depends on X86 && I2C && LEDS_CLASS
         select INPUT_POLLDEV
         select CHECK_SIGNATURE
         help
          Say Y here for support of the Application Panel buttons, used on
          Fujitsu Lifebook. These are attached to the mainboard through
-         an SMBus interface managed by the I2C Intel ICH (i801) driver.
+         an SMBus interface managed by the I2C Intel ICH (i801) driver,
+         which you should also build for this kernel.
 
          To compile this driver as a module, choose M here: the module will
          be called apanel.
diff --git a/drivers/input/serio/i8042.h b/drivers/input/serio/i8042.h
index dd22d91f8b39..c972e5d03a3f 100644
--- a/drivers/input/serio/i8042.h
+++ b/drivers/input/serio/i8042.h
@@ -16,7 +16,7 @@
 
 #if defined(CONFIG_MACH_JAZZ)
 #include "i8042-jazzio.h"
-#elif defined(CONFIG_SGI_IP22)
+#elif defined(CONFIG_SGI_HAS_I8042)
 #include "i8042-ip22io.h"
 #elif defined(CONFIG_PPC)
 #include "i8042-ppcio.h"
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index aacedec4986f..827c32c16795 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -637,7 +637,6 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
                 err("maximum number of devices exceeded");
                 return NULL;
         }
-        mutex_init(&cs->mutex);
 
         gig_dbg(DEBUG_INIT, "allocating bcs[0..%d]", channels - 1);
         cs->bcs = kmalloc(channels * sizeof(struct bc_state), GFP_KERNEL);
@@ -898,8 +897,10 @@ int gigaset_shutdown(struct cardstate *cs)
 {
         mutex_lock(&cs->mutex);
 
-        if (!(cs->flags & VALID_MINOR))
+        if (!(cs->flags & VALID_MINOR)) {
+                mutex_unlock(&cs->mutex);
                 return -1;
+        }
 
         cs->waiting = 1;
 
@@ -1086,6 +1087,7 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
                 drv->cs[i].driver = drv;
                 drv->cs[i].ops = drv->ops;
                 drv->cs[i].minor_index = i;
+                mutex_init(&drv->cs[i].mutex);
         }
 
         gigaset_if_initdriver(drv, procname, devname);
diff --git a/drivers/isdn/hisax/hisax_fcpcipnp.c b/drivers/isdn/hisax/hisax_fcpcipnp.c
index 7993e01f9fc5..76043dedba5b 100644
--- a/drivers/isdn/hisax/hisax_fcpcipnp.c
+++ b/drivers/isdn/hisax/hisax_fcpcipnp.c
@@ -725,23 +725,6 @@ static int __devinit fcpcipnp_setup(struct fritz_adapter *adapter)
 
         switch (adapter->type) {
         case AVM_FRITZ_PCIV2:
-                retval = request_irq(adapter->irq, fcpci2_irq, IRQF_SHARED,
-                                     "fcpcipnp", adapter);
-                break;
-        case AVM_FRITZ_PCI:
-                retval = request_irq(adapter->irq, fcpci_irq, IRQF_SHARED,
-                                     "fcpcipnp", adapter);
-                break;
-        case AVM_FRITZ_PNP:
-                retval = request_irq(adapter->irq, fcpci_irq, 0,
-                                     "fcpcipnp", adapter);
-                break;
-        }
-        if (retval)
-                goto err_region;
-
-        switch (adapter->type) {
-        case AVM_FRITZ_PCIV2:
         case AVM_FRITZ_PCI:
                 val = inl(adapter->io);
                 break;
@@ -796,6 +779,23 @@ static int __devinit fcpcipnp_setup(struct fritz_adapter *adapter)
 
         switch (adapter->type) {
         case AVM_FRITZ_PCIV2:
+                retval = request_irq(adapter->irq, fcpci2_irq, IRQF_SHARED,
+                                     "fcpcipnp", adapter);
+                break;
+        case AVM_FRITZ_PCI:
+                retval = request_irq(adapter->irq, fcpci_irq, IRQF_SHARED,
+                                     "fcpcipnp", adapter);
+                break;
+        case AVM_FRITZ_PNP:
+                retval = request_irq(adapter->irq, fcpci_irq, 0,
+                                     "fcpcipnp", adapter);
+                break;
+        }
+        if (retval)
+                goto err_region;
+
+        switch (adapter->type) {
+        case AVM_FRITZ_PCIV2:
                 fcpci2_init(adapter);
                 isacsx_setup(&adapter->isac);
                 break;
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 9cef6fcf587b..d4ad6992f776 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -981,13 +981,13 @@ isdn_readbchan_tty(int di, int channel, struct tty_struct *tty, int cisco_hack)
 }
 
 
-static __inline int
+static inline int
 isdn_minor2drv(int minor)
 {
         return (dev->drvmap[minor]);
 }
 
-static __inline int
+static inline int
 isdn_minor2chan(int minor)
 {
         return (dev->chanmap[minor]);
diff --git a/drivers/isdn/i4l/isdn_ttyfax.c b/drivers/isdn/i4l/isdn_ttyfax.c
index f93de4a30355..78f7660c1d0e 100644
--- a/drivers/isdn/i4l/isdn_ttyfax.c
+++ b/drivers/isdn/i4l/isdn_ttyfax.c
@@ -906,7 +906,8 @@ isdn_tty_cmd_FCLASS2(char **p, modem_info * info)
                         sprintf(rs, "\r\n0-2");
                         isdn_tty_at_cout(rs, info);
                 } else {
-                        if ((f->phase != ISDN_FAX_PHASE_D) || (!info->faxonline & 1))
+                        if ((f->phase != ISDN_FAX_PHASE_D) ||
+                            (!(info->faxonline & 1)))
                                 PARSE_ERROR1;
                         par = isdn_getnum(p);
                         if ((par < 0) || (par > 2))
diff --git a/drivers/isdn/i4l/isdn_v110.c b/drivers/isdn/i4l/isdn_v110.c
index 5484d3c38a57..c5d02b6aafab 100644
--- a/drivers/isdn/i4l/isdn_v110.c
+++ b/drivers/isdn/i4l/isdn_v110.c
@@ -62,7 +62,7 @@ static unsigned char V110_OffMatrix_38400[] =
  * and to 67452301 when keylen = 2. This is necessary because ordering on
  * the isdn line is the other way.
  */
-static __inline unsigned char
+static inline unsigned char
 FlipBits(unsigned char c, int keylen)
 {
         unsigned char b = c;
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index 655ef9a3f4df..a335c85a736e 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -1289,7 +1289,7 @@ isdnloop_command(isdn_ctrl * c, isdnloop_card * card)
                                 }
                                 break;
                 case ISDN_CMD_CLREAZ:
-                                if (!card->flags & ISDNLOOP_FLAGS_RUNNING)
+                                if (!(card->flags & ISDNLOOP_FLAGS_RUNNING))
                                         return -ENODEV;
                                 if (card->leased)
                                         break;
@@ -1333,7 +1333,7 @@ isdnloop_command(isdn_ctrl * c, isdnloop_card * card)
                                 }
                                 break;
                 case ISDN_CMD_SETL3:
-                                if (!card->flags & ISDNLOOP_FLAGS_RUNNING)
+                                if (!(card->flags & ISDNLOOP_FLAGS_RUNNING))
                                         return -ENODEV;
                                 return 0;
                 default:
@@ -1380,7 +1380,7 @@ if_writecmd(const u_char __user *buf, int len, int id, int channel)
         isdnloop_card *card = isdnloop_findcard(id);
 
         if (card) {
-                if (!card->flags & ISDNLOOP_FLAGS_RUNNING)
+                if (!(card->flags & ISDNLOOP_FLAGS_RUNNING))
                         return -ENODEV;
                 return (isdnloop_writecmd(buf, len, 1, card));
         }
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 7743d73768df..c632c08cbbdc 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -69,11 +69,22 @@ static __init int map_switcher(void)
                 switcher_page[i] = virt_to_page(addr);
         }
 
+        /* First we check that the Switcher won't overlap the fixmap area at
+         * the top of memory.  It's currently nowhere near, but it could have
+         * very strange effects if it ever happened. */
+        if (SWITCHER_ADDR + (TOTAL_SWITCHER_PAGES+1)*PAGE_SIZE > FIXADDR_START){
+                err = -ENOMEM;
+                printk("lguest: mapping switcher would thwack fixmap\n");
+                goto free_pages;
+        }
+
         /* Now we reserve the "virtual memory area" we want: 0xFFC00000
          * (SWITCHER_ADDR).  We might not get it in theory, but in practice
-         * it's worked so far. */
+         * it's worked so far.  The end address needs +1 because __get_vm_area
+         * allocates an extra guard page, so we need space for that. */
         switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-                                       VM_ALLOC, SWITCHER_ADDR, VMALLOC_END);
+                                     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
+                                     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
         if (!switcher_vma) {
                 err = -ENOMEM;
                 printk("lguest: could not map switcher pages high\n");
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 85d42d3d01a9..2221485b0773 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -241,15 +241,16 @@ static ssize_t write(struct file *file, const char __user *in,
                 cpu = &lg->cpus[cpu_id];
                 if (!cpu)
                         return -EINVAL;
-        }
 
-        /* Once the Guest is dead, all you can do is read() why it died. */
-        if (lg && lg->dead)
-                return -ENOENT;
+                /* Once the Guest is dead, you can only read() why it died. */
+                if (lg->dead)
+                        return -ENOENT;
 
-        /* If you're not the task which owns the Guest, you can only break */
-        if (lg && current != cpu->tsk && req != LHREQ_BREAK)
-                return -EPERM;
+                /* If you're not the task which owns the Guest, all you can do
+                 * is break the Launcher out of running the Guest. */
+                if (current != cpu->tsk && req != LHREQ_BREAK)
+                        return -EPERM;
+        }
 
         switch (req) {
         case LHREQ_INITIALIZE:
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 275f23c2deb4..a7f64a9d67e0 100644
--- a/drivers/lguest/page_tables.c
+++ b/drivers/lguest/page_tables.c
@@ -391,7 +391,7 @@ static unsigned int find_pgdir(struct lguest *lg, unsigned long pgtable)
 {
         unsigned int i;
         for (i = 0; i < ARRAY_SIZE(lg->pgdirs); i++)
-                if (lg->pgdirs[i].gpgdir == pgtable)
+                if (lg->pgdirs[i].pgdir && lg->pgdirs[i].gpgdir == pgtable)
                         break;
         return i;
 }
diff --git a/drivers/macintosh/via-pmu-backlight.c b/drivers/macintosh/via-pmu-backlight.c
index 741a2e3f4fc6..a348bb0791d3 100644
--- a/drivers/macintosh/via-pmu-backlight.c
+++ b/drivers/macintosh/via-pmu-backlight.c
@@ -17,7 +17,7 @@
 
 static struct backlight_ops pmu_backlight_data;
 static DEFINE_SPINLOCK(pmu_backlight_lock);
-static int sleeping;
+static int sleeping, uses_pmu_bl;
 static u8 bl_curve[FB_BACKLIGHT_LEVELS];
 
 static void pmu_backlight_init_curve(u8 off, u8 min, u8 max)
@@ -128,7 +128,7 @@ void pmu_backlight_set_sleep(int sleep)
 
         spin_lock_irqsave(&pmu_backlight_lock, flags);
         sleeping = sleep;
-        if (pmac_backlight) {
+        if (pmac_backlight && uses_pmu_bl) {
                 if (sleep) {
                         struct adb_request req;
 
@@ -166,6 +166,7 @@ void __init pmu_backlight_init()
                 printk(KERN_ERR "PMU Backlight registration failed\n");
                 return;
         }
+        uses_pmu_bl = 1;
         bd->props.max_brightness = FB_BACKLIGHT_LEVELS - 1;
         pmu_backlight_init_curve(0x7F, 0x46, 0x0E);
 
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index ebec663d5d37..d6365a9f0637 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -2528,7 +2528,7 @@ EXPORT_SYMBOL(pmu_wait_complete);
 EXPORT_SYMBOL(pmu_suspend);
 EXPORT_SYMBOL(pmu_resume);
 EXPORT_SYMBOL(pmu_unlock);
-#if defined(CONFIG_SUSPEND) && defined(CONFIG_PPC32)
+#if defined(CONFIG_PPC32)
 EXPORT_SYMBOL(pmu_enable_irled);
 EXPORT_SYMBOL(pmu_battery_count);
 EXPORT_SYMBOL(pmu_batteries);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 7aeceedcf7d4..c14dacdacfac 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1045,8 +1045,14 @@ void bitmap_daemon_work(struct bitmap *bitmap)
         if (bitmap == NULL)
                 return;
         if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
-                return;
+                goto done;
+
         bitmap->daemon_lastrun = jiffies;
+        if (bitmap->allclean) {
+                bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+                return;
+        }
+        bitmap->allclean = 1;
 
         for (j = 0; j < bitmap->chunks; j++) {
                 bitmap_counter_t *bmc;
@@ -1068,8 +1074,10 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                         clear_page_attr(bitmap, page, BITMAP_PAGE_NEEDWRITE);
 
                                 spin_unlock_irqrestore(&bitmap->lock, flags);
-                                if (need_write)
+                                if (need_write) {
                                         write_page(bitmap, page, 0);
+                                        bitmap->allclean = 0;
+                                }
                                 continue;
                         }
 
@@ -1098,6 +1106,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 /*
   if (j < 100) printk("bitmap: j=%lu, *bmc = 0x%x\n", j, *bmc);
 */
+                        if (*bmc)
+                                bitmap->allclean = 0;
+
                         if (*bmc == 2) {
                                 *bmc=1; /* maybe clear the bit next time */
                                 set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
@@ -1132,6 +1143,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                 }
         }
 
+ done:
+        if (bitmap->allclean == 0)
+                bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
 }
 
 static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
@@ -1226,6 +1240,7 @@ int bitmap_startwrite(struct bitmap *bitmap, sector_t offset, unsigned long sect
                         sectors -= blocks;
                 else sectors = 0;
         }
+        bitmap->allclean = 0;
         return 0;
 }
 
@@ -1296,6 +1311,7 @@ int bitmap_start_sync(struct bitmap *bitmap, sector_t offset, int *blocks,
                 }
         }
         spin_unlock_irq(&bitmap->lock);
+        bitmap->allclean = 0;
         return rv;
 }
 
@@ -1332,6 +1348,7 @@ void bitmap_end_sync(struct bitmap *bitmap, sector_t offset, int *blocks, int ab
         }
  unlock:
         spin_unlock_irqrestore(&bitmap->lock, flags);
+        bitmap->allclean = 0;
 }
 
 void bitmap_close_sync(struct bitmap *bitmap)
@@ -1399,7 +1416,7 @@ static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset, int n
                 set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
         }
         spin_unlock_irq(&bitmap->lock);
-
+        bitmap->allclean = 0;
 }
 
 /* dirty the memory and file bits for bitmap chunks "s" to "e" */
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 7da6ec244e15..ccbbf63727cc 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1105,7 +1105,11 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
         rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
         bmask = queue_hardsect_size(rdev->bdev->bd_disk->queue)-1;
         if (rdev->sb_size & bmask)
-                rdev-> sb_size = (rdev->sb_size | bmask)+1;
+                rdev->sb_size = (rdev->sb_size | bmask) + 1;
+
+        if (minor_version
+            && rdev->data_offset < sb_offset + (rdev->sb_size/512))
+                return -EINVAL;
 
         if (sb->level == cpu_to_le32(LEVEL_MULTIPATH))
                 rdev->desc_nr = -1;
@@ -1137,7 +1141,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
                 else
                         ret = 0;
         }
-        if (minor_version) 
+        if (minor_version)
                 rdev->size = ((rdev->bdev->bd_inode->i_size>>9) - le64_to_cpu(sb->data_offset)) / 2;
         else
                 rdev->size = rdev->sb_offset;
@@ -1499,7 +1503,8 @@ static void export_rdev(mdk_rdev_t * rdev)
         free_disk_sb(rdev);
         list_del_init(&rdev->same_set);
 #ifndef MODULE
-        md_autodetect_dev(rdev->bdev->bd_dev);
+        if (test_bit(AutoDetected, &rdev->flags))
+                md_autodetect_dev(rdev->bdev->bd_dev);
 #endif
         unlock_rdev(rdev);
         kobject_put(&rdev->kobj);
@@ -1996,9 +2001,11 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
         char *e;
         unsigned long long size = simple_strtoull(buf, &e, 10);
         unsigned long long oldsize = rdev->size;
+        mddev_t *my_mddev = rdev->mddev;
+
         if (e==buf || (*e && *e != '\n'))
                 return -EINVAL;
-        if (rdev->mddev->pers)
+        if (my_mddev->pers)
                 return -EBUSY;
         rdev->size = size;
         if (size > oldsize && rdev->mddev->external) {
@@ -2011,7 +2018,7 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                 int overlap = 0;
                 struct list_head *tmp, *tmp2;
 
-                mddev_unlock(rdev->mddev);
+                mddev_unlock(my_mddev);
                 for_each_mddev(mddev, tmp) {
                         mdk_rdev_t *rdev2;
 
@@ -2031,7 +2038,7 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                                 break;
                         }
                 }
-                mddev_lock(rdev->mddev);
+                mddev_lock(my_mddev);
                 if (overlap) {
                         /* Someone else could have slipped in a size
                          * change here, but doing so is just silly.
@@ -2043,8 +2050,8 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                         return -EBUSY;
                 }
         }
-        if (size < rdev->mddev->size || rdev->mddev->size == 0)
-                rdev->mddev->size = size;
+        if (size < my_mddev->size || my_mddev->size == 0)
+                my_mddev->size = size;
         return len;
 }
 
@@ -2065,10 +2072,21 @@ rdev_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
 {
         struct rdev_sysfs_entry *entry = container_of(attr, struct rdev_sysfs_entry, attr);
         mdk_rdev_t *rdev = container_of(kobj, mdk_rdev_t, kobj);
+        mddev_t *mddev = rdev->mddev;
+        ssize_t rv;
 
         if (!entry->show)
                 return -EIO;
-        return entry->show(rdev, page);
+
+        rv = mddev ? mddev_lock(mddev) : -EBUSY;
+        if (!rv) {
+                if (rdev->mddev == NULL)
+                        rv = -EBUSY;
+                else
+                        rv = entry->show(rdev, page);
+                mddev_unlock(mddev);
+        }
+        return rv;
 }
 
 static ssize_t
@@ -2077,15 +2095,19 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
 {
         struct rdev_sysfs_entry *entry = container_of(attr, struct rdev_sysfs_entry, attr);
         mdk_rdev_t *rdev = container_of(kobj, mdk_rdev_t, kobj);
-        int rv;
+        ssize_t rv;
+        mddev_t *mddev = rdev->mddev;
 
         if (!entry->store)
                 return -EIO;
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
-        rv = mddev_lock(rdev->mddev);
+        rv = mddev ? mddev_lock(mddev): -EBUSY;
         if (!rv) {
-                rv = entry->store(rdev, page, length);
+                if (rdev->mddev == NULL)
+                        rv = -EBUSY;
+                else
+                        rv = entry->store(rdev, page, length);
                 mddev_unlock(rdev->mddev);
         }
         return rv;
@@ -5127,7 +5149,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
                         if (mddev->ro==1)
                                 seq_printf(seq, " (read-only)");
                         if (mddev->ro==2)
-                                seq_printf(seq, "(auto-read-only)");
+                                seq_printf(seq, " (auto-read-only)");
                         seq_printf(seq, " %s", mddev->pers->name);
                 }
 
@@ -5351,6 +5373,7 @@ void md_write_start(mddev_t *mddev, struct bio *bi)
                 mddev->ro = 0;
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                 md_wakeup_thread(mddev->thread);
+                md_wakeup_thread(mddev->sync_thread);
         }
         atomic_inc(&mddev->writes_pending);
         if (mddev->in_sync) {
@@ -6021,6 +6044,7 @@ static void autostart_arrays(int part)
                         MD_BUG();
                         continue;
                 }
+                set_bit(AutoDetected, &rdev->flags);
                 list_add(&rdev->same_set, &pending_raid_disks);
                 i_passed++;
         }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 5c7fef091cec..ff61b309129a 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -592,6 +592,37 @@ static int raid1_congested(void *data, int bits)
 }
 
 
+static int flush_pending_writes(conf_t *conf)
+{
+        /* Any writes that have been queued but are awaiting
+         * bitmap updates get flushed here.
+         * We return 1 if any requests were actually submitted.
+         */
+        int rv = 0;
+
+        spin_lock_irq(&conf->device_lock);
+
+        if (conf->pending_bio_list.head) {
+                struct bio *bio;
+                bio = bio_list_get(&conf->pending_bio_list);
+                blk_remove_plug(conf->mddev->queue);
+                spin_unlock_irq(&conf->device_lock);
+                /* flush any pending bitmap writes to
+                 * disk before proceeding w/ I/O */
+                bitmap_unplug(conf->mddev->bitmap);
+
+                while (bio) { /* submit pending writes */
+                        struct bio *next = bio->bi_next;
+                        bio->bi_next = NULL;
+                        generic_make_request(bio);
+                        bio = next;
+                }
+                rv = 1;
+        } else
+                spin_unlock_irq(&conf->device_lock);
+        return rv;
+}
+
 /* Barriers....
  * Sometimes we need to suspend IO while we do something else,
  * either some resync/recovery, or reconfigure the array.
@@ -673,15 +704,23 @@ static void freeze_array(conf_t *conf)
         /* stop syncio and normal IO and wait for everything to
          * go quite.
          * We increment barrier and nr_waiting, and then
-         * wait until barrier+nr_pending match nr_queued+2
+         * wait until nr_pending match nr_queued+1
+         * This is called in the context of one normal IO request
+         * that has failed. Thus any sync request that might be pending
+         * will be blocked by nr_pending, and we need to wait for
+         * pending IO requests to complete or be queued for re-try.
+         * Thus the number queued (nr_queued) plus this request (1)
+         * must match the number of pending IOs (nr_pending) before
+         * we continue.
          */
         spin_lock_irq(&conf->resync_lock);
         conf->barrier++;
         conf->nr_waiting++;
         wait_event_lock_irq(conf->wait_barrier,
-                            conf->barrier+conf->nr_pending == conf->nr_queued+2,
+                            conf->nr_pending == conf->nr_queued+1,
                             conf->resync_lock,
-                            raid1_unplug(conf->mddev->queue));
+                            ({ flush_pending_writes(conf);
+                               raid1_unplug(conf->mddev->queue); }));
         spin_unlock_irq(&conf->resync_lock);
 }
 static void unfreeze_array(conf_t *conf)
@@ -907,6 +946,9 @@ static int make_request(struct request_queue *q, struct bio * bio)
         blk_plug_device(mddev->queue);
         spin_unlock_irqrestore(&conf->device_lock, flags);
 
+        /* In case raid1d snuck into freeze_array */
+        wake_up(&conf->wait_barrier);
+
         if (do_sync)
                 md_wakeup_thread(mddev->thread);
 #if 0
@@ -1473,28 +1515,14 @@ static void raid1d(mddev_t *mddev)
         
         for (;;) {
                 char b[BDEVNAME_SIZE];
-                spin_lock_irqsave(&conf->device_lock, flags);
-
-                if (conf->pending_bio_list.head) {
-                        bio = bio_list_get(&conf->pending_bio_list);
-                        blk_remove_plug(mddev->queue);
-                        spin_unlock_irqrestore(&conf->device_lock, flags);
-                        /* flush any pending bitmap writes to disk before proceeding w/ I/O */
-                        bitmap_unplug(mddev->bitmap);
 
-                        while (bio) { /* submit pending writes */
-                                struct bio *next = bio->bi_next;
-                                bio->bi_next = NULL;
-                                generic_make_request(bio);
-                                bio = next;
-                        }
-                        unplug = 1;
+                unplug += flush_pending_writes(conf);
 
-                        continue;
-                }
-
-                if (list_empty(head))
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (list_empty(head)) {
+                        spin_unlock_irqrestore(&conf->device_lock, flags);
                         break;
+                }
                 r1_bio = list_entry(head->prev, r1bio_t, retry_list);
                 list_del(head->prev);
                 conf->nr_queued--;
@@ -1590,7 +1618,6 @@ static void raid1d(mddev_t *mddev)
                         }
                 }
         }
-        spin_unlock_irqrestore(&conf->device_lock, flags);
         if (unplug)
                 unplug_slaves(mddev);
 }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 017f58113c33..32389d2f18fc 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -537,7 +537,8 @@ static int read_balance(conf_t *conf, r10bio_t *r10_bio)
         current_distance = abs(r10_bio->devs[slot].addr -
                                conf->mirrors[disk].head_position);
 
-        /* Find the disk whose head is closest */
+        /* Find the disk whose head is closest,
+         * or - for far > 1 - find the closest to partition beginning */
 
         for (nslot = slot; nslot < conf->copies; nslot++) {
                 int ndisk = r10_bio->devs[nslot].devnum;
@@ -557,8 +558,13 @@ static int read_balance(conf_t *conf, r10bio_t *r10_bio)
                         slot = nslot;
                         break;
                 }
-                new_distance = abs(r10_bio->devs[nslot].addr -
-                                   conf->mirrors[ndisk].head_position);
+
+                /* for far > 1 always use the lowest address */
+                if (conf->far_copies > 1)
+                        new_distance = r10_bio->devs[nslot].addr;
+                else
+                        new_distance = abs(r10_bio->devs[nslot].addr -
+                                           conf->mirrors[ndisk].head_position);
                 if (new_distance < current_distance) {
                         current_distance = new_distance;
                         disk = ndisk;
@@ -629,7 +635,36 @@ static int raid10_congested(void *data, int bits)
         return ret;
 }
 
-
+static int flush_pending_writes(conf_t *conf)
+{
+        /* Any writes that have been queued but are awaiting
+         * bitmap updates get flushed here.
+         * We return 1 if any requests were actually submitted.
+         */
+        int rv = 0;
+
+        spin_lock_irq(&conf->device_lock);
+
+        if (conf->pending_bio_list.head) {
+                struct bio *bio;
+                bio = bio_list_get(&conf->pending_bio_list);
+                blk_remove_plug(conf->mddev->queue);
+                spin_unlock_irq(&conf->device_lock);
+                /* flush any pending bitmap writes to disk
+                 * before proceeding w/ I/O */
+                bitmap_unplug(conf->mddev->bitmap);
+
+                while (bio) { /* submit pending writes */
+                        struct bio *next = bio->bi_next;
+                        bio->bi_next = NULL;
+                        generic_make_request(bio);
+                        bio = next;
+                }
+                rv = 1;
+        } else
+                spin_unlock_irq(&conf->device_lock);
+        return rv;
+}
 /* Barriers....
  * Sometimes we need to suspend IO while we do something else,
  * either some resync/recovery, or reconfigure the array.
@@ -712,15 +747,23 @@ static void freeze_array(conf_t *conf)
         /* stop syncio and normal IO and wait for everything to
          * go quiet.
          * We increment barrier and nr_waiting, and then
-         * wait until barrier+nr_pending match nr_queued+2
+         * wait until nr_pending match nr_queued+1
+         * This is called in the context of one normal IO request
+         * that has failed. Thus any sync request that might be pending
+         * will be blocked by nr_pending, and we need to wait for
+         * pending IO requests to complete or be queued for re-try.
+         * Thus the number queued (nr_queued) plus this request (1)
+         * must match the number of pending IOs (nr_pending) before
+         * we continue.
          */
         spin_lock_irq(&conf->resync_lock);
         conf->barrier++;
         conf->nr_waiting++;
         wait_event_lock_irq(conf->wait_barrier,
-                            conf->barrier+conf->nr_pending == conf->nr_queued+2,
+                            conf->nr_pending == conf->nr_queued+1,
                             conf->resync_lock,
-                            raid10_unplug(conf->mddev->queue));
+                            ({ flush_pending_writes(conf);
+                               raid10_unplug(conf->mddev->queue); }));
         spin_unlock_irq(&conf->resync_lock);
 }
 
@@ -892,6 +935,9 @@ static int make_request(struct request_queue *q, struct bio * bio)
         blk_plug_device(mddev->queue);
         spin_unlock_irqrestore(&conf->device_lock, flags);
 
+        /* In case raid10d snuck in to freeze_array */
+        wake_up(&conf->wait_barrier);
+
         if (do_sync)
                 md_wakeup_thread(mddev->thread);
 
@@ -1464,28 +1510,14 @@ static void raid10d(mddev_t *mddev)
 
         for (;;) {
                 char b[BDEVNAME_SIZE];
-                spin_lock_irqsave(&conf->device_lock, flags);
 
-                if (conf->pending_bio_list.head) {
-                        bio = bio_list_get(&conf->pending_bio_list);
-                        blk_remove_plug(mddev->queue);
-                        spin_unlock_irqrestore(&conf->device_lock, flags);
-                        /* flush any pending bitmap writes to disk before proceeding w/ I/O */
-                        bitmap_unplug(mddev->bitmap);
-
-                        while (bio) { /* submit pending writes */
-                                struct bio *next = bio->bi_next;
-                                bio->bi_next = NULL;
-                                generic_make_request(bio);
-                                bio = next;
-                        }
-                        unplug = 1;
-
-                        continue;
-                }
+                unplug += flush_pending_writes(conf);
 
-                if (list_empty(head))
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (list_empty(head)) {
+                        spin_unlock_irqrestore(&conf->device_lock, flags);
                         break;
+                }
                 r10_bio = list_entry(head->prev, r10bio_t, retry_list);
                 list_del(head->prev);
                 conf->nr_queued--;
@@ -1548,7 +1580,6 @@ static void raid10d(mddev_t *mddev)
                         }
                 }
         }
-        spin_unlock_irqrestore(&conf->device_lock, flags);
         if (unplug)
                 unplug_slaves(mddev);
 }
@@ -1787,6 +1818,8 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                                 if (j == conf->copies) {
                                         /* Cannot recover, so abort the recovery */
                                         put_buf(r10_bio);
+                                        if (rb2)
+                                                atomic_dec(&rb2->remaining);
                                         r10_bio = rb2;
                                         if (!test_and_set_bit(MD_RECOVERY_ERR, &mddev->recovery))
                                                 printk(KERN_INFO "raid10: %s: insufficient working devices for recovery.\n",
diff --git a/drivers/memstick/Kconfig b/drivers/memstick/Kconfig
index 1093fdb07297..f0ca41c20323 100644
--- a/drivers/memstick/Kconfig
+++ b/drivers/memstick/Kconfig
@@ -8,7 +8,7 @@ menuconfig MEMSTICK
           Sony MemoryStick is a proprietary storage/extension card protocol.
 
           If you want MemoryStick support, you should say Y here and also
-          to the specific driver for your MMC interface.
+          to the specific driver for your MemoryStick interface.
 
 if MEMSTICK
 
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index bba467fe4bce..de80dba12f9b 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -18,7 +18,6 @@
 #include <linux/delay.h>
 
 #define DRIVER_NAME "memstick"
-#define DRIVER_VERSION "0.2"
 
 static unsigned int cmd_retries = 3;
 module_param(cmd_retries, uint, 0644);
@@ -236,7 +235,7 @@ int memstick_next_req(struct memstick_host *host, struct memstick_request **mrq)
                 rc = host->card->next_request(host->card, mrq);
 
         if (!rc)
-                host->retries = cmd_retries;
+                host->retries = cmd_retries > 1 ? cmd_retries - 1 : 1;
         else
                 *mrq = NULL;
 
@@ -271,7 +270,7 @@ void memstick_init_req_sg(struct memstick_request *mrq, unsigned char tpc,
                 mrq->data_dir = READ;
 
         mrq->sg = *sg;
-        mrq->io_type = MEMSTICK_IO_SG;
+        mrq->long_data = 1;
 
         if (tpc == MS_TPC_SET_CMD || tpc == MS_TPC_EX_SET_CMD)
                 mrq->need_card_int = 1;
@@ -306,7 +305,7 @@ void memstick_init_req(struct memstick_request *mrq, unsigned char tpc,
         if (mrq->data_dir == WRITE)
                 memcpy(mrq->data, buf, mrq->data_len);
 
-        mrq->io_type = MEMSTICK_IO_VAL;
+        mrq->long_data = 0;
 
         if (tpc == MS_TPC_SET_CMD || tpc == MS_TPC_EX_SET_CMD)
                 mrq->need_card_int = 1;
@@ -561,6 +560,31 @@ void memstick_free_host(struct memstick_host *host)
 }
 EXPORT_SYMBOL(memstick_free_host);
 
+/**
+ * memstick_suspend_host - notify bus driver of host suspension
+ * @host - host to use
+ */
+void memstick_suspend_host(struct memstick_host *host)
+{
+        mutex_lock(&host->lock);
+        host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF);
+        mutex_unlock(&host->lock);
+}
+EXPORT_SYMBOL(memstick_suspend_host);
+
+/**
+ * memstick_resume_host - notify bus driver of host resumption
+ * @host - host to use
+ */
+void memstick_resume_host(struct memstick_host *host)
+{
+        mutex_lock(&host->lock);
+        host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_ON);
+        mutex_unlock(&host->lock);
+        memstick_detect_change(host);
+}
+EXPORT_SYMBOL(memstick_resume_host);
+
 int memstick_register_driver(struct memstick_driver *drv)
 {
         drv->driver.bus = &memstick_bus_type;
@@ -611,4 +635,3 @@ module_exit(memstick_exit);
 MODULE_AUTHOR("Alex Dubov");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Sony MemoryStick core driver");
-MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
index 423ad8cf4bb9..1d637e4561d3 100644
--- a/drivers/memstick/core/mspro_block.c
+++ b/drivers/memstick/core/mspro_block.c
@@ -16,10 +16,10 @@
 #include <linux/idr.h>
 #include <linux/hdreg.h>
 #include <linux/kthread.h>
+#include <linux/delay.h>
 #include <linux/memstick.h>
 
 #define DRIVER_NAME "mspro_block"
-#define DRIVER_VERSION "0.2"
 
 static int major;
 module_param(major, int, 0644);
@@ -110,6 +110,17 @@ struct mspro_mbr {
         unsigned int  sectors_per_partition;
 } __attribute__((packed));
 
+struct mspro_specfile {
+        char           name[8];
+        char           ext[3];
+        unsigned char  attr;
+        unsigned char  reserved[10];
+        unsigned short time;
+        unsigned short date;
+        unsigned short cluster;
+        unsigned int   size;
+} __attribute__((packed));
+
 struct mspro_devinfo {
         unsigned short cylinders;
         unsigned short heads;
@@ -293,6 +304,20 @@ static ssize_t mspro_block_attr_show_sysinfo(struct device *dev,
                                                      dev_attr);
         struct mspro_sys_info *x_sys = x_attr->data;
         ssize_t rc = 0;
+        int date_tz = 0, date_tz_f = 0;
+
+        if (x_sys->assembly_date[0] > 0x80U) {
+                date_tz = (~x_sys->assembly_date[0]) + 1;
+                date_tz_f = date_tz & 3;
+                date_tz >>= 2;
+                date_tz = -date_tz;
+                date_tz_f *= 15;
+        } else if (x_sys->assembly_date[0] < 0x80U) {
+                date_tz = x_sys->assembly_date[0];
+                date_tz_f = date_tz & 3;
+                date_tz >>= 2;
+                date_tz_f *= 15;
+        }
 
         rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "class: %x\n",
                         x_sys->class);
@@ -305,8 +330,8 @@ static ssize_t mspro_block_attr_show_sysinfo(struct device *dev,
         rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "page size: %x\n",
                         be16_to_cpu(x_sys->page_size));
         rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "assembly date: "
-                        "%d %04u-%02u-%02u %02u:%02u:%02u\n",
-                        x_sys->assembly_date[0],
+                        "GMT%+d:%d %04u-%02u-%02u %02u:%02u:%02u\n",
+                        date_tz, date_tz_f,
                         be16_to_cpu(*(unsigned short *)
                                     &x_sys->assembly_date[1]),
                         x_sys->assembly_date[3], x_sys->assembly_date[4],
@@ -398,6 +423,41 @@ static ssize_t mspro_block_attr_show_mbr(struct device *dev,
         return rc;
 }
 
+static ssize_t mspro_block_attr_show_specfile(struct device *dev,
+                                              struct device_attribute *attr,
+                                              char *buffer)
+{
+        struct mspro_sys_attr *x_attr = container_of(attr,
+                                                     struct mspro_sys_attr,
+                                                     dev_attr);
+        struct mspro_specfile *x_spfile = x_attr->data;
+        char name[9], ext[4];
+        ssize_t rc = 0;
+
+        memcpy(name, x_spfile->name, 8);
+        name[8] = 0;
+        memcpy(ext, x_spfile->ext, 3);
+        ext[3] = 0;
+
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "name: %s\n", name);
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "ext: %s\n", ext);
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "attribute: %x\n",
+                        x_spfile->attr);
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "time: %d:%d:%d\n",
+                        x_spfile->time >> 11,
+                        (x_spfile->time >> 5) & 0x3f,
+                        (x_spfile->time & 0x1f) * 2);
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "date: %d-%d-%d\n",
+                        (x_spfile->date >> 9) + 1980,
+                        (x_spfile->date >> 5) & 0xf,
+                        x_spfile->date & 0x1f);
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "start cluster: %x\n",
+                        x_spfile->cluster);
+        rc += scnprintf(buffer + rc, PAGE_SIZE - rc, "size: %x\n",
+                        x_spfile->size);
+        return rc;
+}
+
 static ssize_t mspro_block_attr_show_devinfo(struct device *dev,
                                              struct device_attribute *attr,
                                              char *buffer)
@@ -430,6 +490,9 @@ static sysfs_show_t mspro_block_attr_show(unsigned char tag)
                 return mspro_block_attr_show_modelname;
         case MSPRO_BLOCK_ID_MBR:
                 return mspro_block_attr_show_mbr;
+        case MSPRO_BLOCK_ID_SPECFILEVALUES1:
+        case MSPRO_BLOCK_ID_SPECFILEVALUES2:
+                return mspro_block_attr_show_specfile;
         case MSPRO_BLOCK_ID_DEVINFO:
                 return mspro_block_attr_show_devinfo;
         default:
@@ -629,7 +692,7 @@ static void mspro_block_process_request(struct memstick_dev *card,
                         param.system = msb->system;
                         param.data_count = cpu_to_be16(page_count);
                         param.data_address = cpu_to_be32((uint32_t)t_sec);
-                        param.cmd_param = 0;
+                        param.tpc_param = 0;
 
                         msb->data_dir = rq_data_dir(req);
                         msb->transfer_cmd = msb->data_dir == READ
@@ -758,10 +821,10 @@ static int mspro_block_switch_to_parallel(struct memstick_dev *card)
         struct memstick_host *host = card->host;
         struct mspro_block_data *msb = memstick_get_drvdata(card);
         struct mspro_param_register param = {
-                .system = 0,
+                .system = MEMSTICK_SYS_PAR4,
                 .data_count = 0,
                 .data_address = 0,
-                .cmd_param = 0
+                .tpc_param = 0
         };
 
         card->next_request = h_mspro_block_req_init;
@@ -773,8 +836,8 @@ static int mspro_block_switch_to_parallel(struct memstick_dev *card)
         if (card->current_mrq.error)
                 return card->current_mrq.error;
 
-        msb->system = 0;
-        host->set_param(host, MEMSTICK_INTERFACE, MEMSTICK_PARALLEL);
+        msb->system = MEMSTICK_SYS_PAR4;
+        host->set_param(host, MEMSTICK_INTERFACE, MEMSTICK_PAR4);
 
         card->next_request = h_mspro_block_req_init;
         msb->mrq_handler = h_mspro_block_default;
@@ -783,8 +846,24 @@ static int mspro_block_switch_to_parallel(struct memstick_dev *card)
         wait_for_completion(&card->mrq_complete);
 
         if (card->current_mrq.error) {
-                msb->system = 0x80;
+                msb->system = MEMSTICK_SYS_SERIAL;
+                host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF);
+                msleep(1000);
+                host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_ON);
                 host->set_param(host, MEMSTICK_INTERFACE, MEMSTICK_SERIAL);
+
+                if (memstick_set_rw_addr(card))
+                        return card->current_mrq.error;
+
+                param.system = msb->system;
+
+                card->next_request = h_mspro_block_req_init;
+                msb->mrq_handler = h_mspro_block_default;
+                memstick_init_req(&card->current_mrq, MS_TPC_WRITE_REG, &param,
+                                  sizeof(param));
+                memstick_new_req(host);
+                wait_for_completion(&card->mrq_complete);
+
                 return -EFAULT;
         }
 
@@ -802,7 +881,7 @@ static int mspro_block_read_attributes(struct memstick_dev *card)
                 .system = msb->system,
                 .data_count = cpu_to_be16(1),
                 .data_address = 0,
-                .cmd_param = 0
+                .tpc_param = 0
         };
         struct mspro_attribute *attr = NULL;
         struct mspro_sys_attr *s_attr = NULL;
@@ -922,7 +1001,7 @@ static int mspro_block_read_attributes(struct memstick_dev *card)
                 param.system = msb->system;
                 param.data_count = cpu_to_be16((rc / msb->page_size) + 1);
                 param.data_address = cpu_to_be32(addr / msb->page_size);
-                param.cmd_param = 0;
+                param.tpc_param = 0;
 
                 sg_init_one(&msb->req_sg[0], buffer,
                             be16_to_cpu(param.data_count) * msb->page_size);
@@ -964,7 +1043,7 @@ static int mspro_block_init_card(struct memstick_dev *card)
         struct memstick_host *host = card->host;
         int rc = 0;
 
-        msb->system = 0x80;
+        msb->system = MEMSTICK_SYS_SERIAL;
         card->reg_addr.r_offset = offsetof(struct mspro_register, status);
         card->reg_addr.r_length = sizeof(struct ms_status_register);
         card->reg_addr.w_offset = offsetof(struct mspro_register, param);
@@ -973,7 +1052,7 @@ static int mspro_block_init_card(struct memstick_dev *card)
         if (memstick_set_rw_addr(card))
                 return -EIO;
 
-        if (host->caps & MEMSTICK_CAP_PARALLEL) {
+        if (host->caps & MEMSTICK_CAP_PAR4) {
                 if (mspro_block_switch_to_parallel(card))
                         printk(KERN_WARNING "%s: could not switch to "
                                "parallel interface\n", card->dev.bus_id);
@@ -1348,4 +1427,3 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Alex Dubov");
 MODULE_DESCRIPTION("Sony MemoryStickPro block device driver");
 MODULE_DEVICE_TABLE(memstick, mspro_block_id_tbl);
-MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/memstick/host/Kconfig b/drivers/memstick/host/Kconfig
index c002fcc3c879..4ce5c8dffb68 100644
--- a/drivers/memstick/host/Kconfig
+++ b/drivers/memstick/host/Kconfig
@@ -20,3 +20,13 @@ config MEMSTICK_TIFM_MS
           To compile this driver as a module, choose M here: the
           module will be called tifm_ms.
 
+config MEMSTICK_JMICRON_38X
+        tristate "JMicron JMB38X MemoryStick interface support (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && PCI
+
+        help
+          Say Y here if you want to be able to access MemoryStick cards with
+          the JMicron(R) JMB38X MemoryStick card reader.
+
+          To compile this driver as a module, choose M here: the
+          module will be called jmb38x_ms.
diff --git a/drivers/memstick/host/Makefile b/drivers/memstick/host/Makefile
index ee666380efa1..12530e4311d3 100644
--- a/drivers/memstick/host/Makefile
+++ b/drivers/memstick/host/Makefile
@@ -3,8 +3,8 @@
 #
 
 ifeq ($(CONFIG_MEMSTICK_DEBUG),y)
-        EXTRA_CFLAGS            += -DDEBUG
+        EXTRA_CFLAGS                    += -DDEBUG
 endif
 
-obj-$(CONFIG_MEMSTICK_TIFM_MS)  += tifm_ms.o
-
+obj-$(CONFIG_MEMSTICK_TIFM_MS)          += tifm_ms.o
+obj-$(CONFIG_MEMSTICK_JMICRON_38X)      += jmb38x_ms.o
diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
new file mode 100644
index 000000000000..03fe8783b1ee
--- /dev/null
+++ b/drivers/memstick/host/jmb38x_ms.c
@@ -0,0 +1,945 @@
+/*
+ *  jmb38x_ms.c - JMicron jmb38x MemoryStick card reader
+ *
+ *  Copyright (C) 2008 Alex Dubov <oakad@yahoo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/highmem.h>
+#include <linux/memstick.h>
+
+#define DRIVER_NAME "jmb38x_ms"
+
+static int no_dma;
+module_param(no_dma, bool, 0644);
+
+enum {
+        DMA_ADDRESS       = 0x00,
+        BLOCK             = 0x04,
+        DMA_CONTROL       = 0x08,
+        TPC_P0            = 0x0c,
+        TPC_P1            = 0x10,
+        TPC               = 0x14,
+        HOST_CONTROL      = 0x18,
+        DATA              = 0x1c,
+        STATUS            = 0x20,
+        INT_STATUS        = 0x24,
+        INT_STATUS_ENABLE = 0x28,
+        INT_SIGNAL_ENABLE = 0x2c,
+        TIMER             = 0x30,
+        TIMER_CONTROL     = 0x34,
+        PAD_OUTPUT_ENABLE = 0x38,
+        PAD_PU_PD         = 0x3c,
+        CLOCK_DELAY       = 0x40,
+        ADMA_ADDRESS      = 0x44,
+        CLOCK_CONTROL     = 0x48,
+        LED_CONTROL       = 0x4c,
+        VERSION           = 0x50
+};
+
+struct jmb38x_ms_host {
+        struct jmb38x_ms        *chip;
+        void __iomem            *addr;
+        spinlock_t              lock;
+        int                     id;
+        char                    host_id[DEVICE_ID_SIZE];
+        int                     irq;
+        unsigned int            block_pos;
+        unsigned long           timeout_jiffies;
+        struct timer_list       timer;
+        struct memstick_request *req;
+        unsigned char           eject:1,
+                                use_dma:1;
+        unsigned char           cmd_flags;
+        unsigned char           io_pos;
+        unsigned int            io_word[2];
+};
+
+struct jmb38x_ms {
+        struct pci_dev        *pdev;
+        int                   host_cnt;
+        struct memstick_host  *hosts[];
+};
+
+#define BLOCK_COUNT_MASK       0xffff0000
+#define BLOCK_SIZE_MASK        0x00000fff
+
+#define DMA_CONTROL_ENABLE     0x00000001
+
+#define TPC_DATA_SEL           0x00008000
+#define TPC_DIR                0x00004000
+#define TPC_WAIT_INT           0x00002000
+#define TPC_GET_INT            0x00000800
+#define TPC_CODE_SZ_MASK       0x00000700
+#define TPC_DATA_SZ_MASK       0x00000007
+
+#define HOST_CONTROL_RESET_REQ 0x00008000
+#define HOST_CONTROL_REI       0x00004000
+#define HOST_CONTROL_LED       0x00000400
+#define HOST_CONTROL_FAST_CLK  0x00000200
+#define HOST_CONTROL_RESET     0x00000100
+#define HOST_CONTROL_POWER_EN  0x00000080
+#define HOST_CONTROL_CLOCK_EN  0x00000040
+#define HOST_CONTROL_IF_SHIFT  4
+
+#define HOST_CONTROL_IF_SERIAL 0x0
+#define HOST_CONTROL_IF_PAR4   0x1
+#define HOST_CONTROL_IF_PAR8   0x3
+
+#define STATUS_HAS_MEDIA        0x00000400
+#define STATUS_FIFO_EMPTY       0x00000200
+#define STATUS_FIFO_FULL        0x00000100
+
+#define INT_STATUS_TPC_ERR      0x00080000
+#define INT_STATUS_CRC_ERR      0x00040000
+#define INT_STATUS_TIMER_TO     0x00020000
+#define INT_STATUS_HSK_TO       0x00010000
+#define INT_STATUS_ANY_ERR      0x00008000
+#define INT_STATUS_FIFO_WRDY    0x00000080
+#define INT_STATUS_FIFO_RRDY    0x00000040
+#define INT_STATUS_MEDIA_OUT    0x00000010
+#define INT_STATUS_MEDIA_IN     0x00000008
+#define INT_STATUS_DMA_BOUNDARY 0x00000004
+#define INT_STATUS_EOTRAN       0x00000002
+#define INT_STATUS_EOTPC        0x00000001
+
+#define INT_STATUS_ALL          0x000f801f
+
+#define PAD_OUTPUT_ENABLE_MS  0x0F3F
+
+#define PAD_PU_PD_OFF         0x7FFF0000
+#define PAD_PU_PD_ON_MS_SOCK0 0x5f8f0000
+#define PAD_PU_PD_ON_MS_SOCK1 0x0f0f0000
+
+enum {
+        CMD_READY    = 0x01,
+        FIFO_READY   = 0x02,
+        REG_DATA     = 0x04,
+        AUTO_GET_INT = 0x08
+};
+
+static unsigned int jmb38x_ms_read_data(struct jmb38x_ms_host *host,
+                                        unsigned char *buf, unsigned int length)
+{
+        unsigned int off = 0;
+
+        while (host->io_pos && length) {
+                buf[off++] = host->io_word[0] & 0xff;
+                host->io_word[0] >>= 8;
+                length--;
+                host->io_pos--;
+        }
+
+        if (!length)
+                return off;
+
+        while (!(STATUS_FIFO_EMPTY & readl(host->addr + STATUS))) {
+                if (length < 4)
+                        break;
+                *(unsigned int *)(buf + off) = __raw_readl(host->addr + DATA);
+                length -= 4;
+                off += 4;
+        }
+
+        if (length
+            && !(STATUS_FIFO_EMPTY & readl(host->addr + STATUS))) {
+                host->io_word[0] = readl(host->addr + DATA);
+                for (host->io_pos = 4; host->io_pos; --host->io_pos) {
+                        buf[off++] = host->io_word[0] & 0xff;
+                        host->io_word[0] >>= 8;
+                        length--;
+                        if (!length)
+                                break;
+                }
+        }
+
+        return off;
+}
+
+static unsigned int jmb38x_ms_read_reg_data(struct jmb38x_ms_host *host,
+                                            unsigned char *buf,
+                                            unsigned int length)
+{
+        unsigned int off = 0;
+
+        while (host->io_pos > 4 && length) {
+                buf[off++] = host->io_word[0] & 0xff;
+                host->io_word[0] >>= 8;
+                length--;
+                host->io_pos--;
+        }
+
+        if (!length)
+                return off;
+
+        while (host->io_pos && length) {
+                buf[off++] = host->io_word[1] & 0xff;
+                host->io_word[1] >>= 8;
+                length--;
+                host->io_pos--;
+        }
+
+        return off;
+}
+
+static unsigned int jmb38x_ms_write_data(struct jmb38x_ms_host *host,
+                                         unsigned char *buf,
+                                         unsigned int length)
+{
+        unsigned int off = 0;
+
+        if (host->io_pos) {
+                while (host->io_pos < 4 && length) {
+                        host->io_word[0] |=  buf[off++] << (host->io_pos * 8);
+                        host->io_pos++;
+                        length--;
+                }
+        }
+
+        if (host->io_pos == 4
+            && !(STATUS_FIFO_FULL & readl(host->addr + STATUS))) {
+                writel(host->io_word[0], host->addr + DATA);
+                host->io_pos = 0;
+                host->io_word[0] = 0;
+        } else if (host->io_pos) {
+                return off;
+        }
+
+        if (!length)
+                return off;
+
+        while (!(STATUS_FIFO_FULL & readl(host->addr + STATUS))) {
+                if (length < 4)
+                        break;
+
+                __raw_writel(*(unsigned int *)(buf + off),
+                             host->addr + DATA);
+                length -= 4;
+                off += 4;
+        }
+
+        switch (length) {
+        case 3:
+                host->io_word[0] |= buf[off + 2] << 16;
+                host->io_pos++;
+        case 2:
+                host->io_word[0] |= buf[off + 1] << 8;
+                host->io_pos++;
+        case 1:
+                host->io_word[0] |= buf[off];
+                host->io_pos++;
+        }
+
+        off += host->io_pos;
+
+        return off;
+}
+
+static unsigned int jmb38x_ms_write_reg_data(struct jmb38x_ms_host *host,
+                                             unsigned char *buf,
+                                             unsigned int length)
+{
+        unsigned int off = 0;
+
+        while (host->io_pos < 4 && length) {
+                host->io_word[0] &= ~(0xff << (host->io_pos * 8));
+                host->io_word[0] |=  buf[off++] << (host->io_pos * 8);
+                host->io_pos++;
+                length--;
+        }
+
+        if (!length)
+                return off;
+
+        while (host->io_pos < 8 && length) {
+                host->io_word[1] &= ~(0xff << (host->io_pos * 8));
+                host->io_word[1] |=  buf[off++] << (host->io_pos * 8);
+                host->io_pos++;
+                length--;
+        }
+
+        return off;
+}
+
+static int jmb38x_ms_transfer_data(struct jmb38x_ms_host *host)
+{
+        unsigned int length;
+        unsigned int off;
+        unsigned int t_size, p_off, p_cnt;
+        unsigned char *buf;
+        struct page *pg;
+        unsigned long flags = 0;
+
+        if (host->req->long_data) {
+                length = host->req->sg.length - host->block_pos;
+                off = host->req->sg.offset + host->block_pos;
+        } else {
+                length = host->req->data_len - host->block_pos;
+                off = 0;
+        }
+
+        while (length) {
+                if (host->req->long_data) {
+                        pg = nth_page(sg_page(&host->req->sg),
+                                      off >> PAGE_SHIFT);
+                        p_off = offset_in_page(off);
+                        p_cnt = PAGE_SIZE - p_off;
+                        p_cnt = min(p_cnt, length);
+
+                        local_irq_save(flags);
+                        buf = kmap_atomic(pg, KM_BIO_SRC_IRQ) + p_off;
+                } else {
+                        buf = host->req->data + host->block_pos;
+                        p_cnt = host->req->data_len - host->block_pos;
+                }
+
+                if (host->req->data_dir == WRITE)
+                        t_size = !(host->cmd_flags & REG_DATA)
+                                 ? jmb38x_ms_write_data(host, buf, p_cnt)
+                                 : jmb38x_ms_write_reg_data(host, buf, p_cnt);
+                else
+                        t_size = !(host->cmd_flags & REG_DATA)
+                                 ? jmb38x_ms_read_data(host, buf, p_cnt)
+                                 : jmb38x_ms_read_reg_data(host, buf, p_cnt);
+
+                if (host->req->long_data) {
+                        kunmap_atomic(buf - p_off, KM_BIO_SRC_IRQ);
+                        local_irq_restore(flags);
+                }
+
+                if (!t_size)
+                        break;
+                host->block_pos += t_size;
+                length -= t_size;
+                off += t_size;
+        }
+
+        if (!length && host->req->data_dir == WRITE) {
+                if (host->cmd_flags & REG_DATA) {
+                        writel(host->io_word[0], host->addr + TPC_P0);
+                        writel(host->io_word[1], host->addr + TPC_P1);
+                } else if (host->io_pos) {
+                        writel(host->io_word[0], host->addr + DATA);
+                }
+        }
+
+        return length;
+}
+
+static int jmb38x_ms_issue_cmd(struct memstick_host *msh)
+{
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+        unsigned char *data;
+        unsigned int data_len, cmd, t_val;
+
+        if (!(STATUS_HAS_MEDIA & readl(host->addr + STATUS))) {
+                dev_dbg(msh->cdev.dev, "no media status\n");
+                host->req->error = -ETIME;
+                return host->req->error;
+        }
+
+        dev_dbg(msh->cdev.dev, "control %08x\n",
+                readl(host->addr + HOST_CONTROL));
+        dev_dbg(msh->cdev.dev, "status %08x\n", readl(host->addr + INT_STATUS));
+        dev_dbg(msh->cdev.dev, "hstatus %08x\n", readl(host->addr + STATUS));
+
+        host->cmd_flags = 0;
+        host->block_pos = 0;
+        host->io_pos = 0;
+        host->io_word[0] = 0;
+        host->io_word[1] = 0;
+
+        cmd = host->req->tpc << 16;
+        cmd |= TPC_DATA_SEL;
+
+        if (host->req->data_dir == READ)
+                cmd |= TPC_DIR;
+        if (host->req->need_card_int)
+                cmd |= TPC_WAIT_INT;
+        if (host->req->get_int_reg)
+                cmd |= TPC_GET_INT;
+
+        data = host->req->data;
+
+        host->use_dma = !no_dma;
+
+        if (host->req->long_data) {
+                data_len = host->req->sg.length;
+        } else {
+                data_len = host->req->data_len;
+                host->use_dma = 0;
+        }
+
+        if (data_len <= 8) {
+                cmd &= ~(TPC_DATA_SEL | 0xf);
+                host->cmd_flags |= REG_DATA;
+                cmd |= data_len & 0xf;
+                host->use_dma = 0;
+        }
+
+        if (host->use_dma) {
+                if (1 != pci_map_sg(host->chip->pdev, &host->req->sg, 1,
+                                    host->req->data_dir == READ
+                                    ? PCI_DMA_FROMDEVICE
+                                    : PCI_DMA_TODEVICE)) {
+                        host->req->error = -ENOMEM;
+                        return host->req->error;
+                }
+                data_len = sg_dma_len(&host->req->sg);
+                writel(sg_dma_address(&host->req->sg),
+                       host->addr + DMA_ADDRESS);
+                writel(((1 << 16) & BLOCK_COUNT_MASK)
+                       | (data_len & BLOCK_SIZE_MASK),
+                       host->addr + BLOCK);
+                writel(DMA_CONTROL_ENABLE, host->addr + DMA_CONTROL);
+        } else if (!(host->cmd_flags & REG_DATA)) {
+                writel(((1 << 16) & BLOCK_COUNT_MASK)
+                       | (data_len & BLOCK_SIZE_MASK),
+                       host->addr + BLOCK);
+                        t_val = readl(host->addr + INT_STATUS_ENABLE);
+                        t_val |= host->req->data_dir == READ
+                                 ? INT_STATUS_FIFO_RRDY
+                                 : INT_STATUS_FIFO_WRDY;
+
+                        writel(t_val, host->addr + INT_STATUS_ENABLE);
+                        writel(t_val, host->addr + INT_SIGNAL_ENABLE);
+        } else {
+                cmd &= ~(TPC_DATA_SEL | 0xf);
+                host->cmd_flags |= REG_DATA;
+                cmd |= data_len & 0xf;
+
+                if (host->req->data_dir == WRITE) {
+                        jmb38x_ms_transfer_data(host);
+                        writel(host->io_word[0], host->addr + TPC_P0);
+                        writel(host->io_word[1], host->addr + TPC_P1);
+                }
+        }
+
+        mod_timer(&host->timer, jiffies + host->timeout_jiffies);
+        writel(HOST_CONTROL_LED | readl(host->addr + HOST_CONTROL),
+               host->addr + HOST_CONTROL);
+        host->req->error = 0;
+
+        writel(cmd, host->addr + TPC);
+        dev_dbg(msh->cdev.dev, "executing TPC %08x, len %x\n", cmd, data_len);
+
+        return 0;
+}
+
+static void jmb38x_ms_complete_cmd(struct memstick_host *msh, int last)
+{
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+        unsigned int t_val = 0;
+        int rc;
+
+        del_timer(&host->timer);
+
+        dev_dbg(msh->cdev.dev, "c control %08x\n",
+                readl(host->addr + HOST_CONTROL));
+        dev_dbg(msh->cdev.dev, "c status %08x\n",
+                readl(host->addr + INT_STATUS));
+        dev_dbg(msh->cdev.dev, "c hstatus %08x\n", readl(host->addr + STATUS));
+
+        if (host->req->get_int_reg) {
+                t_val = readl(host->addr + TPC_P0);
+                host->req->int_reg = (t_val & 0xff);
+        }
+
+        if (host->use_dma) {
+                writel(0, host->addr + DMA_CONTROL);
+                pci_unmap_sg(host->chip->pdev, &host->req->sg, 1,
+                             host->req->data_dir == READ
+                             ? PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
+        } else {
+                t_val = readl(host->addr + INT_STATUS_ENABLE);
+                if (host->req->data_dir == READ)
+                        t_val &= ~INT_STATUS_FIFO_RRDY;
+                else
+                        t_val &= ~INT_STATUS_FIFO_WRDY;
+
+                writel(t_val, host->addr + INT_STATUS_ENABLE);
+                writel(t_val, host->addr + INT_SIGNAL_ENABLE);
+        }
+
+        writel((~HOST_CONTROL_LED) & readl(host->addr + HOST_CONTROL),
+               host->addr + HOST_CONTROL);
+
+        if (!last) {
+                do {
+                        rc = memstick_next_req(msh, &host->req);
+                } while (!rc && jmb38x_ms_issue_cmd(msh));
+        } else {
+                do {
+                        rc = memstick_next_req(msh, &host->req);
+                        if (!rc)
+                                host->req->error = -ETIME;
+                } while (!rc);
+        }
+}
+
+static irqreturn_t jmb38x_ms_isr(int irq, void *dev_id)
+{
+        struct memstick_host *msh = dev_id;
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+        unsigned int irq_status;
+
+        spin_lock(&host->lock);
+        irq_status = readl(host->addr + INT_STATUS);
+        dev_dbg(&host->chip->pdev->dev, "irq_status = %08x\n", irq_status);
+        if (irq_status == 0 || irq_status == (~0)) {
+                spin_unlock(&host->lock);
+                return IRQ_NONE;
+        }
+
+        if (host->req) {
+                if (irq_status & INT_STATUS_ANY_ERR) {
+                        if (irq_status & INT_STATUS_CRC_ERR)
+                                host->req->error = -EILSEQ;
+                        else
+                                host->req->error = -ETIME;
+                } else {
+                        if (host->use_dma) {
+                                if (irq_status & INT_STATUS_EOTRAN)
+                                        host->cmd_flags |= FIFO_READY;
+                        } else {
+                                if (irq_status & (INT_STATUS_FIFO_RRDY
+                                                  | INT_STATUS_FIFO_WRDY))
+                                        jmb38x_ms_transfer_data(host);
+
+                                if (irq_status & INT_STATUS_EOTRAN) {
+                                        jmb38x_ms_transfer_data(host);
+                                        host->cmd_flags |= FIFO_READY;
+                                }
+                        }
+
+                        if (irq_status & INT_STATUS_EOTPC) {
+                                host->cmd_flags |= CMD_READY;
+                                if (host->cmd_flags & REG_DATA) {
+                                        if (host->req->data_dir == READ) {
+                                                host->io_word[0]
+                                                        = readl(host->addr
+                                                                + TPC_P0);
+                                                host->io_word[1]
+                                                        = readl(host->addr
+                                                                + TPC_P1);
+                                                host->io_pos = 8;
+
+                                                jmb38x_ms_transfer_data(host);
+                                        }
+                                        host->cmd_flags |= FIFO_READY;
+                                }
+                        }
+                }
+        }
+
+        if (irq_status & (INT_STATUS_MEDIA_IN | INT_STATUS_MEDIA_OUT)) {
+                dev_dbg(&host->chip->pdev->dev, "media changed\n");
+                memstick_detect_change(msh);
+        }
+
+        writel(irq_status, host->addr + INT_STATUS);
+
+        if (host->req
+            && (((host->cmd_flags & CMD_READY)
+                 && (host->cmd_flags & FIFO_READY))
+                || host->req->error))
+                jmb38x_ms_complete_cmd(msh, 0);
+
+        spin_unlock(&host->lock);
+        return IRQ_HANDLED;
+}
+
+static void jmb38x_ms_abort(unsigned long data)
+{
+        struct memstick_host *msh = (struct memstick_host *)data;
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+        unsigned long flags;
+
+        dev_dbg(&host->chip->pdev->dev, "abort\n");
+        spin_lock_irqsave(&host->lock, flags);
+        if (host->req) {
+                host->req->error = -ETIME;
+                jmb38x_ms_complete_cmd(msh, 0);
+        }
+        spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void jmb38x_ms_request(struct memstick_host *msh)
+{
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+        unsigned long flags;
+        int rc;
+
+        spin_lock_irqsave(&host->lock, flags);
+        if (host->req) {
+                spin_unlock_irqrestore(&host->lock, flags);
+                BUG();
+                return;
+        }
+
+        do {
+                rc = memstick_next_req(msh, &host->req);
+        } while (!rc && jmb38x_ms_issue_cmd(msh));
+        spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void jmb38x_ms_reset(struct jmb38x_ms_host *host)
+{
+        unsigned int host_ctl = readl(host->addr + HOST_CONTROL);
+
+        writel(host_ctl | HOST_CONTROL_RESET_REQ | HOST_CONTROL_RESET,
+               host->addr + HOST_CONTROL);
+
+        while (HOST_CONTROL_RESET_REQ
+               & (host_ctl = readl(host->addr + HOST_CONTROL))) {
+                ndelay(100);
+                dev_dbg(&host->chip->pdev->dev, "reset\n");
+        }
+
+        writel(INT_STATUS_ALL, host->addr + INT_STATUS_ENABLE);
+        writel(INT_STATUS_ALL, host->addr + INT_SIGNAL_ENABLE);
+
+        dev_dbg(&host->chip->pdev->dev, "reset\n");
+}
+
+static void jmb38x_ms_set_param(struct memstick_host *msh,
+                                enum memstick_param param,
+                                int value)
+{
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+        unsigned int host_ctl;
+        unsigned long flags;
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        switch (param) {
+        case MEMSTICK_POWER:
+                if (value == MEMSTICK_POWER_ON) {
+                        jmb38x_ms_reset(host);
+
+                        writel(host->id ? PAD_PU_PD_ON_MS_SOCK1
+                                          : PAD_PU_PD_ON_MS_SOCK0,
+                               host->addr + PAD_PU_PD);
+
+                        writel(PAD_OUTPUT_ENABLE_MS,
+                               host->addr + PAD_OUTPUT_ENABLE);
+
+                        host_ctl = readl(host->addr + HOST_CONTROL);
+                        host_ctl |= 7;
+                        writel(host_ctl | (HOST_CONTROL_POWER_EN
+                                           | HOST_CONTROL_CLOCK_EN),
+                               host->addr + HOST_CONTROL);
+
+                        dev_dbg(&host->chip->pdev->dev, "power on\n");
+                } else if (value == MEMSTICK_POWER_OFF) {
+                        writel(readl(host->addr + HOST_CONTROL)
+                               & ~(HOST_CONTROL_POWER_EN
+                                   | HOST_CONTROL_CLOCK_EN),
+                               host->addr +  HOST_CONTROL);
+                        writel(0, host->addr + PAD_OUTPUT_ENABLE);
+                        writel(PAD_PU_PD_OFF, host->addr + PAD_PU_PD);
+                        dev_dbg(&host->chip->pdev->dev, "power off\n");
+                }
+                break;
+        case MEMSTICK_INTERFACE:
+                /* jmb38x_ms_reset(host); */
+
+                host_ctl = readl(host->addr + HOST_CONTROL);
+                host_ctl &= ~(3 << HOST_CONTROL_IF_SHIFT);
+                /* host_ctl |= 7; */
+
+                if (value == MEMSTICK_SERIAL) {
+                        host_ctl &= ~HOST_CONTROL_FAST_CLK;
+                        host_ctl |= HOST_CONTROL_IF_SERIAL
+                                    << HOST_CONTROL_IF_SHIFT;
+                        host_ctl |= HOST_CONTROL_REI;
+                        writel(0, host->addr + CLOCK_DELAY);
+                } else if (value == MEMSTICK_PAR4) {
+                        host_ctl |= HOST_CONTROL_FAST_CLK;
+                        host_ctl |= HOST_CONTROL_IF_PAR4
+                                    << HOST_CONTROL_IF_SHIFT;
+                        host_ctl &= ~HOST_CONTROL_REI;
+                        writel(4, host->addr + CLOCK_DELAY);
+                } else if (value == MEMSTICK_PAR8) {
+                        host_ctl |= HOST_CONTROL_FAST_CLK;
+                        host_ctl |= HOST_CONTROL_IF_PAR8
+                                    << HOST_CONTROL_IF_SHIFT;
+                        host_ctl &= ~HOST_CONTROL_REI;
+                        writel(4, host->addr + CLOCK_DELAY);
+                }
+                writel(host_ctl, host->addr + HOST_CONTROL);
+                break;
+        };
+
+        spin_unlock_irqrestore(&host->lock, flags);
+}
+
+#ifdef CONFIG_PM
+
+static int jmb38x_ms_suspend(struct pci_dev *dev, pm_message_t state)
+{
+        struct jmb38x_ms *jm = pci_get_drvdata(dev);
+        int cnt;
+
+        for (cnt = 0; cnt < jm->host_cnt; ++cnt) {
+                if (!jm->hosts[cnt])
+                        break;
+                memstick_suspend_host(jm->hosts[cnt]);
+        }
+
+        pci_save_state(dev);
+        pci_enable_wake(dev, pci_choose_state(dev, state), 0);
+        pci_disable_device(dev);
+        pci_set_power_state(dev, pci_choose_state(dev, state));
+        return 0;
+}
+
+static int jmb38x_ms_resume(struct pci_dev *dev)
+{
+        struct jmb38x_ms *jm = pci_get_drvdata(dev);
+        int rc;
+
+        pci_set_power_state(dev, PCI_D0);
+        pci_restore_state(dev);
+        rc = pci_enable_device(dev);
+        if (rc)
+                return rc;
+        pci_set_master(dev);
+
+        pci_read_config_dword(dev, 0xac, &rc);
+        pci_write_config_dword(dev, 0xac, rc | 0x00470000);
+
+        for (rc = 0; rc < jm->host_cnt; ++rc) {
+                if (!jm->hosts[rc])
+                        break;
+                memstick_resume_host(jm->hosts[rc]);
+                memstick_detect_change(jm->hosts[rc]);
+        }
+
+        return 0;
+}
+
+#else
+
+#define jmb38x_ms_suspend NULL
+#define jmb38x_ms_resume NULL
+
+#endif /* CONFIG_PM */
+
+static int jmb38x_ms_count_slots(struct pci_dev *pdev)
+{
+        int cnt, rc = 0;
+
+        for (cnt = 0; cnt < PCI_ROM_RESOURCE; ++cnt) {
+                if (!(IORESOURCE_MEM & pci_resource_flags(pdev, cnt)))
+                        break;
+
+                if (256 != pci_resource_len(pdev, cnt))
+                        break;
+
+                ++rc;
+        }
+        return rc;
+}
+
+static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt)
+{
+        struct memstick_host *msh;
+        struct jmb38x_ms_host *host;
+
+        msh = memstick_alloc_host(sizeof(struct jmb38x_ms_host),
+                                  &jm->pdev->dev);
+        if (!msh)
+                return NULL;
+
+        host = memstick_priv(msh);
+        host->chip = jm;
+        host->addr = ioremap(pci_resource_start(jm->pdev, cnt),
+                             pci_resource_len(jm->pdev, cnt));
+        if (!host->addr)
+                goto err_out_free;
+
+        spin_lock_init(&host->lock);
+        host->id = cnt;
+        snprintf(host->host_id, DEVICE_ID_SIZE, DRIVER_NAME ":slot%d",
+                 host->id);
+        host->irq = jm->pdev->irq;
+        host->timeout_jiffies = msecs_to_jiffies(4000);
+        msh->request = jmb38x_ms_request;
+        msh->set_param = jmb38x_ms_set_param;
+        /*
+        msh->caps = MEMSTICK_CAP_AUTO_GET_INT | MEMSTICK_CAP_PAR4
+                    | MEMSTICK_CAP_PAR8;
+        */
+        msh->caps = MEMSTICK_CAP_PAR4 | MEMSTICK_CAP_PAR8;
+
+        setup_timer(&host->timer, jmb38x_ms_abort, (unsigned long)msh);
+
+        if (!request_irq(host->irq, jmb38x_ms_isr, IRQF_SHARED, host->host_id,
+                         msh))
+                return msh;
+
+        iounmap(host->addr);
+err_out_free:
+        kfree(msh);
+        return NULL;
+}
+
+static void jmb38x_ms_free_host(struct memstick_host *msh)
+{
+        struct jmb38x_ms_host *host = memstick_priv(msh);
+
+        free_irq(host->irq, msh);
+        iounmap(host->addr);
+        memstick_free_host(msh);
+}
+
+static int jmb38x_ms_probe(struct pci_dev *pdev,
+                           const struct pci_device_id *dev_id)
+{
+        struct jmb38x_ms *jm;
+        int pci_dev_busy = 0;
+        int rc, cnt;
+
+        rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+        if (rc)
+                return rc;
+
+        rc = pci_enable_device(pdev);
+        if (rc)
+                return rc;
+
+        pci_set_master(pdev);
+
+        rc = pci_request_regions(pdev, DRIVER_NAME);
+        if (rc) {
+                pci_dev_busy = 1;
+                goto err_out;
+        }
+
+        pci_read_config_dword(pdev, 0xac, &rc);
+        pci_write_config_dword(pdev, 0xac, rc | 0x00470000);
+
+        cnt = jmb38x_ms_count_slots(pdev);
+        if (!cnt) {
+                rc = -ENODEV;
+                pci_dev_busy = 1;
+                goto err_out;
+        }
+
+        jm = kzalloc(sizeof(struct jmb38x_ms)
+                     + cnt * sizeof(struct memstick_host *), GFP_KERNEL);
+        if (!jm) {
+                rc = -ENOMEM;
+                goto err_out_int;
+        }
+
+        jm->pdev = pdev;
+        jm->host_cnt = cnt;
+        pci_set_drvdata(pdev, jm);
+
+        for (cnt = 0; cnt < jm->host_cnt; ++cnt) {
+                jm->hosts[cnt] = jmb38x_ms_alloc_host(jm, cnt);
+                if (!jm->hosts[cnt])
+                        break;
+
+                rc = memstick_add_host(jm->hosts[cnt]);
+
+                if (rc) {
+                        jmb38x_ms_free_host(jm->hosts[cnt]);
+                        jm->hosts[cnt] = NULL;
+                        break;
+                }
+        }
+
+        if (cnt)
+                return 0;
+
+        rc = -ENODEV;
+
+        pci_set_drvdata(pdev, NULL);
+        kfree(jm);
+err_out_int:
+        pci_release_regions(pdev);
+err_out:
+        if (!pci_dev_busy)
+                pci_disable_device(pdev);
+        return rc;
+}
+
+static void jmb38x_ms_remove(struct pci_dev *dev)
+{
+        struct jmb38x_ms *jm = pci_get_drvdata(dev);
+        struct jmb38x_ms_host *host;
+        int cnt;
+        unsigned long flags;
+
+        for (cnt = 0; cnt < jm->host_cnt; ++cnt) {
+                if (!jm->hosts[cnt])
+                        break;
+
+                host = memstick_priv(jm->hosts[cnt]);
+
+                writel(0, host->addr + INT_SIGNAL_ENABLE);
+                writel(0, host->addr + INT_STATUS_ENABLE);
+                mmiowb();
+                dev_dbg(&jm->pdev->dev, "interrupts off\n");
+                spin_lock_irqsave(&host->lock, flags);
+                if (host->req) {
+                        host->req->error = -ETIME;
+                        jmb38x_ms_complete_cmd(jm->hosts[cnt], 1);
+                }
+                spin_unlock_irqrestore(&host->lock, flags);
+
+                memstick_remove_host(jm->hosts[cnt]);
+                dev_dbg(&jm->pdev->dev, "host removed\n");
+
+                jmb38x_ms_free_host(jm->hosts[cnt]);
+        }
+
+        pci_set_drvdata(dev, NULL);
+        pci_release_regions(dev);
+        pci_disable_device(dev);
+        kfree(jm);
+}
+
+static struct pci_device_id jmb38x_ms_id_tbl [] = {
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_MS, PCI_ANY_ID,
+          PCI_ANY_ID, 0, 0, 0 },
+        { }
+};
+
+static struct pci_driver jmb38x_ms_driver = {
+        .name = DRIVER_NAME,
+        .id_table = jmb38x_ms_id_tbl,
+        .probe = jmb38x_ms_probe,
+        .remove = jmb38x_ms_remove,
+        .suspend = jmb38x_ms_suspend,
+        .resume = jmb38x_ms_resume
+};
+
+static int __init jmb38x_ms_init(void)
+{
+        return pci_register_driver(&jmb38x_ms_driver);
+}
+
+static void __exit jmb38x_ms_exit(void)
+{
+        pci_unregister_driver(&jmb38x_ms_driver);
+}
+
+MODULE_AUTHOR("Alex Dubov");
+MODULE_DESCRIPTION("JMicron jmb38x MemoryStick driver");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, jmb38x_ms_id_tbl);
+
+module_init(jmb38x_ms_init);
+module_exit(jmb38x_ms_exit);
diff --git a/drivers/memstick/host/tifm_ms.c b/drivers/memstick/host/tifm_ms.c
index 4fb24215bd95..2b5bf52a8302 100644
--- a/drivers/memstick/host/tifm_ms.c
+++ b/drivers/memstick/host/tifm_ms.c
@@ -20,293 +20,315 @@
 #include <asm/io.h>
 
 #define DRIVER_NAME "tifm_ms"
-#define DRIVER_VERSION "0.1"
 
 static int no_dma;
 module_param(no_dma, bool, 0644);
 
-#define TIFM_MS_TIMEOUT      0x00100
-#define TIFM_MS_BADCRC       0x00200
-#define TIFM_MS_EOTPC        0x01000
-#define TIFM_MS_INT          0x02000
-
-/* The meaning of the bit majority in this constant is unknown. */
-#define TIFM_MS_SERIAL       0x04010
+/*
+ * Some control bits of TIFM appear to conform to Sony's reference design,
+ * so I'm just assuming they all are.
+ */
 
-#define TIFM_MS_SYS_LATCH    0x00100
-#define TIFM_MS_SYS_NOT_RDY  0x00800
-#define TIFM_MS_SYS_DATA     0x10000
+#define TIFM_MS_STAT_DRQ     0x04000
+#define TIFM_MS_STAT_MSINT   0x02000
+#define TIFM_MS_STAT_RDY     0x01000
+#define TIFM_MS_STAT_CRC     0x00200
+#define TIFM_MS_STAT_TOE     0x00100
+#define TIFM_MS_STAT_EMP     0x00020
+#define TIFM_MS_STAT_FUL     0x00010
+#define TIFM_MS_STAT_CED     0x00008
+#define TIFM_MS_STAT_ERR     0x00004
+#define TIFM_MS_STAT_BRQ     0x00002
+#define TIFM_MS_STAT_CNK     0x00001
+
+#define TIFM_MS_SYS_DMA      0x10000
+#define TIFM_MS_SYS_RESET    0x08000
+#define TIFM_MS_SYS_SRAC     0x04000
+#define TIFM_MS_SYS_INTEN    0x02000
+#define TIFM_MS_SYS_NOCRC    0x01000
+#define TIFM_MS_SYS_INTCLR   0x00800
+#define TIFM_MS_SYS_MSIEN    0x00400
+#define TIFM_MS_SYS_FCLR     0x00200
+#define TIFM_MS_SYS_FDIR     0x00100
+#define TIFM_MS_SYS_DAM      0x00080
+#define TIFM_MS_SYS_DRM      0x00040
+#define TIFM_MS_SYS_DRQSL    0x00020
+#define TIFM_MS_SYS_REI      0x00010
+#define TIFM_MS_SYS_REO      0x00008
+#define TIFM_MS_SYS_BSY_MASK 0x00007
+
+#define TIFM_MS_SYS_FIFO     (TIFM_MS_SYS_INTEN | TIFM_MS_SYS_MSIEN \
+                              | TIFM_MS_SYS_FCLR | TIFM_MS_SYS_BSY_MASK)
 
 /* Hardware flags */
 enum {
-        CMD_READY  = 0x0001,
-        FIFO_READY = 0x0002,
-        CARD_READY = 0x0004,
-        DATA_CARRY = 0x0008
+        CMD_READY  = 0x01,
+        FIFO_READY = 0x02,
+        CARD_INT   = 0x04
 };
 
 struct tifm_ms {
         struct tifm_dev         *dev;
-        unsigned short          eject:1,
-                                no_dma:1;
-        unsigned short          cmd_flags;
+        struct timer_list       timer;
+        struct memstick_request *req;
         unsigned int            mode_mask;
         unsigned int            block_pos;
         unsigned long           timeout_jiffies;
-
-        struct timer_list       timer;
-        struct memstick_request *req;
+        unsigned char           eject:1,
+                                use_dma:1;
+        unsigned char           cmd_flags;
+        unsigned char           io_pos;
         unsigned int            io_word;
 };
 
-static void tifm_ms_read_fifo(struct tifm_ms *host, unsigned int fifo_offset,
-                              struct page *pg, unsigned int page_off,
-                              unsigned int length)
+static unsigned int tifm_ms_read_data(struct tifm_ms *host,
+                                      unsigned char *buf, unsigned int length)
 {
         struct tifm_dev *sock = host->dev;
-        unsigned int cnt = 0, off = 0;
-        unsigned char *buf = kmap_atomic(pg, KM_BIO_DST_IRQ) + page_off;
+        unsigned int off = 0;
+
+        while (host->io_pos && length) {
+                buf[off++] = host->io_word & 0xff;
+                host->io_word >>= 8;
+                length--;
+                host->io_pos--;
+        }
 
-        if (host->cmd_flags & DATA_CARRY) {
-                while ((fifo_offset & 3) && length) {
+        if (!length)
+                return off;
+
+        while (!(TIFM_MS_STAT_EMP & readl(sock->addr + SOCK_MS_STATUS))) {
+                if (length < 4)
+                        break;
+                *(unsigned int *)(buf + off) = __raw_readl(sock->addr
+                                                           + SOCK_MS_DATA);
+                length -= 4;
+                off += 4;
+        }
+
+        if (length
+            && !(TIFM_MS_STAT_EMP & readl(sock->addr + SOCK_MS_STATUS))) {
+                host->io_word = readl(sock->addr + SOCK_MS_DATA);
+                for (host->io_pos = 4; host->io_pos; --host->io_pos) {
                         buf[off++] = host->io_word & 0xff;
                         host->io_word >>= 8;
                         length--;
-                        fifo_offset++;
+                        if (!length)
+                                break;
                 }
-                if (!(fifo_offset & 3))
-                        host->cmd_flags &= ~DATA_CARRY;
-                if (!length)
-                        return;
         }
 
-        do {
-                host->io_word = readl(sock->addr + SOCK_FIFO_ACCESS
-                                      + fifo_offset);
-                cnt = 4;
-                while (length && cnt) {
-                        buf[off++] = (host->io_word >> 8) & 0xff;
-                        cnt--;
-                        length--;
-                }
-                fifo_offset += 4 - cnt;
-        } while (length);
-
-        if (cnt)
-                host->cmd_flags |= DATA_CARRY;
-
-        kunmap_atomic(buf - page_off, KM_BIO_DST_IRQ);
+        return off;
 }
 
-static void tifm_ms_write_fifo(struct tifm_ms *host, unsigned int fifo_offset,
-                               struct page *pg, unsigned int page_off,
-                               unsigned int length)
+static unsigned int tifm_ms_write_data(struct tifm_ms *host,
+                                       unsigned char *buf, unsigned int length)
 {
         struct tifm_dev *sock = host->dev;
-        unsigned int cnt = 0, off = 0;
-        unsigned char *buf = kmap_atomic(pg, KM_BIO_SRC_IRQ) + page_off;
+        unsigned int off = 0;
 
-        if (host->cmd_flags & DATA_CARRY) {
-                while (fifo_offset & 3) {
-                        host->io_word |= buf[off++] << (8 * (fifo_offset & 3));
+        if (host->io_pos) {
+                while (host->io_pos < 4 && length) {
+                        host->io_word |=  buf[off++] << (host->io_pos * 8);
+                        host->io_pos++;
                         length--;
-                        fifo_offset++;
                 }
-                if (!(fifo_offset & 3)) {
-                        writel(host->io_word, sock->addr + SOCK_FIFO_ACCESS
-                               + fifo_offset - 4);
-
-                        host->cmd_flags &= ~DATA_CARRY;
-                }
-                if (!length)
-                        return;
         }
 
-        do {
-                cnt = 4;
+        if (host->io_pos == 4
+            && !(TIFM_MS_STAT_FUL & readl(sock->addr + SOCK_MS_STATUS))) {
+                writel(TIFM_MS_SYS_FDIR | readl(sock->addr + SOCK_MS_SYSTEM),
+                       sock->addr + SOCK_MS_SYSTEM);
+                writel(host->io_word, sock->addr + SOCK_MS_DATA);
+                host->io_pos = 0;
                 host->io_word = 0;
-                while (length && cnt) {
-                        host->io_word |= buf[off++] << (4 - cnt);
-                        cnt--;
-                        length--;
-                }
-                fifo_offset += 4 - cnt;
-                if (!cnt)
-                        writel(host->io_word, sock->addr + SOCK_FIFO_ACCESS
-                                              + fifo_offset - 4);
-
-        } while (length);
-
-        if (cnt)
-                host->cmd_flags |= DATA_CARRY;
+        } else if (host->io_pos) {
+                return off;
+        }
 
-        kunmap_atomic(buf - page_off, KM_BIO_SRC_IRQ);
-}
+        if (!length)
+                return off;
 
-static void tifm_ms_move_block(struct tifm_ms *host, unsigned int length)
-{
-        unsigned int t_size;
-        unsigned int off = host->req->sg.offset + host->block_pos;
-        unsigned int p_off, p_cnt;
-        struct page *pg;
-        unsigned long flags;
+        while (!(TIFM_MS_STAT_FUL & readl(sock->addr + SOCK_MS_STATUS))) {
+                if (length < 4)
+                        break;
+                writel(TIFM_MS_SYS_FDIR | readl(sock->addr + SOCK_MS_SYSTEM),
+                       sock->addr + SOCK_MS_SYSTEM);
+                __raw_writel(*(unsigned int *)(buf + off),
+                             sock->addr + SOCK_MS_DATA);
+                length -= 4;
+                off += 4;
+        }
 
-        dev_dbg(&host->dev->dev, "moving block\n");
-        local_irq_save(flags);
-        t_size = length;
-        while (t_size) {
-                pg = nth_page(sg_page(&host->req->sg), off >> PAGE_SHIFT);
-                p_off = offset_in_page(off);
-                p_cnt = PAGE_SIZE - p_off;
-                p_cnt = min(p_cnt, t_size);
+        switch (length) {
+        case 3:
+                host->io_word |= buf[off + 2] << 16;
+                host->io_pos++;
+        case 2:
+                host->io_word |= buf[off + 1] << 8;
+                host->io_pos++;
+        case 1:
+                host->io_word |= buf[off];
+                host->io_pos++;
+        }
 
-                if (host->req->data_dir == WRITE)
-                        tifm_ms_write_fifo(host, length - t_size,
-                                           pg, p_off, p_cnt);
-                else
-                        tifm_ms_read_fifo(host, length - t_size,
-                                          pg, p_off, p_cnt);
+        off += host->io_pos;
 
-                t_size -= p_cnt;
-        }
-        local_irq_restore(flags);
+        return off;
 }
 
-static int tifm_ms_transfer_data(struct tifm_ms *host, int skip)
+static unsigned int tifm_ms_transfer_data(struct tifm_ms *host)
 {
         struct tifm_dev *sock = host->dev;
-        unsigned int length = host->req->sg.length - host->block_pos;
+        unsigned int length;
+        unsigned int off;
+        unsigned int t_size, p_off, p_cnt;
+        unsigned char *buf;
+        struct page *pg;
+        unsigned long flags = 0;
+
+        if (host->req->long_data) {
+                length = host->req->sg.length - host->block_pos;
+                off = host->req->sg.offset + host->block_pos;
+        } else {
+                length = host->req->data_len - host->block_pos;
+                off = 0;
+        }
+        dev_dbg(&sock->dev, "fifo data transfer, %d, %d\n", length,
+                host->block_pos);
+
+        while (length) {
+                if (host->req->long_data) {
+                        pg = nth_page(sg_page(&host->req->sg),
+                                      off >> PAGE_SHIFT);
+                        p_off = offset_in_page(off);
+                        p_cnt = PAGE_SIZE - p_off;
+                        p_cnt = min(p_cnt, length);
+
+                        local_irq_save(flags);
+                        buf = kmap_atomic(pg, KM_BIO_SRC_IRQ) + p_off;
+                } else {
+                        buf = host->req->data + host->block_pos;
+                        p_cnt = host->req->data_len - host->block_pos;
+                }
 
-        if (!length)
-                return 1;
+                t_size = host->req->data_dir == WRITE
+                         ? tifm_ms_write_data(host, buf, p_cnt)
+                         : tifm_ms_read_data(host, buf, p_cnt);
 
-        if (length > TIFM_FIFO_SIZE)
-                length = TIFM_FIFO_SIZE;
+                if (host->req->long_data) {
+                        kunmap_atomic(buf - p_off, KM_BIO_SRC_IRQ);
+                        local_irq_restore(flags);
+                }
 
-        if (!skip) {
-                tifm_ms_move_block(host, length);
-                host->block_pos += length;
+                if (!t_size)
+                        break;
+                host->block_pos += t_size;
+                length -= t_size;
+                off += t_size;
         }
 
-        if ((host->req->data_dir == READ)
-            && (host->block_pos == host->req->sg.length))
-                return 1;
-
-        writel(ilog2(length) - 2, sock->addr + SOCK_FIFO_PAGE_SIZE);
-        if (host->req->data_dir == WRITE)
-                writel((1 << 8) | TIFM_DMA_TX, sock->addr + SOCK_DMA_CONTROL);
-        else
-                writel((1 << 8), sock->addr + SOCK_DMA_CONTROL);
+        dev_dbg(&sock->dev, "fifo data transfer, %d remaining\n", length);
+        if (!length && (host->req->data_dir == WRITE)) {
+                if (host->io_pos) {
+                        writel(TIFM_MS_SYS_FDIR
+                               | readl(sock->addr + SOCK_MS_SYSTEM),
+                               sock->addr + SOCK_MS_SYSTEM);
+                        writel(host->io_word, sock->addr + SOCK_MS_DATA);
+                }
+                writel(TIFM_MS_SYS_FDIR
+                       | readl(sock->addr + SOCK_MS_SYSTEM),
+                       sock->addr + SOCK_MS_SYSTEM);
+                writel(0, sock->addr + SOCK_MS_DATA);
+        } else {
+                readl(sock->addr + SOCK_MS_DATA);
+        }
 
-        return 0;
+        return length;
 }
 
 static int tifm_ms_issue_cmd(struct tifm_ms *host)
 {
         struct tifm_dev *sock = host->dev;
         unsigned char *data;
-        unsigned int data_len = 0, cmd = 0, cmd_mask = 0, cnt, tval = 0;
+        unsigned int data_len, cmd, sys_param;
 
         host->cmd_flags = 0;
+        host->block_pos = 0;
+        host->io_pos = 0;
+        host->io_word = 0;
+        host->cmd_flags = 0;
 
-        if (host->req->io_type == MEMSTICK_IO_SG) {
-                if (!host->no_dma) {
-                        if (1 != tifm_map_sg(sock, &host->req->sg, 1,
-                                             host->req->data_dir == READ
-                                             ? PCI_DMA_FROMDEVICE
-                                             : PCI_DMA_TODEVICE)) {
-                                host->req->error = -ENOMEM;
-                                return host->req->error;
-                        }
-                        data_len = sg_dma_len(&host->req->sg);
-                } else
-                        data_len = host->req->sg.length;
-
-                writel(TIFM_FIFO_INT_SETALL,
-                       sock->addr + SOCK_DMA_FIFO_INT_ENABLE_CLEAR);
-                writel(TIFM_FIFO_ENABLE,
-                       sock->addr + SOCK_FIFO_CONTROL);
-                writel(TIFM_FIFO_INTMASK,
-                       sock->addr + SOCK_DMA_FIFO_INT_ENABLE_SET);
+        data = host->req->data;
 
-                if (!host->no_dma) {
-                        writel(ilog2(data_len) - 2,
-                               sock->addr + SOCK_FIFO_PAGE_SIZE);
-                        writel(sg_dma_address(&host->req->sg),
-                               sock->addr + SOCK_DMA_ADDRESS);
-                        if (host->req->data_dir == WRITE)
-                                writel((1 << 8) | TIFM_DMA_TX | TIFM_DMA_EN,
-                                       sock->addr + SOCK_DMA_CONTROL);
-                        else
-                                writel((1 << 8) | TIFM_DMA_EN,
-                                       sock->addr + SOCK_DMA_CONTROL);
-                } else {
-                        tifm_ms_transfer_data(host,
-                                              host->req->data_dir == READ);
-                }
+        host->use_dma = !no_dma;
 
-                cmd_mask = readl(sock->addr + SOCK_MS_SYSTEM);
-                cmd_mask |= TIFM_MS_SYS_DATA | TIFM_MS_SYS_NOT_RDY;
-                writel(cmd_mask, sock->addr + SOCK_MS_SYSTEM);
-        } else if (host->req->io_type == MEMSTICK_IO_VAL) {
-                data = host->req->data;
+        if (host->req->long_data) {
+                data_len = host->req->sg.length;
+                if (!is_power_of_2(data_len))
+                        host->use_dma = 0;
+        } else {
                 data_len = host->req->data_len;
+                host->use_dma = 0;
+        }
 
-                cmd_mask = host->mode_mask | 0x2607; /* unknown constant */
-
-                if (host->req->data_dir == WRITE) {
-                        cmd_mask |= TIFM_MS_SYS_LATCH;
-                        writel(cmd_mask, sock->addr + SOCK_MS_SYSTEM);
-                        for (cnt = 0; (data_len - cnt) >= 4; cnt += 4) {
-                                writel(TIFM_MS_SYS_LATCH
-                                       | readl(sock->addr + SOCK_MS_SYSTEM),
-                                       sock->addr + SOCK_MS_SYSTEM);
-                                __raw_writel(*(unsigned int *)(data + cnt),
-                                             sock->addr + SOCK_MS_DATA);
-                                dev_dbg(&sock->dev, "writing %x\n",
-                                        *(int *)(data + cnt));
-                        }
-                        switch (data_len - cnt) {
-                        case 3:
-                                tval |= data[cnt + 2] << 16;
-                        case 2:
-                                tval |= data[cnt + 1] << 8;
-                        case 1:
-                                tval |= data[cnt];
-                                writel(TIFM_MS_SYS_LATCH
-                                       | readl(sock->addr + SOCK_MS_SYSTEM),
-                                       sock->addr + SOCK_MS_SYSTEM);
-                                writel(tval, sock->addr + SOCK_MS_DATA);
-                                dev_dbg(&sock->dev, "writing %x\n", tval);
-                        }
+        writel(TIFM_FIFO_INT_SETALL,
+               sock->addr + SOCK_DMA_FIFO_INT_ENABLE_CLEAR);
+        writel(TIFM_FIFO_ENABLE,
+               sock->addr + SOCK_FIFO_CONTROL);
+
+        if (host->use_dma) {
+                if (1 != tifm_map_sg(sock, &host->req->sg, 1,
+                                     host->req->data_dir == READ
+                                     ? PCI_DMA_FROMDEVICE
+                                     : PCI_DMA_TODEVICE)) {
+                        host->req->error = -ENOMEM;
+                        return host->req->error;
+                }
+                data_len = sg_dma_len(&host->req->sg);
 
-                        writel(TIFM_MS_SYS_LATCH
-                               | readl(sock->addr + SOCK_MS_SYSTEM),
-                               sock->addr + SOCK_MS_SYSTEM);
-                        writel(0, sock->addr + SOCK_MS_DATA);
-                        dev_dbg(&sock->dev, "writing %x\n", 0);
+                writel(ilog2(data_len) - 2,
+                       sock->addr + SOCK_FIFO_PAGE_SIZE);
+                writel(TIFM_FIFO_INTMASK,
+                       sock->addr + SOCK_DMA_FIFO_INT_ENABLE_SET);
+                sys_param = TIFM_DMA_EN | (1 << 8);
+                if (host->req->data_dir == WRITE)
+                        sys_param |= TIFM_DMA_TX;
+
+                writel(TIFM_FIFO_INTMASK,
+                       sock->addr + SOCK_DMA_FIFO_INT_ENABLE_SET);
 
-                } else
-                        writel(cmd_mask, sock->addr + SOCK_MS_SYSTEM);
+                writel(sg_dma_address(&host->req->sg),
+                       sock->addr + SOCK_DMA_ADDRESS);
+                writel(sys_param, sock->addr + SOCK_DMA_CONTROL);
+        } else {
+                writel(host->mode_mask | TIFM_MS_SYS_FIFO,
+                       sock->addr + SOCK_MS_SYSTEM);
 
-                cmd_mask = readl(sock->addr + SOCK_MS_SYSTEM);
-                cmd_mask &= ~TIFM_MS_SYS_DATA;
-                cmd_mask |= TIFM_MS_SYS_NOT_RDY;
-                dev_dbg(&sock->dev, "mask %x\n", cmd_mask);
-                writel(cmd_mask, sock->addr + SOCK_MS_SYSTEM);
-        } else
-                BUG();
+                writel(TIFM_FIFO_MORE,
+                       sock->addr + SOCK_DMA_FIFO_INT_ENABLE_SET);
+        }
 
         mod_timer(&host->timer, jiffies + host->timeout_jiffies);
         writel(TIFM_CTRL_LED | readl(sock->addr + SOCK_CONTROL),
                sock->addr + SOCK_CONTROL);
         host->req->error = 0;
 
+        sys_param = readl(sock->addr + SOCK_MS_SYSTEM);
+        sys_param |= TIFM_MS_SYS_INTCLR;
+
+        if (host->use_dma)
+                sys_param |= TIFM_MS_SYS_DMA;
+        else
+                sys_param &= ~TIFM_MS_SYS_DMA;
+
+        writel(sys_param, sock->addr + SOCK_MS_SYSTEM);
+
         cmd = (host->req->tpc & 0xf) << 12;
         cmd |= data_len;
         writel(cmd, sock->addr + SOCK_MS_COMMAND);
 
-        dev_dbg(&sock->dev, "executing TPC %x, %x\n", cmd, cmd_mask);
+        dev_dbg(&sock->dev, "executing TPC %x, %x\n", cmd, sys_param);
         return 0;
 }
 
@@ -314,47 +336,20 @@ static void tifm_ms_complete_cmd(struct tifm_ms *host)
 {
         struct tifm_dev *sock = host->dev;
         struct memstick_host *msh = tifm_get_drvdata(sock);
-        unsigned int tval = 0, data_len;
-        unsigned char *data;
         int rc;
 
         del_timer(&host->timer);
-        if (host->req->io_type == MEMSTICK_IO_SG) {
-                if (!host->no_dma)
-                        tifm_unmap_sg(sock, &host->req->sg, 1,
-                                      host->req->data_dir == READ
-                                      ? PCI_DMA_FROMDEVICE
-                                      : PCI_DMA_TODEVICE);
-        } else if (host->req->io_type == MEMSTICK_IO_VAL) {
-                writel(~TIFM_MS_SYS_DATA & readl(sock->addr + SOCK_MS_SYSTEM),
-                       sock->addr + SOCK_MS_SYSTEM);
-
-                data = host->req->data;
-                data_len = host->req->data_len;
 
-                if (host->req->data_dir == READ) {
-                        for (rc = 0; (data_len - rc) >= 4; rc += 4)
-                                *(int *)(data + rc)
-                                        = __raw_readl(sock->addr
-                                                      + SOCK_MS_DATA);
-
-                        if (data_len - rc)
-                                tval = readl(sock->addr + SOCK_MS_DATA);
-                        switch (data_len - rc) {
-                        case 3:
-                                data[rc + 2] = (tval >> 16) & 0xff;
-                        case 2:
-                                data[rc + 1] = (tval >> 8) & 0xff;
-                        case 1:
-                                data[rc] = tval & 0xff;
-                        }
-                        readl(sock->addr + SOCK_MS_DATA);
-                }
-        }
+        if (host->use_dma)
+                tifm_unmap_sg(sock, &host->req->sg, 1,
+                              host->req->data_dir == READ
+                              ? PCI_DMA_FROMDEVICE
+                              : PCI_DMA_TODEVICE);
 
         writel((~TIFM_CTRL_LED) & readl(sock->addr + SOCK_CONTROL),
                sock->addr + SOCK_CONTROL);
 
+        dev_dbg(&sock->dev, "TPC complete\n");
         do {
                 rc = memstick_next_req(msh, &host->req);
         } while (!rc && tifm_ms_issue_cmd(host));
@@ -365,11 +360,10 @@ static int tifm_ms_check_status(struct tifm_ms *host)
         if (!host->req->error) {
                 if (!(host->cmd_flags & CMD_READY))
                         return 1;
-                if ((host->req->io_type == MEMSTICK_IO_SG)
-                    && !(host->cmd_flags & FIFO_READY))
+                if (!(host->cmd_flags & FIFO_READY))
                         return 1;
                 if (host->req->need_card_int
-                    && !(host->cmd_flags & CARD_READY))
+                    && !(host->cmd_flags & CARD_INT))
                         return 1;
         }
         return 0;
@@ -379,18 +373,24 @@ static int tifm_ms_check_status(struct tifm_ms *host)
 static void tifm_ms_data_event(struct tifm_dev *sock)
 {
         struct tifm_ms *host;
-        unsigned int fifo_status = 0;
+        unsigned int fifo_status = 0, host_status = 0;
         int rc = 1;
 
         spin_lock(&sock->lock);
         host = memstick_priv((struct memstick_host *)tifm_get_drvdata(sock));
         fifo_status = readl(sock->addr + SOCK_DMA_FIFO_STATUS);
-        dev_dbg(&sock->dev, "data event: fifo_status %x, flags %x\n",
-                fifo_status, host->cmd_flags);
+        host_status = readl(sock->addr + SOCK_MS_STATUS);
+        dev_dbg(&sock->dev,
+                "data event: fifo_status %x, host_status %x, flags %x\n",
+                fifo_status, host_status, host->cmd_flags);
 
         if (host->req) {
-                if (fifo_status & TIFM_FIFO_READY) {
-                        if (!host->no_dma || tifm_ms_transfer_data(host, 0)) {
+                if (host->use_dma && (fifo_status & 1)) {
+                        host->cmd_flags |= FIFO_READY;
+                        rc = tifm_ms_check_status(host);
+                }
+                if (!host->use_dma && (fifo_status & TIFM_FIFO_MORE)) {
+                        if (!tifm_ms_transfer_data(host)) {
                                 host->cmd_flags |= FIFO_READY;
                                 rc = tifm_ms_check_status(host);
                         }
@@ -419,9 +419,9 @@ static void tifm_ms_card_event(struct tifm_dev *sock)
                 host_status, host->cmd_flags);
 
         if (host->req) {
-                if (host_status & TIFM_MS_TIMEOUT)
+                if (host_status & TIFM_MS_STAT_TOE)
                         host->req->error = -ETIME;
-                else if (host_status & TIFM_MS_BADCRC)
+                else if (host_status & TIFM_MS_STAT_CRC)
                         host->req->error = -EILSEQ;
 
                 if (host->req->error) {
@@ -430,18 +430,17 @@ static void tifm_ms_card_event(struct tifm_dev *sock)
                         writel(TIFM_DMA_RESET, sock->addr + SOCK_DMA_CONTROL);
                 }
 
-                if (host_status & TIFM_MS_EOTPC)
+                if (host_status & TIFM_MS_STAT_RDY)
                         host->cmd_flags |= CMD_READY;
-                if (host_status & TIFM_MS_INT)
-                        host->cmd_flags |= CARD_READY;
+
+                if (host_status & TIFM_MS_STAT_MSINT)
+                        host->cmd_flags |= CARD_INT;
 
                 rc = tifm_ms_check_status(host);
 
         }
 
-        writel(TIFM_MS_SYS_NOT_RDY | readl(sock->addr + SOCK_MS_SYSTEM),
-               sock->addr + SOCK_MS_SYSTEM);
-        writel((~TIFM_MS_SYS_DATA) & readl(sock->addr + SOCK_MS_SYSTEM),
+        writel(TIFM_MS_SYS_INTCLR | readl(sock->addr + SOCK_MS_SYSTEM),
                sock->addr + SOCK_MS_SYSTEM);
 
         if (!rc)
@@ -497,15 +496,26 @@ static void tifm_ms_set_param(struct memstick_host *msh,
 
         switch (param) {
         case MEMSTICK_POWER:
-                /* this is set by card detection mechanism */
+                /* also affected by media detection mechanism */
+                if (value == MEMSTICK_POWER_ON) {
+                        host->mode_mask = TIFM_MS_SYS_SRAC | TIFM_MS_SYS_REI;
+                        writel(TIFM_MS_SYS_RESET, sock->addr + SOCK_MS_SYSTEM);
+                        writel(TIFM_MS_SYS_FCLR | TIFM_MS_SYS_INTCLR,
+                               sock->addr + SOCK_MS_SYSTEM);
+                        writel(0xffffffff, sock->addr + SOCK_MS_STATUS);
+                } else if (value == MEMSTICK_POWER_OFF) {
+                        writel(TIFM_MS_SYS_FCLR | TIFM_MS_SYS_INTCLR,
+                               sock->addr + SOCK_MS_SYSTEM);
+                        writel(0xffffffff, sock->addr + SOCK_MS_STATUS);
+                }
                 break;
         case MEMSTICK_INTERFACE:
                 if (value == MEMSTICK_SERIAL) {
-                        host->mode_mask = TIFM_MS_SERIAL;
+                        host->mode_mask = TIFM_MS_SYS_SRAC | TIFM_MS_SYS_REI;
                         writel((~TIFM_CTRL_FAST_CLK)
                                & readl(sock->addr + SOCK_CONTROL),
                                sock->addr + SOCK_CONTROL);
-                } else if (value == MEMSTICK_PARALLEL) {
+                } else if (value == MEMSTICK_PAR4) {
                         host->mode_mask = 0;
                         writel(TIFM_CTRL_FAST_CLK
                                | readl(sock->addr + SOCK_CONTROL),
@@ -532,21 +542,6 @@ static void tifm_ms_abort(unsigned long data)
         tifm_eject(host->dev);
 }
 
-static int tifm_ms_initialize_host(struct tifm_ms *host)
-{
-        struct tifm_dev *sock = host->dev;
-        struct memstick_host *msh = tifm_get_drvdata(sock);
-
-        host->mode_mask = TIFM_MS_SERIAL;
-        writel(0x8000, sock->addr + SOCK_MS_SYSTEM);
-        writel(0x0200 | TIFM_MS_SYS_NOT_RDY, sock->addr + SOCK_MS_SYSTEM);
-        writel(0xffffffff, sock->addr + SOCK_MS_STATUS);
-        if (tifm_has_ms_pif(sock))
-                msh->caps |= MEMSTICK_CAP_PARALLEL;
-
-        return 0;
-}
-
 static int tifm_ms_probe(struct tifm_dev *sock)
 {
         struct memstick_host *msh;
@@ -568,7 +563,6 @@ static int tifm_ms_probe(struct tifm_dev *sock)
         tifm_set_drvdata(sock, msh);
         host->dev = sock;
         host->timeout_jiffies = msecs_to_jiffies(1000);
-        host->no_dma = no_dma;
 
         setup_timer(&host->timer, tifm_ms_abort, (unsigned long)host);
 
@@ -576,10 +570,10 @@ static int tifm_ms_probe(struct tifm_dev *sock)
         msh->set_param = tifm_ms_set_param;
         sock->card_event = tifm_ms_card_event;
         sock->data_event = tifm_ms_data_event;
-        rc = tifm_ms_initialize_host(host);
+        if (tifm_has_ms_pif(sock))
+                msh->caps |= MEMSTICK_CAP_PAR4;
 
-        if (!rc)
-                rc = memstick_add_host(msh);
+        rc = memstick_add_host(msh);
         if (!rc)
                 return 0;
 
@@ -601,7 +595,7 @@ static void tifm_ms_remove(struct tifm_dev *sock)
                 writel(TIFM_FIFO_INT_SETALL,
                        sock->addr + SOCK_DMA_FIFO_INT_ENABLE_CLEAR);
                 writel(TIFM_DMA_RESET, sock->addr + SOCK_DMA_CONTROL);
-                if ((host->req->io_type == MEMSTICK_IO_SG) && !host->no_dma)
+                if (host->use_dma)
                         tifm_unmap_sg(sock, &host->req->sg, 1,
                                       host->req->data_dir == READ
                                       ? PCI_DMA_TODEVICE
@@ -617,10 +611,6 @@ static void tifm_ms_remove(struct tifm_dev *sock)
         spin_unlock_irqrestore(&sock->lock, flags);
 
         memstick_remove_host(msh);
-
-        writel(0x0200 | TIFM_MS_SYS_NOT_RDY, sock->addr + SOCK_MS_SYSTEM);
-        writel(0xffffffff, sock->addr + SOCK_MS_STATUS);
-
         memstick_free_host(msh);
 }
 
@@ -628,17 +618,17 @@ static void tifm_ms_remove(struct tifm_dev *sock)
 
 static int tifm_ms_suspend(struct tifm_dev *sock, pm_message_t state)
 {
+        struct memstick_host *msh = tifm_get_drvdata(sock);
+
+        memstick_suspend_host(msh);
         return 0;
 }
 
 static int tifm_ms_resume(struct tifm_dev *sock)
 {
         struct memstick_host *msh = tifm_get_drvdata(sock);
-        struct tifm_ms *host = memstick_priv(msh);
-
-        tifm_ms_initialize_host(host);
-        memstick_detect_change(msh);
 
+        memstick_resume_host(msh);
         return 0;
 }
 
@@ -679,7 +669,6 @@ MODULE_AUTHOR("Alex Dubov");
 MODULE_DESCRIPTION("TI FlashMedia MemoryStick driver");
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(tifm, tifm_ms_id_tbl);
-MODULE_VERSION(DRIVER_VERSION);
 
 module_init(tifm_ms_init);
 module_exit(tifm_ms_exit);
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 0c303c84b37b..6b6df8679585 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -632,8 +632,7 @@ mpt_deregister(u8 cb_idx)
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /**
- *      mpt_event_register - Register protocol-specific event callback
- *      handler.
+ *      mpt_event_register - Register protocol-specific event callback handler.
  *      @cb_idx: previously registered (via mpt_register) callback handle
  *      @ev_cbfunc: callback function
  *
@@ -654,8 +653,7 @@ mpt_event_register(u8 cb_idx, MPT_EVHANDLER ev_cbfunc)
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /**
- *      mpt_event_deregister - Deregister protocol-specific event callback
- *      handler.
+ *      mpt_event_deregister - Deregister protocol-specific event callback handler
  *      @cb_idx: previously registered callback handle
  *
  *      Each protocol-specific driver should call this routine
@@ -765,11 +763,13 @@ mpt_device_driver_deregister(u8 cb_idx)
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /**
- *      mpt_get_msg_frame - Obtain a MPT request frame from the pool (of 1024)
- *      allocated per MPT adapter.
+ *      mpt_get_msg_frame - Obtain an MPT request frame from the pool
  *      @cb_idx: Handle of registered MPT protocol driver
  *      @ioc: Pointer to MPT adapter structure
  *
+ *      Obtain an MPT request frame from the pool (of 1024) that are
+ *      allocated per MPT adapter.
+ *
  *      Returns pointer to a MPT request frame or %NULL if none are available
  *      or IOC is not active.
  */
@@ -834,13 +834,12 @@ mpt_get_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc)
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /**
- *      mpt_put_msg_frame - Send a protocol specific MPT request frame
- *      to a IOC.
+ *      mpt_put_msg_frame - Send a protocol-specific MPT request frame to an IOC
  *      @cb_idx: Handle of registered MPT protocol driver
  *      @ioc: Pointer to MPT adapter structure
  *      @mf: Pointer to MPT request frame
  *
- *      This routine posts a MPT request frame to the request post FIFO of a
+ *      This routine posts an MPT request frame to the request post FIFO of a
  *      specific MPT adapter.
  */
 void
@@ -868,13 +867,15 @@ mpt_put_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf)
 }
 
 /**
- *      mpt_put_msg_frame_hi_pri - Send a protocol specific MPT request frame
- *      to a IOC using hi priority request queue.
+ *      mpt_put_msg_frame_hi_pri - Send a hi-pri protocol-specific MPT request frame
  *      @cb_idx: Handle of registered MPT protocol driver
  *      @ioc: Pointer to MPT adapter structure
  *      @mf: Pointer to MPT request frame
  *
- *      This routine posts a MPT request frame to the request post FIFO of a
+ *      Send a protocol-specific MPT request frame to an IOC using
+ *      hi-priority request queue.
+ *
+ *      This routine posts an MPT request frame to the request post FIFO of a
  *      specific MPT adapter.
  **/
 void
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index f77b329f6923..78734e25edd5 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -1701,6 +1701,11 @@ mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
         if (error)
                 goto out_free_consistent;
 
+        if (!buffer->NumPhys) {
+                error = -ENODEV;
+                goto out_free_consistent;
+        }
+
         /* save config data */
         port_info->num_phys = buffer->NumPhys;
         port_info->phy_info = kcalloc(port_info->num_phys,
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index af1de0ccee2f..0c252f60c4c1 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -1533,7 +1533,7 @@ mptscsih_freeChainBuffers(MPT_ADAPTER *ioc, int req_idx)
  *
  *      Remark: Currently invoked from a non-interrupt thread (_bh).
  *
- *      Remark: With old EH code, at most 1 SCSI TaskMgmt function per IOC
+ *      Note: With old EH code, at most 1 SCSI TaskMgmt function per IOC
  *      will be active.
  *
  *      Returns 0 for SUCCESS, or %FAILED.
@@ -2537,14 +2537,12 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
 
 /**
  * mptscsih_get_scsi_lookup
- *
- * retrieves scmd entry from ScsiLookup[] array list
- *
  * @ioc: Pointer to MPT_ADAPTER structure
  * @i: index into the array
  *
- * Returns the scsi_cmd pointer
+ * retrieves scmd entry from ScsiLookup[] array list
  *
+ * Returns the scsi_cmd pointer
  **/
 static struct scsi_cmnd *
 mptscsih_get_scsi_lookup(MPT_ADAPTER *ioc, int i)
@@ -2561,14 +2559,12 @@ mptscsih_get_scsi_lookup(MPT_ADAPTER *ioc, int i)
 
 /**
  * mptscsih_getclear_scsi_lookup
- *
- * retrieves and clears scmd entry from ScsiLookup[] array list
- *
  * @ioc: Pointer to MPT_ADAPTER structure
  * @i: index into the array
  *
- * Returns the scsi_cmd pointer
+ * retrieves and clears scmd entry from ScsiLookup[] array list
  *
+ * Returns the scsi_cmd pointer
  **/
 static struct scsi_cmnd *
 mptscsih_getclear_scsi_lookup(MPT_ADAPTER *ioc, int i)
diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index afd82966f9a0..13bac53db69a 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -48,31 +48,13 @@ struct sm501_devdata {
         unsigned int                     pdev_id;
         unsigned int                     irq;
         void __iomem                    *regs;
+        unsigned int                     rev;
 };
 
 #define MHZ (1000 * 1000)
 
 #ifdef DEBUG
-static const unsigned int misc_div[] = {
-        [0]             = 1,
-        [1]             = 2,
-        [2]             = 4,
-        [3]             = 8,
-        [4]             = 16,
-        [5]             = 32,
-        [6]             = 64,
-        [7]             = 128,
-        [8]             = 3,
-        [9]             = 6,
-        [10]            = 12,
-        [11]            = 24,
-        [12]            = 48,
-        [13]            = 96,
-        [14]            = 192,
-        [15]            = 384,
-};
-
-static const unsigned int px_div[] = {
+static const unsigned int div_tab[] = {
         [0]             = 1,
         [1]             = 2,
         [2]             = 4,
@@ -101,12 +83,12 @@ static const unsigned int px_div[] = {
 
 static unsigned long decode_div(unsigned long pll2, unsigned long val,
                                 unsigned int lshft, unsigned int selbit,
-                                unsigned long mask, const unsigned int *dtab)
+                                unsigned long mask)
 {
         if (val & selbit)
                 pll2 = 288 * MHZ;
 
-        return pll2 / dtab[(val >> lshft) & mask];
+        return pll2 / div_tab[(val >> lshft) & mask];
 }
 
 #define fmt_freq(x) ((x) / MHZ), ((x) % MHZ), (x)
@@ -141,10 +123,10 @@ static void sm501_dump_clk(struct sm501_devdata *sm)
         }
 
         sdclk0 = (misct & (1<<12)) ? pll2 : 288 * MHZ;
-        sdclk0 /= misc_div[((misct >> 8) & 0xf)];
+        sdclk0 /= div_tab[((misct >> 8) & 0xf)];
 
         sdclk1 = (misct & (1<<20)) ? pll2 : 288 * MHZ;
-        sdclk1 /= misc_div[((misct >> 16) & 0xf)];
+        sdclk1 /= div_tab[((misct >> 16) & 0xf)];
 
         dev_dbg(sm->dev, "MISCT=%08lx, PM0=%08lx, PM1=%08lx\n",
                 misct, pm0, pm1);
@@ -158,19 +140,19 @@ static void sm501_dump_clk(struct sm501_devdata *sm)
                  "P2 %ld.%ld MHz (%ld), V2 %ld.%ld (%ld), "
                  "M %ld.%ld (%ld), MX1 %ld.%ld (%ld)\n",
                  (pmc & 3 ) == 0 ? '*' : '-',
-                 fmt_freq(decode_div(pll2, pm0, 24, 1<<29, 31, px_div)),
-                 fmt_freq(decode_div(pll2, pm0, 16, 1<<20, 15, misc_div)),
-                 fmt_freq(decode_div(pll2, pm0, 8,  1<<12, 15, misc_div)),
-                 fmt_freq(decode_div(pll2, pm0, 0,  1<<4,  15, misc_div)));
+                 fmt_freq(decode_div(pll2, pm0, 24, 1<<29, 31)),
+                 fmt_freq(decode_div(pll2, pm0, 16, 1<<20, 15)),
+                 fmt_freq(decode_div(pll2, pm0, 8,  1<<12, 15)),
+                 fmt_freq(decode_div(pll2, pm0, 0,  1<<4,  15)));
 
         dev_dbg(sm->dev, "PM1[%c]: "
                 "P2 %ld.%ld MHz (%ld), V2 %ld.%ld (%ld), "
                 "M %ld.%ld (%ld), MX1 %ld.%ld (%ld)\n",
                 (pmc & 3 ) == 1 ? '*' : '-',
-                fmt_freq(decode_div(pll2, pm1, 24, 1<<29, 31, px_div)),
-                fmt_freq(decode_div(pll2, pm1, 16, 1<<20, 15, misc_div)),
-                fmt_freq(decode_div(pll2, pm1, 8,  1<<12, 15, misc_div)),
-                fmt_freq(decode_div(pll2, pm1, 0,  1<<4,  15, misc_div)));
+                fmt_freq(decode_div(pll2, pm1, 24, 1<<29, 31)),
+                fmt_freq(decode_div(pll2, pm1, 16, 1<<20, 15)),
+                fmt_freq(decode_div(pll2, pm1, 8,  1<<12, 15)),
+                fmt_freq(decode_div(pll2, pm1, 0,  1<<4,  15)));
 }
 
 static void sm501_dump_regs(struct sm501_devdata *sm)
@@ -436,46 +418,108 @@ struct sm501_clock {
         unsigned long mclk;
         int divider;
         int shift;
+        unsigned int m, n, k;
 };
 
+/* sm501_calc_clock
+ *
+ * Calculates the nearest discrete clock frequency that
+ * can be achieved with the specified input clock.
+ *   the maximum divisor is 3 or 5
+ */
+
+static int sm501_calc_clock(unsigned long freq,
+                            struct sm501_clock *clock,
+                            int max_div,
+                            unsigned long mclk,
+                            long *best_diff)
+{
+        int ret = 0;
+        int divider;
+        int shift;
+        long diff;
+
+        /* try dividers 1 and 3 for CRT and for panel,
+           try divider 5 for panel only.*/
+
+        for (divider = 1; divider <= max_div; divider += 2) {
+                /* try all 8 shift values.*/
+                for (shift = 0; shift < 8; shift++) {
+                        /* Calculate difference to requested clock */
+                        diff = sm501fb_round_div(mclk, divider << shift) - freq;
+                        if (diff < 0)
+                                diff = -diff;
+
+                        /* If it is less than the current, use it */
+                        if (diff < *best_diff) {
+                                *best_diff = diff;
+
+                                clock->mclk = mclk;
+                                clock->divider = divider;
+                                clock->shift = shift;
+                                ret = 1;
+                        }
+                }
+        }
+
+        return ret;
+}
+
+/* sm501_calc_pll
+ *
+ * Calculates the nearest discrete clock frequency that can be
+ * achieved using the programmable PLL.
+ *   the maximum divisor is 3 or 5
+ */
+
+static unsigned long sm501_calc_pll(unsigned long freq,
+                                        struct sm501_clock *clock,
+                                        int max_div)
+{
+        unsigned long mclk;
+        unsigned int m, n, k;
+        long best_diff = 999999999;
+
+        /*
+         * The SM502 datasheet doesn't specify the min/max values for M and N.
+         * N = 1 at least doesn't work in practice.
+         */
+        for (m = 2; m <= 255; m++) {
+                for (n = 2; n <= 127; n++) {
+                        for (k = 0; k <= 1; k++) {
+                                mclk = (24000000UL * m / n) >> k;
+
+                                if (sm501_calc_clock(freq, clock, max_div,
+                                                     mclk, &best_diff)) {
+                                        clock->m = m;
+                                        clock->n = n;
+                                        clock->k = k;
+                                }
+                        }
+                }
+        }
+
+        /* Return best clock. */
+        return clock->mclk / (clock->divider << clock->shift);
+}
+
 /* sm501_select_clock
  *
- * selects nearest discrete clock frequency the SM501 can achive
+ * Calculates the nearest discrete clock frequency that can be
+ * achieved using the 288MHz and 336MHz PLLs.
  *   the maximum divisor is 3 or 5
  */
+
 static unsigned long sm501_select_clock(unsigned long freq,
                                         struct sm501_clock *clock,
                                         int max_div)
 {
         unsigned long mclk;
-        int divider;
-        int shift;
-        long diff;
         long best_diff = 999999999;
 
         /* Try 288MHz and 336MHz clocks. */
         for (mclk = 288000000; mclk <= 336000000; mclk += 48000000) {
-                /* try dividers 1 and 3 for CRT and for panel,
-                   try divider 5 for panel only.*/
-
-                for (divider = 1; divider <= max_div; divider += 2) {
-                        /* try all 8 shift values.*/
-                        for (shift = 0; shift < 8; shift++) {
-                                /* Calculate difference to requested clock */
-                                diff = sm501fb_round_div(mclk, divider << shift) - freq;
-                                if (diff < 0)
-                                        diff = -diff;
-
-                                /* If it is less than the current, use it */
-                                if (diff < best_diff) {
-                                        best_diff = diff;
-
-                                        clock->mclk = mclk;
-                                        clock->divider = divider;
-                                        clock->shift = shift;
-                                }
-                        }
-                }
+                sm501_calc_clock(freq, clock, max_div, mclk, &best_diff);
         }
 
         /* Return best clock. */
@@ -497,6 +541,7 @@ unsigned long sm501_set_clock(struct device *dev,
         unsigned long gate = readl(sm->regs + SM501_CURRENT_GATE);
         unsigned long clock = readl(sm->regs + SM501_CURRENT_CLOCK);
         unsigned char reg;
+        unsigned int pll_reg = 0;
         unsigned long sm501_freq; /* the actual frequency acheived */
 
         struct sm501_clock to;
@@ -511,14 +556,28 @@ unsigned long sm501_set_clock(struct device *dev,
                  * requested frequency the value must be multiplied by
                  * 2. This clock also has an additional pre divisor */
 
-                sm501_freq = (sm501_select_clock(2 * req_freq, &to, 5) / 2);
-                reg=to.shift & 0x07;/* bottom 3 bits are shift */
-                if (to.divider == 3)
-                        reg |= 0x08; /* /3 divider required */
-                else if (to.divider == 5)
-                        reg |= 0x10; /* /5 divider required */
-                if (to.mclk != 288000000)
-                        reg |= 0x20; /* which mclk pll is source */
+                if (sm->rev >= 0xC0) {
+                        /* SM502 -> use the programmable PLL */
+                        sm501_freq = (sm501_calc_pll(2 * req_freq,
+                                                     &to, 5) / 2);
+                        reg = to.shift & 0x07;/* bottom 3 bits are shift */
+                        if (to.divider == 3)
+                                reg |= 0x08; /* /3 divider required */
+                        else if (to.divider == 5)
+                                reg |= 0x10; /* /5 divider required */
+                        reg |= 0x40; /* select the programmable PLL */
+                        pll_reg = 0x20000 | (to.k << 15) | (to.n << 8) | to.m;
+                } else {
+                        sm501_freq = (sm501_select_clock(2 * req_freq,
+                                                         &to, 5) / 2);
+                        reg = to.shift & 0x07;/* bottom 3 bits are shift */
+                        if (to.divider == 3)
+                                reg |= 0x08; /* /3 divider required */
+                        else if (to.divider == 5)
+                                reg |= 0x10; /* /5 divider required */
+                        if (to.mclk != 288000000)
+                                reg |= 0x20; /* which mclk pll is source */
+                }
                 break;
 
         case SM501_CLOCK_V2XCLK:
@@ -579,6 +638,10 @@ unsigned long sm501_set_clock(struct device *dev,
         }
 
         writel(mode, sm->regs + SM501_POWER_MODE_CONTROL);
+
+        if (pll_reg)
+                writel(pll_reg, sm->regs + SM501_PROGRAMMABLE_PLL_CONTROL);
+
         sm501_sync_regs(sm);
 
         dev_info(sm->dev, "gate %08lx, clock %08lx, mode %08lx\n",
@@ -599,15 +662,24 @@ EXPORT_SYMBOL_GPL(sm501_set_clock);
  * finds the closest available frequency for a given clock
 */
 
-unsigned long sm501_find_clock(int clksrc,
+unsigned long sm501_find_clock(struct device *dev,
+                               int clksrc,
                                unsigned long req_freq)
 {
+        struct sm501_devdata *sm = dev_get_drvdata(dev);
         unsigned long sm501_freq; /* the frequency achiveable by the 501 */
         struct sm501_clock to;
 
         switch (clksrc) {
         case SM501_CLOCK_P2XCLK:
-                sm501_freq = (sm501_select_clock(2 * req_freq, &to, 5) / 2);
+                if (sm->rev >= 0xC0) {
+                        /* SM502 -> use the programmable PLL */
+                        sm501_freq = (sm501_calc_pll(2 * req_freq,
+                                                     &to, 5) / 2);
+                } else {
+                        sm501_freq = (sm501_select_clock(2 * req_freq,
+                                                         &to, 5) / 2);
+                }
                 break;
 
         case SM501_CLOCK_V2XCLK:
@@ -914,6 +986,8 @@ static int sm501_init_dev(struct sm501_devdata *sm)
         dev_info(sm->dev, "SM501 At %p: Version %08lx, %ld Mb, IRQ %d\n",
                  sm->regs, devid, (unsigned long)mem_avail >> 20, sm->irq);
 
+        sm->rev = devid & SM501_DEVICEID_REVMASK;
+
         sm501_dump_gate(sm);
 
         ret = device_create_file(sm->dev, &dev_attr_dbg_regs);
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index bb269d0c677e..6cb781262f94 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -1078,7 +1078,8 @@ static int hotkey_get_tablet_mode(int *status)
         if (!acpi_evalf(hkey_handle, &s, "MHKG", "d"))
                 return -EIO;
 
-        return ((s & TP_HOTKEY_TABLET_MASK) != 0);
+        *status = ((s & TP_HOTKEY_TABLET_MASK) != 0);
+        return 0;
 }
 
 /*
diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c
index 63a089b29545..67503ea71d21 100644
--- a/drivers/misc/tifm_7xx1.c
+++ b/drivers/misc/tifm_7xx1.c
@@ -368,6 +368,8 @@ static int tifm_7xx1_probe(struct pci_dev *dev,
                 goto err_out_irq;
 
         writel(TIFM_IRQ_ENABLE | TIFM_IRQ_SOCKMASK((1 << fm->num_sockets) - 1),
+               fm->addr + FM_CLEAR_INTERRUPT_ENABLE);
+        writel(TIFM_IRQ_ENABLE | TIFM_IRQ_SOCKMASK((1 << fm->num_sockets) - 1),
                fm->addr + FM_SET_INTERRUPT_ENABLE);
         return 0;
 
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 6ac81e35355c..275960462970 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1000,8 +1000,8 @@ static int __init ubi_init(void)
                 mutex_unlock(&ubi_devices_mutex);
                 if (err < 0) {
                         put_mtd_device(mtd);
-                        printk(KERN_ERR "UBI error: cannot attach %s\n",
-                               p->name);
+                        printk(KERN_ERR "UBI error: cannot attach mtd%d\n",
+                               mtd->index);
                         goto out_detach;
                 }
         }
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 457710615261..a548c1d28fa8 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -217,11 +217,11 @@ struct ubi_volume {
         void *upd_buf;
 
         int *eba_tbl;
-        int checked:1;
-        int corrupted:1;
-        int upd_marker:1;
-        int updating:1;
-        int changing_leb:1;
+        unsigned int checked:1;
+        unsigned int corrupted:1;
+        unsigned int upd_marker:1;
+        unsigned int updating:1;
+        unsigned int changing_leb:1;
 
 #ifdef CONFIG_MTD_UBI_GLUEBI
         /*
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index a3ca2257e601..5be58d85c639 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -376,7 +376,9 @@ out_sysfs:
         get_device(&vol->dev);
         volume_sysfs_close(vol);
 out_gluebi:
-        ubi_destroy_gluebi(vol);
+        if (ubi_destroy_gluebi(vol))
+                dbg_err("cannot destroy gluebi for volume %d:%d",
+                        ubi->ubi_num, vol_id);
 out_cdev:
         cdev_del(&vol->cdev);
 out_mapping:
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 56fc3fbce838..af36b12be278 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -519,6 +519,7 @@ static int init_volumes(struct ubi_device *ubi, const struct ubi_scan_info *si,
                         if (ubi->autoresize_vol_id != -1) {
                                 ubi_err("more then one auto-resize volume (%d "
                                         "and %d)", ubi->autoresize_vol_id, i);
+                                kfree(vol);
                                 return -EINVAL;
                         }
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index f337800076c0..fe7b5ec09708 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -90,6 +90,11 @@ config MACVLAN
           This allows one to create virtual interfaces that map packets to
           or from specific MAC addresses to a particular interface.
 
+          Macvlan devices can be added using the "ip" command from the
+          iproute2 package starting with the iproute2-2.6.23 release:
+
+          "ip link add link <real dev> [ address MAC ] [ NAME ] type macvlan"
+
           To compile this driver as a module, choose M here: the module
           will be called macvlan.
 
@@ -2361,14 +2366,15 @@ config GELIC_NET
           module will be called ps3_gelic.
 
 config GELIC_WIRELESS
-       bool "PS3 Wireless support"
-       depends on GELIC_NET
-       help
-        This option adds the support for the wireless feature of PS3.
-        If you have the wireless-less model of PS3 or have no plan to
-        use wireless feature, disabling this option saves memory.  As
-        the driver automatically distinguishes the models, you can
-        safely enable this option even if you have a wireless-less model.
+        bool "PS3 Wireless support"
+        depends on GELIC_NET
+        select WIRELESS_EXT
+        help
+          This option adds the support for the wireless feature of PS3.
+          If you have the wireless-less model of PS3 or have no plan to
+          use wireless feature, disabling this option saves memory.  As
+          the driver automatically distinguishes the models, you can
+          safely enable this option even if you have a wireless-less model.
 
 config GIANFAR
         tristate "Gianfar Ethernet"
@@ -2513,7 +2519,7 @@ config CHELSIO_T3
 
 config EHEA
         tristate "eHEA Ethernet support"
-        depends on IBMEBUS && INET
+        depends on IBMEBUS && INET && SPARSEMEM
         select INET_LRO
         ---help---
           This driver supports the IBM pSeries eHEA ethernet adapter.
diff --git a/drivers/net/ac3200.c b/drivers/net/ac3200.c
index 5136d94923aa..b1448637107f 100644
--- a/drivers/net/ac3200.c
+++ b/drivers/net/ac3200.c
@@ -369,7 +369,7 @@ MODULE_PARM_DESC(mem, "Memory base address(es)");
 MODULE_DESCRIPTION("Ansel AC3200 EISA ethernet driver");
 MODULE_LICENSE("GPL");
 
-int __init init_module(void)
+static int __init ac3200_module_init(void)
 {
         struct net_device *dev;
         int this_dev, found = 0;
@@ -404,8 +404,7 @@ static void cleanup_card(struct net_device *dev)
         iounmap(ei_status.mem);
 }
 
-void __exit
-cleanup_module(void)
+static void __exit ac3200_module_exit(void)
 {
         int this_dev;
 
@@ -418,4 +417,6 @@ cleanup_module(void)
                 }
         }
 }
+module_init(ac3200_module_init);
+module_exit(ac3200_module_exit);
 #endif /* MODULE */
diff --git a/drivers/net/apne.c b/drivers/net/apne.c
index c12cbdf368b1..47a8275d3962 100644
--- a/drivers/net/apne.c
+++ b/drivers/net/apne.c
@@ -569,7 +569,7 @@ static irqreturn_t apne_interrupt(int irq, void *dev_id)
 #ifdef MODULE
 static struct net_device *apne_dev;
 
-int __init init_module(void)
+static int __init apne_module_init(void)
 {
         apne_dev = apne_probe(-1);
         if (IS_ERR(apne_dev))
@@ -577,7 +577,7 @@ int __init init_module(void)
         return 0;
 }
 
-void __exit cleanup_module(void)
+static void __exit apne_module_exit(void)
 {
         unregister_netdev(apne_dev);
 
@@ -591,7 +591,8 @@ void __exit cleanup_module(void)
 
         free_netdev(apne_dev);
 }
-
+module_init(apne_module_init);
+module_exit(apne_module_exit);
 #endif
 
 static int init_pcmcia(void)
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index 6ab2c2d4d673..fef5560bc7a2 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -1252,7 +1252,7 @@ module_param(irq, int, 0);
 module_param(dma, int, 0);
 
 
-int __init init_module(void)
+static int __init ltpc_module_init(void)
 {
         if(io == 0)
                 printk(KERN_NOTICE
@@ -1263,6 +1263,7 @@ int __init init_module(void)
                 return PTR_ERR(dev_ltpc);
         return 0;
 }
+module_init(ltpc_module_init);
 #endif
 
 static void __exit ltpc_cleanup(void)
diff --git a/drivers/net/arcnet/capmode.c b/drivers/net/arcnet/capmode.c
index cc4610db6395..02cb8f1c1148 100644
--- a/drivers/net/arcnet/capmode.c
+++ b/drivers/net/arcnet/capmode.c
@@ -80,17 +80,19 @@ void arcnet_cap_init(void)
 
 #ifdef MODULE
 
-int __init init_module(void)
+static int __init capmode_module_init(void)
 {
         printk(VERSION);
         arcnet_cap_init();
         return 0;
 }
 
-void cleanup_module(void)
+static void __exit capmode_module_exit(void)
 {
         arcnet_unregister_proto(&capmode_proto);
 }
+module_init(capmode_module_init);
+module_exit(capmode_module_exit);
 
 MODULE_LICENSE("GPL");
 #endif                          /* MODULE */
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index b74dbeef8050..13c293b286de 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -336,8 +336,6 @@ struct lance_addr {
 
 /***************************** Prototypes *****************************/
 
-static int addr_accessible( volatile void *regp, int wordflag, int
-                            writeflag );
 static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
                                    *init_rec );
 static int lance_open( struct net_device *dev );
@@ -406,7 +404,8 @@ struct net_device * __init atarilance_probe(int unit)
 
 /* Derived from hwreg_present() in atari/config.c: */
 
-static int __init addr_accessible( volatile void *regp, int wordflag, int writeflag )
+static noinline int __init addr_accessible(volatile void *regp, int wordflag,
+                                           int writeflag)
 {
         int             ret;
         long    flags;
diff --git a/drivers/net/bnx2x.c b/drivers/net/bnx2x.c
index afc7f34b1dcf..8af142ccf373 100644
--- a/drivers/net/bnx2x.c
+++ b/drivers/net/bnx2x.c
@@ -1,6 +1,6 @@
 /* bnx2x.c: Broadcom Everest network driver.
  *
- * Copyright (c) 2007 Broadcom Corporation
+ * Copyright (c) 2007-2008 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -10,13 +10,13 @@
  * Based on code from Michael Chan's bnx2 driver
  * UDP CSUM errata workaround by Arik Gendelman
  * Slowpath rework by Vladislav Zolotarov
- * Statistics and Link managment by Yitchak Gertner
+ * Statistics and Link management by Yitchak Gertner
  *
  */
 
 /* define this to make the driver freeze on error
  * to allow getting debug info
- * (you will need to reboot afterwords)
+ * (you will need to reboot afterwards)
  */
 /*#define BNX2X_STOP_ON_ERROR*/
 
@@ -63,22 +63,21 @@
 #include "bnx2x.h"
 #include "bnx2x_init.h"
 
-#define DRV_MODULE_VERSION      "0.40.15"
-#define DRV_MODULE_RELDATE      "$DateTime: 2007/11/15 07:28:37 $"
-#define BNX2X_BC_VER            0x040009
+#define DRV_MODULE_VERSION      "1.40.22"
+#define DRV_MODULE_RELDATE      "2007/11/27"
+#define BNX2X_BC_VER            0x040200
 
 /* Time in jiffies before concluding the transmitter is hung. */
 #define TX_TIMEOUT              (5*HZ)
 
 static char version[] __devinitdata =
-        "Broadcom NetXtreme II 577xx 10Gigabit Ethernet Driver "
+        "Broadcom NetXtreme II 5771X 10Gigabit Ethernet Driver "
         DRV_MODULE_NAME " " DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
 
 MODULE_AUTHOR("Eliezer Tamir <eliezert@broadcom.com>");
 MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710 Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
-MODULE_INFO(cvs_version, "$Revision: #356 $");
 
 static int use_inta;
 static int poll;
@@ -94,8 +93,8 @@ module_param(debug, int, 0);
 MODULE_PARM_DESC(use_inta, "use INT#A instead of MSI-X");
 MODULE_PARM_DESC(poll, "use polling (for debug)");
 MODULE_PARM_DESC(onefunc, "enable only first function");
-MODULE_PARM_DESC(nomcp, "ignore managment CPU (Implies onefunc)");
-MODULE_PARM_DESC(debug, "defualt debug msglevel");
+MODULE_PARM_DESC(nomcp, "ignore management CPU (Implies onefunc)");
+MODULE_PARM_DESC(debug, "default debug msglevel");
 
 #ifdef BNX2X_MULTI
 module_param(use_multi, int, 0);
@@ -298,8 +297,7 @@ static void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
 
 static int bnx2x_mc_assert(struct bnx2x *bp)
 {
-        int i, j;
-        int rc = 0;
+        int i, j, rc = 0;
         char last_idx;
         const char storm[] = {"XTCU"};
         const u32 intmem_base[] = {
@@ -313,8 +311,9 @@ static int bnx2x_mc_assert(struct bnx2x *bp)
         for (i = 0; i < 4; i++) {
                 last_idx = REG_RD8(bp, XSTORM_ASSERT_LIST_INDEX_OFFSET +
                                    intmem_base[i]);
-                BNX2X_ERR("DATA %cSTORM_ASSERT_LIST_INDEX 0x%x\n",
-                          storm[i], last_idx);
+                if (last_idx)
+                        BNX2X_LOG("DATA %cSTORM_ASSERT_LIST_INDEX 0x%x\n",
+                                  storm[i], last_idx);
 
                 /* print the asserts */
                 for (j = 0; j < STROM_ASSERT_ARRAY_SIZE; j++) {
@@ -330,7 +329,7 @@ static int bnx2x_mc_assert(struct bnx2x *bp)
                                       intmem_base[i]);
 
                         if (row0 != COMMON_ASM_INVALID_ASSERT_OPCODE) {
-                                BNX2X_ERR("DATA %cSTORM_ASSERT_INDEX 0x%x ="
+                                BNX2X_LOG("DATA %cSTORM_ASSERT_INDEX 0x%x ="
                                           " 0x%08x 0x%08x 0x%08x 0x%08x\n",
                                           storm[i], j, row3, row2, row1, row0);
                                 rc++;
@@ -341,6 +340,7 @@ static int bnx2x_mc_assert(struct bnx2x *bp)
         }
         return rc;
 }
+
 static void bnx2x_fw_dump(struct bnx2x *bp)
 {
         u32 mark, offset;
@@ -348,21 +348,22 @@ static void bnx2x_fw_dump(struct bnx2x *bp)
         int word;
 
         mark = REG_RD(bp, MCP_REG_MCPR_SCRATCH + 0xf104);
-        printk(KERN_ERR PFX "begin fw dump (mark 0x%x)\n", mark);
+        mark = ((mark + 0x3) & ~0x3);
+        printk(KERN_ERR PFX "begin fw dump (mark 0x%x)\n" KERN_ERR, mark);
 
         for (offset = mark - 0x08000000; offset <= 0xF900; offset += 0x8*4) {
                 for (word = 0; word < 8; word++)
                         data[word] = htonl(REG_RD(bp, MCP_REG_MCPR_SCRATCH +
                                                   offset + 4*word));
                 data[8] = 0x0;
-                printk(KERN_ERR PFX "%s", (char *)data);
+                printk(KERN_CONT "%s", (char *)data);
         }
         for (offset = 0xF108; offset <= mark - 0x08000000; offset += 0x8*4) {
                 for (word = 0; word < 8; word++)
                         data[word] = htonl(REG_RD(bp, MCP_REG_MCPR_SCRATCH +
                                                   offset + 4*word));
                 data[8] = 0x0;
-                printk(KERN_ERR PFX "%s", (char *)data);
+                printk(KERN_CONT "%s", (char *)data);
         }
         printk("\n" KERN_ERR PFX "end of fw dump\n");
 }
@@ -427,10 +428,10 @@ static void bnx2x_panic_dump(struct bnx2x *bp)
                 }
         }
 
-        BNX2X_ERR("def_c_idx(%u)  def_u_idx(%u)  def_t_idx(%u)"
-                  "  def_x_idx(%u)  def_att_idx(%u)  attn_state(%u)"
+        BNX2X_ERR("def_c_idx(%u)  def_u_idx(%u)  def_x_idx(%u)"
+                  "  def_t_idx(%u)  def_att_idx(%u)  attn_state(%u)"
                   "  spq_prod_idx(%u)\n",
-                  bp->def_c_idx, bp->def_u_idx, bp->def_t_idx, bp->def_x_idx,
+                  bp->def_c_idx, bp->def_u_idx, bp->def_x_idx, bp->def_t_idx,
                   bp->def_att_idx, bp->attn_state, bp->spq_prod_idx);
 
 
@@ -441,7 +442,7 @@ static void bnx2x_panic_dump(struct bnx2x *bp)
         DP(BNX2X_MSG_STATS, "stats_state - DISABLE\n");
 }
 
-static void bnx2x_enable_int(struct bnx2x *bp)
+static void bnx2x_int_enable(struct bnx2x *bp)
 {
         int port = bp->port;
         u32 addr = port ? HC_REG_CONFIG_1 : HC_REG_CONFIG_0;
@@ -454,18 +455,26 @@ static void bnx2x_enable_int(struct bnx2x *bp)
                         HC_CONFIG_0_REG_ATTN_BIT_EN_0);
         } else {
                 val |= (HC_CONFIG_0_REG_SINGLE_ISR_EN_0 |
+                        HC_CONFIG_0_REG_MSI_MSIX_INT_EN_0 |
                         HC_CONFIG_0_REG_INT_LINE_EN_0 |
                         HC_CONFIG_0_REG_ATTN_BIT_EN_0);
+
+                /* Errata A0.158 workaround */
+                DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)  MSI-X %d\n",
+                   val, port, addr, msix);
+
+                REG_WR(bp, addr, val);
+
                 val &= ~HC_CONFIG_0_REG_MSI_MSIX_INT_EN_0;
         }
 
-        DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)  msi %d\n",
+        DP(NETIF_MSG_INTR, "write %x to HC %d (addr 0x%x)  MSI-X %d\n",
            val, port, addr, msix);
 
         REG_WR(bp, addr, val);
 }
 
-static void bnx2x_disable_int(struct bnx2x *bp)
+static void bnx2x_int_disable(struct bnx2x *bp)
 {
         int port = bp->port;
         u32 addr = port ? HC_REG_CONFIG_1 : HC_REG_CONFIG_0;
@@ -484,15 +493,15 @@ static void bnx2x_disable_int(struct bnx2x *bp)
                 BNX2X_ERR("BUG! proper val not read from IGU!\n");
 }
 
-static void bnx2x_disable_int_sync(struct bnx2x *bp)
+static void bnx2x_int_disable_sync(struct bnx2x *bp)
 {
 
         int msix = (bp->flags & USING_MSIX_FLAG) ? 1 : 0;
         int i;
 
         atomic_inc(&bp->intr_sem);
-        /* prevent the HW from sending interrupts*/
-        bnx2x_disable_int(bp);
+        /* prevent the HW from sending interrupts */
+        bnx2x_int_disable(bp);
 
         /* make sure all ISRs are done */
         if (msix) {
@@ -775,6 +784,7 @@ static void bnx2x_sp_event(struct bnx2x_fastpath *fp,
                 mb(); /* force bnx2x_wait_ramrod to see the change */
                 return;
         }
+
         switch (command | bp->state) {
         case (RAMROD_CMD_ID_ETH_PORT_SETUP | BNX2X_STATE_OPENING_WAIT4_PORT):
                 DP(NETIF_MSG_IFUP, "got setup ramrod\n");
@@ -787,20 +797,20 @@ static void bnx2x_sp_event(struct bnx2x_fastpath *fp,
                 fp->state = BNX2X_FP_STATE_HALTED;
                 break;
 
-        case (RAMROD_CMD_ID_ETH_PORT_DEL | BNX2X_STATE_CLOSING_WAIT4_DELETE):
-                DP(NETIF_MSG_IFDOWN, "got delete ramrod\n");
-                bp->state = BNX2X_STATE_CLOSING_WAIT4_UNLOAD;
-                break;
-
         case (RAMROD_CMD_ID_ETH_CFC_DEL | BNX2X_STATE_CLOSING_WAIT4_HALT):
-                DP(NETIF_MSG_IFDOWN, "got delete ramrod for MULTI[%d]\n", cid);
-                bnx2x_fp(bp, cid, state) = BNX2X_FP_STATE_DELETED;
+                DP(NETIF_MSG_IFDOWN, "got delete ramrod for MULTI[%d]\n",
+                   cid);
+                bnx2x_fp(bp, cid, state) = BNX2X_FP_STATE_CLOSED;
                 break;
 
         case (RAMROD_CMD_ID_ETH_SET_MAC | BNX2X_STATE_OPEN):
                 DP(NETIF_MSG_IFUP, "got set mac ramrod\n");
                 break;
 
+        case (RAMROD_CMD_ID_ETH_SET_MAC | BNX2X_STATE_CLOSING_WAIT4_HALT):
+                DP(NETIF_MSG_IFUP, "got (un)set mac ramrod\n");
+                break;
+
         default:
                 BNX2X_ERR("unexpected ramrod (%d)  state is %x\n",
                           command, bp->state);
@@ -1179,12 +1189,175 @@ static u32 bnx2x_bits_dis(struct bnx2x *bp, u32 reg, u32 bits)
         return val;
 }
 
+static int bnx2x_hw_lock(struct bnx2x *bp, u32 resource)
+{
+        u32 cnt;
+        u32 lock_status;
+        u32 resource_bit = (1 << resource);
+        u8 func = bp->port;
+
+        /* Validating that the resource is within range */
+        if (resource > HW_LOCK_MAX_RESOURCE_VALUE) {
+                DP(NETIF_MSG_HW,
+                   "resource(0x%x) > HW_LOCK_MAX_RESOURCE_VALUE(0x%x)\n",
+                   resource, HW_LOCK_MAX_RESOURCE_VALUE);
+                return -EINVAL;
+        }
+
+        /* Validating that the resource is not already taken */
+        lock_status = REG_RD(bp, MISC_REG_DRIVER_CONTROL_1 + func*8);
+        if (lock_status & resource_bit) {
+                DP(NETIF_MSG_HW, "lock_status 0x%x  resource_bit 0x%x\n",
+                   lock_status, resource_bit);
+                return -EEXIST;
+        }
+
+        /* Try for 1 second every 5ms */
+        for (cnt = 0; cnt < 200; cnt++) {
+                /* Try to acquire the lock */
+                REG_WR(bp, MISC_REG_DRIVER_CONTROL_1 + func*8 + 4,
+                       resource_bit);
+                lock_status = REG_RD(bp, MISC_REG_DRIVER_CONTROL_1 + func*8);
+                if (lock_status & resource_bit)
+                        return 0;
+
+                msleep(5);
+        }
+        DP(NETIF_MSG_HW, "Timeout\n");
+        return -EAGAIN;
+}
+
+static int bnx2x_hw_unlock(struct bnx2x *bp, u32 resource)
+{
+        u32 lock_status;
+        u32 resource_bit = (1 << resource);
+        u8 func = bp->port;
+
+        /* Validating that the resource is within range */
+        if (resource > HW_LOCK_MAX_RESOURCE_VALUE) {
+                DP(NETIF_MSG_HW,
+                   "resource(0x%x) > HW_LOCK_MAX_RESOURCE_VALUE(0x%x)\n",
+                   resource, HW_LOCK_MAX_RESOURCE_VALUE);
+                return -EINVAL;
+        }
+
+        /* Validating that the resource is currently taken */
+        lock_status = REG_RD(bp, MISC_REG_DRIVER_CONTROL_1 + func*8);
+        if (!(lock_status & resource_bit)) {
+                DP(NETIF_MSG_HW, "lock_status 0x%x  resource_bit 0x%x\n",
+                   lock_status, resource_bit);
+                return -EFAULT;
+        }
+
+        REG_WR(bp, MISC_REG_DRIVER_CONTROL_1 + func*8, resource_bit);
+        return 0;
+}
+
+static int bnx2x_set_gpio(struct bnx2x *bp, int gpio_num, u32 mode)
+{
+        /* The GPIO should be swapped if swap register is set and active */
+        int gpio_port = (REG_RD(bp, NIG_REG_PORT_SWAP) &&
+                         REG_RD(bp, NIG_REG_STRAP_OVERRIDE)) ^ bp->port;
+        int gpio_shift = gpio_num +
+                        (gpio_port ? MISC_REGISTERS_GPIO_PORT_SHIFT : 0);
+        u32 gpio_mask = (1 << gpio_shift);
+        u32 gpio_reg;
+
+        if (gpio_num > MISC_REGISTERS_GPIO_3) {
+                BNX2X_ERR("Invalid GPIO %d\n", gpio_num);
+                return -EINVAL;
+        }
+
+        bnx2x_hw_lock(bp, HW_LOCK_RESOURCE_GPIO);
+        /* read GPIO and mask except the float bits */
+        gpio_reg = (REG_RD(bp, MISC_REG_GPIO) & MISC_REGISTERS_GPIO_FLOAT);
+
+        switch (mode) {
+        case MISC_REGISTERS_GPIO_OUTPUT_LOW:
+                DP(NETIF_MSG_LINK, "Set GPIO %d (shift %d) -> output low\n",
+                   gpio_num, gpio_shift);
+                /* clear FLOAT and set CLR */
+                gpio_reg &= ~(gpio_mask << MISC_REGISTERS_GPIO_FLOAT_POS);
+                gpio_reg |=  (gpio_mask << MISC_REGISTERS_GPIO_CLR_POS);
+                break;
+
+        case MISC_REGISTERS_GPIO_OUTPUT_HIGH:
+                DP(NETIF_MSG_LINK, "Set GPIO %d (shift %d) -> output high\n",
+                   gpio_num, gpio_shift);
+                /* clear FLOAT and set SET */
+                gpio_reg &= ~(gpio_mask << MISC_REGISTERS_GPIO_FLOAT_POS);
+                gpio_reg |=  (gpio_mask << MISC_REGISTERS_GPIO_SET_POS);
+                break;
+
+        case MISC_REGISTERS_GPIO_INPUT_HI_Z :
+                DP(NETIF_MSG_LINK, "Set GPIO %d (shift %d) -> input\n",
+                   gpio_num, gpio_shift);
+                /* set FLOAT */
+                gpio_reg |= (gpio_mask << MISC_REGISTERS_GPIO_FLOAT_POS);
+                break;
+
+        default:
+                break;
+        }
+
+        REG_WR(bp, MISC_REG_GPIO, gpio_reg);
+        bnx2x_hw_unlock(bp, HW_LOCK_RESOURCE_GPIO);
+
+        return 0;
+}
+
+static int bnx2x_set_spio(struct bnx2x *bp, int spio_num, u32 mode)
+{
+        u32 spio_mask = (1 << spio_num);
+        u32 spio_reg;
+
+        if ((spio_num < MISC_REGISTERS_SPIO_4) ||
+            (spio_num > MISC_REGISTERS_SPIO_7)) {
+                BNX2X_ERR("Invalid SPIO %d\n", spio_num);
+                return -EINVAL;
+        }
+
+        bnx2x_hw_lock(bp, HW_LOCK_RESOURCE_SPIO);
+        /* read SPIO and mask except the float bits */
+        spio_reg = (REG_RD(bp, MISC_REG_SPIO) & MISC_REGISTERS_SPIO_FLOAT);
+
+        switch (mode) {
+        case MISC_REGISTERS_SPIO_OUTPUT_LOW :
+                DP(NETIF_MSG_LINK, "Set SPIO %d -> output low\n", spio_num);
+                /* clear FLOAT and set CLR */
+                spio_reg &= ~(spio_mask << MISC_REGISTERS_SPIO_FLOAT_POS);
+                spio_reg |=  (spio_mask << MISC_REGISTERS_SPIO_CLR_POS);
+                break;
+
+        case MISC_REGISTERS_SPIO_OUTPUT_HIGH :
+                DP(NETIF_MSG_LINK, "Set SPIO %d -> output high\n", spio_num);
+                /* clear FLOAT and set SET */
+                spio_reg &= ~(spio_mask << MISC_REGISTERS_SPIO_FLOAT_POS);
+                spio_reg |=  (spio_mask << MISC_REGISTERS_SPIO_SET_POS);
+                break;
+
+        case MISC_REGISTERS_SPIO_INPUT_HI_Z:
+                DP(NETIF_MSG_LINK, "Set SPIO %d -> input\n", spio_num);
+                /* set FLOAT */
+                spio_reg |= (spio_mask << MISC_REGISTERS_SPIO_FLOAT_POS);
+                break;
+
+        default:
+                break;
+        }
+
+        REG_WR(bp, MISC_REG_SPIO, spio_reg);
+        bnx2x_hw_unlock(bp, HW_LOCK_RESOURCE_SPIO);
+
+        return 0;
+}
+
 static int bnx2x_mdio22_write(struct bnx2x *bp, u32 reg, u32 val)
 {
-        int rc;
-        u32 tmp, i;
         int port = bp->port;
         u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+        u32 tmp;
+        int i, rc;
 
 /*      DP(NETIF_MSG_HW, "phy_addr 0x%x  reg 0x%x  val 0x%08x\n",
            bp->phy_addr, reg, val); */
@@ -1236,8 +1409,8 @@ static int bnx2x_mdio22_read(struct bnx2x *bp, u32 reg, u32 *ret_val)
 {
         int port = bp->port;
         u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
-        u32 val, i;
-        int rc;
+        u32 val;
+        int i, rc;
 
         if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG) {
 
@@ -1286,58 +1459,54 @@ static int bnx2x_mdio22_read(struct bnx2x *bp, u32 reg, u32 *ret_val)
         return rc;
 }
 
-static int bnx2x_mdio45_write(struct bnx2x *bp, u32 reg, u32 addr, u32 val)
+static int bnx2x_mdio45_ctrl_write(struct bnx2x *bp, u32 mdio_ctrl,
+                                   u32 phy_addr, u32 reg, u32 addr, u32 val)
 {
-        int rc = 0;
-        u32 tmp, i;
-        int port = bp->port;
-        u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
-
-        if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG) {
-
-                tmp = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-                tmp &= ~EMAC_MDIO_MODE_AUTO_POLL;
-                EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, tmp);
-                REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-                udelay(40);
-        }
+        u32 tmp;
+        int i, rc = 0;
 
-        /* set clause 45 mode */
-        tmp = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-        tmp |= EMAC_MDIO_MODE_CLAUSE_45;
-        EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, tmp);
+        /* set clause 45 mode, slow down the MDIO clock to 2.5MHz
+         * (a value of 49==0x31) and make sure that the AUTO poll is off
+         */
+        tmp = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        tmp &= ~(EMAC_MDIO_MODE_AUTO_POLL | EMAC_MDIO_MODE_CLOCK_CNT);
+        tmp |= (EMAC_MDIO_MODE_CLAUSE_45 |
+                (49 << EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT));
+        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, tmp);
+        REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        udelay(40);
 
         /* address */
-        tmp = ((bp->phy_addr << 21) | (reg << 16) | addr |
+        tmp = ((phy_addr << 21) | (reg << 16) | addr |
                EMAC_MDIO_COMM_COMMAND_ADDRESS |
                EMAC_MDIO_COMM_START_BUSY);
-        EMAC_WR(EMAC_REG_EMAC_MDIO_COMM, tmp);
+        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, tmp);
 
         for (i = 0; i < 50; i++) {
                 udelay(10);
 
-                tmp = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM);
+                tmp = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
                 if (!(tmp & EMAC_MDIO_COMM_START_BUSY)) {
                         udelay(5);
                         break;
                 }
         }
-
         if (tmp & EMAC_MDIO_COMM_START_BUSY) {
                 BNX2X_ERR("write phy register failed\n");
 
                 rc = -EBUSY;
+
         } else {
                 /* data */
-                tmp = ((bp->phy_addr << 21) | (reg << 16) | val |
+                tmp = ((phy_addr << 21) | (reg << 16) | val |
                        EMAC_MDIO_COMM_COMMAND_WRITE_45 |
                        EMAC_MDIO_COMM_START_BUSY);
-                EMAC_WR(EMAC_REG_EMAC_MDIO_COMM, tmp);
+                REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, tmp);
 
                 for (i = 0; i < 50; i++) {
                         udelay(10);
 
-                        tmp = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM);
+                        tmp = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
                         if (!(tmp & EMAC_MDIO_COMM_START_BUSY)) {
                                 udelay(5);
                                 break;
@@ -1351,75 +1520,78 @@ static int bnx2x_mdio45_write(struct bnx2x *bp, u32 reg, u32 addr, u32 val)
                 }
         }
 
-        /* unset clause 45 mode */
-        tmp = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-        tmp &= ~EMAC_MDIO_MODE_CLAUSE_45;
-        EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, tmp);
-
-        if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG) {
-
-                tmp = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
+        /* unset clause 45 mode, set the MDIO clock to a faster value
+         * (0x13 => 6.25Mhz) and restore the AUTO poll if needed
+         */
+        tmp = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        tmp &= ~(EMAC_MDIO_MODE_CLAUSE_45 | EMAC_MDIO_MODE_CLOCK_CNT);
+        tmp |= (0x13 << EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT);
+        if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG)
                 tmp |= EMAC_MDIO_MODE_AUTO_POLL;
-                EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, tmp);
-        }
+        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, tmp);
 
         return rc;
 }
 
-static int bnx2x_mdio45_read(struct bnx2x *bp, u32 reg, u32 addr,
-                             u32 *ret_val)
+static int bnx2x_mdio45_write(struct bnx2x *bp, u32 phy_addr, u32 reg,
+                              u32 addr, u32 val)
 {
-        int port = bp->port;
-        u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
-        u32 val, i;
-        int rc = 0;
+        u32 emac_base = bp->port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
 
-        if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG) {
+        return bnx2x_mdio45_ctrl_write(bp, emac_base, phy_addr,
+                                       reg, addr, val);
+}
 
-                val = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-                val &= ~EMAC_MDIO_MODE_AUTO_POLL;
-                EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, val);
-                REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-                udelay(40);
-        }
+static int bnx2x_mdio45_ctrl_read(struct bnx2x *bp, u32 mdio_ctrl,
+                                  u32 phy_addr, u32 reg, u32 addr,
+                                  u32 *ret_val)
+{
+        u32 val;
+        int i, rc = 0;
 
-        /* set clause 45 mode */
-        val = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-        val |= EMAC_MDIO_MODE_CLAUSE_45;
-        EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, val);
+        /* set clause 45 mode, slow down the MDIO clock to 2.5MHz
+         * (a value of 49==0x31) and make sure that the AUTO poll is off
+         */
+        val = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        val &= ~(EMAC_MDIO_MODE_AUTO_POLL | EMAC_MDIO_MODE_CLOCK_CNT);
+        val |= (EMAC_MDIO_MODE_CLAUSE_45 |
+                (49 << EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT));
+        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, val);
+        REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        udelay(40);
 
         /* address */
-        val = ((bp->phy_addr << 21) | (reg << 16) | addr |
+        val = ((phy_addr << 21) | (reg << 16) | addr |
                EMAC_MDIO_COMM_COMMAND_ADDRESS |
                EMAC_MDIO_COMM_START_BUSY);
-        EMAC_WR(EMAC_REG_EMAC_MDIO_COMM, val);
+        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, val);
 
         for (i = 0; i < 50; i++) {
                 udelay(10);
 
-                val = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM);
+                val = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
                 if (!(val & EMAC_MDIO_COMM_START_BUSY)) {
                         udelay(5);
                         break;
                 }
         }
-
         if (val & EMAC_MDIO_COMM_START_BUSY) {
                 BNX2X_ERR("read phy register failed\n");
 
                 *ret_val = 0;
                 rc = -EBUSY;
+
         } else {
                 /* data */
-                val = ((bp->phy_addr << 21) | (reg << 16) |
+                val = ((phy_addr << 21) | (reg << 16) |
                        EMAC_MDIO_COMM_COMMAND_READ_45 |
                        EMAC_MDIO_COMM_START_BUSY);
-                EMAC_WR(EMAC_REG_EMAC_MDIO_COMM, val);
+                REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM, val);
 
                 for (i = 0; i < 50; i++) {
                         udelay(10);
 
-                        val = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_COMM);
+                        val = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_COMM);
                         if (!(val & EMAC_MDIO_COMM_START_BUSY)) {
                                 val &= EMAC_MDIO_COMM_DATA;
                                 break;
@@ -1436,31 +1608,39 @@ static int bnx2x_mdio45_read(struct bnx2x *bp, u32 reg, u32 addr,
                 *ret_val = val;
         }
 
-        /* unset clause 45 mode */
-        val = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
-        val &= ~EMAC_MDIO_MODE_CLAUSE_45;
-        EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, val);
-
-        if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG) {
-
-                val = REG_RD(bp, emac_base + EMAC_REG_EMAC_MDIO_MODE);
+        /* unset clause 45 mode, set the MDIO clock to a faster value
+         * (0x13 => 6.25Mhz) and restore the AUTO poll if needed
+         */
+        val = REG_RD(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE);
+        val &= ~(EMAC_MDIO_MODE_CLAUSE_45 | EMAC_MDIO_MODE_CLOCK_CNT);
+        val |= (0x13 << EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT);
+        if (bp->phy_flags & PHY_INT_MODE_AUTO_POLLING_FLAG)
                 val |= EMAC_MDIO_MODE_AUTO_POLL;
-                EMAC_WR(EMAC_REG_EMAC_MDIO_MODE, val);
-        }
+        REG_WR(bp, mdio_ctrl + EMAC_REG_EMAC_MDIO_MODE, val);
 
         return rc;
 }
 
-static int bnx2x_mdio45_vwrite(struct bnx2x *bp, u32 reg, u32 addr, u32 val)
+static int bnx2x_mdio45_read(struct bnx2x *bp, u32 phy_addr, u32 reg,
+                             u32 addr, u32 *ret_val)
+{
+        u32 emac_base = bp->port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+
+        return bnx2x_mdio45_ctrl_read(bp, emac_base, phy_addr,
+                                      reg, addr, ret_val);
+}
+
+static int bnx2x_mdio45_vwrite(struct bnx2x *bp, u32 phy_addr, u32 reg,
+                               u32 addr, u32 val)
 {
         int i;
         u32 rd_val;
 
         might_sleep();
         for (i = 0; i < 10; i++) {
-                bnx2x_mdio45_write(bp, reg, addr, val);
+                bnx2x_mdio45_write(bp, phy_addr, reg, addr, val);
                 msleep(5);
-                bnx2x_mdio45_read(bp, reg, addr, &rd_val);
+                bnx2x_mdio45_read(bp, phy_addr, reg, addr, &rd_val);
                 /* if the read value is not the same as the value we wrote,
                    we should write it again */
                 if (rd_val == val)
@@ -1471,18 +1651,81 @@ static int bnx2x_mdio45_vwrite(struct bnx2x *bp, u32 reg, u32 addr, u32 val)
 }
 
 /*
- * link managment
+ * link management
  */
 
+static void bnx2x_pause_resolve(struct bnx2x *bp, u32 pause_result)
+{
+        switch (pause_result) {                 /* ASYM P ASYM P */
+        case 0xb:                               /*   1  0   1  1 */
+                bp->flow_ctrl = FLOW_CTRL_TX;
+                break;
+
+        case 0xe:                               /*   1  1   1  0 */
+                bp->flow_ctrl = FLOW_CTRL_RX;
+                break;
+
+        case 0x5:                               /*   0  1   0  1 */
+        case 0x7:                               /*   0  1   1  1 */
+        case 0xd:                               /*   1  1   0  1 */
+        case 0xf:                               /*   1  1   1  1 */
+                bp->flow_ctrl = FLOW_CTRL_BOTH;
+                break;
+
+        default:
+                break;
+        }
+}
+
+static u8 bnx2x_ext_phy_resove_fc(struct bnx2x *bp)
+{
+        u32 ext_phy_addr;
+        u32 ld_pause;   /* local */
+        u32 lp_pause;   /* link partner */
+        u32 an_complete; /* AN complete */
+        u32 pause_result;
+        u8 ret = 0;
+
+        ext_phy_addr = ((bp->ext_phy_config &
+                         PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
+                                        PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
+
+        /* read twice */
+        bnx2x_mdio45_read(bp, ext_phy_addr,
+                          EXT_PHY_KR_AUTO_NEG_DEVAD,
+                          EXT_PHY_KR_STATUS, &an_complete);
+        bnx2x_mdio45_read(bp, ext_phy_addr,
+                          EXT_PHY_KR_AUTO_NEG_DEVAD,
+                          EXT_PHY_KR_STATUS, &an_complete);
+
+        if (an_complete & EXT_PHY_KR_AUTO_NEG_COMPLETE) {
+                ret = 1;
+                bnx2x_mdio45_read(bp, ext_phy_addr,
+                                  EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                  EXT_PHY_KR_AUTO_NEG_ADVERT, &ld_pause);
+                bnx2x_mdio45_read(bp, ext_phy_addr,
+                                  EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                  EXT_PHY_KR_LP_AUTO_NEG, &lp_pause);
+                pause_result = (ld_pause &
+                                EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_MASK) >> 8;
+                pause_result |= (lp_pause &
+                                 EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_MASK) >> 10;
+                DP(NETIF_MSG_LINK, "Ext PHY pause result 0x%x \n",
+                   pause_result);
+                bnx2x_pause_resolve(bp, pause_result);
+        }
+        return ret;
+}
+
 static void bnx2x_flow_ctrl_resolve(struct bnx2x *bp, u32 gp_status)
 {
-        u32 ld_pause;   /* local driver */
-        u32 lp_pause;   /* link partner */
+        u32 ld_pause;   /* local driver */
+        u32 lp_pause;   /* link partner */
         u32 pause_result;
 
         bp->flow_ctrl = 0;
 
-        /* reolve from gp_status in case of AN complete and not sgmii */
+        /* resolve from gp_status in case of AN complete and not sgmii */
         if ((bp->req_autoneg & AUTONEG_FLOW_CTRL) &&
             (gp_status & MDIO_AN_CL73_OR_37_COMPLETE) &&
             (!(bp->phy_flags & PHY_SGMII_FLAG)) &&
@@ -1499,45 +1742,57 @@ static void bnx2x_flow_ctrl_resolve(struct bnx2x *bp, u32 gp_status)
                 pause_result |= (lp_pause &
                                  MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_MASK)>>7;
                 DP(NETIF_MSG_LINK, "pause_result 0x%x\n", pause_result);
+                bnx2x_pause_resolve(bp, pause_result);
+        } else if (!(bp->req_autoneg & AUTONEG_FLOW_CTRL) ||
+                   !(bnx2x_ext_phy_resove_fc(bp))) {
+                /* forced speed */
+                if (bp->req_autoneg & AUTONEG_FLOW_CTRL) {
+                        switch (bp->req_flow_ctrl) {
+                        case FLOW_CTRL_AUTO:
+                                if (bp->dev->mtu <= 4500)
+                                        bp->flow_ctrl = FLOW_CTRL_BOTH;
+                                else
+                                        bp->flow_ctrl = FLOW_CTRL_TX;
+                                break;
 
-                switch (pause_result) {                 /* ASYM P ASYM P */
-                case 0xb:                               /*   1  0   1  1 */
-                        bp->flow_ctrl = FLOW_CTRL_TX;
-                        break;
-
-                case 0xe:                               /*   1  1   1  0 */
-                        bp->flow_ctrl = FLOW_CTRL_RX;
-                        break;
+                        case FLOW_CTRL_TX:
+                                bp->flow_ctrl = FLOW_CTRL_TX;
+                                break;
 
-                case 0x5:                               /*   0  1   0  1 */
-                case 0x7:                               /*   0  1   1  1 */
-                case 0xd:                               /*   1  1   0  1 */
-                case 0xf:                               /*   1  1   1  1 */
-                        bp->flow_ctrl = FLOW_CTRL_BOTH;
-                        break;
+                        case FLOW_CTRL_RX:
+                                if (bp->dev->mtu <= 4500)
+                                        bp->flow_ctrl = FLOW_CTRL_RX;
+                                break;
 
-                default:
-                        break;
-                }
+                        case FLOW_CTRL_BOTH:
+                                if (bp->dev->mtu <= 4500)
+                                        bp->flow_ctrl = FLOW_CTRL_BOTH;
+                                else
+                                        bp->flow_ctrl = FLOW_CTRL_TX;
+                                break;
 
-        } else { /* forced mode */
-                switch (bp->req_flow_ctrl) {
-                case FLOW_CTRL_AUTO:
-                        if (bp->dev->mtu <= 4500)
-                                bp->flow_ctrl = FLOW_CTRL_BOTH;
-                        else
-                                bp->flow_ctrl = FLOW_CTRL_TX;
-                        break;
+                        case FLOW_CTRL_NONE:
+                        default:
+                                break;
+                        }
+                } else { /* forced mode */
+                        switch (bp->req_flow_ctrl) {
+                        case FLOW_CTRL_AUTO:
+                                DP(NETIF_MSG_LINK, "req_flow_ctrl 0x%x while"
+                                                   " req_autoneg 0x%x\n",
+                                   bp->req_flow_ctrl, bp->req_autoneg);
+                                break;
 
-                case FLOW_CTRL_TX:
-                case FLOW_CTRL_RX:
-                case FLOW_CTRL_BOTH:
-                        bp->flow_ctrl = bp->req_flow_ctrl;
-                        break;
+                        case FLOW_CTRL_TX:
+                        case FLOW_CTRL_RX:
+                        case FLOW_CTRL_BOTH:
+                                bp->flow_ctrl = bp->req_flow_ctrl;
+                                break;
 
-                case FLOW_CTRL_NONE:
-                default:
-                        break;
+                        case FLOW_CTRL_NONE:
+                        default:
+                                break;
+                        }
                 }
         }
         DP(NETIF_MSG_LINK, "flow_ctrl 0x%x\n", bp->flow_ctrl);
@@ -1548,9 +1803,9 @@ static void bnx2x_link_settings_status(struct bnx2x *bp, u32 gp_status)
         bp->link_status = 0;
 
         if (gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS) {
-                DP(NETIF_MSG_LINK, "link up\n");
+                DP(NETIF_MSG_LINK, "phy link up\n");
 
-                bp->link_up = 1;
+                bp->phy_link_up = 1;
                 bp->link_status |= LINK_STATUS_LINK_UP;
 
                 if (gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_DUPLEX_STATUS)
@@ -1659,20 +1914,20 @@ static void bnx2x_link_settings_status(struct bnx2x *bp, u32 gp_status)
                        bp->link_status |= LINK_STATUS_RX_FLOW_CONTROL_ENABLED;
 
         } else { /* link_down */
-                DP(NETIF_MSG_LINK, "link down\n");
+                DP(NETIF_MSG_LINK, "phy link down\n");
 
-                bp->link_up = 0;
+                bp->phy_link_up = 0;
 
                 bp->line_speed = 0;
                 bp->duplex = DUPLEX_FULL;
                 bp->flow_ctrl = 0;
         }
 
-        DP(NETIF_MSG_LINK, "gp_status 0x%x  link_up %d\n"
+        DP(NETIF_MSG_LINK, "gp_status 0x%x  phy_link_up %d\n"
            DP_LEVEL "  line_speed %d  duplex %d  flow_ctrl 0x%x"
                     "  link_status 0x%x\n",
-           gp_status, bp->link_up, bp->line_speed, bp->duplex, bp->flow_ctrl,
-           bp->link_status);
+           gp_status, bp->phy_link_up, bp->line_speed, bp->duplex,
+           bp->flow_ctrl, bp->link_status);
 }
 
 static void bnx2x_link_int_ack(struct bnx2x *bp, int is_10g)
@@ -1680,40 +1935,40 @@ static void bnx2x_link_int_ack(struct bnx2x *bp, int is_10g)
         int port = bp->port;
 
         /* first reset all status
-         * we asume only one line will be change at a time */
+         * we assume only one line will be change at a time */
         bnx2x_bits_dis(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                       (NIG_XGXS0_LINK_STATUS |
-                        NIG_SERDES0_LINK_STATUS |
-                        NIG_STATUS_INTERRUPT_XGXS0_LINK10G));
-        if (bp->link_up) {
+                       (NIG_STATUS_XGXS0_LINK10G |
+                        NIG_STATUS_XGXS0_LINK_STATUS |
+                        NIG_STATUS_SERDES0_LINK_STATUS));
+        if (bp->phy_link_up) {
                 if (is_10g) {
                         /* Disable the 10G link interrupt
                          * by writing 1 to the status register
                          */
-                        DP(NETIF_MSG_LINK, "10G XGXS link up\n");
+                        DP(NETIF_MSG_LINK, "10G XGXS phy link up\n");
                         bnx2x_bits_en(bp,
                                       NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                                      NIG_STATUS_INTERRUPT_XGXS0_LINK10G);
+                                      NIG_STATUS_XGXS0_LINK10G);
 
                 } else if (bp->phy_flags & PHY_XGXS_FLAG) {
                         /* Disable the link interrupt
                          * by writing 1 to the relevant lane
                          * in the status register
                          */
-                        DP(NETIF_MSG_LINK, "1G XGXS link up\n");
+                        DP(NETIF_MSG_LINK, "1G XGXS phy link up\n");
                         bnx2x_bits_en(bp,
                                       NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
                                       ((1 << bp->ser_lane) <<
-                                       NIG_XGXS0_LINK_STATUS_SIZE));
+                                       NIG_STATUS_XGXS0_LINK_STATUS_SIZE));
 
                 } else { /* SerDes */
-                        DP(NETIF_MSG_LINK, "SerDes link up\n");
+                        DP(NETIF_MSG_LINK, "SerDes phy link up\n");
                         /* Disable the link interrupt
                          * by writing 1 to the status register
                          */
                         bnx2x_bits_en(bp,
                                       NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                                      NIG_SERDES0_LINK_STATUS);
+                                      NIG_STATUS_SERDES0_LINK_STATUS);
                 }
 
         } else { /* link_down */
@@ -1724,91 +1979,182 @@ static int bnx2x_ext_phy_is_link_up(struct bnx2x *bp)
 {
         u32 ext_phy_type;
         u32 ext_phy_addr;
-        u32 local_phy;
-        u32 val = 0;
+        u32 val1 = 0, val2;
         u32 rx_sd, pcs_status;
 
         if (bp->phy_flags & PHY_XGXS_FLAG) {
-                local_phy = bp->phy_addr;
                 ext_phy_addr = ((bp->ext_phy_config &
                                  PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
                                 PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
-                bp->phy_addr = (u8)ext_phy_addr;
 
                 ext_phy_type = XGXS_EXT_PHY_TYPE(bp);
                 switch (ext_phy_type) {
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
                         DP(NETIF_MSG_LINK, "XGXS Direct\n");
-                        val = 1;
+                        val1 = 1;
                         break;
 
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
                         DP(NETIF_MSG_LINK, "XGXS 8705\n");
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_WIS_DEVAD,
-                                          EXT_PHY_OPT_LASI_STATUS, &val);
-                        DP(NETIF_MSG_LINK, "8705 LASI status is %d\n", val);
-
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_WIS_DEVAD,
-                                          EXT_PHY_OPT_LASI_STATUS, &val);
-                        DP(NETIF_MSG_LINK, "8705 LASI status is %d\n", val);
-
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_WIS_DEVAD,
+                                          EXT_PHY_OPT_LASI_STATUS, &val1);
+                        DP(NETIF_MSG_LINK, "8705 LASI status 0x%x\n", val1);
+
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_WIS_DEVAD,
+                                          EXT_PHY_OPT_LASI_STATUS, &val1);
+                        DP(NETIF_MSG_LINK, "8705 LASI status 0x%x\n", val1);
+
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
                                           EXT_PHY_OPT_PMD_RX_SD, &rx_sd);
-                        val = (rx_sd & 0x1);
+                        DP(NETIF_MSG_LINK, "8705 rx_sd 0x%x\n", rx_sd);
+                        val1 = (rx_sd & 0x1);
                         break;
 
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
                         DP(NETIF_MSG_LINK, "XGXS 8706\n");
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
-                                          EXT_PHY_OPT_LASI_STATUS, &val);
-                        DP(NETIF_MSG_LINK, "8706 LASI status is %d\n", val);
-
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
-                                          EXT_PHY_OPT_LASI_STATUS, &val);
-                        DP(NETIF_MSG_LINK, "8706 LASI status is %d\n", val);
-
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_OPT_LASI_STATUS, &val1);
+                        DP(NETIF_MSG_LINK, "8706 LASI status 0x%x\n", val1);
+
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_OPT_LASI_STATUS, &val1);
+                        DP(NETIF_MSG_LINK, "8706 LASI status 0x%x\n", val1);
+
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
                                           EXT_PHY_OPT_PMD_RX_SD, &rx_sd);
-                        bnx2x_mdio45_read(bp, EXT_PHY_OPT_PCS_DEVAD,
-                                         EXT_PHY_OPT_PCS_STATUS, &pcs_status);
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PCS_DEVAD,
+                                          EXT_PHY_OPT_PCS_STATUS, &pcs_status);
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_AUTO_NEG_DEVAD,
+                                          EXT_PHY_OPT_AN_LINK_STATUS, &val2);
+
                         DP(NETIF_MSG_LINK, "8706 rx_sd 0x%x"
-                           "  pcs_status 0x%x\n", rx_sd, pcs_status);
-                        /* link is up if both bit 0 of pmd_rx and
-                         * bit 0 of pcs_status are set
+                           "  pcs_status 0x%x 1Gbps link_status 0x%x 0x%x\n",
+                           rx_sd, pcs_status, val2, (val2 & (1<<1)));
+                        /* link is up if both bit 0 of pmd_rx_sd and
+                         * bit 0 of pcs_status are set, or if the autoneg bit
+                           1 is set
                          */
-                        val = (rx_sd & pcs_status);
+                        val1 = ((rx_sd & pcs_status & 0x1) || (val2 & (1<<1)));
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
+                        bnx2x_hw_lock(bp, HW_LOCK_RESOURCE_8072_MDIO);
+
+                        /* clear the interrupt LASI status register */
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                               ext_phy_addr,
+                                               EXT_PHY_KR_PCS_DEVAD,
+                                               EXT_PHY_KR_LASI_STATUS, &val2);
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                               ext_phy_addr,
+                                               EXT_PHY_KR_PCS_DEVAD,
+                                               EXT_PHY_KR_LASI_STATUS, &val1);
+                        DP(NETIF_MSG_LINK, "KR LASI status 0x%x->0x%x\n",
+                           val2, val1);
+                        /* Check the LASI */
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                               ext_phy_addr,
+                                               EXT_PHY_KR_PMA_PMD_DEVAD,
+                                               0x9003, &val2);
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                               ext_phy_addr,
+                                               EXT_PHY_KR_PMA_PMD_DEVAD,
+                                               0x9003, &val1);
+                        DP(NETIF_MSG_LINK, "KR 0x9003 0x%x->0x%x\n",
+                           val2, val1);
+                        /* Check the link status */
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                               ext_phy_addr,
+                                               EXT_PHY_KR_PCS_DEVAD,
+                                               EXT_PHY_KR_PCS_STATUS, &val2);
+                        DP(NETIF_MSG_LINK, "KR PCS status 0x%x\n", val2);
+                        /* Check the link status on 1.1.2 */
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                          ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_KR_STATUS, &val2);
+                        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                          ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_KR_STATUS, &val1);
+                        DP(NETIF_MSG_LINK,
+                           "KR PMA status 0x%x->0x%x\n", val2, val1);
+                        val1 = ((val1 & 4) == 4);
+                        /* If 1G was requested assume the link is up */
+                        if (!(bp->req_autoneg & AUTONEG_SPEED) &&
+                            (bp->req_line_speed == SPEED_1000))
+                                val1 = 1;
+                        bnx2x_hw_unlock(bp, HW_LOCK_RESOURCE_8072_MDIO);
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_OPT_LASI_STATUS, &val2);
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_OPT_LASI_STATUS, &val1);
+                        DP(NETIF_MSG_LINK,
+                           "10G-base-T LASI status 0x%x->0x%x\n", val2, val1);
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_KR_STATUS, &val2);
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                          EXT_PHY_KR_STATUS, &val1);
+                        DP(NETIF_MSG_LINK,
+                           "10G-base-T PMA status 0x%x->0x%x\n", val2, val1);
+                        val1 = ((val1 & 4) == 4);
+                        /* if link is up
+                         * print the AN outcome of the SFX7101 PHY
+                         */
+                        if (val1) {
+                                bnx2x_mdio45_read(bp, ext_phy_addr,
+                                                  EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                                  0x21, &val2);
+                                DP(NETIF_MSG_LINK,
+                                   "SFX7101 AN status 0x%x->%s\n", val2,
+                                   (val2 & (1<<14)) ? "Master" : "Slave");
+                        }
                         break;
 
                 default:
                         DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
                            bp->ext_phy_config);
-                        val = 0;
+                        val1 = 0;
                         break;
                 }
-                bp->phy_addr = local_phy;
 
         } else { /* SerDes */
                 ext_phy_type = SERDES_EXT_PHY_TYPE(bp);
                 switch (ext_phy_type) {
                 case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT:
                         DP(NETIF_MSG_LINK, "SerDes Direct\n");
-                        val = 1;
+                        val1 = 1;
                         break;
 
                 case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482:
                         DP(NETIF_MSG_LINK, "SerDes 5482\n");
-                        val = 1;
+                        val1 = 1;
                         break;
 
                 default:
                         DP(NETIF_MSG_LINK, "BAD SerDes ext_phy_config 0x%x\n",
                            bp->ext_phy_config);
-                        val = 0;
+                        val1 = 0;
                         break;
                 }
         }
 
-        return val;
+        return val1;
 }
 
 static void bnx2x_bmac_enable(struct bnx2x *bp, int is_lb)
@@ -1819,7 +2165,7 @@ static void bnx2x_bmac_enable(struct bnx2x *bp, int is_lb)
         u32 wb_write[2];
         u32 val;
 
-        DP(NETIF_MSG_LINK, "enableing BigMAC\n");
+        DP(NETIF_MSG_LINK, "enabling BigMAC\n");
         /* reset and unreset the BigMac */
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
                (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
@@ -1933,6 +2279,35 @@ static void bnx2x_bmac_enable(struct bnx2x *bp, int is_lb)
         bp->stats_state = STATS_STATE_ENABLE;
 }
 
+static void bnx2x_bmac_rx_disable(struct bnx2x *bp)
+{
+        int port = bp->port;
+        u32 bmac_addr = port ? NIG_REG_INGRESS_BMAC1_MEM :
+                               NIG_REG_INGRESS_BMAC0_MEM;
+        u32 wb_write[2];
+
+        /* Only if the bmac is out of reset */
+        if (REG_RD(bp, MISC_REG_RESET_REG_2) &
+                        (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port)) {
+                /* Clear Rx Enable bit in BMAC_CONTROL register */
+#ifdef BNX2X_DMAE_RD
+                bnx2x_read_dmae(bp, bmac_addr +
+                                BIGMAC_REGISTER_BMAC_CONTROL, 2);
+                wb_write[0] = *bnx2x_sp(bp, wb_data[0]);
+                wb_write[1] = *bnx2x_sp(bp, wb_data[1]);
+#else
+                wb_write[0] = REG_RD(bp,
+                                bmac_addr + BIGMAC_REGISTER_BMAC_CONTROL);
+                wb_write[1] = REG_RD(bp,
+                                bmac_addr + BIGMAC_REGISTER_BMAC_CONTROL + 4);
+#endif
+                wb_write[0] &= ~BMAC_CONTROL_RX_ENABLE;
+                REG_WR_DMAE(bp, bmac_addr + BIGMAC_REGISTER_BMAC_CONTROL,
+                            wb_write, 2);
+                msleep(1);
+        }
+}
+
 static void bnx2x_emac_enable(struct bnx2x *bp)
 {
         int port = bp->port;
@@ -1940,7 +2315,7 @@ static void bnx2x_emac_enable(struct bnx2x *bp)
         u32 val;
         int timeout;
 
-        DP(NETIF_MSG_LINK, "enableing EMAC\n");
+        DP(NETIF_MSG_LINK, "enabling EMAC\n");
         /* reset and unreset the emac core */
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
                (MISC_REGISTERS_RESET_REG_2_RST_EMAC0_HARD_CORE << port));
@@ -2033,7 +2408,7 @@ static void bnx2x_emac_enable(struct bnx2x *bp)
                                       EMAC_TX_MODE_EXT_PAUSE_EN);
         }
 
-        /* KEEP_VLAN_TAG, promiscous */
+        /* KEEP_VLAN_TAG, promiscuous */
         val = REG_RD(bp, emac_base + EMAC_REG_EMAC_RX_MODE);
         val |= EMAC_RX_MODE_KEEP_VLAN_TAG | EMAC_RX_MODE_PROMISCUOUS;
         EMAC_WR(EMAC_REG_EMAC_RX_MODE, val);
@@ -2161,7 +2536,6 @@ static void bnx2x_pbf_update(struct bnx2x *bp)
         u32 count = 1000;
         u32 pause = 0;
 
-
         /* disable port */
         REG_WR(bp, PBF_REG_DISABLE_NEW_TASK_PROC_P0 + port*4, 0x1);
 
@@ -2232,7 +2606,7 @@ static void bnx2x_pbf_update(struct bnx2x *bp)
 static void bnx2x_update_mng(struct bnx2x *bp)
 {
         if (!nomcp)
-                SHMEM_WR(bp, drv_fw_mb[bp->port].link_status,
+                SHMEM_WR(bp, port_mb[bp->port].link_status,
                          bp->link_status);
 }
 
@@ -2294,19 +2668,19 @@ static void bnx2x_link_down(struct bnx2x *bp)
                 DP(BNX2X_MSG_STATS, "stats_state - STOP\n");
         }
 
-        /* indicate link down */
+        /* indicate no mac active */
         bp->phy_flags &= ~(PHY_BMAC_FLAG | PHY_EMAC_FLAG);
 
-        /* reset BigMac */
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
-               (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
+        /* update shared memory */
+        bnx2x_update_mng(bp);
 
-        /* ignore drain flag interrupt */
         /* activate nig drain */
         NIG_WR(NIG_REG_EGRESS_DRAIN0_MODE + port*4, 1);
 
-        /* update shared memory */
-        bnx2x_update_mng(bp);
+        /* reset BigMac */
+        bnx2x_bmac_rx_disable(bp);
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
+               (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
 
         /* indicate link down */
         bnx2x_link_report(bp);
@@ -2317,14 +2691,15 @@ static void bnx2x_init_mac_stats(struct bnx2x *bp);
 /* This function is called upon link interrupt */
 static void bnx2x_link_update(struct bnx2x *bp)
 {
-        u32 gp_status;
         int port = bp->port;
         int i;
+        u32 gp_status;
         int link_10g;
 
-        DP(NETIF_MSG_LINK, "port %x, is xgxs %x, stat_mask 0x%x,"
+        DP(NETIF_MSG_LINK, "port %x, %s, int_status 0x%x,"
            " int_mask 0x%x, saved_mask 0x%x, MI_INT %x, SERDES_LINK %x,"
-           " 10G %x, XGXS_LINK %x\n", port, (bp->phy_flags & PHY_XGXS_FLAG),
+           " 10G %x, XGXS_LINK %x\n", port,
+           (bp->phy_flags & PHY_XGXS_FLAG)? "XGXS":"SerDes",
            REG_RD(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4),
            REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4), bp->nig_mask,
            REG_RD(bp, NIG_REG_EMAC0_STATUS_MISC_MI_INT + port*0x18),
@@ -2336,7 +2711,7 @@ static void bnx2x_link_update(struct bnx2x *bp)
         might_sleep();
         MDIO_SET_REG_BANK(bp, MDIO_REG_BANK_GP_STATUS);
         /* avoid fast toggling */
-        for (i = 0 ; i < 10 ; i++) {
+        for (i = 0; i < 10; i++) {
                 msleep(10);
                 bnx2x_mdio22_read(bp, MDIO_GP_STATUS_TOP_AN_STATUS1,
                                   &gp_status);
@@ -2351,7 +2726,8 @@ static void bnx2x_link_update(struct bnx2x *bp)
         bnx2x_link_int_ack(bp, link_10g);
 
         /* link is up only if both local phy and external phy are up */
-        if (bp->link_up && bnx2x_ext_phy_is_link_up(bp)) {
+        bp->link_up = (bp->phy_link_up && bnx2x_ext_phy_is_link_up(bp));
+        if (bp->link_up) {
                 if (link_10g) {
                         bnx2x_bmac_enable(bp, 0);
                         bnx2x_leds_set(bp, SPEED_10000);
@@ -2427,7 +2803,9 @@ static void bnx2x_reset_unicore(struct bnx2x *bp)
                 }
         }
 
-        BNX2X_ERR("BUG! unicore is still in reset!\n");
+        BNX2X_ERR("BUG! %s (0x%x) is still in reset!\n",
+                  (bp->phy_flags & PHY_XGXS_FLAG)? "XGXS":"SerDes",
+                  bp->phy_addr);
 }
 
 static void bnx2x_set_swap_lanes(struct bnx2x *bp)
@@ -2475,12 +2853,12 @@ static void bnx2x_set_parallel_detection(struct bnx2x *bp)
                 MDIO_SET_REG_BANK(bp, MDIO_REG_BANK_10G_PARALLEL_DETECT);
 
                 bnx2x_mdio22_write(bp,
-                                   MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_LINK,
+                                MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_LINK,
                                MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_LINK_CNT);
 
                 bnx2x_mdio22_read(bp,
-                                 MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL,
-                                  &control2);
+                                MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL,
+                                &control2);
 
                 if (bp->autoneg & AUTONEG_PARALLEL) {
                         control2 |=
@@ -2490,8 +2868,14 @@ static void bnx2x_set_parallel_detection(struct bnx2x *bp)
                    ~MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL_PARDET10G_EN;
                 }
                 bnx2x_mdio22_write(bp,
-                                 MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL,
-                                   control2);
+                                MDIO_10G_PARALLEL_DETECT_PAR_DET_10G_CONTROL,
+                                control2);
+
+                /* Disable parallel detection of HiG */
+                MDIO_SET_REG_BANK(bp, MDIO_REG_BANK_XGXS_BLOCK2);
+                bnx2x_mdio22_write(bp, MDIO_XGXS_BLOCK2_UNICORE_MODE_10G,
+                                MDIO_XGXS_BLOCK2_UNICORE_MODE_10G_CX4_XGXS |
+                                MDIO_XGXS_BLOCK2_UNICORE_MODE_10G_HIGIG_XGXS);
         }
 }
 
@@ -2625,7 +3009,7 @@ static void bnx2x_set_brcm_cl37_advertisment(struct bnx2x *bp)
         MDIO_SET_REG_BANK(bp, MDIO_REG_BANK_OVER_1G);
 
         /* set extended capabilities */
-        if (bp->advertising & ADVERTISED_2500baseT_Full)
+        if (bp->advertising & ADVERTISED_2500baseX_Full)
                 val |= MDIO_OVER_1G_UP1_2_5G;
         if (bp->advertising & ADVERTISED_10000baseT_Full)
                 val |= MDIO_OVER_1G_UP1_10G;
@@ -2641,20 +3025,91 @@ static void bnx2x_set_ieee_aneg_advertisment(struct bnx2x *bp)
         /* for AN, we are always publishing full duplex */
         an_adv = MDIO_COMBO_IEEE0_AUTO_NEG_ADV_FULL_DUPLEX;
 
-        /* set pause */
-        switch (bp->pause_mode) {
-        case PAUSE_SYMMETRIC:
-                an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_SYMMETRIC;
-                break;
-        case PAUSE_ASYMMETRIC:
-                an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
-                break;
-        case PAUSE_BOTH:
-                an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
-                break;
-        case PAUSE_NONE:
-                an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE;
-                break;
+        /* resolve pause mode and advertisement
+         * Please refer to Table 28B-3 of the 802.3ab-1999 spec */
+        if (bp->req_autoneg & AUTONEG_FLOW_CTRL) {
+                switch (bp->req_flow_ctrl) {
+                case FLOW_CTRL_AUTO:
+                        if (bp->dev->mtu <= 4500) {
+                                an_adv |=
+                                     MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+                                bp->advertising |= (ADVERTISED_Pause |
+                                                    ADVERTISED_Asym_Pause);
+                        } else {
+                                an_adv |=
+                               MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
+                                bp->advertising |= ADVERTISED_Asym_Pause;
+                        }
+                        break;
+
+                case FLOW_CTRL_TX:
+                        an_adv |=
+                               MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
+                        bp->advertising |= ADVERTISED_Asym_Pause;
+                        break;
+
+                case FLOW_CTRL_RX:
+                        if (bp->dev->mtu <= 4500) {
+                                an_adv |=
+                                     MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+                                bp->advertising |= (ADVERTISED_Pause |
+                                                    ADVERTISED_Asym_Pause);
+                        } else {
+                                an_adv |=
+                                     MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE;
+                                bp->advertising &= ~(ADVERTISED_Pause |
+                                                     ADVERTISED_Asym_Pause);
+                        }
+                        break;
+
+                case FLOW_CTRL_BOTH:
+                        if (bp->dev->mtu <= 4500) {
+                                an_adv |=
+                                     MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+                                bp->advertising |= (ADVERTISED_Pause |
+                                                    ADVERTISED_Asym_Pause);
+                        } else {
+                                an_adv |=
+                               MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
+                                bp->advertising |= ADVERTISED_Asym_Pause;
+                        }
+                        break;
+
+                case FLOW_CTRL_NONE:
+                default:
+                        an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE;
+                        bp->advertising &= ~(ADVERTISED_Pause |
+                                             ADVERTISED_Asym_Pause);
+                        break;
+                }
+        } else { /* forced mode */
+                switch (bp->req_flow_ctrl) {
+                case FLOW_CTRL_AUTO:
+                        DP(NETIF_MSG_LINK, "req_flow_ctrl 0x%x while"
+                                           " req_autoneg 0x%x\n",
+                           bp->req_flow_ctrl, bp->req_autoneg);
+                        break;
+
+                case FLOW_CTRL_TX:
+                        an_adv |=
+                               MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_ASYMMETRIC;
+                        bp->advertising |= ADVERTISED_Asym_Pause;
+                        break;
+
+                case FLOW_CTRL_RX:
+                case FLOW_CTRL_BOTH:
+                        an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_BOTH;
+                        bp->advertising |= (ADVERTISED_Pause |
+                                            ADVERTISED_Asym_Pause);
+                        break;
+
+                case FLOW_CTRL_NONE:
+                default:
+                        an_adv |= MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE;
+                        bp->advertising &= ~(ADVERTISED_Pause |
+                                             ADVERTISED_Asym_Pause);
+                        break;
+                }
         }
 
         MDIO_SET_REG_BANK(bp, MDIO_REG_BANK_COMBO_IEEE0);
@@ -2752,47 +3207,162 @@ static void bnx2x_initialize_sgmii_process(struct bnx2x *bp)
 static void bnx2x_link_int_enable(struct bnx2x *bp)
 {
         int port = bp->port;
+        u32 ext_phy_type;
+        u32 mask;
 
         /* setting the status to report on link up
            for either XGXS or SerDes */
         bnx2x_bits_dis(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4,
-                       (NIG_XGXS0_LINK_STATUS |
-                        NIG_STATUS_INTERRUPT_XGXS0_LINK10G |
-                        NIG_SERDES0_LINK_STATUS));
+                       (NIG_STATUS_XGXS0_LINK10G |
+                        NIG_STATUS_XGXS0_LINK_STATUS |
+                        NIG_STATUS_SERDES0_LINK_STATUS));
 
         if (bp->phy_flags & PHY_XGXS_FLAG) {
-                /* TBD -
-                 * in force mode (not AN) we can enable just the relevant
-                 * interrupt
-                 * Even in AN we might enable only one according to the AN
-                 * speed mask
-                 */
-                bnx2x_bits_en(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                              (NIG_MASK_XGXS0_LINK_STATUS |
-                               NIG_MASK_XGXS0_LINK10G));
-                DP(NETIF_MSG_LINK, "enable XGXS interrupt\n");
+                mask = (NIG_MASK_XGXS0_LINK10G |
+                        NIG_MASK_XGXS0_LINK_STATUS);
+                DP(NETIF_MSG_LINK, "enabled XGXS interrupt\n");
+                ext_phy_type = XGXS_EXT_PHY_TYPE(bp);
+                if ((ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
+                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE) &&
+                    (ext_phy_type !=
+                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN)) {
+                        mask |= NIG_MASK_MI_INT;
+                        DP(NETIF_MSG_LINK, "enabled external phy int\n");
+                }
 
         } else { /* SerDes */
-                bnx2x_bits_en(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                              NIG_MASK_SERDES0_LINK_STATUS);
-                DP(NETIF_MSG_LINK, "enable SerDes interrupt\n");
+                mask = NIG_MASK_SERDES0_LINK_STATUS;
+                DP(NETIF_MSG_LINK, "enabled SerDes interrupt\n");
+                ext_phy_type = SERDES_EXT_PHY_TYPE(bp);
+                if ((ext_phy_type !=
+                                PORT_HW_CFG_SERDES_EXT_PHY_TYPE_DIRECT) &&
+                    (ext_phy_type !=
+                                PORT_HW_CFG_SERDES_EXT_PHY_TYPE_NOT_CONN)) {
+                        mask |= NIG_MASK_MI_INT;
+                        DP(NETIF_MSG_LINK, "enabled external phy int\n");
+                }
         }
+        bnx2x_bits_en(bp,
+                      NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
+                      mask);
+        DP(NETIF_MSG_LINK, "port %x, %s, int_status 0x%x,"
+           " int_mask 0x%x, MI_INT %x, SERDES_LINK %x,"
+           " 10G %x, XGXS_LINK %x\n", port,
+           (bp->phy_flags & PHY_XGXS_FLAG)? "XGXS":"SerDes",
+           REG_RD(bp, NIG_REG_STATUS_INTERRUPT_PORT0 + port*4),
+           REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4),
+           REG_RD(bp, NIG_REG_EMAC0_STATUS_MISC_MI_INT + port*0x18),
+           REG_RD(bp, NIG_REG_SERDES0_STATUS_LINK_STATUS + port*0x3c),
+           REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK10G + port*0x68),
+           REG_RD(bp, NIG_REG_XGXS0_STATUS_LINK_STATUS + port*0x68)
+        );
+}
+
+static void bnx2x_bcm8072_external_rom_boot(struct bnx2x *bp)
+{
+        u32 ext_phy_addr = ((bp->ext_phy_config &
+                             PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
+                            PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
+        u32 fw_ver1, fw_ver2;
+
+        /* Need to wait 200ms after reset */
+        msleep(200);
+        /* Boot port from external ROM
+         * Set ser_boot_ctl bit in the MISC_CTRL1 register
+         */
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD,
+                                EXT_PHY_KR_MISC_CTRL1, 0x0001);
+
+        /* Reset internal microprocessor */
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD, EXT_PHY_KR_GEN_CTRL,
+                                EXT_PHY_KR_ROM_RESET_INTERNAL_MP);
+        /* set micro reset = 0 */
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD, EXT_PHY_KR_GEN_CTRL,
+                                EXT_PHY_KR_ROM_MICRO_RESET);
+        /* Reset internal microprocessor */
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD, EXT_PHY_KR_GEN_CTRL,
+                                EXT_PHY_KR_ROM_RESET_INTERNAL_MP);
+        /* wait for 100ms for code download via SPI port */
+        msleep(100);
+
+        /* Clear ser_boot_ctl bit */
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD,
+                                EXT_PHY_KR_MISC_CTRL1, 0x0000);
+        /* Wait 100ms */
+        msleep(100);
+
+        /* Print the PHY FW version */
+        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0, ext_phy_addr,
+                               EXT_PHY_KR_PMA_PMD_DEVAD,
+                               0xca19, &fw_ver1);
+        bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0, ext_phy_addr,
+                               EXT_PHY_KR_PMA_PMD_DEVAD,
+                               0xca1a, &fw_ver2);
+        DP(NETIF_MSG_LINK,
+           "8072 FW version 0x%x:0x%x\n", fw_ver1, fw_ver2);
+}
+
+static void bnx2x_bcm8072_force_10G(struct bnx2x *bp)
+{
+        u32 ext_phy_addr = ((bp->ext_phy_config &
+                             PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
+                            PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
+
+        /* Force KR or KX */
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD, EXT_PHY_KR_CTRL,
+                                0x2040);
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD, EXT_PHY_KR_CTRL2,
+                                0x000b);
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_PMA_PMD_DEVAD, EXT_PHY_KR_PMD_CTRL,
+                                0x0000);
+        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0, ext_phy_addr,
+                                EXT_PHY_KR_AUTO_NEG_DEVAD, EXT_PHY_KR_CTRL,
+                                0x0000);
 }
 
 static void bnx2x_ext_phy_init(struct bnx2x *bp)
 {
-        int port = bp->port;
         u32 ext_phy_type;
         u32 ext_phy_addr;
-        u32 local_phy;
+        u32 cnt;
+        u32 ctrl;
+        u32 val = 0;
 
         if (bp->phy_flags & PHY_XGXS_FLAG) {
-                local_phy = bp->phy_addr;
                 ext_phy_addr = ((bp->ext_phy_config &
                                  PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
                                 PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
 
                 ext_phy_type = XGXS_EXT_PHY_TYPE(bp);
+                /* Make sure that the soft reset is off (expect for the 8072:
+                 * due to the lock, it will be done inside the specific
+                 * handling)
+                 */
+                if ((ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT) &&
+                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE) &&
+                   (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN) &&
+                    (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072)) {
+                        /* Wait for soft reset to get cleared upto 1 sec */
+                        for (cnt = 0; cnt < 1000; cnt++) {
+                                bnx2x_mdio45_read(bp, ext_phy_addr,
+                                                  EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                  EXT_PHY_OPT_CNTL, &ctrl);
+                                if (!(ctrl & (1<<15)))
+                                        break;
+                                msleep(1);
+                        }
+                        DP(NETIF_MSG_LINK,
+                           "control reg 0x%x (after %d ms)\n", ctrl, cnt);
+                }
+
                 switch (ext_phy_type) {
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
                         DP(NETIF_MSG_LINK, "XGXS Direct\n");
@@ -2800,49 +3370,235 @@ static void bnx2x_ext_phy_init(struct bnx2x *bp)
 
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
                         DP(NETIF_MSG_LINK, "XGXS 8705\n");
-                        bnx2x_bits_en(bp,
-                                      NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                                      NIG_MASK_MI_INT);
-                        DP(NETIF_MSG_LINK, "enabled extenal phy int\n");
 
-                        bp->phy_addr = ext_phy_type;
-                        bnx2x_mdio45_vwrite(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_OPT_PMA_PMD_DEVAD,
                                             EXT_PHY_OPT_PMD_MISC_CNTL,
                                             0x8288);
-                        bnx2x_mdio45_vwrite(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_OPT_PMA_PMD_DEVAD,
                                             EXT_PHY_OPT_PHY_IDENTIFIER,
                                             0x7fbf);
-                        bnx2x_mdio45_vwrite(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_OPT_PMA_PMD_DEVAD,
                                             EXT_PHY_OPT_CMU_PLL_BYPASS,
                                             0x0100);
-                        bnx2x_mdio45_vwrite(bp, EXT_PHY_OPT_WIS_DEVAD,
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_OPT_WIS_DEVAD,
                                             EXT_PHY_OPT_LASI_CNTL, 0x1);
                         break;
 
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
                         DP(NETIF_MSG_LINK, "XGXS 8706\n");
-                        bnx2x_bits_en(bp,
-                                      NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                                      NIG_MASK_MI_INT);
-                        DP(NETIF_MSG_LINK, "enabled extenal phy int\n");
-
-                        bp->phy_addr = ext_phy_type;
-                        bnx2x_mdio45_vwrite(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
-                                            EXT_PHY_OPT_PMD_DIGITAL_CNT,
-                                            0x400);
-                        bnx2x_mdio45_vwrite(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+
+                        if (!(bp->req_autoneg & AUTONEG_SPEED)) {
+                                /* Force speed */
+                                if (bp->req_line_speed == SPEED_10000) {
+                                        DP(NETIF_MSG_LINK,
+                                           "XGXS 8706 force 10Gbps\n");
+                                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                EXT_PHY_OPT_PMD_DIGITAL_CNT,
+                                                0x400);
+                                } else {
+                                        /* Force 1Gbps */
+                                        DP(NETIF_MSG_LINK,
+                                           "XGXS 8706 force 1Gbps\n");
+
+                                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                EXT_PHY_OPT_CNTL,
+                                                0x0040);
+
+                                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                EXT_PHY_OPT_CNTL2,
+                                                0x000D);
+                                }
+
+                                /* Enable LASI */
+                                bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                    EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                    EXT_PHY_OPT_LASI_CNTL,
+                                                    0x1);
+                        } else {
+                                /* AUTONEG */
+                                /* Allow CL37 through CL73 */
+                                DP(NETIF_MSG_LINK, "XGXS 8706 AutoNeg\n");
+                                bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                    EXT_PHY_AUTO_NEG_DEVAD,
+                                                    EXT_PHY_OPT_AN_CL37_CL73,
+                                                    0x040c);
+
+                                /* Enable Full-Duplex advertisment on CL37 */
+                                bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                    EXT_PHY_AUTO_NEG_DEVAD,
+                                                    EXT_PHY_OPT_AN_CL37_FD,
+                                                    0x0020);
+                                /* Enable CL37 AN */
+                                bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                    EXT_PHY_AUTO_NEG_DEVAD,
+                                                    EXT_PHY_OPT_AN_CL37_AN,
+                                                    0x1000);
+                                /* Advertise 10G/1G support */
+                                if (bp->advertising &
+                                    ADVERTISED_1000baseT_Full)
+                                        val = (1<<5);
+                                if (bp->advertising &
+                                    ADVERTISED_10000baseT_Full)
+                                        val |= (1<<7);
+
+                                bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                    EXT_PHY_AUTO_NEG_DEVAD,
+                                                    EXT_PHY_OPT_AN_ADV, val);
+                                /* Enable LASI */
+                                bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                                    EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                    EXT_PHY_OPT_LASI_CNTL,
+                                                    0x1);
+
+                                /* Enable clause 73 AN */
+                                bnx2x_mdio45_write(bp, ext_phy_addr,
+                                                   EXT_PHY_AUTO_NEG_DEVAD,
+                                                   EXT_PHY_OPT_CNTL,
+                                                   0x1200);
+                        }
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
+                        bnx2x_hw_lock(bp, HW_LOCK_RESOURCE_8072_MDIO);
+                        /* Wait for soft reset to get cleared upto 1 sec */
+                        for (cnt = 0; cnt < 1000; cnt++) {
+                                bnx2x_mdio45_ctrl_read(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                                EXT_PHY_OPT_CNTL, &ctrl);
+                                if (!(ctrl & (1<<15)))
+                                        break;
+                                msleep(1);
+                        }
+                        DP(NETIF_MSG_LINK,
+                           "8072 control reg 0x%x (after %d ms)\n",
+                           ctrl, cnt);
+
+                        bnx2x_bcm8072_external_rom_boot(bp);
+                        DP(NETIF_MSG_LINK, "Finshed loading 8072 KR ROM\n");
+
+                        /* enable LASI */
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_KR_PMA_PMD_DEVAD,
+                                                0x9000, 0x0400);
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_KR_PMA_PMD_DEVAD,
+                                                EXT_PHY_KR_LASI_CNTL, 0x0004);
+
+                        /* If this is forced speed, set to KR or KX
+                         * (all other are not supported)
+                         */
+                        if (!(bp->req_autoneg & AUTONEG_SPEED)) {
+                                if (bp->req_line_speed == SPEED_10000) {
+                                        bnx2x_bcm8072_force_10G(bp);
+                                        DP(NETIF_MSG_LINK,
+                                           "Forced speed 10G on 8072\n");
+                                        /* unlock */
+                                        bnx2x_hw_unlock(bp,
+                                                HW_LOCK_RESOURCE_8072_MDIO);
+                                        break;
+                                } else
+                                        val = (1<<5);
+                        } else {
+
+                                /* Advertise 10G/1G support */
+                                if (bp->advertising &
+                                                ADVERTISED_1000baseT_Full)
+                                        val = (1<<5);
+                                if (bp->advertising &
+                                                ADVERTISED_10000baseT_Full)
+                                        val |= (1<<7);
+                        }
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                        ext_phy_addr,
+                                        EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                        0x11, val);
+                        /* Add support for CL37 ( passive mode ) I */
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                                0x8370, 0x040c);
+                        /* Add support for CL37 ( passive mode ) II */
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                                0xffe4, 0x20);
+                        /* Add support for CL37 ( passive mode ) III */
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                                0xffe0, 0x1000);
+                        /* Restart autoneg */
+                        msleep(500);
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                        ext_phy_addr,
+                                        EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                        EXT_PHY_KR_CTRL, 0x1200);
+                        DP(NETIF_MSG_LINK, "8072 Autoneg Restart: "
+                           "1G %ssupported  10G %ssupported\n",
+                           (val & (1<<5)) ? "" : "not ",
+                           (val & (1<<7)) ? "" : "not ");
+
+                        /* unlock */
+                        bnx2x_hw_unlock(bp, HW_LOCK_RESOURCE_8072_MDIO);
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+                        DP(NETIF_MSG_LINK,
+                           "Setting the SFX7101 LASI indication\n");
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_OPT_PMA_PMD_DEVAD,
                                             EXT_PHY_OPT_LASI_CNTL, 0x1);
+                        DP(NETIF_MSG_LINK,
+                           "Setting the SFX7101 LED to blink on traffic\n");
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_OPT_PMA_PMD_DEVAD,
+                                            0xC007, (1<<3));
+
+                        /* read modify write pause advertizing */
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                          EXT_PHY_KR_AUTO_NEG_ADVERT, &val);
+                        val &= ~EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_BOTH;
+                        /* Please refer to Table 28B-3 of 802.3ab-1999 spec. */
+                        if (bp->advertising & ADVERTISED_Pause)
+                                val |= EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE;
+
+                        if (bp->advertising & ADVERTISED_Asym_Pause) {
+                                val |=
+                                 EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_ASYMMETRIC;
+                        }
+                        DP(NETIF_MSG_LINK, "SFX7101 AN advertize 0x%x\n", val);
+                        bnx2x_mdio45_vwrite(bp, ext_phy_addr,
+                                            EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                            EXT_PHY_KR_AUTO_NEG_ADVERT, val);
+                        /* Restart autoneg */
+                        bnx2x_mdio45_read(bp, ext_phy_addr,
+                                          EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                          EXT_PHY_KR_CTRL, &val);
+                        val |= 0x200;
+                        bnx2x_mdio45_write(bp, ext_phy_addr,
+                                            EXT_PHY_KR_AUTO_NEG_DEVAD,
+                                            EXT_PHY_KR_CTRL, val);
                         break;
 
                 default:
-                        DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
-                           bp->ext_phy_config);
+                        BNX2X_ERR("BAD XGXS ext_phy_config 0x%x\n",
+                                  bp->ext_phy_config);
                         break;
                 }
-                bp->phy_addr = local_phy;
 
         } else { /* SerDes */
-/*              ext_phy_addr = ((bp->ext_phy_config &
+/*              ext_phy_addr = ((bp->ext_phy_config &
                                  PORT_HW_CFG_SERDES_EXT_PHY_ADDR_MASK) >>
                                 PORT_HW_CFG_SERDES_EXT_PHY_ADDR_SHIFT);
 */
@@ -2854,10 +3610,6 @@ static void bnx2x_ext_phy_init(struct bnx2x *bp)
 
                 case PORT_HW_CFG_SERDES_EXT_PHY_TYPE_BCM5482:
                         DP(NETIF_MSG_LINK, "SerDes 5482\n");
-                        bnx2x_bits_en(bp,
-                                      NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
-                                      NIG_MASK_MI_INT);
-                        DP(NETIF_MSG_LINK, "enabled extenal phy int\n");
                         break;
 
                 default:
@@ -2871,8 +3623,22 @@ static void bnx2x_ext_phy_init(struct bnx2x *bp)
 static void bnx2x_ext_phy_reset(struct bnx2x *bp)
 {
         u32 ext_phy_type;
-        u32 ext_phy_addr;
-        u32 local_phy;
+        u32 ext_phy_addr = ((bp->ext_phy_config &
+                             PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
+                            PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
+        u32 board = (bp->board & SHARED_HW_CFG_BOARD_TYPE_MASK);
+
+        /* The PHY reset is controled by GPIO 1
+         * Give it 1ms of reset pulse
+         */
+        if ((board != SHARED_HW_CFG_BOARD_TYPE_BCM957710T1002G) &&
+            (board != SHARED_HW_CFG_BOARD_TYPE_BCM957710T1003G)) {
+                bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                               MISC_REGISTERS_GPIO_OUTPUT_LOW);
+                msleep(1);
+                bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                               MISC_REGISTERS_GPIO_OUTPUT_HIGH);
+        }
 
         if (bp->phy_flags & PHY_XGXS_FLAG) {
                 ext_phy_type = XGXS_EXT_PHY_TYPE(bp);
@@ -2883,15 +3649,24 @@ static void bnx2x_ext_phy_reset(struct bnx2x *bp)
 
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                        DP(NETIF_MSG_LINK, "XGXS 8705/6\n");
-                        local_phy = bp->phy_addr;
-                        ext_phy_addr = ((bp->ext_phy_config &
-                                        PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK) >>
-                                        PORT_HW_CFG_XGXS_EXT_PHY_ADDR_SHIFT);
-                        bp->phy_addr = (u8)ext_phy_addr;
-                        bnx2x_mdio45_write(bp, EXT_PHY_OPT_PMA_PMD_DEVAD,
+                        DP(NETIF_MSG_LINK, "XGXS 8705/8706\n");
+                        bnx2x_mdio45_write(bp, ext_phy_addr,
+                                           EXT_PHY_OPT_PMA_PMD_DEVAD,
                                            EXT_PHY_OPT_CNTL, 0xa040);
-                        bp->phy_addr = local_phy;
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
+                        DP(NETIF_MSG_LINK, "XGXS 8072\n");
+                        bnx2x_hw_lock(bp, HW_LOCK_RESOURCE_8072_MDIO);
+                        bnx2x_mdio45_ctrl_write(bp, GRCBASE_EMAC0,
+                                                ext_phy_addr,
+                                                EXT_PHY_KR_PMA_PMD_DEVAD,
+                                                0, 1<<15);
+                        bnx2x_hw_unlock(bp, HW_LOCK_RESOURCE_8072_MDIO);
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+                        DP(NETIF_MSG_LINK, "XGXS SFX7101\n");
                         break;
 
                 default:
@@ -2930,6 +3705,7 @@ static void bnx2x_link_initialize(struct bnx2x *bp)
                         NIG_MASK_SERDES0_LINK_STATUS |
                         NIG_MASK_MI_INT));
 
+        /* Activate the external PHY */
         bnx2x_ext_phy_reset(bp);
 
         bnx2x_set_aer_mmd(bp);
@@ -2994,13 +3770,13 @@ static void bnx2x_link_initialize(struct bnx2x *bp)
                         /* AN enabled */
                         bnx2x_set_brcm_cl37_advertisment(bp);
 
-                        /* program duplex & pause advertisment (for aneg) */
+                        /* program duplex & pause advertisement (for aneg) */
                         bnx2x_set_ieee_aneg_advertisment(bp);
 
                         /* enable autoneg */
                         bnx2x_set_autoneg(bp);
 
-                        /* enalbe and restart AN */
+                        /* enable and restart AN */
                         bnx2x_restart_autoneg(bp);
                 }
 
@@ -3010,11 +3786,11 @@ static void bnx2x_link_initialize(struct bnx2x *bp)
                 bnx2x_initialize_sgmii_process(bp);
         }
 
-        /* enable the interrupt */
-        bnx2x_link_int_enable(bp);
-
         /* init ext phy and enable link state int */
         bnx2x_ext_phy_init(bp);
+
+        /* enable the interrupt */
+        bnx2x_link_int_enable(bp);
 }
 
 static void bnx2x_phy_deassert(struct bnx2x *bp)
@@ -3073,6 +3849,11 @@ static int bnx2x_phy_init(struct bnx2x *bp)
 static void bnx2x_link_reset(struct bnx2x *bp)
 {
         int port = bp->port;
+        u32 board = (bp->board & SHARED_HW_CFG_BOARD_TYPE_MASK);
+
+        /* update shared memory */
+        bp->link_status = 0;
+        bnx2x_update_mng(bp);
 
         /* disable attentions */
         bnx2x_bits_dis(bp, NIG_REG_MASK_INTERRUPT_PORT0 + port*4,
@@ -3081,21 +3862,45 @@ static void bnx2x_link_reset(struct bnx2x *bp)
                         NIG_MASK_SERDES0_LINK_STATUS |
                         NIG_MASK_MI_INT));
 
-        bnx2x_ext_phy_reset(bp);
+        /* activate nig drain */
+        NIG_WR(NIG_REG_EGRESS_DRAIN0_MODE + port*4, 1);
+
+        /* disable nig egress interface */
+        NIG_WR(NIG_REG_BMAC0_OUT_EN + port*4, 0);
+        NIG_WR(NIG_REG_EGRESS_EMAC0_OUT_EN + port*4, 0);
+
+        /* Stop BigMac rx */
+        bnx2x_bmac_rx_disable(bp);
+
+        /* disable emac */
+        NIG_WR(NIG_REG_NIG_EMAC0_EN + port*4, 0);
+
+        msleep(10);
+
+        /* The PHY reset is controled by GPIO 1
+         * Hold it as output low
+         */
+        if ((board != SHARED_HW_CFG_BOARD_TYPE_BCM957710T1002G) &&
+            (board != SHARED_HW_CFG_BOARD_TYPE_BCM957710T1003G)) {
+                bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                               MISC_REGISTERS_GPIO_OUTPUT_LOW);
+                DP(NETIF_MSG_LINK, "reset external PHY\n");
+        }
 
         /* reset the SerDes/XGXS */
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_CLEAR,
                (0x1ff << (port*16)));
 
-        /* reset EMAC / BMAC and disable NIG interfaces */
-        NIG_WR(NIG_REG_BMAC0_IN_EN + port*4, 0);
-        NIG_WR(NIG_REG_BMAC0_OUT_EN + port*4, 0);
+        /* reset BigMac */
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR,
+               (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << port));
 
-        NIG_WR(NIG_REG_NIG_EMAC0_EN + port*4, 0);
+        /* disable nig ingress interface */
+        NIG_WR(NIG_REG_BMAC0_IN_EN + port*4, 0);
         NIG_WR(NIG_REG_EMAC0_IN_EN + port*4, 0);
-        NIG_WR(NIG_REG_EGRESS_EMAC0_OUT_EN + port*4, 0);
 
-        NIG_WR(NIG_REG_EGRESS_DRAIN0_MODE + port*4, 1);
+        /* set link down */
+        bp->link_up = 0;
 }
 
 #ifdef BNX2X_XGXS_LB
@@ -3158,7 +3963,7 @@ static int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
         int port = bp->port;
 
         DP(NETIF_MSG_TIMER,
-           "spe (%x:%x)  command %x  hw_cid %x  data (%x:%x)  left %x\n",
+           "spe (%x:%x)  command %d  hw_cid %x  data (%x:%x)  left %x\n",
            (u32)U64_HI(bp->spq_mapping), (u32)(U64_LO(bp->spq_mapping) +
            (void *)bp->spq_prod_bd - (void *)bp->spq), command,
            HW_CID(bp, cid), data_hi, data_lo, bp->spq_left);
@@ -3176,6 +3981,7 @@ static int bnx2x_sp_post(struct bnx2x *bp, int command, int cid,
                 bnx2x_panic();
                 return -EBUSY;
         }
+
         /* CID needs port number to be encoded int it */
         bp->spq_prod_bd->hdr.conn_and_cmd_data =
                         cpu_to_le32(((command << SPE_HDR_CMD_ID_SHIFT) |
@@ -3282,8 +4088,8 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
         u32 igu_addr = (IGU_ADDR_ATTN_BITS_SET + IGU_PORT_BASE * port) * 8;
         u32 aeu_addr = port ? MISC_REG_AEU_MASK_ATTN_FUNC_1 :
                               MISC_REG_AEU_MASK_ATTN_FUNC_0;
-        u32 nig_mask_addr = port ? NIG_REG_MASK_INTERRUPT_PORT1 :
-                                   NIG_REG_MASK_INTERRUPT_PORT0;
+        u32 nig_int_mask_addr = port ? NIG_REG_MASK_INTERRUPT_PORT1 :
+                                       NIG_REG_MASK_INTERRUPT_PORT0;
 
         if (~bp->aeu_mask & (asserted & 0xff))
                 BNX2X_ERR("IGU ERROR\n");
@@ -3301,15 +4107,11 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
 
         if (asserted & ATTN_HARD_WIRED_MASK) {
                 if (asserted & ATTN_NIG_FOR_FUNC) {
-                        u32 nig_status_port;
-                        u32 nig_int_addr = port ?
-                                        NIG_REG_STATUS_INTERRUPT_PORT1 :
-                                        NIG_REG_STATUS_INTERRUPT_PORT0;
 
-                        bp->nig_mask = REG_RD(bp, nig_mask_addr);
-                        REG_WR(bp, nig_mask_addr, 0);
+                        /* save nig interrupt mask */
+                        bp->nig_mask = REG_RD(bp, nig_int_mask_addr);
+                        REG_WR(bp, nig_int_mask_addr, 0);
 
-                        nig_status_port = REG_RD(bp, nig_int_addr);
                         bnx2x_link_update(bp);
 
                         /* handle unicore attn? */
@@ -3362,15 +4164,132 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
 
         /* now set back the mask */
         if (asserted & ATTN_NIG_FOR_FUNC)
-                REG_WR(bp, nig_mask_addr, bp->nig_mask);
+                REG_WR(bp, nig_int_mask_addr, bp->nig_mask);
 }
 
-static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
+static inline void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
 {
         int port = bp->port;
-        int index;
+        int reg_offset;
+        u32 val;
+
+        if (attn & AEU_INPUTS_ATTN_BITS_SPIO5) {
+
+                reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
+                                     MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+
+                val = REG_RD(bp, reg_offset);
+                val &= ~AEU_INPUTS_ATTN_BITS_SPIO5;
+                REG_WR(bp, reg_offset, val);
+
+                BNX2X_ERR("SPIO5 hw attention\n");
+
+                switch (bp->board & SHARED_HW_CFG_BOARD_TYPE_MASK) {
+                case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G:
+                        /* Fan failure attention */
+
+                        /* The PHY reset is controled by GPIO 1 */
+                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_1,
+                                       MISC_REGISTERS_GPIO_OUTPUT_LOW);
+                        /* Low power mode is controled by GPIO 2 */
+                        bnx2x_set_gpio(bp, MISC_REGISTERS_GPIO_2,
+                                       MISC_REGISTERS_GPIO_OUTPUT_LOW);
+                        /* mark the failure */
+                        bp->ext_phy_config &=
+                                        ~PORT_HW_CFG_XGXS_EXT_PHY_TYPE_MASK;
+                        bp->ext_phy_config |=
+                                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE;
+                        SHMEM_WR(bp,
+                                 dev_info.port_hw_config[port].
+                                                        external_phy_config,
+                                 bp->ext_phy_config);
+                        /* log the failure */
+                        printk(KERN_ERR PFX "Fan Failure on Network"
+                               " Controller %s has caused the driver to"
+                               " shutdown the card to prevent permanent"
+                               " damage.  Please contact Dell Support for"
+                               " assistance\n", bp->dev->name);
+                        break;
+
+                default:
+                        break;
+                }
+        }
+}
+
+static inline void bnx2x_attn_int_deasserted1(struct bnx2x *bp, u32 attn)
+{
+        u32 val;
+
+        if (attn & BNX2X_DOORQ_ASSERT) {
+
+                val = REG_RD(bp, DORQ_REG_DORQ_INT_STS_CLR);
+                BNX2X_ERR("DB hw attention 0x%x\n", val);
+                /* DORQ discard attention */
+                if (val & 0x2)
+                        BNX2X_ERR("FATAL error from DORQ\n");
+        }
+}
+
+static inline void bnx2x_attn_int_deasserted2(struct bnx2x *bp, u32 attn)
+{
+        u32 val;
+
+        if (attn & AEU_INPUTS_ATTN_BITS_CFC_HW_INTERRUPT) {
+
+                val = REG_RD(bp, CFC_REG_CFC_INT_STS_CLR);
+                BNX2X_ERR("CFC hw attention 0x%x\n", val);
+                /* CFC error attention */
+                if (val & 0x2)
+                        BNX2X_ERR("FATAL error from CFC\n");
+        }
+
+        if (attn & AEU_INPUTS_ATTN_BITS_PXP_HW_INTERRUPT) {
+
+                val = REG_RD(bp, PXP_REG_PXP_INT_STS_CLR_0);
+                BNX2X_ERR("PXP hw attention 0x%x\n", val);
+                /* RQ_USDMDP_FIFO_OVERFLOW */
+                if (val & 0x18000)
+                        BNX2X_ERR("FATAL error from PXP\n");
+        }
+}
+
+static inline void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
+{
+        if (attn & EVEREST_GEN_ATTN_IN_USE_MASK) {
+
+                if (attn & BNX2X_MC_ASSERT_BITS) {
+
+                        BNX2X_ERR("MC assert!\n");
+                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_10, 0);
+                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_9, 0);
+                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_8, 0);
+                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_7, 0);
+                        bnx2x_panic();
+
+                } else if (attn & BNX2X_MCP_ASSERT) {
+
+                        BNX2X_ERR("MCP assert!\n");
+                        REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_11, 0);
+                        bnx2x_mc_assert(bp);
+
+                } else
+                        BNX2X_ERR("Unknown HW assert! (attn 0x%x)\n", attn);
+        }
+
+        if (attn & EVEREST_LATCHED_ATTN_IN_USE_MASK) {
+
+                REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL, 0x7ff);
+                BNX2X_ERR("LATCHED attention 0x%x (masked)\n", attn);
+        }
+}
+
+static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
+{
         struct attn_route attn;
         struct attn_route group_mask;
+        int port = bp->port;
+        int index;
         u32 reg_addr;
         u32 val;
 
@@ -3391,64 +4310,14 @@ static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
                         DP(NETIF_MSG_HW, "group[%d]: %llx\n", index,
                            (unsigned long long)group_mask.sig[0]);
 
-                        if (attn.sig[3] & group_mask.sig[3] &
-                            EVEREST_GEN_ATTN_IN_USE_MASK) {
-
-                                if (attn.sig[3] & BNX2X_MC_ASSERT_BITS) {
-
-                                        BNX2X_ERR("MC assert!\n");
-                                        bnx2x_panic();
-
-                                } else if (attn.sig[3] & BNX2X_MCP_ASSERT) {
-
-                                        BNX2X_ERR("MCP assert!\n");
-                                        REG_WR(bp,
-                                             MISC_REG_AEU_GENERAL_ATTN_11, 0);
-                                        bnx2x_mc_assert(bp);
-
-                                } else {
-                                        BNX2X_ERR("UNKOWEN HW ASSERT!\n");
-                                }
-                        }
-
-                        if (attn.sig[1] & group_mask.sig[1] &
-                            BNX2X_DOORQ_ASSERT) {
-
-                                val = REG_RD(bp, DORQ_REG_DORQ_INT_STS_CLR);
-                                BNX2X_ERR("DB hw attention 0x%x\n", val);
-                                /* DORQ discard attention */
-                                if (val & 0x2)
-                                        BNX2X_ERR("FATAL error from DORQ\n");
-                        }
-
-                        if (attn.sig[2] & group_mask.sig[2] &
-                            AEU_INPUTS_ATTN_BITS_CFC_HW_INTERRUPT) {
-
-                                val = REG_RD(bp, CFC_REG_CFC_INT_STS_CLR);
-                                BNX2X_ERR("CFC hw attention 0x%x\n", val);
-                                /* CFC error attention */
-                                if (val & 0x2)
-                                        BNX2X_ERR("FATAL error from CFC\n");
-                        }
-
-                        if (attn.sig[2] & group_mask.sig[2] &
-                            AEU_INPUTS_ATTN_BITS_PXP_HW_INTERRUPT) {
-
-                                val = REG_RD(bp, PXP_REG_PXP_INT_STS_CLR_0);
-                                BNX2X_ERR("PXP hw attention 0x%x\n", val);
-                                /* RQ_USDMDP_FIFO_OVERFLOW */
-                                if (val & 0x18000)
-                                        BNX2X_ERR("FATAL error from PXP\n");
-                        }
-
-                        if (attn.sig[3] & group_mask.sig[3] &
-                            EVEREST_LATCHED_ATTN_IN_USE_MASK) {
-
-                                REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL,
-                                       0x7ff);
-                                DP(NETIF_MSG_HW, "got latched bits 0x%x\n",
-                                   attn.sig[3]);
-                        }
+                        bnx2x_attn_int_deasserted3(bp,
+                                        attn.sig[3] & group_mask.sig[3]);
+                        bnx2x_attn_int_deasserted1(bp,
+                                        attn.sig[1] & group_mask.sig[1]);
+                        bnx2x_attn_int_deasserted2(bp,
+                                        attn.sig[2] & group_mask.sig[2]);
+                        bnx2x_attn_int_deasserted0(bp,
+                                        attn.sig[0] & group_mask.sig[0]);
 
                         if ((attn.sig[0] & group_mask.sig[0] &
                                                 HW_INTERRUT_ASSERT_SET_0) ||
@@ -3456,7 +4325,15 @@ static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
                                                 HW_INTERRUT_ASSERT_SET_1) ||
                             (attn.sig[2] & group_mask.sig[2] &
                                                 HW_INTERRUT_ASSERT_SET_2))
-                                BNX2X_ERR("FATAL HW block attention\n");
+                                BNX2X_ERR("FATAL HW block attention"
+                                          "  set0 0x%x  set1 0x%x"
+                                          "  set2 0x%x\n",
+                                          (attn.sig[0] & group_mask.sig[0] &
+                                           HW_INTERRUT_ASSERT_SET_0),
+                                          (attn.sig[1] & group_mask.sig[1] &
+                                           HW_INTERRUT_ASSERT_SET_1),
+                                          (attn.sig[2] & group_mask.sig[2] &
+                                           HW_INTERRUT_ASSERT_SET_2));
 
                         if ((attn.sig[0] & group_mask.sig[0] &
                                                 HW_PRTY_ASSERT_SET_0) ||
@@ -3464,7 +4341,7 @@ static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
                                                 HW_PRTY_ASSERT_SET_1) ||
                             (attn.sig[2] & group_mask.sig[2] &
                                                 HW_PRTY_ASSERT_SET_2))
-                                BNX2X_ERR("FATAL HW block parity atention\n");
+                               BNX2X_ERR("FATAL HW block parity attention\n");
                 }
         }
 
@@ -3529,7 +4406,7 @@ static void bnx2x_sp_task(struct work_struct *work)
 
         /* Return here if interrupt is disabled */
         if (unlikely(atomic_read(&bp->intr_sem) != 0)) {
-                DP(NETIF_MSG_INTR, "called but intr_sem not 0, returning\n");
+                DP(BNX2X_MSG_SP, "called but intr_sem not 0, returning\n");
                 return;
         }
 
@@ -3539,12 +4416,11 @@ static void bnx2x_sp_task(struct work_struct *work)
 
         DP(NETIF_MSG_INTR, "got a slowpath interrupt (updated %x)\n", status);
 
-        if (status & 0x1) {
-                /* HW attentions */
+        /* HW attentions */
+        if (status & 0x1)
                 bnx2x_attn_int(bp);
-        }
 
-        /* CStorm events: query_stats, cfc delete ramrods */
+        /* CStorm events: query_stats, port delete ramrod */
         if (status & 0x2)
                 bp->stat_pending = 0;
 
@@ -3558,6 +4434,7 @@ static void bnx2x_sp_task(struct work_struct *work)
                      IGU_INT_NOP, 1);
         bnx2x_ack_sb(bp, DEF_SB_ID, TSTORM_ID, le16_to_cpu(bp->def_t_idx),
                      IGU_INT_ENABLE, 1);
+
 }
 
 static irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance)
@@ -3567,11 +4444,11 @@ static irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance)
 
         /* Return here if interrupt is disabled */
         if (unlikely(atomic_read(&bp->intr_sem) != 0)) {
-                DP(NETIF_MSG_INTR, "called but intr_sem not 0, returning\n");
+                DP(BNX2X_MSG_SP, "called but intr_sem not 0, returning\n");
                 return IRQ_HANDLED;
         }
 
-        bnx2x_ack_sb(bp, 16, XSTORM_ID, 0, IGU_INT_DISABLE, 0);
+        bnx2x_ack_sb(bp, DEF_SB_ID, XSTORM_ID, 0, IGU_INT_DISABLE, 0);
 
 #ifdef BNX2X_STOP_ON_ERROR
         if (unlikely(bp->panic))
@@ -3906,7 +4783,7 @@ static void bnx2x_stop_stats(struct bnx2x *bp)
 
                 while (bp->stats_state != STATS_STATE_DISABLE) {
                         if (!timeout) {
-                                BNX2X_ERR("timeout wating for stats stop\n");
+                                BNX2X_ERR("timeout waiting for stats stop\n");
                                 break;
                         }
                         timeout--;
@@ -4173,39 +5050,37 @@ static void bnx2x_update_net_stats(struct bnx2x *bp)
 
         nstats->rx_bytes = bnx2x_hilo(&estats->total_bytes_received_hi);
 
-        nstats->tx_bytes =
-                bnx2x_hilo(&estats->total_bytes_transmitted_hi);
+        nstats->tx_bytes = bnx2x_hilo(&estats->total_bytes_transmitted_hi);
 
-        nstats->rx_dropped = estats->checksum_discard +
-                                   estats->mac_discard;
+        nstats->rx_dropped = estats->checksum_discard + estats->mac_discard;
         nstats->tx_dropped = 0;
 
         nstats->multicast =
                 bnx2x_hilo(&estats->total_multicast_packets_transmitted_hi);
 
-        nstats->collisions =
-                estats->single_collision_transmit_frames +
-                estats->multiple_collision_transmit_frames +
-                estats->late_collision_frames +
-                estats->excessive_collision_frames;
+        nstats->collisions = estats->single_collision_transmit_frames +
+                             estats->multiple_collision_transmit_frames +
+                             estats->late_collision_frames +
+                             estats->excessive_collision_frames;
 
         nstats->rx_length_errors = estats->runt_packets_received +
                                    estats->jabber_packets_received;
-        nstats->rx_over_errors = estats->no_buff_discard;
+        nstats->rx_over_errors = estats->brb_discard +
+                                 estats->brb_truncate_discard;
         nstats->rx_crc_errors = estats->crc_receive_errors;
         nstats->rx_frame_errors = estats->alignment_errors;
-        nstats->rx_fifo_errors = estats->brb_discard +
-                                       estats->brb_truncate_discard;
+        nstats->rx_fifo_errors = estats->no_buff_discard;
         nstats->rx_missed_errors = estats->xxoverflow_discard;
 
         nstats->rx_errors = nstats->rx_length_errors +
                             nstats->rx_over_errors +
                             nstats->rx_crc_errors +
                             nstats->rx_frame_errors +
-                            nstats->rx_fifo_errors;
+                            nstats->rx_fifo_errors +
+                            nstats->rx_missed_errors;
 
         nstats->tx_aborted_errors = estats->late_collision_frames +
-                                          estats->excessive_collision_frames;
+                                    estats->excessive_collision_frames;
         nstats->tx_carrier_errors = estats->false_carrier_detections;
         nstats->tx_fifo_errors = 0;
         nstats->tx_heartbeat_errors = 0;
@@ -4334,7 +5209,7 @@ static void bnx2x_timer(unsigned long data)
                 return;
 
         if (atomic_read(&bp->intr_sem) != 0)
-                goto bnx2x_restart_timer;
+                goto timer_restart;
 
         if (poll) {
                 struct bnx2x_fastpath *fp = &bp->fp[0];
@@ -4344,7 +5219,7 @@ static void bnx2x_timer(unsigned long data)
                 rc = bnx2x_rx_int(fp, 1000);
         }
 
-        if (!nomcp && (bp->bc_ver >= 0x040003)) {
+        if (!nomcp) {
                 int port = bp->port;
                 u32 drv_pulse;
                 u32 mcp_pulse;
@@ -4353,9 +5228,9 @@ static void bnx2x_timer(unsigned long data)
                 bp->fw_drv_pulse_wr_seq &= DRV_PULSE_SEQ_MASK;
                 /* TBD - add SYSTEM_TIME */
                 drv_pulse = bp->fw_drv_pulse_wr_seq;
-                SHMEM_WR(bp, drv_fw_mb[port].drv_pulse_mb, drv_pulse);
+                SHMEM_WR(bp, func_mb[port].drv_pulse_mb, drv_pulse);
 
-                mcp_pulse = (SHMEM_RD(bp, drv_fw_mb[port].mcp_pulse_mb) &
+                mcp_pulse = (SHMEM_RD(bp, func_mb[port].mcp_pulse_mb) &
                              MCP_PULSE_SEQ_MASK);
                 /* The delta between driver pulse and mcp response
                  * should be 1 (before mcp response) or 0 (after mcp response)
@@ -4369,11 +5244,11 @@ static void bnx2x_timer(unsigned long data)
         }
 
         if (bp->stats_state == STATS_STATE_DISABLE)
-                goto bnx2x_restart_timer;
+                goto timer_restart;
 
         bnx2x_update_stats(bp);
 
-bnx2x_restart_timer:
+timer_restart:
         mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
 
@@ -4438,6 +5313,9 @@ static void bnx2x_init_def_sb(struct bnx2x *bp,
                                             atten_status_block);
         def_sb->atten_status_block.status_block_id = id;
 
+        bp->def_att_idx = 0;
+        bp->attn_state = 0;
+
         reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                              MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
 
@@ -4472,6 +5350,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp,
                                             u_def_status_block);
         def_sb->u_def_status_block.status_block_id = id;
 
+        bp->def_u_idx = 0;
+
         REG_WR(bp, BAR_USTRORM_INTMEM +
                USTORM_DEF_SB_HOST_SB_ADDR_OFFSET(port), U64_LO(section));
         REG_WR(bp, BAR_USTRORM_INTMEM +
@@ -4489,6 +5369,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp,
                                             c_def_status_block);
         def_sb->c_def_status_block.status_block_id = id;
 
+        bp->def_c_idx = 0;
+
         REG_WR(bp, BAR_CSTRORM_INTMEM +
                CSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(port), U64_LO(section));
         REG_WR(bp, BAR_CSTRORM_INTMEM +
@@ -4506,6 +5388,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp,
                                             t_def_status_block);
         def_sb->t_def_status_block.status_block_id = id;
 
+        bp->def_t_idx = 0;
+
         REG_WR(bp, BAR_TSTRORM_INTMEM +
                TSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(port), U64_LO(section));
         REG_WR(bp, BAR_TSTRORM_INTMEM +
@@ -4523,6 +5407,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp,
                                             x_def_status_block);
         def_sb->x_def_status_block.status_block_id = id;
 
+        bp->def_x_idx = 0;
+
         REG_WR(bp, BAR_XSTRORM_INTMEM +
                XSTORM_DEF_SB_HOST_SB_ADDR_OFFSET(port), U64_LO(section));
         REG_WR(bp, BAR_XSTRORM_INTMEM +
@@ -4535,6 +5421,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp,
                 REG_WR16(bp, BAR_XSTRORM_INTMEM +
                          XSTORM_DEF_SB_HC_DISABLE_OFFSET(port, index), 0x1);
 
+        bp->stat_pending = 0;
+
         bnx2x_ack_sb(bp, id, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
 }
 
@@ -4626,7 +5514,7 @@ static void bnx2x_init_rx_rings(struct bnx2x *bp)
                 fp->rx_bd_prod = fp->rx_comp_prod = ring_prod;
                 fp->rx_pkt = fp->rx_calls = 0;
 
-                /* Warning! this will genrate an interrupt (to the TSTORM) */
+                /* Warning! this will generate an interrupt (to the TSTORM) */
                 /* must only be done when chip is initialized */
                 REG_WR(bp, BAR_TSTRORM_INTMEM +
                        TSTORM_RCQ_PROD_OFFSET(port, j), ring_prod);
@@ -4678,7 +5566,6 @@ static void bnx2x_init_sp_ring(struct bnx2x *bp)
 
         bp->spq_left = MAX_SPQ_PENDING;
         bp->spq_prod_idx = 0;
-        bp->dsb_sp_prod_idx = 0;
         bp->dsb_sp_prod = BNX2X_SP_DSB_INDEX;
         bp->spq_prod_bd = bp->spq;
         bp->spq_last_bd = bp->spq_prod_bd + MAX_SP_DESC_CNT;
@@ -4755,6 +5642,42 @@ static void bnx2x_init_ind_table(struct bnx2x *bp)
         REG_WR(bp, PRS_REG_A_PRSU_20, 0xf);
 }
 
+static void bnx2x_set_client_config(struct bnx2x *bp)
+{
+#ifdef BCM_VLAN
+        int mode = bp->rx_mode;
+#endif
+        int i, port = bp->port;
+        struct tstorm_eth_client_config tstorm_client = {0};
+
+        tstorm_client.mtu = bp->dev->mtu;
+        tstorm_client.statistics_counter_id = 0;
+        tstorm_client.config_flags =
+                                TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE;
+#ifdef BCM_VLAN
+        if (mode && bp->vlgrp) {
+                tstorm_client.config_flags |=
+                                TSTORM_ETH_CLIENT_CONFIG_VLAN_REMOVAL_ENABLE;
+                DP(NETIF_MSG_IFUP, "vlan removal enabled\n");
+        }
+#endif
+        if (mode != BNX2X_RX_MODE_PROMISC)
+                tstorm_client.drop_flags =
+                                TSTORM_ETH_CLIENT_CONFIG_DROP_MAC_ERR;
+
+        for_each_queue(bp, i) {
+                REG_WR(bp, BAR_TSTRORM_INTMEM +
+                       TSTORM_CLIENT_CONFIG_OFFSET(port, i),
+                       ((u32 *)&tstorm_client)[0]);
+                REG_WR(bp, BAR_TSTRORM_INTMEM +
+                       TSTORM_CLIENT_CONFIG_OFFSET(port, i) + 4,
+                       ((u32 *)&tstorm_client)[1]);
+        }
+
+/*      DP(NETIF_MSG_IFUP, "tstorm_client: 0x%08x 0x%08x\n",
+           ((u32 *)&tstorm_client)[0], ((u32 *)&tstorm_client)[1]); */
+}
+
 static void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
 {
         int mode = bp->rx_mode;
@@ -4794,41 +5717,9 @@ static void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
 /*              DP(NETIF_MSG_IFUP, "tstorm_mac_filter[%d]: 0x%08x\n", i,
                    ((u32 *)&tstorm_mac_filter)[i]); */
         }
-}
 
-static void bnx2x_set_client_config(struct bnx2x *bp, int client_id)
-{
-#ifdef BCM_VLAN
-        int mode = bp->rx_mode;
-#endif
-        int port = bp->port;
-        struct tstorm_eth_client_config tstorm_client = {0};
-
-        tstorm_client.mtu = bp->dev->mtu;
-        tstorm_client.statistics_counter_id = 0;
-        tstorm_client.config_flags =
-                TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE;
-#ifdef BCM_VLAN
-        if (mode && bp->vlgrp) {
-                tstorm_client.config_flags |=
-                                TSTORM_ETH_CLIENT_CONFIG_VLAN_REMOVAL_ENABLE;
-                DP(NETIF_MSG_IFUP, "vlan removal enabled\n");
-        }
-#endif
-        tstorm_client.drop_flags = (TSTORM_ETH_CLIENT_CONFIG_DROP_IP_CS_ERR |
-                                    TSTORM_ETH_CLIENT_CONFIG_DROP_TCP_CS_ERR |
-                                    TSTORM_ETH_CLIENT_CONFIG_DROP_UDP_CS_ERR |
-                                    TSTORM_ETH_CLIENT_CONFIG_DROP_MAC_ERR);
-
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               TSTORM_CLIENT_CONFIG_OFFSET(port, client_id),
-               ((u32 *)&tstorm_client)[0]);
-        REG_WR(bp, BAR_TSTRORM_INTMEM +
-               TSTORM_CLIENT_CONFIG_OFFSET(port, client_id) + 4,
-               ((u32 *)&tstorm_client)[1]);
-
-/*      DP(NETIF_MSG_IFUP, "tstorm_client: 0x%08x 0x%08x\n",
-           ((u32 *)&tstorm_client)[0], ((u32 *)&tstorm_client)[1]); */
+        if (mode != BNX2X_RX_MODE_NONE)
+                bnx2x_set_client_config(bp);
 }
 
 static void bnx2x_init_internal(struct bnx2x *bp)
@@ -4836,7 +5727,6 @@ static void bnx2x_init_internal(struct bnx2x *bp)
         int port = bp->port;
         struct tstorm_eth_function_common_config tstorm_config = {0};
         struct stats_indication_flags stats_flags = {0};
-        int i;
 
         if (is_multi(bp)) {
                 tstorm_config.config_flags = MULTI_FLAGS;
@@ -4850,13 +5740,9 @@ static void bnx2x_init_internal(struct bnx2x *bp)
 /*      DP(NETIF_MSG_IFUP, "tstorm_config: 0x%08x\n",
            (*(u32 *)&tstorm_config)); */
 
-        bp->rx_mode = BNX2X_RX_MODE_NONE; /* no rx untill link is up */
+        bp->rx_mode = BNX2X_RX_MODE_NONE; /* no rx until link is up */
         bnx2x_set_storm_rx_mode(bp);
 
-        for_each_queue(bp, i)
-                bnx2x_set_client_config(bp, i);
-
-
         stats_flags.collect_eth = cpu_to_le32(1);
 
         REG_WR(bp, BAR_XSTRORM_INTMEM + XSTORM_STATS_FLAGS_OFFSET(port),
@@ -4902,7 +5788,7 @@ static void bnx2x_nic_init(struct bnx2x *bp)
         bnx2x_init_internal(bp);
         bnx2x_init_stats(bp);
         bnx2x_init_ind_table(bp);
-        bnx2x_enable_int(bp);
+        bnx2x_int_enable(bp);
 
 }
 
@@ -5265,8 +6151,10 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
         if (mode & 0x1) {       /* init common */
                 DP(BNX2X_MSG_MCP, "starting common init  func %d  mode %x\n",
                    func, mode);
-                REG_WR(bp, MISC_REG_RESET_REG_1, 0xffffffff);
-                REG_WR(bp, MISC_REG_RESET_REG_2, 0xfffc);
+                REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET,
+                       0xffffffff);
+                REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET,
+                       0xfffc);
                 bnx2x_init_block(bp, MISC_COMMON_START, MISC_COMMON_END);
 
                 REG_WR(bp, MISC_REG_LCPLL_CTRL_REG_2, 0x100);
@@ -5359,7 +6247,7 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
                 REG_RD(bp, USEM_REG_PASSIVE_BUFFER + 8);
 #endif
                 bnx2x_init_block(bp, QM_COMMON_START, QM_COMMON_END);
-                /* softrest pulse */
+                /* soft reset pulse */
                 REG_WR(bp, QM_REG_SOFT_RESET, 1);
                 REG_WR(bp, QM_REG_SOFT_RESET, 0);
 
@@ -5413,7 +6301,7 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
                 REG_WR(bp, SRC_REG_SOFT_RST, 1);
                 for (i = SRC_REG_KEYRSS0_0; i <= SRC_REG_KEYRSS1_9; i += 4) {
                         REG_WR(bp, i, 0xc0cac01a);
-                        /* TODO: repleace with something meaningfull */
+                        /* TODO: replace with something meaningful */
                 }
                 /* SRCH COMMON comes here */
                 REG_WR(bp, SRC_REG_SOFT_RST, 0);
@@ -5486,6 +6374,28 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
                 enable_blocks_attention(bp);
                 /* enable_blocks_parity(bp); */
 
+                switch (bp->board & SHARED_HW_CFG_BOARD_TYPE_MASK) {
+                case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G:
+                        /* Fan failure is indicated by SPIO 5 */
+                        bnx2x_set_spio(bp, MISC_REGISTERS_SPIO_5,
+                                       MISC_REGISTERS_SPIO_INPUT_HI_Z);
+
+                        /* set to active low mode */
+                        val = REG_RD(bp, MISC_REG_SPIO_INT);
+                        val |= ((1 << MISC_REGISTERS_SPIO_5) <<
+                                        MISC_REGISTERS_SPIO_INT_OLD_SET_POS);
+                        REG_WR(bp, MISC_REG_SPIO_INT, val);
+
+                        /* enable interrupt to signal the IGU */
+                        val = REG_RD(bp, MISC_REG_SPIO_EVENT_EN);
+                        val |= (1 << MISC_REGISTERS_SPIO_5);
+                        REG_WR(bp, MISC_REG_SPIO_EVENT_EN, val);
+                        break;
+
+                default:
+                        break;
+                }
+
         } /* end of common init */
 
         /* per port init */
@@ -5645,9 +6555,21 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
         /* Port MCP comes here */
         /* Port DMAE comes here */
 
+        switch (bp->board & SHARED_HW_CFG_BOARD_TYPE_MASK) {
+        case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G:
+                /* add SPIO 5 to group 0 */
+                val = REG_RD(bp, MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+                val |= AEU_INPUTS_ATTN_BITS_SPIO5;
+                REG_WR(bp, MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0, val);
+                break;
+
+        default:
+                break;
+        }
+
         bnx2x_link_reset(bp);
 
-        /* Reset pciex errors for debug */
+        /* Reset PCIE errors for debug */
         REG_WR(bp, 0x2114, 0xffffffff);
         REG_WR(bp, 0x2120, 0xffffffff);
         REG_WR(bp, 0x2814, 0xffffffff);
@@ -5669,9 +6591,9 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
                 port = bp->port;
 
                 bp->fw_drv_pulse_wr_seq =
-                                (SHMEM_RD(bp, drv_fw_mb[port].drv_pulse_mb) &
+                                (SHMEM_RD(bp, func_mb[port].drv_pulse_mb) &
                                  DRV_PULSE_SEQ_MASK);
-                bp->fw_mb = SHMEM_RD(bp, drv_fw_mb[port].fw_mb_param);
+                bp->fw_mb = SHMEM_RD(bp, func_mb[port].fw_mb_param);
                 DP(BNX2X_MSG_MCP, "drv_pulse 0x%x  fw_mb 0x%x\n",
                    bp->fw_drv_pulse_wr_seq, bp->fw_mb);
         } else {
@@ -5681,16 +6603,15 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
         return 0;
 }
 
-
-/* send the MCP a request, block untill there is a reply */
+/* send the MCP a request, block until there is a reply */
 static u32 bnx2x_fw_command(struct bnx2x *bp, u32 command)
 {
-        u32 rc = 0;
-        u32 seq = ++bp->fw_seq;
         int port = bp->port;
+        u32 seq = ++bp->fw_seq;
+        u32 rc = 0;
 
-        SHMEM_WR(bp, drv_fw_mb[port].drv_mb_header, command|seq);
-        DP(BNX2X_MSG_MCP, "wrote command (%x) to FW MB\n", command|seq);
+        SHMEM_WR(bp, func_mb[port].drv_mb_header, (command | seq));
+        DP(BNX2X_MSG_MCP, "wrote command (%x) to FW MB\n", (command | seq));
 
         /* let the FW do it's magic ... */
         msleep(100); /* TBD */
@@ -5698,19 +6619,20 @@ static u32 bnx2x_fw_command(struct bnx2x *bp, u32 command)
         if (CHIP_REV_IS_SLOW(bp))
                 msleep(900);
 
-        rc = SHMEM_RD(bp, drv_fw_mb[port].fw_mb_header);
-
+        rc = SHMEM_RD(bp, func_mb[port].fw_mb_header);
         DP(BNX2X_MSG_MCP, "read (%x) seq is (%x) from FW MB\n", rc, seq);
 
         /* is this a reply to our command? */
         if (seq == (rc & FW_MSG_SEQ_NUMBER_MASK)) {
                 rc &= FW_MSG_CODE_MASK;
+
         } else {
                 /* FW BUG! */
                 BNX2X_ERR("FW failed to respond!\n");
                 bnx2x_fw_dump(bp);
                 rc = 0;
         }
+
         return rc;
 }
 
@@ -5869,7 +6791,7 @@ static int bnx2x_alloc_mem(struct bnx2x *bp)
         for (i = 0; i < 16*1024; i += 64)
                 * (u64 *)((char *)bp->t2 + i + 56) = bp->t2_mapping + i + 64;
 
-        /* now sixup the last line in the block to point to the next block */
+        /* now fixup the last line in the block to point to the next block */
         *(u64 *)((char *)bp->t2 + 1024*16-8) = bp->t2_mapping;
 
         /* Timer block array (MAX_CONN*8) phys uncached for now 1024 conns */
@@ -5950,22 +6872,19 @@ static void bnx2x_free_msix_irqs(struct bnx2x *bp)
         int i;
 
         free_irq(bp->msix_table[0].vector, bp->dev);
-        DP(NETIF_MSG_IFDOWN, "rleased sp irq (%d)\n",
+        DP(NETIF_MSG_IFDOWN, "released sp irq (%d)\n",
            bp->msix_table[0].vector);
 
         for_each_queue(bp, i) {
-                DP(NETIF_MSG_IFDOWN, "about to rlease fp #%d->%d irq  "
+                DP(NETIF_MSG_IFDOWN, "about to release fp #%d->%d irq  "
                    "state(%x)\n", i, bp->msix_table[i + 1].vector,
                    bnx2x_fp(bp, i, state));
 
-                if (bnx2x_fp(bp, i, state) != BNX2X_FP_STATE_CLOSED) {
-
-                        free_irq(bp->msix_table[i + 1].vector, &bp->fp[i]);
-                        bnx2x_fp(bp, i, state) = BNX2X_FP_STATE_CLOSED;
-
-                } else
-                        DP(NETIF_MSG_IFDOWN, "irq not freed\n");
+                if (bnx2x_fp(bp, i, state) != BNX2X_FP_STATE_CLOSED)
+                        BNX2X_ERR("IRQ of fp #%d being freed while "
+                                  "state != closed\n", i);
 
+                free_irq(bp->msix_table[i + 1].vector, &bp->fp[i]);
         }
 
 }
@@ -5995,7 +6914,7 @@ static int bnx2x_enable_msix(struct bnx2x *bp)
 
         if (pci_enable_msix(bp->pdev, &bp->msix_table[0],
                                      bp->num_queues + 1)){
-                BNX2X_ERR("failed to enable msix\n");
+                BNX2X_LOG("failed to enable MSI-X\n");
                 return -1;
 
         }
@@ -6010,11 +6929,8 @@ static int bnx2x_enable_msix(struct bnx2x *bp)
 static int bnx2x_req_msix_irqs(struct bnx2x *bp)
 {
 
-
         int i, rc;
 
-        DP(NETIF_MSG_IFUP, "about to request sp irq\n");
-
         rc = request_irq(bp->msix_table[0].vector, bnx2x_msix_sp_int, 0,
                          bp->dev->name, bp->dev);
 
@@ -6029,7 +6945,8 @@ static int bnx2x_req_msix_irqs(struct bnx2x *bp)
                                  bp->dev->name, &bp->fp[i]);
 
                 if (rc) {
-                        BNX2X_ERR("request fp #%d irq failed\n", i);
+                        BNX2X_ERR("request fp #%d irq failed  "
+                                  "rc %d\n", i, rc);
                         bnx2x_free_msix_irqs(bp);
                         return -EBUSY;
                 }
@@ -6109,8 +7026,8 @@ static int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
         /* can take a while if any port is running */
         int timeout = 500;
 
-        /* DP("waiting for state to become %d on IDX [%d]\n",
-        state, sb_idx); */
+        DP(NETIF_MSG_IFUP, "%s for state to become %x on IDX [%d]\n",
+           poll ? "polling" : "waiting", state, idx);
 
         might_sleep();
 
@@ -6128,7 +7045,7 @@ static int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
 
                 mb(); /* state is changed by bnx2x_sp_event()*/
 
-                if (*state_p != state)
+                if (*state_p == state)
                         return 0;
 
                 timeout--;
@@ -6136,17 +7053,17 @@ static int bnx2x_wait_ramrod(struct bnx2x *bp, int state, int idx,
 
         }
 
-
         /* timeout! */
-        BNX2X_ERR("timeout waiting for ramrod %d on %d\n", state, idx);
-        return -EBUSY;
+        BNX2X_ERR("timeout %s for state %x on IDX [%d]\n",
+                  poll ? "polling" : "waiting", state, idx);
 
+        return -EBUSY;
 }
 
 static int bnx2x_setup_leading(struct bnx2x *bp)
 {
 
-        /* reset IGU staae */
+        /* reset IGU state */
         bnx2x_ack_sb(bp, DEF_SB_ID, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
 
         /* SETUP ramrod */
@@ -6162,12 +7079,13 @@ static int bnx2x_setup_multi(struct bnx2x *bp, int index)
         /* reset IGU state */
         bnx2x_ack_sb(bp, index, CSTORM_ID, 0, IGU_INT_ENABLE, 0);
 
+        /* SETUP ramrod */
         bp->fp[index].state = BNX2X_FP_STATE_OPENING;
         bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_CLIENT_SETUP, index, 0, index, 0);
 
         /* Wait for completion */
         return bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_OPEN, index,
-                                 &(bp->fp[index].state), 1);
+                                 &(bp->fp[index].state), 0);
 
 }
 
@@ -6177,8 +7095,8 @@ static void bnx2x_set_rx_mode(struct net_device *dev);
 
 static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
 {
-        int rc;
-        int i = 0;
+        u32 load_code;
+        int i;
 
         bp->state = BNX2X_STATE_OPENING_WAIT4_LOAD;
 
@@ -6188,26 +7106,28 @@ static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
            initialized, otherwise - not.
         */
         if (!nomcp) {
-                rc = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
-                if (rc == FW_MSG_CODE_DRV_LOAD_REFUSED) {
+                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
+                if (!load_code) {
+                        BNX2X_ERR("MCP response failure, unloading\n");
+                        return -EBUSY;
+                }
+                if (load_code == FW_MSG_CODE_DRV_LOAD_REFUSED) {
+                        BNX2X_ERR("MCP refused load request, unloading\n");
                         return -EBUSY; /* other port in diagnostic mode */
                 }
         } else {
-                rc = FW_MSG_CODE_DRV_LOAD_COMMON;
+                load_code = FW_MSG_CODE_DRV_LOAD_COMMON;
         }
 
-        DP(NETIF_MSG_IFUP, "set number of queues to %d\n", bp->num_queues);
-
         /* if we can't use msix we only need one fp,
          * so try to enable msix with the requested number of fp's
          * and fallback to inta with one fp
          */
         if (req_irq) {
-
                 if (use_inta) {
                         bp->num_queues = 1;
                 } else {
-                        if (use_multi > 1 && use_multi <= 16)
+                        if ((use_multi > 1) && (use_multi <= 16))
                                 /* user requested number */
                                 bp->num_queues = use_multi;
                         else if (use_multi == 1)
@@ -6216,15 +7136,17 @@ static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
                                 bp->num_queues = 1;
 
                         if (bnx2x_enable_msix(bp)) {
-                                /* faild to enable msix */
+                                /* failed to enable msix */
                                 bp->num_queues = 1;
                                 if (use_multi)
-                                        BNX2X_ERR("Muti requested but failed"
+                                        BNX2X_ERR("Multi requested but failed"
                                                   " to enable MSI-X\n");
                         }
                 }
         }
 
+        DP(NETIF_MSG_IFUP, "set number of queues to %d\n", bp->num_queues);
+
         if (bnx2x_alloc_mem(bp))
                 return -ENOMEM;
 
@@ -6232,13 +7154,13 @@ static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
                 if (bp->flags & USING_MSIX_FLAG) {
                         if (bnx2x_req_msix_irqs(bp)) {
                                 pci_disable_msix(bp->pdev);
-                                goto out_error;
+                                goto load_error;
                         }
 
                 } else {
                         if (bnx2x_req_irq(bp)) {
                                 BNX2X_ERR("IRQ request failed, aborting\n");
-                                goto out_error;
+                                goto load_error;
                         }
                 }
         }
@@ -6249,31 +7171,25 @@ static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
 
 
         /* Initialize HW */
-        if (bnx2x_function_init(bp, (rc == FW_MSG_CODE_DRV_LOAD_COMMON))) {
+        if (bnx2x_function_init(bp,
+                                (load_code == FW_MSG_CODE_DRV_LOAD_COMMON))) {
                 BNX2X_ERR("HW init failed, aborting\n");
-                goto out_error;
+                goto load_error;
         }
 
 
         atomic_set(&bp->intr_sem, 0);
 
-        /* Reenable SP tasklet */
-        /*if (bp->sp_task_en) {                */
-        /*        tasklet_enable(&bp->sp_task);*/
-        /*} else {                             */
-        /*        bp->sp_task_en = 1;          */
-        /*}                                    */
 
         /* Setup NIC internals and enable interrupts */
         bnx2x_nic_init(bp);
 
         /* Send LOAD_DONE command to MCP */
         if (!nomcp) {
-                rc = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE);
-                DP(NETIF_MSG_IFUP, "rc = 0x%x\n", rc);
-                if (!rc) {
+                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_DONE);
+                if (!load_code) {
                         BNX2X_ERR("MCP response failure, unloading\n");
-                        goto int_disable;
+                        goto load_int_disable;
                 }
         }
 
@@ -6285,11 +7201,11 @@ static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
                 napi_enable(&bnx2x_fp(bp, i, napi));
 
         if (bnx2x_setup_leading(bp))
-                goto stop_netif;
+                goto load_stop_netif;
 
         for_each_nondefault_queue(bp, i)
                 if (bnx2x_setup_multi(bp, i))
-                        goto stop_netif;
+                        goto load_stop_netif;
 
         bnx2x_set_mac_addr(bp);
 
@@ -6313,42 +7229,24 @@ static int bnx2x_nic_load(struct bnx2x *bp, int req_irq)
 
         return 0;
 
-stop_netif:
+load_stop_netif:
         for_each_queue(bp, i)
                 napi_disable(&bnx2x_fp(bp, i, napi));
 
-int_disable:
-        bnx2x_disable_int_sync(bp);
+load_int_disable:
+        bnx2x_int_disable_sync(bp);
 
         bnx2x_free_skbs(bp);
         bnx2x_free_irq(bp);
 
-out_error:
+load_error:
         bnx2x_free_mem(bp);
 
         /* TBD we really need to reset the chip
            if we want to recover from this */
-        return rc;
+        return -EBUSY;
 }
 
-static void bnx2x_netif_stop(struct bnx2x *bp)
-{
-        int i;
-
-        bp->rx_mode = BNX2X_RX_MODE_NONE;
-        bnx2x_set_storm_rx_mode(bp);
-
-        bnx2x_disable_int_sync(bp);
-        bnx2x_link_reset(bp);
-
-        for_each_queue(bp, i)
-                napi_disable(&bnx2x_fp(bp, i, napi));
-
-        if (netif_running(bp->dev)) {
-                netif_tx_disable(bp->dev);
-                bp->dev->trans_start = jiffies; /* prevent tx timeout */
-        }
-}
 
 static void bnx2x_reset_chip(struct bnx2x *bp, u32 reset_code)
 {
@@ -6401,20 +7299,20 @@ static int bnx2x_stop_multi(struct bnx2x *bp, int index)
 
         int rc;
 
-        /* halt the connnection */
+        /* halt the connection */
         bp->fp[index].state = BNX2X_FP_STATE_HALTING;
         bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, index, 0, 0, 0);
 
 
         rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_HALTED, index,
                                        &(bp->fp[index].state), 1);
-        if (rc) /* timout */
+        if (rc) /* timeout */
                 return rc;
 
         /* delete cfc entry */
         bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_CFC_DEL, index, 0, 0, 1);
 
-        return bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_DELETED, index,
+        return bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_CLOSED, index,
                                  &(bp->fp[index].state), 1);
 
 }
@@ -6422,8 +7320,8 @@ static int bnx2x_stop_multi(struct bnx2x *bp, int index)
 
 static void bnx2x_stop_leading(struct bnx2x *bp)
 {
-
-        /* if the other port is hadling traffic,
+        u16 dsb_sp_prod_idx;
+        /* if the other port is handling traffic,
            this can take a lot of time */
         int timeout = 500;
 
@@ -6437,52 +7335,71 @@ static void bnx2x_stop_leading(struct bnx2x *bp)
                                &(bp->fp[0].state), 1))
                 return;
 
-        bp->dsb_sp_prod_idx = *bp->dsb_sp_prod;
+        dsb_sp_prod_idx = *bp->dsb_sp_prod;
 
-        /* Send CFC_DELETE ramrod */
+        /* Send PORT_DELETE ramrod */
         bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_PORT_DEL, 0, 0, 0, 1);
 
-        /*
-           Wait for completion.
+        /* Wait for completion to arrive on default status block
            we are going to reset the chip anyway
            so there is not much to do if this times out
          */
-        while (bp->dsb_sp_prod_idx == *bp->dsb_sp_prod && timeout) {
-                        timeout--;
-                        msleep(1);
+        while ((dsb_sp_prod_idx == *bp->dsb_sp_prod) && timeout) {
+                timeout--;
+                msleep(1);
         }
-
+        if (!timeout) {
+                DP(NETIF_MSG_IFDOWN, "timeout polling for completion "
+                   "dsb_sp_prod 0x%x != dsb_sp_prod_idx 0x%x\n",
+                   *bp->dsb_sp_prod, dsb_sp_prod_idx);
+        }
+        bp->state = BNX2X_STATE_CLOSING_WAIT4_UNLOAD;
+        bp->fp[0].state = BNX2X_FP_STATE_CLOSED;
 }
 
-static int bnx2x_nic_unload(struct bnx2x *bp, int fre_irq)
+
+static int bnx2x_nic_unload(struct bnx2x *bp, int free_irq)
 {
         u32 reset_code = 0;
-        int rc;
-        int i;
+        int i, timeout;
 
         bp->state = BNX2X_STATE_CLOSING_WAIT4_HALT;
 
-        /* Calling flush_scheduled_work() may deadlock because
-         * linkwatch_event() may be on the workqueue and it will try to get
-         * the rtnl_lock which we are holding.
-         */
+        del_timer_sync(&bp->timer);
 
-        while (bp->in_reset_task)
-                msleep(1);
+        bp->rx_mode = BNX2X_RX_MODE_NONE;
+        bnx2x_set_storm_rx_mode(bp);
 
-        /* Delete the timer: do it before disabling interrupts, as it
-           may be stil STAT_QUERY ramrod pending after stopping the timer */
-        del_timer_sync(&bp->timer);
+        if (netif_running(bp->dev)) {
+                netif_tx_disable(bp->dev);
+                bp->dev->trans_start = jiffies; /* prevent tx timeout */
+        }
+
+        /* Wait until all fast path tasks complete */
+        for_each_queue(bp, i) {
+                struct bnx2x_fastpath *fp = &bp->fp[i];
+
+                timeout = 1000;
+                while (bnx2x_has_work(fp) && (timeout--))
+                        msleep(1);
+                if (!timeout)
+                        BNX2X_ERR("timeout waiting for queue[%d]\n", i);
+        }
 
         /* Wait until stat ramrod returns and all SP tasks complete */
-        while (bp->stat_pending && (bp->spq_left != MAX_SPQ_PENDING))
+        timeout = 1000;
+        while ((bp->stat_pending || (bp->spq_left != MAX_SPQ_PENDING)) &&
+               (timeout--))
                 msleep(1);
 
-        /* Stop fast path, disable MAC, disable interrupts, disable napi */
-        bnx2x_netif_stop(bp);
+        for_each_queue(bp, i)
+                napi_disable(&bnx2x_fp(bp, i, napi));
+        /* Disable interrupts after Tx and Rx are disabled on stack level */
+        bnx2x_int_disable_sync(bp);
 
         if (bp->flags & NO_WOL_FLAG)
                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP;
+
         else if (bp->wol) {
                 u32 emac_base = bp->port ? GRCBASE_EMAC0 : GRCBASE_EMAC1;
                 u8 *mac_addr = bp->dev->dev_addr;
@@ -6499,28 +7416,37 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int fre_irq)
                 EMAC_WR(EMAC_REG_EMAC_MAC_MATCH + 4, val);
 
                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
+
         } else
                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
 
+        /* Close multi and leading connections */
         for_each_nondefault_queue(bp, i)
                 if (bnx2x_stop_multi(bp, i))
-                        goto error;
-
+                        goto unload_error;
 
         bnx2x_stop_leading(bp);
+        if ((bp->state != BNX2X_STATE_CLOSING_WAIT4_UNLOAD) ||
+            (bp->fp[0].state != BNX2X_FP_STATE_CLOSED)) {
+                DP(NETIF_MSG_IFDOWN, "failed to close leading properly!"
+                   "state 0x%x  fp[0].state 0x%x",
+                   bp->state, bp->fp[0].state);
+        }
+
+unload_error:
+        bnx2x_link_reset(bp);
 
-error:
         if (!nomcp)
-                rc = bnx2x_fw_command(bp, reset_code);
+                reset_code = bnx2x_fw_command(bp, reset_code);
         else
-                rc = FW_MSG_CODE_DRV_UNLOAD_COMMON;
+                reset_code = FW_MSG_CODE_DRV_UNLOAD_COMMON;
 
         /* Release IRQs */
-        if (fre_irq)
+        if (free_irq)
                 bnx2x_free_irq(bp);
 
         /* Reset the chip */
-        bnx2x_reset_chip(bp, rc);
+        bnx2x_reset_chip(bp, reset_code);
 
         /* Report UNLOAD_DONE to MCP */
         if (!nomcp)
@@ -6531,8 +7457,7 @@ error:
         bnx2x_free_mem(bp);
 
         bp->state = BNX2X_STATE_CLOSED;
-        /* Set link down */
-        bp->link_up = 0;
+
         netif_carrier_off(bp->dev);
 
         return 0;
@@ -6568,7 +7493,7 @@ static void bnx2x_link_settings_supported(struct bnx2x *bp, u32 switch_cfg)
                                           SUPPORTED_100baseT_Half |
                                           SUPPORTED_100baseT_Full |
                                           SUPPORTED_1000baseT_Full |
-                                          SUPPORTED_2500baseT_Full |
+                                          SUPPORTED_2500baseX_Full |
                                           SUPPORTED_TP | SUPPORTED_FIBRE |
                                           SUPPORTED_Autoneg |
                                           SUPPORTED_Pause |
@@ -6581,10 +7506,10 @@ static void bnx2x_link_settings_supported(struct bnx2x *bp, u32 switch_cfg)
 
                         bp->phy_flags |= PHY_SGMII_FLAG;
 
-                        bp->supported |= (/* SUPPORTED_10baseT_Half |
-                                             SUPPORTED_10baseT_Full |
-                                             SUPPORTED_100baseT_Half |
-                                             SUPPORTED_100baseT_Full |*/
+                        bp->supported |= (SUPPORTED_10baseT_Half |
+                                          SUPPORTED_10baseT_Full |
+                                          SUPPORTED_100baseT_Half |
+                                          SUPPORTED_100baseT_Full |
                                           SUPPORTED_1000baseT_Full |
                                           SUPPORTED_TP | SUPPORTED_FIBRE |
                                           SUPPORTED_Autoneg |
@@ -6620,7 +7545,7 @@ static void bnx2x_link_settings_supported(struct bnx2x *bp, u32 switch_cfg)
                                           SUPPORTED_100baseT_Half |
                                           SUPPORTED_100baseT_Full |
                                           SUPPORTED_1000baseT_Full |
-                                          SUPPORTED_2500baseT_Full |
+                                          SUPPORTED_2500baseX_Full |
                                           SUPPORTED_10000baseT_Full |
                                           SUPPORTED_TP | SUPPORTED_FIBRE |
                                           SUPPORTED_Autoneg |
@@ -6629,12 +7554,46 @@ static void bnx2x_link_settings_supported(struct bnx2x *bp, u32 switch_cfg)
                         break;
 
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
+                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8705)\n",
+                                        ext_phy_type);
+
+                        bp->supported |= (SUPPORTED_10000baseT_Full |
+                                          SUPPORTED_FIBRE |
+                                          SUPPORTED_Pause |
+                                          SUPPORTED_Asym_Pause);
+                        break;
+
                 case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
-                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8705/6)\n",
+                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8706)\n",
+                                       ext_phy_type);
+
+                        bp->supported |= (SUPPORTED_10000baseT_Full |
+                                          SUPPORTED_1000baseT_Full |
+                                          SUPPORTED_Autoneg |
+                                          SUPPORTED_FIBRE |
+                                          SUPPORTED_Pause |
+                                          SUPPORTED_Asym_Pause);
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
+                        BNX2X_DEV_INFO("ext_phy_type 0x%x (8072)\n",
                                        ext_phy_type);
 
                         bp->supported |= (SUPPORTED_10000baseT_Full |
+                                          SUPPORTED_1000baseT_Full |
                                           SUPPORTED_FIBRE |
+                                          SUPPORTED_Autoneg |
+                                          SUPPORTED_Pause |
+                                          SUPPORTED_Asym_Pause);
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+                        BNX2X_DEV_INFO("ext_phy_type 0x%x (SFX7101)\n",
+                                       ext_phy_type);
+
+                        bp->supported |= (SUPPORTED_10000baseT_Full |
+                                          SUPPORTED_TP |
+                                          SUPPORTED_Autoneg |
                                           SUPPORTED_Pause |
                                           SUPPORTED_Asym_Pause);
                         break;
@@ -6691,7 +7650,7 @@ static void bnx2x_link_settings_supported(struct bnx2x *bp, u32 switch_cfg)
                                    SUPPORTED_1000baseT_Full);
 
         if (!(bp->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G))
-                bp->supported &= ~SUPPORTED_2500baseT_Full;
+                bp->supported &= ~SUPPORTED_2500baseX_Full;
 
         if (!(bp->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_10G))
                 bp->supported &= ~SUPPORTED_10000baseT_Full;
@@ -6711,13 +7670,8 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                         bp->req_line_speed = 0;
                         bp->advertising = bp->supported;
                 } else {
-                        u32 ext_phy_type;
-
-                        ext_phy_type = XGXS_EXT_PHY_TYPE(bp);
-                        if ((ext_phy_type ==
-                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705) ||
-                            (ext_phy_type ==
-                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706)) {
+                        if (XGXS_EXT_PHY_TYPE(bp) ==
+                                PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705) {
                                 /* force 10G, no AN */
                                 bp->req_line_speed = SPEED_10000;
                                 bp->advertising =
@@ -6734,8 +7688,7 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                 break;
 
         case PORT_FEATURE_LINK_SPEED_10M_FULL:
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) {
+                if (bp->supported & SUPPORTED_10baseT_Full) {
                         bp->req_line_speed = SPEED_10;
                         bp->advertising = (ADVERTISED_10baseT_Full |
                                            ADVERTISED_TP);
@@ -6749,8 +7702,7 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                 break;
 
         case PORT_FEATURE_LINK_SPEED_10M_HALF:
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) {
+                if (bp->supported & SUPPORTED_10baseT_Half) {
                         bp->req_line_speed = SPEED_10;
                         bp->req_duplex = DUPLEX_HALF;
                         bp->advertising = (ADVERTISED_10baseT_Half |
@@ -6765,8 +7717,7 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                 break;
 
         case PORT_FEATURE_LINK_SPEED_100M_FULL:
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
+                if (bp->supported & SUPPORTED_100baseT_Full) {
                         bp->req_line_speed = SPEED_100;
                         bp->advertising = (ADVERTISED_100baseT_Full |
                                            ADVERTISED_TP);
@@ -6780,8 +7731,7 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                 break;
 
         case PORT_FEATURE_LINK_SPEED_100M_HALF:
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
+                if (bp->supported & SUPPORTED_100baseT_Half) {
                         bp->req_line_speed = SPEED_100;
                         bp->req_duplex = DUPLEX_HALF;
                         bp->advertising = (ADVERTISED_100baseT_Half |
@@ -6796,8 +7746,7 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                 break;
 
         case PORT_FEATURE_LINK_SPEED_1G:
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_1G) {
+                if (bp->supported & SUPPORTED_1000baseT_Full) {
                         bp->req_line_speed = SPEED_1000;
                         bp->advertising = (ADVERTISED_1000baseT_Full |
                                            ADVERTISED_TP);
@@ -6811,10 +7760,9 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
                 break;
 
         case PORT_FEATURE_LINK_SPEED_2_5G:
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_2_5G) {
+                if (bp->supported & SUPPORTED_2500baseX_Full) {
                         bp->req_line_speed = SPEED_2500;
-                        bp->advertising = (ADVERTISED_2500baseT_Full |
+                        bp->advertising = (ADVERTISED_2500baseX_Full |
                                            ADVERTISED_TP);
                 } else {
                         BNX2X_ERR("NVRAM config error. "
@@ -6828,15 +7776,7 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
         case PORT_FEATURE_LINK_SPEED_10G_CX4:
         case PORT_FEATURE_LINK_SPEED_10G_KX4:
         case PORT_FEATURE_LINK_SPEED_10G_KR:
-                if (!(bp->phy_flags & PHY_XGXS_FLAG)) {
-                        BNX2X_ERR("NVRAM config error. "
-                                  "Invalid link_config 0x%x"
-                                  "  phy_flags 0x%x\n",
-                                  bp->link_config, bp->phy_flags);
-                        return;
-                }
-                if (bp->speed_cap_mask &
-                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10G) {
+                if (bp->supported & SUPPORTED_10000baseT_Full) {
                         bp->req_line_speed = SPEED_10000;
                         bp->advertising = (ADVERTISED_10000baseT_Full |
                                            ADVERTISED_FIBRE);
@@ -6863,43 +7803,13 @@ static void bnx2x_link_settings_requested(struct bnx2x *bp)
 
         bp->req_flow_ctrl = (bp->link_config &
                              PORT_FEATURE_FLOW_CONTROL_MASK);
-        /* Please refer to Table 28B-3 of the 802.3ab-1999 spec */
-        switch (bp->req_flow_ctrl) {
-        case FLOW_CTRL_AUTO:
+        if ((bp->req_flow_ctrl == FLOW_CTRL_AUTO) &&
+            (bp->supported & SUPPORTED_Autoneg))
                 bp->req_autoneg |= AUTONEG_FLOW_CTRL;
-                if (bp->dev->mtu <= 4500) {
-                        bp->pause_mode = PAUSE_BOTH;
-                        bp->advertising |= (ADVERTISED_Pause |
-                                            ADVERTISED_Asym_Pause);
-                } else {
-                        bp->pause_mode = PAUSE_ASYMMETRIC;
-                        bp->advertising |= ADVERTISED_Asym_Pause;
-                }
-                break;
-
-        case FLOW_CTRL_TX:
-                bp->pause_mode = PAUSE_ASYMMETRIC;
-                bp->advertising |= ADVERTISED_Asym_Pause;
-                break;
-
-        case FLOW_CTRL_RX:
-        case FLOW_CTRL_BOTH:
-                bp->pause_mode = PAUSE_BOTH;
-                bp->advertising |= (ADVERTISED_Pause |
-                                    ADVERTISED_Asym_Pause);
-                break;
 
-        case FLOW_CTRL_NONE:
-        default:
-                bp->pause_mode = PAUSE_NONE;
-                bp->advertising &= ~(ADVERTISED_Pause |
-                                     ADVERTISED_Asym_Pause);
-                break;
-        }
-        BNX2X_DEV_INFO("req_autoneg 0x%x  req_flow_ctrl 0x%x\n"
-             KERN_INFO "  pause_mode %d  advertising 0x%x\n",
-                       bp->req_autoneg, bp->req_flow_ctrl,
-                       bp->pause_mode, bp->advertising);
+        BNX2X_DEV_INFO("req_autoneg 0x%x  req_flow_ctrl 0x%x"
+                       "  advertising 0x%x\n",
+                       bp->req_autoneg, bp->req_flow_ctrl, bp->advertising);
 }
 
 static void bnx2x_get_hwinfo(struct bnx2x *bp)
@@ -6933,15 +7843,15 @@ static void bnx2x_get_hwinfo(struct bnx2x *bp)
         val = SHMEM_RD(bp, validity_map[port]);
         if ((val & (SHR_MEM_VALIDITY_DEV_INFO | SHR_MEM_VALIDITY_MB))
                 != (SHR_MEM_VALIDITY_DEV_INFO | SHR_MEM_VALIDITY_MB))
-                BNX2X_ERR("MCP validity signature bad\n");
+                BNX2X_ERR("BAD MCP validity signature\n");
 
-        bp->fw_seq = (SHMEM_RD(bp, drv_fw_mb[port].drv_mb_header) &
+        bp->fw_seq = (SHMEM_RD(bp, func_mb[port].drv_mb_header) &
                       DRV_MSG_SEQ_NUMBER_MASK);
 
         bp->hw_config = SHMEM_RD(bp, dev_info.shared_hw_config.config);
-
+        bp->board = SHMEM_RD(bp, dev_info.shared_hw_config.board);
         bp->serdes_config =
-                SHMEM_RD(bp, dev_info.port_hw_config[bp->port].serdes_config);
+                SHMEM_RD(bp, dev_info.port_hw_config[port].serdes_config);
         bp->lane_config =
                 SHMEM_RD(bp, dev_info.port_hw_config[port].lane_config);
         bp->ext_phy_config =
@@ -6954,13 +7864,13 @@ static void bnx2x_get_hwinfo(struct bnx2x *bp)
         bp->link_config =
                 SHMEM_RD(bp, dev_info.port_feature_config[port].link_config);
 
-        BNX2X_DEV_INFO("hw_config (%08x)  serdes_config (%08x)\n"
+        BNX2X_DEV_INFO("hw_config (%08x) board (%08x)  serdes_config (%08x)\n"
              KERN_INFO "  lane_config (%08x)  ext_phy_config (%08x)\n"
              KERN_INFO "  speed_cap_mask (%08x)  link_config (%08x)"
                        "  fw_seq (%08x)\n",
-                       bp->hw_config, bp->serdes_config, bp->lane_config,
-                       bp->ext_phy_config, bp->speed_cap_mask,
-                       bp->link_config, bp->fw_seq);
+                       bp->hw_config, bp->board, bp->serdes_config,
+                       bp->lane_config, bp->ext_phy_config,
+                       bp->speed_cap_mask, bp->link_config, bp->fw_seq);
 
         switch_cfg = (bp->link_config & PORT_FEATURE_CONNECTED_SWITCH_MASK);
         bnx2x_link_settings_supported(bp, switch_cfg);
@@ -7014,14 +7924,8 @@ static void bnx2x_get_hwinfo(struct bnx2x *bp)
         return;
 
 set_mac: /* only supposed to happen on emulation/FPGA */
-        BNX2X_ERR("warning constant MAC workaround active\n");
-        bp->dev->dev_addr[0] = 0;
-        bp->dev->dev_addr[1] = 0x50;
-        bp->dev->dev_addr[2] = 0xc2;
-        bp->dev->dev_addr[3] = 0x2c;
-        bp->dev->dev_addr[4] = 0x71;
-        bp->dev->dev_addr[5] = port ? 0x0d : 0x0e;
-
+        BNX2X_ERR("warning rendom MAC workaround active\n");
+        random_ether_addr(bp->dev->dev_addr);
         memcpy(bp->dev->perm_addr, bp->dev->dev_addr, 6);
 
 }
@@ -7048,19 +7952,34 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         }
 
         if (bp->phy_flags & PHY_XGXS_FLAG) {
-                cmd->port = PORT_FIBRE;
-        } else {
+                u32 ext_phy_type = XGXS_EXT_PHY_TYPE(bp);
+
+                switch (ext_phy_type) {
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8705:
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706:
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8072:
+                        cmd->port = PORT_FIBRE;
+                        break;
+
+                case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101:
+                        cmd->port = PORT_TP;
+                        break;
+
+                default:
+                        DP(NETIF_MSG_LINK, "BAD XGXS ext_phy_config 0x%x\n",
+                           bp->ext_phy_config);
+                }
+        } else
                 cmd->port = PORT_TP;
-        }
 
         cmd->phy_address = bp->phy_addr;
         cmd->transceiver = XCVR_INTERNAL;
 
-        if (bp->req_autoneg & AUTONEG_SPEED) {
+        if (bp->req_autoneg & AUTONEG_SPEED)
                 cmd->autoneg = AUTONEG_ENABLE;
-        } else {
+        else
                 cmd->autoneg = AUTONEG_DISABLE;
-        }
 
         cmd->maxtxpkt = 0;
         cmd->maxrxpkt = 0;
@@ -7091,8 +8010,10 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 
         switch (cmd->port) {
         case PORT_TP:
-                if (!(bp->supported & SUPPORTED_TP))
+                if (!(bp->supported & SUPPORTED_TP)) {
+                        DP(NETIF_MSG_LINK, "TP not supported\n");
                         return -EINVAL;
+                }
 
                 if (bp->phy_flags & PHY_XGXS_FLAG) {
                         bnx2x_link_reset(bp);
@@ -7102,8 +8023,10 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 break;
 
         case PORT_FIBRE:
-                if (!(bp->supported & SUPPORTED_FIBRE))
+                if (!(bp->supported & SUPPORTED_FIBRE)) {
+                        DP(NETIF_MSG_LINK, "FIBRE not supported\n");
                         return -EINVAL;
+                }
 
                 if (!(bp->phy_flags & PHY_XGXS_FLAG)) {
                         bnx2x_link_reset(bp);
@@ -7113,12 +8036,15 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 break;
 
         default:
+                DP(NETIF_MSG_LINK, "Unknown port type\n");
                 return -EINVAL;
         }
 
         if (cmd->autoneg == AUTONEG_ENABLE) {
-                if (!(bp->supported & SUPPORTED_Autoneg))
+                if (!(bp->supported & SUPPORTED_Autoneg)) {
+                        DP(NETIF_MSG_LINK, "Aotoneg not supported\n");
                         return -EINVAL;
+                }
 
                 /* advertise the requested speed and duplex if supported */
                 cmd->advertising &= bp->supported;
@@ -7133,14 +8059,22 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 switch (cmd->speed) {
                 case SPEED_10:
                         if (cmd->duplex == DUPLEX_FULL) {
-                                if (!(bp->supported & SUPPORTED_10baseT_Full))
+                                if (!(bp->supported &
+                                      SUPPORTED_10baseT_Full)) {
+                                        DP(NETIF_MSG_LINK,
+                                           "10M full not supported\n");
                                         return -EINVAL;
+                                }
 
                                 advertising = (ADVERTISED_10baseT_Full |
                                                ADVERTISED_TP);
                         } else {
-                                if (!(bp->supported & SUPPORTED_10baseT_Half))
+                                if (!(bp->supported &
+                                      SUPPORTED_10baseT_Half)) {
+                                        DP(NETIF_MSG_LINK,
+                                           "10M half not supported\n");
                                         return -EINVAL;
+                                }
 
                                 advertising = (ADVERTISED_10baseT_Half |
                                                ADVERTISED_TP);
@@ -7150,15 +8084,21 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 case SPEED_100:
                         if (cmd->duplex == DUPLEX_FULL) {
                                 if (!(bp->supported &
-                                                SUPPORTED_100baseT_Full))
+                                                SUPPORTED_100baseT_Full)) {
+                                        DP(NETIF_MSG_LINK,
+                                           "100M full not supported\n");
                                         return -EINVAL;
+                                }
 
                                 advertising = (ADVERTISED_100baseT_Full |
                                                ADVERTISED_TP);
                         } else {
                                 if (!(bp->supported &
-                                                SUPPORTED_100baseT_Half))
+                                                SUPPORTED_100baseT_Half)) {
+                                        DP(NETIF_MSG_LINK,
+                                           "100M half not supported\n");
                                         return -EINVAL;
+                                }
 
                                 advertising = (ADVERTISED_100baseT_Half |
                                                ADVERTISED_TP);
@@ -7166,39 +8106,54 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         break;
 
                 case SPEED_1000:
-                        if (cmd->duplex != DUPLEX_FULL)
+                        if (cmd->duplex != DUPLEX_FULL) {
+                                DP(NETIF_MSG_LINK, "1G half not supported\n");
                                 return -EINVAL;
+                        }
 
-                        if (!(bp->supported & SUPPORTED_1000baseT_Full))
+                        if (!(bp->supported & SUPPORTED_1000baseT_Full)) {
+                                DP(NETIF_MSG_LINK, "1G full not supported\n");
                                 return -EINVAL;
+                        }
 
                         advertising = (ADVERTISED_1000baseT_Full |
                                        ADVERTISED_TP);
                         break;
 
                 case SPEED_2500:
-                        if (cmd->duplex != DUPLEX_FULL)
+                        if (cmd->duplex != DUPLEX_FULL) {
+                                DP(NETIF_MSG_LINK,
+                                   "2.5G half not supported\n");
                                 return -EINVAL;
+                        }
 
-                        if (!(bp->supported & SUPPORTED_2500baseT_Full))
+                        if (!(bp->supported & SUPPORTED_2500baseX_Full)) {
+                                DP(NETIF_MSG_LINK,
+                                   "2.5G full not supported\n");
                                 return -EINVAL;
+                        }
 
-                        advertising = (ADVERTISED_2500baseT_Full |
+                        advertising = (ADVERTISED_2500baseX_Full |
                                        ADVERTISED_TP);
                         break;
 
                 case SPEED_10000:
-                        if (cmd->duplex != DUPLEX_FULL)
+                        if (cmd->duplex != DUPLEX_FULL) {
+                                DP(NETIF_MSG_LINK, "10G half not supported\n");
                                 return -EINVAL;
+                        }
 
-                        if (!(bp->supported & SUPPORTED_10000baseT_Full))
+                        if (!(bp->supported & SUPPORTED_10000baseT_Full)) {
+                                DP(NETIF_MSG_LINK, "10G full not supported\n");
                                 return -EINVAL;
+                        }
 
                         advertising = (ADVERTISED_10000baseT_Full |
                                        ADVERTISED_FIBRE);
                         break;
 
                 default:
+                        DP(NETIF_MSG_LINK, "Unsupported speed\n");
                         return -EINVAL;
                 }
 
@@ -7398,8 +8353,7 @@ static void bnx2x_disable_nvram_access(struct bnx2x *bp)
 static int bnx2x_nvram_read_dword(struct bnx2x *bp, u32 offset, u32 *ret_val,
                                   u32 cmd_flags)
 {
-        int rc;
-        int count, i;
+        int count, i, rc;
         u32 val;
 
         /* build the command word */
@@ -7452,13 +8406,13 @@ static int bnx2x_nvram_read(struct bnx2x *bp, u32 offset, u8 *ret_buf,
 
         if ((offset & 0x03) || (buf_size & 0x03) || (buf_size == 0)) {
                 DP(NETIF_MSG_NVM,
-                   "Invalid paramter: offset 0x%x  buf_size 0x%x\n",
+                   "Invalid parameter: offset 0x%x  buf_size 0x%x\n",
                    offset, buf_size);
                 return -EINVAL;
         }
 
         if (offset + buf_size > bp->flash_size) {
-                DP(NETIF_MSG_NVM, "Invalid paramter: offset (0x%x) +"
+                DP(NETIF_MSG_NVM, "Invalid parameter: offset (0x%x) +"
                                   " buf_size (0x%x) > flash_size (0x%x)\n",
                    offset, buf_size, bp->flash_size);
                 return -EINVAL;
@@ -7519,8 +8473,7 @@ static int bnx2x_get_eeprom(struct net_device *dev,
 static int bnx2x_nvram_write_dword(struct bnx2x *bp, u32 offset, u32 val,
                                    u32 cmd_flags)
 {
-        int rc;
-        int count, i;
+        int count, i, rc;
 
         /* build the command word */
         cmd_flags |= MCPR_NVM_COMMAND_DOIT | MCPR_NVM_COMMAND_WR;
@@ -7557,7 +8510,7 @@ static int bnx2x_nvram_write_dword(struct bnx2x *bp, u32 offset, u32 val,
         return rc;
 }
 
-#define BYTE_OFFSET(offset)             (8 * (offset & 0x03))
+#define BYTE_OFFSET(offset)             (8 * (offset & 0x03))
 
 static int bnx2x_nvram_write1(struct bnx2x *bp, u32 offset, u8 *data_buf,
                               int buf_size)
@@ -7568,7 +8521,7 @@ static int bnx2x_nvram_write1(struct bnx2x *bp, u32 offset, u8 *data_buf,
         u32 val;
 
         if (offset + buf_size > bp->flash_size) {
-                DP(NETIF_MSG_NVM, "Invalid paramter: offset (0x%x) +"
+                DP(NETIF_MSG_NVM, "Invalid parameter: offset (0x%x) +"
                                   " buf_size (0x%x) > flash_size (0x%x)\n",
                    offset, buf_size, bp->flash_size);
                 return -EINVAL;
@@ -7621,13 +8574,13 @@ static int bnx2x_nvram_write(struct bnx2x *bp, u32 offset, u8 *data_buf,
 
         if ((offset & 0x03) || (buf_size & 0x03) || (buf_size == 0)) {
                 DP(NETIF_MSG_NVM,
-                   "Invalid paramter: offset 0x%x  buf_size 0x%x\n",
+                   "Invalid parameter: offset 0x%x  buf_size 0x%x\n",
                    offset, buf_size);
                 return -EINVAL;
         }
 
         if (offset + buf_size > bp->flash_size) {
-                DP(NETIF_MSG_NVM, "Invalid paramter: offset (0x%x) +"
+                DP(NETIF_MSG_NVM, "Invalid parameter: offset (0x%x) +"
                                   " buf_size (0x%x) > flash_size (0x%x)\n",
                    offset, buf_size, bp->flash_size);
                 return -EINVAL;
@@ -7788,52 +8741,29 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
            DP_LEVEL "  autoneg %d  rx_pause %d  tx_pause %d\n",
            epause->cmd, epause->autoneg, epause->rx_pause, epause->tx_pause);
 
-        bp->req_flow_ctrl = FLOW_CTRL_AUTO;
         if (epause->autoneg) {
-                bp->req_autoneg |= AUTONEG_FLOW_CTRL;
-                if (bp->dev->mtu <= 4500) {
-                        bp->pause_mode = PAUSE_BOTH;
-                        bp->advertising |= (ADVERTISED_Pause |
-                                            ADVERTISED_Asym_Pause);
-                } else {
-                        bp->pause_mode = PAUSE_ASYMMETRIC;
-                        bp->advertising |= ADVERTISED_Asym_Pause;
+                if (!(bp->supported & SUPPORTED_Autoneg)) {
+                        DP(NETIF_MSG_LINK, "Aotoneg not supported\n");
+                        return -EINVAL;
                 }
 
-        } else {
+                bp->req_autoneg |= AUTONEG_FLOW_CTRL;
+        } else
                 bp->req_autoneg &= ~AUTONEG_FLOW_CTRL;
 
-                if (epause->rx_pause)
-                        bp->req_flow_ctrl |= FLOW_CTRL_RX;
-                if (epause->tx_pause)
-                        bp->req_flow_ctrl |= FLOW_CTRL_TX;
-
-                switch (bp->req_flow_ctrl) {
-                case FLOW_CTRL_AUTO:
-                        bp->req_flow_ctrl = FLOW_CTRL_NONE;
-                        bp->pause_mode = PAUSE_NONE;
-                        bp->advertising &= ~(ADVERTISED_Pause |
-                                             ADVERTISED_Asym_Pause);
-                        break;
+        bp->req_flow_ctrl = FLOW_CTRL_AUTO;
 
-                case FLOW_CTRL_TX:
-                        bp->pause_mode = PAUSE_ASYMMETRIC;
-                        bp->advertising |= ADVERTISED_Asym_Pause;
-                        break;
+        if (epause->rx_pause)
+                bp->req_flow_ctrl |= FLOW_CTRL_RX;
+        if (epause->tx_pause)
+                bp->req_flow_ctrl |= FLOW_CTRL_TX;
 
-                case FLOW_CTRL_RX:
-                case FLOW_CTRL_BOTH:
-                        bp->pause_mode = PAUSE_BOTH;
-                        bp->advertising |= (ADVERTISED_Pause |
-                                            ADVERTISED_Asym_Pause);
-                        break;
-                }
-        }
+        if (!(bp->req_autoneg & AUTONEG_FLOW_CTRL) &&
+            (bp->req_flow_ctrl == FLOW_CTRL_AUTO))
+                bp->req_flow_ctrl = FLOW_CTRL_NONE;
 
-        DP(NETIF_MSG_LINK, "req_autoneg 0x%x  req_flow_ctrl 0x%x\n"
-           DP_LEVEL "  pause_mode %d  advertising 0x%x\n",
-           bp->req_autoneg, bp->req_flow_ctrl, bp->pause_mode,
-           bp->advertising);
+        DP(NETIF_MSG_LINK, "req_autoneg 0x%x  req_flow_ctrl 0x%x\n",
+           bp->req_autoneg, bp->req_flow_ctrl);
 
         bnx2x_stop_stats(bp);
         bnx2x_link_initialize(bp);
@@ -7906,81 +8836,87 @@ static void bnx2x_self_test(struct net_device *dev,
 static struct {
         char string[ETH_GSTRING_LEN];
 } bnx2x_stats_str_arr[BNX2X_NUM_STATS] = {
-        { "rx_bytes"},                           /*  0 */
-        { "rx_error_bytes"},                     /*  1 */
-        { "tx_bytes"},                           /*  2 */
-        { "tx_error_bytes"},                     /*  3 */
-        { "rx_ucast_packets"},                   /*  4 */
-        { "rx_mcast_packets"},                   /*  5 */
-        { "rx_bcast_packets"},                   /*  6 */
-        { "tx_ucast_packets"},                   /*  7 */
-        { "tx_mcast_packets"},                   /*  8 */
-        { "tx_bcast_packets"},                   /*  9 */
-        { "tx_mac_errors"},                      /* 10 */
-        { "tx_carrier_errors"},                  /* 11 */
-        { "rx_crc_errors"},                      /* 12 */
-        { "rx_align_errors"},                    /* 13 */
-        { "tx_single_collisions"},               /* 14 */
-        { "tx_multi_collisions"},                /* 15 */
-        { "tx_deferred"},                        /* 16 */
-        { "tx_excess_collisions"},               /* 17 */
-        { "tx_late_collisions"},                 /* 18 */
-        { "tx_total_collisions"},                /* 19 */
-        { "rx_fragments"},                       /* 20 */
-        { "rx_jabbers"},                         /* 21 */
-        { "rx_undersize_packets"},               /* 22 */
-        { "rx_oversize_packets"},                /* 23 */
-        { "rx_xon_frames"},                      /* 24 */
-        { "rx_xoff_frames"},                     /* 25 */
-        { "tx_xon_frames"},                      /* 26 */
-        { "tx_xoff_frames"},                     /* 27 */
-        { "rx_mac_ctrl_frames"},                 /* 28 */
-        { "rx_filtered_packets"},                /* 29 */
-        { "rx_discards"},                        /* 30 */
+        { "rx_bytes"},
+        { "rx_error_bytes"},
+        { "tx_bytes"},
+        { "tx_error_bytes"},
+        { "rx_ucast_packets"},
+        { "rx_mcast_packets"},
+        { "rx_bcast_packets"},
+        { "tx_ucast_packets"},
+        { "tx_mcast_packets"},
+        { "tx_bcast_packets"},
+        { "tx_mac_errors"},     /* 10 */
+        { "tx_carrier_errors"},
+        { "rx_crc_errors"},
+        { "rx_align_errors"},
+        { "tx_single_collisions"},
+        { "tx_multi_collisions"},
+        { "tx_deferred"},
+        { "tx_excess_collisions"},
+        { "tx_late_collisions"},
+        { "tx_total_collisions"},
+        { "rx_fragments"},      /* 20 */
+        { "rx_jabbers"},
+        { "rx_undersize_packets"},
+        { "rx_oversize_packets"},
+        { "rx_xon_frames"},
+        { "rx_xoff_frames"},
+        { "tx_xon_frames"},
+        { "tx_xoff_frames"},
+        { "rx_mac_ctrl_frames"},
+        { "rx_filtered_packets"},
+        { "rx_discards"},       /* 30 */
+        { "brb_discard"},
+        { "brb_truncate"},
+        { "xxoverflow"}
 };
 
 #define STATS_OFFSET32(offset_name) \
         (offsetof(struct bnx2x_eth_stats, offset_name) / 4)
 
 static unsigned long bnx2x_stats_offset_arr[BNX2X_NUM_STATS] = {
-        STATS_OFFSET32(total_bytes_received_hi),                     /*  0 */
-        STATS_OFFSET32(stat_IfHCInBadOctets_hi),                     /*  1 */
-        STATS_OFFSET32(total_bytes_transmitted_hi),                  /*  2 */
-        STATS_OFFSET32(stat_IfHCOutBadOctets_hi),                    /*  3 */
-        STATS_OFFSET32(total_unicast_packets_received_hi),           /*  4 */
-        STATS_OFFSET32(total_multicast_packets_received_hi),         /*  5 */
-        STATS_OFFSET32(total_broadcast_packets_received_hi),         /*  6 */
-        STATS_OFFSET32(total_unicast_packets_transmitted_hi),        /*  7 */
-        STATS_OFFSET32(total_multicast_packets_transmitted_hi),      /*  8 */
-        STATS_OFFSET32(total_broadcast_packets_transmitted_hi),      /*  9 */
-        STATS_OFFSET32(stat_Dot3statsInternalMacTransmitErrors),     /* 10 */
-        STATS_OFFSET32(stat_Dot3StatsCarrierSenseErrors),            /* 11 */
-        STATS_OFFSET32(crc_receive_errors),                          /* 12 */
-        STATS_OFFSET32(alignment_errors),                            /* 13 */
-        STATS_OFFSET32(single_collision_transmit_frames),            /* 14 */
-        STATS_OFFSET32(multiple_collision_transmit_frames),          /* 15 */
-        STATS_OFFSET32(stat_Dot3StatsDeferredTransmissions),         /* 16 */
-        STATS_OFFSET32(excessive_collision_frames),                  /* 17 */
-        STATS_OFFSET32(late_collision_frames),                       /* 18 */
-        STATS_OFFSET32(number_of_bugs_found_in_stats_spec),          /* 19 */
-        STATS_OFFSET32(runt_packets_received),                       /* 20 */
-        STATS_OFFSET32(jabber_packets_received),                     /* 21 */
-        STATS_OFFSET32(error_runt_packets_received),                 /* 22 */
-        STATS_OFFSET32(error_jabber_packets_received),               /* 23 */
-        STATS_OFFSET32(pause_xon_frames_received),                   /* 24 */
-        STATS_OFFSET32(pause_xoff_frames_received),                  /* 25 */
-        STATS_OFFSET32(pause_xon_frames_transmitted),                /* 26 */
-        STATS_OFFSET32(pause_xoff_frames_transmitted),               /* 27 */
-        STATS_OFFSET32(control_frames_received),                     /* 28 */
-        STATS_OFFSET32(mac_filter_discard),                          /* 29 */
-        STATS_OFFSET32(no_buff_discard),                             /* 30 */
+        STATS_OFFSET32(total_bytes_received_hi),
+        STATS_OFFSET32(stat_IfHCInBadOctets_hi),
+        STATS_OFFSET32(total_bytes_transmitted_hi),
+        STATS_OFFSET32(stat_IfHCOutBadOctets_hi),
+        STATS_OFFSET32(total_unicast_packets_received_hi),
+        STATS_OFFSET32(total_multicast_packets_received_hi),
+        STATS_OFFSET32(total_broadcast_packets_received_hi),
+        STATS_OFFSET32(total_unicast_packets_transmitted_hi),
+        STATS_OFFSET32(total_multicast_packets_transmitted_hi),
+        STATS_OFFSET32(total_broadcast_packets_transmitted_hi),
+        STATS_OFFSET32(stat_Dot3statsInternalMacTransmitErrors), /* 10 */
+        STATS_OFFSET32(stat_Dot3StatsCarrierSenseErrors),
+        STATS_OFFSET32(crc_receive_errors),
+        STATS_OFFSET32(alignment_errors),
+        STATS_OFFSET32(single_collision_transmit_frames),
+        STATS_OFFSET32(multiple_collision_transmit_frames),
+        STATS_OFFSET32(stat_Dot3StatsDeferredTransmissions),
+        STATS_OFFSET32(excessive_collision_frames),
+        STATS_OFFSET32(late_collision_frames),
+        STATS_OFFSET32(number_of_bugs_found_in_stats_spec),
+        STATS_OFFSET32(runt_packets_received),                  /* 20 */
+        STATS_OFFSET32(jabber_packets_received),
+        STATS_OFFSET32(error_runt_packets_received),
+        STATS_OFFSET32(error_jabber_packets_received),
+        STATS_OFFSET32(pause_xon_frames_received),
+        STATS_OFFSET32(pause_xoff_frames_received),
+        STATS_OFFSET32(pause_xon_frames_transmitted),
+        STATS_OFFSET32(pause_xoff_frames_transmitted),
+        STATS_OFFSET32(control_frames_received),
+        STATS_OFFSET32(mac_filter_discard),
+        STATS_OFFSET32(no_buff_discard),                        /* 30 */
+        STATS_OFFSET32(brb_discard),
+        STATS_OFFSET32(brb_truncate_discard),
+        STATS_OFFSET32(xxoverflow_discard)
 };
 
 static u8 bnx2x_stats_len_arr[BNX2X_NUM_STATS] = {
         8, 0, 8, 0, 8, 8, 8, 8, 8, 8,
         4, 0, 4, 4, 4, 4, 4, 4, 4, 4,
         4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
-        4,
+        4, 4, 4, 4
 };
 
 static void bnx2x_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
@@ -8138,9 +9074,7 @@ static int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
  * net_device service functions
  */
 
-/* Called with rtnl_lock from vlan functions and also netif_tx_lock
- * from set_multicast.
- */
+/* called with netif_tx_lock from set_multicast */
 static void bnx2x_set_rx_mode(struct net_device *dev)
 {
         struct bnx2x *bp = netdev_priv(dev);
@@ -8314,7 +9248,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                ETH_TX_BD_ETH_ADDR_TYPE_SHIFT);
         tx_bd->general_data |= 1; /* header nbd */
 
-        /* remeber the first bd of the packet */
+        /* remember the first bd of the packet */
         tx_buf->first_bd = bd_prod;
 
         DP(NETIF_MSG_TX_QUEUED,
@@ -8334,7 +9268,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 /* for now NS flag is not used in Linux */
                 pbd->global_data = (len |
-                                    ((skb->protocol == ETH_P_8021Q) <<
+                                    ((skb->protocol == ntohs(ETH_P_8021Q)) <<
                                      ETH_TX_PARSE_BD_LLC_SNAP_EN_SHIFT));
                 pbd->ip_hlen = ip_hdrlen(skb) / 2;
                 pbd->total_hlen = cpu_to_le16(len + pbd->ip_hlen);
@@ -8343,7 +9277,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                         tx_bd->bd_flags.as_bitfield |=
                                                 ETH_TX_BD_FLAGS_TCP_CSUM;
-                        pbd->tcp_flags = htonl(tcp_flag_word(skb)) & 0xFFFF;
+                        pbd->tcp_flags = pbd_tcp_flags(skb);
                         pbd->total_hlen += cpu_to_le16(tcp_hdrlen(skb) / 2);
                         pbd->tcp_pseudo_csum = swab16(th->check);
 
@@ -8387,7 +9321,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb_shinfo(skb)->gso_size &&
             (skb->len > (bp->dev->mtu + ETH_HLEN))) {
-                int hlen = 2 * le32_to_cpu(pbd->total_hlen);
+                int hlen = 2 * le16_to_cpu(pbd->total_hlen);
 
                 DP(NETIF_MSG_TX_QUEUED,
                    "TSO packet len %d  hlen %d  total len %d  tso size %d\n",
@@ -8427,7 +9361,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         tx_bd->vlan = cpu_to_le16(pkt_prod);
                         /* this marks the bd
                          * as one that has no individual mapping
-                         * the FW ignors this flag in a bd not maked start
+                         * the FW ignores this flag in a bd not marked start
                          */
                         tx_bd->bd_flags.as_bitfield = ETH_TX_BD_FLAGS_SW_LSO;
                         DP(NETIF_MSG_TX_QUEUED,
@@ -8504,9 +9438,11 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         DP(NETIF_MSG_TX_QUEUED, "doorbell: nbd %u  bd %d\n", nbd, bd_prod);
 
-        fp->hw_tx_prods->bds_prod += cpu_to_le16(nbd);
+        fp->hw_tx_prods->bds_prod =
+                cpu_to_le16(le16_to_cpu(fp->hw_tx_prods->bds_prod) + nbd);
         mb(); /* FW restriction: must not reorder writing nbd and packets */
-        fp->hw_tx_prods->packets_prod += cpu_to_le32(1);
+        fp->hw_tx_prods->packets_prod =
+                cpu_to_le32(le32_to_cpu(fp->hw_tx_prods->packets_prod) + 1);
         DOORBELL(bp, fp_index, 0);
 
         mmiowb();
@@ -8525,11 +9461,6 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 }
 
-static struct net_device_stats *bnx2x_get_stats(struct net_device *dev)
-{
-        return &dev->stats;
-}
-
 /* Called with rtnl_lock */
 static int bnx2x_open(struct net_device *dev)
 {
@@ -8543,16 +9474,13 @@ static int bnx2x_open(struct net_device *dev)
 /* Called with rtnl_lock */
 static int bnx2x_close(struct net_device *dev)
 {
-        int rc;
         struct bnx2x *bp = netdev_priv(dev);
 
         /* Unload the driver, release IRQs */
-        rc = bnx2x_nic_unload(bp, 1);
-        if (rc) {
-                BNX2X_ERR("bnx2x_nic_unload failed: %d\n", rc);
-                return rc;
-        }
-        bnx2x_set_power_state(bp, PCI_D3hot);
+        bnx2x_nic_unload(bp, 1);
+
+        if (!CHIP_REV_IS_SLOW(bp))
+                bnx2x_set_power_state(bp, PCI_D3hot);
 
         return 0;
 }
@@ -8584,7 +9512,7 @@ static int bnx2x_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCGMIIPHY:
                 data->phy_id = bp->phy_addr;
 
-                /* fallthru */
+                /* fallthrough */
         case SIOCGMIIREG: {
                 u32 mii_regval;
 
@@ -8633,7 +9561,7 @@ static int bnx2x_change_mtu(struct net_device *dev, int new_mtu)
                 return -EINVAL;
 
         /* This does not race with packet allocation
-         * because the actuall alloc size is
+         * because the actual alloc size is
          * only updated as part of load
          */
         dev->mtu = new_mtu;
@@ -8666,7 +9594,7 @@ static void bnx2x_vlan_rx_register(struct net_device *dev,
 
         bp->vlgrp = vlgrp;
         if (netif_running(dev))
-                bnx2x_set_rx_mode(dev);
+                bnx2x_set_client_config(bp);
 }
 #endif
 
@@ -8695,14 +9623,18 @@ static void bnx2x_reset_task(struct work_struct *work)
         if (!netif_running(bp->dev))
                 return;
 
-        bp->in_reset_task = 1;
+        rtnl_lock();
 
-        bnx2x_netif_stop(bp);
+        if (bp->state != BNX2X_STATE_OPEN) {
+                DP(NETIF_MSG_TX_ERR, "state is %x, returning\n", bp->state);
+                goto reset_task_exit;
+        }
 
         bnx2x_nic_unload(bp, 0);
         bnx2x_nic_load(bp, 0);
 
-        bp->in_reset_task = 0;
+reset_task_exit:
+        rtnl_unlock();
 }
 
 static int __devinit bnx2x_init_board(struct pci_dev *pdev,
@@ -8783,8 +9715,6 @@ static int __devinit bnx2x_init_board(struct pci_dev *pdev,
 
         spin_lock_init(&bp->phy_lock);
 
-        bp->in_reset_task = 0;
-
         INIT_WORK(&bp->reset_task, bnx2x_reset_task);
         INIT_WORK(&bp->sp_task, bnx2x_sp_task);
 
@@ -8813,7 +9743,7 @@ static int __devinit bnx2x_init_board(struct pci_dev *pdev,
         bnx2x_get_hwinfo(bp);
 
         if (CHIP_REV(bp) == CHIP_REV_FPGA) {
-                printk(KERN_ERR PFX "FPGA detacted. MCP disabled,"
+                printk(KERN_ERR PFX "FPGA detected. MCP disabled,"
                        " will only init first device\n");
                 onefunc = 1;
                 nomcp = 1;
@@ -8882,14 +9812,32 @@ err_out:
         return rc;
 }
 
+static int __devinit bnx2x_get_pcie_width(struct bnx2x *bp)
+{
+        u32 val = REG_RD(bp, PCICFG_OFFSET + PCICFG_LINK_CONTROL);
+
+        val = (val & PCICFG_LINK_WIDTH) >> PCICFG_LINK_WIDTH_SHIFT;
+        return val;
+}
+
+/* return value of 1=2.5GHz 2=5GHz */
+static int __devinit bnx2x_get_pcie_speed(struct bnx2x *bp)
+{
+        u32 val = REG_RD(bp, PCICFG_OFFSET + PCICFG_LINK_CONTROL);
+
+        val = (val & PCICFG_LINK_SPEED) >> PCICFG_LINK_SPEED_SHIFT;
+        return val;
+}
+
 static int __devinit bnx2x_init_one(struct pci_dev *pdev,
                                     const struct pci_device_id *ent)
 {
         static int version_printed;
         struct net_device *dev = NULL;
         struct bnx2x *bp;
-        int rc, i;
+        int rc;
         int port = PCI_FUNC(pdev->devfn);
+        DECLARE_MAC_BUF(mac);
 
         if (version_printed++ == 0)
                 printk(KERN_INFO "%s", version);
@@ -8906,6 +9854,7 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
 
         if (port && onefunc) {
                 printk(KERN_ERR PFX "second function disabled. exiting\n");
+                free_netdev(dev);
                 return 0;
         }
 
@@ -8918,7 +9867,6 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         dev->hard_start_xmit = bnx2x_start_xmit;
         dev->watchdog_timeo = TX_TIMEOUT;
 
-        dev->get_stats = bnx2x_get_stats;
         dev->ethtool_ops = &bnx2x_ethtool_ops;
         dev->open = bnx2x_open;
         dev->stop = bnx2x_close;
@@ -8944,7 +9892,7 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
 
         rc = register_netdev(dev);
         if (rc) {
-                printk(KERN_ERR PFX "Cannot register net device\n");
+                dev_err(&pdev->dev, "Cannot register net device\n");
                 if (bp->regview)
                         iounmap(bp->regview);
                 if (bp->doorbells)
@@ -8959,32 +9907,30 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         pci_set_drvdata(pdev, dev);
 
         bp->name = board_info[ent->driver_data].name;
-        printk(KERN_INFO "%s: %s (%c%d) PCI%s %s %dMHz "
-               "found at mem %lx, IRQ %d, ",
-               dev->name, bp->name,
+        printk(KERN_INFO "%s: %s (%c%d) PCI-E x%d %s found at mem %lx,"
+               " IRQ %d, ", dev->name, bp->name,
                ((CHIP_ID(bp) & 0xf000) >> 12) + 'A',
                ((CHIP_ID(bp) & 0x0ff0) >> 4),
-               ((bp->flags & PCIX_FLAG) ? "-X" : ""),
-               ((bp->flags & PCI_32BIT_FLAG) ? "32-bit" : "64-bit"),
-               bp->bus_speed_mhz,
-               dev->base_addr,
-               bp->pdev->irq);
-
-        printk("node addr ");
-        for (i = 0; i < 6; i++)
-                printk("%2.2x", dev->dev_addr[i]);
-        printk("\n");
-
+               bnx2x_get_pcie_width(bp),
+               (bnx2x_get_pcie_speed(bp) == 2) ? "5GHz (Gen2)" : "2.5GHz",
+               dev->base_addr, bp->pdev->irq);
+        printk(KERN_CONT "node addr %s\n", print_mac(mac, dev->dev_addr));
         return 0;
 }
 
 static void __devexit bnx2x_remove_one(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
-        struct bnx2x *bp = netdev_priv(dev);
+        struct bnx2x *bp;
+
+        if (!dev) {
+                /* we get here if init_one() fails */
+                printk(KERN_ERR PFX "BAD net device from bnx2x_init_one\n");
+                return;
+        }
+
+        bp = netdev_priv(dev);
 
-        flush_scheduled_work();
-        /*tasklet_kill(&bp->sp_task);*/
         unregister_netdev(dev);
 
         if (bp->regview)
@@ -9002,34 +9948,43 @@ static void __devexit bnx2x_remove_one(struct pci_dev *pdev)
 static int bnx2x_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
-        struct bnx2x *bp = netdev_priv(dev);
-        int rc;
+        struct bnx2x *bp;
+
+        if (!dev)
+                return 0;
 
         if (!netif_running(dev))
                 return 0;
 
-        rc = bnx2x_nic_unload(bp, 0);
-        if (!rc)
-                return rc;
+        bp = netdev_priv(dev);
+
+        bnx2x_nic_unload(bp, 0);
 
         netif_device_detach(dev);
-        pci_save_state(pdev);
 
+        pci_save_state(pdev);
         bnx2x_set_power_state(bp, pci_choose_state(pdev, state));
+
         return 0;
 }
 
 static int bnx2x_resume(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
-        struct bnx2x *bp = netdev_priv(dev);
+        struct bnx2x *bp;
         int rc;
 
+        if (!dev) {
+                printk(KERN_ERR PFX "BAD net device from bnx2x_init_one\n");
+                return -ENODEV;
+        }
+
         if (!netif_running(dev))
                 return 0;
 
-        pci_restore_state(pdev);
+        bp = netdev_priv(dev);
 
+        pci_restore_state(pdev);
         bnx2x_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
 
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index 4f7ae6f77452..4f0c0d31e7c1 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -1,6 +1,6 @@
 /* bnx2x.h: Broadcom Everest network driver.
  *
- * Copyright (c) 2007 Broadcom Corporation
+ * Copyright (c) 2007-2008 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -24,6 +24,8 @@
 #define BNX2X_MSG_STATS                 0x20000 /* was: NETIF_MSG_TIMER */
 #define NETIF_MSG_NVM                   0x40000 /* was: NETIF_MSG_HW */
 #define NETIF_MSG_DMAE                  0x80000 /* was: NETIF_MSG_HW */
+#define BNX2X_MSG_SP                    0x100000 /* was: NETIF_MSG_INTR */
+#define BNX2X_MSG_FP                    0x200000 /* was: NETIF_MSG_INTR */
 
 #define DP_LEVEL                        KERN_NOTICE     /* was: KERN_DEBUG */
 
@@ -40,6 +42,12 @@
                 __LINE__, bp->dev?(bp->dev->name):"?", ##__args); \
         } while (0)
 
+/* for logging (never masked) */
+#define BNX2X_LOG(__fmt, __args...) do { \
+        printk(KERN_NOTICE "[%s:%d(%s)]" __fmt, __FUNCTION__, \
+                __LINE__, bp->dev?(bp->dev->name):"?", ##__args); \
+        } while (0)
+
 /* before we have a dev->name use dev_info() */
 #define BNX2X_DEV_INFO(__fmt, __args...) do { \
         if (bp->msglevel & NETIF_MSG_PROBE) \
@@ -423,8 +431,6 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_STATE_OPEN             0xa0000
 #define BNX2X_FP_STATE_HALTING          0xb0000
 #define BNX2X_FP_STATE_HALTED           0xc0000
-#define BNX2X_FP_STATE_DELETED          0xd0000
-#define BNX2X_FP_STATE_CLOSE_IRQ        0xe0000
 
         int                     index;
 
@@ -505,7 +511,6 @@ struct bnx2x {
         struct eth_spe          *spq;
         dma_addr_t              spq_mapping;
         u16                     spq_prod_idx;
-        u16                     dsb_sp_prod_idx;
         struct eth_spe          *spq_prod_bd;
         struct eth_spe          *spq_last_bd;
         u16                     *dsb_sp_prod;
@@ -517,7 +522,7 @@ struct bnx2x {
          */
         u8                      stat_pending;
 
-        /* End of fileds used in the performance code paths */
+        /* End of fields used in the performance code paths */
 
         int                     panic;
         int                     msglevel;
@@ -540,8 +545,6 @@ struct bnx2x {
         spinlock_t              phy_lock;
 
         struct work_struct      reset_task;
-        u16                     in_reset_task;
-
         struct work_struct      sp_task;
 
         struct timer_list       timer;
@@ -555,7 +558,6 @@ struct bnx2x {
 #define CHIP_ID(bp)                     (((bp)->chip_id) & 0xfffffff0)
 
 #define CHIP_NUM(bp)                    (((bp)->chip_id) & 0xffff0000)
-#define CHIP_NUM_5710                   0x57100000
 
 #define CHIP_REV(bp)                    (((bp)->chip_id) & 0x0000f000)
 #define CHIP_REV_Ax                     0x00000000
@@ -574,7 +576,8 @@ struct bnx2x {
         u32                     fw_mb;
 
         u32                     hw_config;
-        u32                     serdes_config;
+        u32                     board;
+        u32                     serdes_config;
         u32                     lane_config;
         u32                     ext_phy_config;
 #define XGXS_EXT_PHY_TYPE(bp)           (bp->ext_phy_config & \
@@ -595,11 +598,11 @@ struct bnx2x {
         u8                      tx_lane_swap;
 
         u8                      link_up;
+        u8                      phy_link_up;
 
         u32                     supported;
 /* link settings - missing defines */
 #define SUPPORTED_2500baseT_Full        (1 << 15)
-#define SUPPORTED_CX4                   (1 << 16)
 
         u32                     phy_flags;
 /*#define PHY_SERDES_FLAG                       0x1*/
@@ -644,16 +647,9 @@ struct bnx2x {
 #define FLOW_CTRL_BOTH                  PORT_FEATURE_FLOW_CONTROL_BOTH
 #define FLOW_CTRL_NONE                  PORT_FEATURE_FLOW_CONTROL_NONE
 
-        u32                     pause_mode;
-#define PAUSE_NONE                      0
-#define PAUSE_SYMMETRIC                 1
-#define PAUSE_ASYMMETRIC                2
-#define PAUSE_BOTH                      3
-
         u32                     advertising;
 /* link settings - missing defines */
 #define ADVERTISED_2500baseT_Full       (1 << 15)
-#define ADVERTISED_CX4                  (1 << 16)
 
         u32                     link_status;
         u32                     line_speed;
@@ -667,6 +663,8 @@ struct bnx2x {
 #define NVRAM_TIMEOUT_COUNT             30000
 #define NVRAM_PAGE_SIZE                 256
 
+        u8                      wol;
+
         int                     rx_ring_size;
 
         u16                     tx_quick_cons_trip_int;
@@ -718,9 +716,6 @@ struct bnx2x {
 #endif
 
         char                    *name;
-        u16                     bus_speed_mhz;
-        u8                      wol;
-        u8                      pad;
 
         /* used to synchronize stats collecting */
         int                     stats_state;
@@ -856,8 +851,8 @@ struct bnx2x {
 #define MAX_SPQ_PENDING                 8
 
 
-#define BNX2X_NUM_STATS                 31
-#define BNX2X_NUM_TESTS                 2
+#define BNX2X_NUM_STATS                 34
+#define BNX2X_NUM_TESTS                 1
 
 
 #define DPM_TRIGER_TYPE                 0x40
@@ -867,6 +862,15 @@ struct bnx2x {
                        DPM_TRIGER_TYPE); \
         } while (0)
 
+/* PCIE link and speed */
+#define PCICFG_LINK_WIDTH               0x1f00000
+#define PCICFG_LINK_WIDTH_SHIFT         20
+#define PCICFG_LINK_SPEED               0xf0000
+#define PCICFG_LINK_SPEED_SHIFT         16
+
+#define BMAC_CONTROL_RX_ENABLE          2
+
+#define pbd_tcp_flags(skb)      (ntohl(tcp_flag_word(tcp_hdr(skb)))>>16 & 0xff)
 
 /* stuff added to make the code fit 80Col */
 
@@ -939,13 +943,13 @@ struct bnx2x {
 #define LINK_16GTFD                     LINK_STATUS_SPEED_AND_DUPLEX_16GTFD
 #define LINK_16GXFD                     LINK_STATUS_SPEED_AND_DUPLEX_16GXFD
 
-#define NIG_STATUS_INTERRUPT_XGXS0_LINK10G \
+#define NIG_STATUS_XGXS0_LINK10G \
                 NIG_STATUS_INTERRUPT_PORT0_REG_STATUS_XGXS0_LINK10G
-#define NIG_XGXS0_LINK_STATUS \
+#define NIG_STATUS_XGXS0_LINK_STATUS \
                 NIG_STATUS_INTERRUPT_PORT0_REG_STATUS_XGXS0_LINK_STATUS
-#define NIG_XGXS0_LINK_STATUS_SIZE \
+#define NIG_STATUS_XGXS0_LINK_STATUS_SIZE \
                 NIG_STATUS_INTERRUPT_PORT0_REG_STATUS_XGXS0_LINK_STATUS_SIZE
-#define NIG_SERDES0_LINK_STATUS \
+#define NIG_STATUS_SERDES0_LINK_STATUS \
                 NIG_STATUS_INTERRUPT_PORT0_REG_STATUS_SERDES0_LINK_STATUS
 #define NIG_MASK_MI_INT \
                 NIG_MASK_INTERRUPT_PORT0_REG_MASK_EMAC0_MISC_MI_INT
diff --git a/drivers/net/bnx2x_fw_defs.h b/drivers/net/bnx2x_fw_defs.h
index 62a6eb81025a..3b968904ca65 100644
--- a/drivers/net/bnx2x_fw_defs.h
+++ b/drivers/net/bnx2x_fw_defs.h
@@ -1,6 +1,6 @@
 /* bnx2x_fw_defs.h: Broadcom Everest network driver.
  *
- * Copyright (c) 2007 Broadcom Corporation
+ * Copyright (c) 2007-2008 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/bnx2x_hsi.h b/drivers/net/bnx2x_hsi.h
index 6fd959c34d1f..b21075ccb52e 100644
--- a/drivers/net/bnx2x_hsi.h
+++ b/drivers/net/bnx2x_hsi.h
@@ -1,6 +1,6 @@
 /* bnx2x_hsi.h: Broadcom Everest network driver.
  *
- * Copyright (c) 2007 Broadcom Corporation
+ * Copyright (c) 2007-2008 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -8,169 +8,9 @@
  */
 
 
-#define FUNC_0                          0
-#define FUNC_1                          1
-#define FUNC_MAX                        2
-
-
-/* This value (in milliseconds) determines the frequency of the driver
- * issuing the PULSE message code.  The firmware monitors this periodic
- * pulse to determine when to switch to an OS-absent mode. */
-#define DRV_PULSE_PERIOD_MS             250
-
-/* This value (in milliseconds) determines how long the driver should
- * wait for an acknowledgement from the firmware before timing out.  Once
- * the firmware has timed out, the driver will assume there is no firmware
- * running and there won't be any firmware-driver synchronization during a
- * driver reset. */
-#define FW_ACK_TIME_OUT_MS              5000
-
-#define FW_ACK_POLL_TIME_MS             1
-
-#define FW_ACK_NUM_OF_POLL      (FW_ACK_TIME_OUT_MS/FW_ACK_POLL_TIME_MS)
-
-/* LED Blink rate that will achieve ~15.9Hz */
-#define LED_BLINK_RATE_VAL              480
-
-/****************************************************************************
- * Driver <-> FW Mailbox                                                    *
- ****************************************************************************/
-struct drv_fw_mb {
-        u32 drv_mb_header;
-#define DRV_MSG_CODE_MASK                       0xffff0000
-#define DRV_MSG_CODE_LOAD_REQ                   0x10000000
-#define DRV_MSG_CODE_LOAD_DONE                  0x11000000
-#define DRV_MSG_CODE_UNLOAD_REQ_WOL_EN          0x20000000
-#define DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS         0x20010000
-#define DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP         0x20020000
-#define DRV_MSG_CODE_UNLOAD_DONE                0x21000000
-#define DRV_MSG_CODE_DIAG_ENTER_REQ             0x50000000
-#define DRV_MSG_CODE_DIAG_EXIT_REQ              0x60000000
-#define DRV_MSG_CODE_VALIDATE_KEY               0x70000000
-#define DRV_MSG_CODE_GET_CURR_KEY               0x80000000
-#define DRV_MSG_CODE_GET_UPGRADE_KEY            0x81000000
-#define DRV_MSG_CODE_GET_MANUF_KEY              0x82000000
-#define DRV_MSG_CODE_LOAD_L2B_PRAM              0x90000000
-
-#define DRV_MSG_SEQ_NUMBER_MASK                 0x0000ffff
-
-        u32 drv_mb_param;
-
-        u32 fw_mb_header;
-#define FW_MSG_CODE_MASK                        0xffff0000
-#define FW_MSG_CODE_DRV_LOAD_COMMON             0x11000000
-#define FW_MSG_CODE_DRV_LOAD_PORT               0x12000000
-#define FW_MSG_CODE_DRV_LOAD_REFUSED            0x13000000
-#define FW_MSG_CODE_DRV_LOAD_DONE               0x14000000
-#define FW_MSG_CODE_DRV_UNLOAD_COMMON           0x21000000
-#define FW_MSG_CODE_DRV_UNLOAD_PORT             0x22000000
-#define FW_MSG_CODE_DRV_UNLOAD_DONE             0x23000000
-#define FW_MSG_CODE_DIAG_ENTER_DONE             0x50000000
-#define FW_MSG_CODE_DIAG_REFUSE                 0x51000000
-#define FW_MSG_CODE_VALIDATE_KEY_SUCCESS        0x70000000
-#define FW_MSG_CODE_VALIDATE_KEY_FAILURE        0x71000000
-#define FW_MSG_CODE_GET_KEY_DONE                0x80000000
-#define FW_MSG_CODE_NO_KEY                      0x8f000000
-#define FW_MSG_CODE_LIC_INFO_NOT_READY          0x8f800000
-#define FW_MSG_CODE_L2B_PRAM_LOADED             0x90000000
-#define FW_MSG_CODE_L2B_PRAM_T_LOAD_FAILURE     0x91000000
-#define FW_MSG_CODE_L2B_PRAM_C_LOAD_FAILURE     0x92000000
-#define FW_MSG_CODE_L2B_PRAM_X_LOAD_FAILURE     0x93000000
-#define FW_MSG_CODE_L2B_PRAM_U_LOAD_FAILURE     0x94000000
-
-#define FW_MSG_SEQ_NUMBER_MASK                  0x0000ffff
-
-        u32 fw_mb_param;
-
-        u32 link_status;
-        /* Driver should update this field on any link change event */
-
-#define LINK_STATUS_LINK_FLAG_MASK              0x00000001
-#define LINK_STATUS_LINK_UP                     0x00000001
-#define LINK_STATUS_SPEED_AND_DUPLEX_MASK       0x0000001E
-#define LINK_STATUS_SPEED_AND_DUPLEX_AN_NOT_COMPLETE    (0<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_10THD              (1<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_10TFD              (2<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_100TXHD            (3<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_100T4              (4<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_100TXFD            (5<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_1000THD            (6<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_1000TFD            (7<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_1000XFD            (7<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_2500THD            (8<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_2500TFD            (9<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_2500XFD            (9<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_10GTFD             (10<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_10GXFD             (10<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_12GTFD             (11<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_12GXFD             (11<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_12_5GTFD           (12<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_12_5GXFD           (12<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_13GTFD             (13<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_13GXFD             (13<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_15GTFD             (14<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_15GXFD             (14<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_16GTFD             (15<<1)
-#define LINK_STATUS_SPEED_AND_DUPLEX_16GXFD             (15<<1)
-
-#define LINK_STATUS_AUTO_NEGOTIATE_FLAG_MASK            0x00000020
-#define LINK_STATUS_AUTO_NEGOTIATE_ENABLED              0x00000020
-
-#define LINK_STATUS_AUTO_NEGOTIATE_COMPLETE             0x00000040
-#define LINK_STATUS_PARALLEL_DETECTION_FLAG_MASK        0x00000080
-#define LINK_STATUS_PARALLEL_DETECTION_USED             0x00000080
-
-#define LINK_STATUS_LINK_PARTNER_1000TFD_CAPABLE        0x00000200
-#define LINK_STATUS_LINK_PARTNER_1000THD_CAPABLE        0x00000400
-#define LINK_STATUS_LINK_PARTNER_100T4_CAPABLE          0x00000800
-#define LINK_STATUS_LINK_PARTNER_100TXFD_CAPABLE        0x00001000
-#define LINK_STATUS_LINK_PARTNER_100TXHD_CAPABLE        0x00002000
-#define LINK_STATUS_LINK_PARTNER_10TFD_CAPABLE          0x00004000
-#define LINK_STATUS_LINK_PARTNER_10THD_CAPABLE          0x00008000
-
-#define LINK_STATUS_TX_FLOW_CONTROL_FLAG_MASK           0x00010000
-#define LINK_STATUS_TX_FLOW_CONTROL_ENABLED             0x00010000
-
-#define LINK_STATUS_RX_FLOW_CONTROL_FLAG_MASK           0x00020000
-#define LINK_STATUS_RX_FLOW_CONTROL_ENABLED             0x00020000
-
-#define LINK_STATUS_LINK_PARTNER_FLOW_CONTROL_MASK      0x000C0000
-#define LINK_STATUS_LINK_PARTNER_NOT_PAUSE_CAPABLE      (0<<18)
-#define LINK_STATUS_LINK_PARTNER_SYMMETRIC_PAUSE        (1<<18)
-#define LINK_STATUS_LINK_PARTNER_ASYMMETRIC_PAUSE       (2<<18)
-#define LINK_STATUS_LINK_PARTNER_BOTH_PAUSE             (3<<18)
-
-#define LINK_STATUS_SERDES_LINK                         0x00100000
-
-#define LINK_STATUS_LINK_PARTNER_2500XFD_CAPABLE        0x00200000
-#define LINK_STATUS_LINK_PARTNER_2500XHD_CAPABLE        0x00400000
-#define LINK_STATUS_LINK_PARTNER_10GXFD_CAPABLE         0x00800000
-#define LINK_STATUS_LINK_PARTNER_12GXFD_CAPABLE         0x01000000
-#define LINK_STATUS_LINK_PARTNER_12_5GXFD_CAPABLE       0x02000000
-#define LINK_STATUS_LINK_PARTNER_13GXFD_CAPABLE         0x04000000
-#define LINK_STATUS_LINK_PARTNER_15GXFD_CAPABLE         0x08000000
-#define LINK_STATUS_LINK_PARTNER_16GXFD_CAPABLE         0x10000000
-
-        u32 drv_pulse_mb;
-#define DRV_PULSE_SEQ_MASK                              0x00007fff
-#define DRV_PULSE_SYSTEM_TIME_MASK                      0xffff0000
-        /* The system time is in the format of
-         * (year-2001)*12*32 + month*32 + day. */
-#define DRV_PULSE_ALWAYS_ALIVE                          0x00008000
-        /* Indicate to the firmware not to go into the
-         * OS-absent when it is not getting driver pulse.
-         * This is used for debugging as well for PXE(MBA). */
-
-        u32 mcp_pulse_mb;
-#define MCP_PULSE_SEQ_MASK                              0x00007fff
-#define MCP_PULSE_ALWAYS_ALIVE                          0x00008000
-        /* Indicates to the driver not to assert due to lack
-         * of MCP response */
-#define MCP_EVENT_MASK                                  0xffff0000
-#define MCP_EVENT_OTHER_DRIVER_RESET_REQ                0x00010000
-
-};
-
+#define PORT_0                          0
+#define PORT_1                          1
+#define PORT_MAX                        2
 
 /****************************************************************************
  * Shared HW configuration                                                  *
@@ -249,7 +89,7 @@ struct shared_hw_cfg {					 /* NVRAM Offset */
 #define SHARED_HW_CFG_SMBUS_TIMING_100KHZ           0x00000000
 #define SHARED_HW_CFG_SMBUS_TIMING_400KHZ           0x00001000
 
-#define SHARED_HW_CFG_HIDE_FUNC1                    0x00002000
+#define SHARED_HW_CFG_HIDE_PORT1                    0x00002000
 
         u32 power_dissipated;                                   /* 0x11c */
 #define SHARED_HW_CFG_POWER_DIS_CMN_MASK            0xff000000
@@ -290,6 +130,8 @@ struct shared_hw_cfg {					 /* NVRAM Offset */
 #define SHARED_HW_CFG_BOARD_TYPE_BCM957710T1015G    0x00000006
 #define SHARED_HW_CFG_BOARD_TYPE_BCM957710A1020G    0x00000007
 #define SHARED_HW_CFG_BOARD_TYPE_BCM957710T1003G    0x00000008
+#define SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G    0x00000009
+#define SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G    0x0000000a
 
 #define SHARED_HW_CFG_BOARD_VER_MASK                0xffff0000
 #define SHARED_HW_CFG_BOARD_VER_SHIFT               16
@@ -304,13 +146,12 @@ struct shared_hw_cfg {					 /* NVRAM Offset */
 
 };
 
+
 /****************************************************************************
  * Port HW configuration                                                    *
  ****************************************************************************/
-struct port_hw_cfg {    /* function 0: 0x12c-0x2bb, function 1: 0x2bc-0x44b */
+struct port_hw_cfg {                        /* port 0: 0x12c  port 1: 0x2bc */
 
-        /* Fields below are port specific (in anticipation of dual port
-           devices */
         u32 pci_id;
 #define PORT_HW_CFG_PCI_VENDOR_ID_MASK              0xffff0000
 #define PORT_HW_CFG_PCI_DEVICE_ID_MASK              0x0000ffff
@@ -420,6 +261,8 @@ struct port_hw_cfg {	/* function 0: 0x12c-0x2bb, function 1: 0x2bc-0x44b */
 #define PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706       0x00000500
 #define PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8276       0x00000600
 #define PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8481       0x00000700
+#define PORT_HW_CFG_XGXS_EXT_PHY_TYPE_SFX7101       0x00000800
+#define PORT_HW_CFG_XGXS_EXT_PHY_TYPE_FAILURE       0x0000fd00
 #define PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN      0x0000ff00
 
 #define PORT_HW_CFG_XGXS_EXT_PHY_ADDR_MASK          0x000000ff
@@ -462,11 +305,13 @@ struct port_hw_cfg {	/* function 0: 0x12c-0x2bb, function 1: 0x2bc-0x44b */
 
 };
 
+
 /****************************************************************************
  * Shared Feature configuration                                             *
  ****************************************************************************/
 struct shared_feat_cfg {                                 /* NVRAM Offset */
-        u32 bmc_common;                                         /* 0x450 */
+
+        u32 config;                                             /* 0x450 */
 #define SHARED_FEATURE_BMC_ECHO_MODE_EN             0x00000001
 
 };
@@ -475,7 +320,8 @@ struct shared_feat_cfg {				 /* NVRAM Offset */
 /****************************************************************************
  * Port Feature configuration                                               *
  ****************************************************************************/
-struct port_feat_cfg {  /* function 0: 0x454-0x4c7, function 1: 0x4c8-0x53b */
+struct port_feat_cfg {                      /* port 0: 0x454  port 1: 0x4c8 */
+
         u32 config;
 #define PORT_FEATURE_BAR1_SIZE_MASK                 0x0000000f
 #define PORT_FEATURE_BAR1_SIZE_SHIFT                0
@@ -609,8 +455,7 @@ struct port_feat_cfg {	/* function 0: 0x454-0x4c7, function 1: 0x4c8-0x53b */
 #define PORT_FEATURE_SMBUS_ADDR_MASK                0x000000fe
 #define PORT_FEATURE_SMBUS_ADDR_SHIFT               1
 
-        u32 iscsib_boot_cfg;
-#define PORT_FEATURE_ISCSIB_SKIP_TARGET_BOOT        0x00000001
+        u32 reserved1;
 
         u32 link_config;    /* Used as HW defaults for the driver */
 #define PORT_FEATURE_CONNECTED_SWITCH_MASK          0x03000000
@@ -657,20 +502,201 @@ struct port_feat_cfg {	/* function 0: 0x454-0x4c7, function 1: 0x4c8-0x53b */
 };
 
 
+/*****************************************************************************
+ * Device Information                                                        *
+ *****************************************************************************/
+struct dev_info {                                                    /* size */
+
+        u32    bc_rev; /* 8 bits each: major, minor, build */           /* 4 */
+
+        struct shared_hw_cfg     shared_hw_config;                     /* 40 */
+
+        struct port_hw_cfg       port_hw_config[PORT_MAX];      /* 400*2=800 */
+
+        struct shared_feat_cfg   shared_feature_config;                 /* 4 */
+
+        struct port_feat_cfg     port_feature_config[PORT_MAX]; /* 116*2=232 */
+
+};
+
+
+#define FUNC_0                          0
+#define FUNC_1                          1
+#define E1_FUNC_MAX                     2
+#define FUNC_MAX                        E1_FUNC_MAX
+
+
+/* This value (in milliseconds) determines the frequency of the driver
+ * issuing the PULSE message code.  The firmware monitors this periodic
+ * pulse to determine when to switch to an OS-absent mode. */
+#define DRV_PULSE_PERIOD_MS             250
+
+/* This value (in milliseconds) determines how long the driver should
+ * wait for an acknowledgement from the firmware before timing out.  Once
+ * the firmware has timed out, the driver will assume there is no firmware
+ * running and there won't be any firmware-driver synchronization during a
+ * driver reset. */
+#define FW_ACK_TIME_OUT_MS              5000
+
+#define FW_ACK_POLL_TIME_MS             1
+
+#define FW_ACK_NUM_OF_POLL      (FW_ACK_TIME_OUT_MS/FW_ACK_POLL_TIME_MS)
+
+/* LED Blink rate that will achieve ~15.9Hz */
+#define LED_BLINK_RATE_VAL              480
+
 /****************************************************************************
- * Device Information                                                       *
+ * Driver <-> FW Mailbox                                                    *
  ****************************************************************************/
-struct dev_info {                                                   /* size */
+struct drv_port_mb {
+
+        u32 link_status;
+        /* Driver should update this field on any link change event */
+
+#define LINK_STATUS_LINK_FLAG_MASK                      0x00000001
+#define LINK_STATUS_LINK_UP                             0x00000001
+#define LINK_STATUS_SPEED_AND_DUPLEX_MASK               0x0000001E
+#define LINK_STATUS_SPEED_AND_DUPLEX_AN_NOT_COMPLETE    (0<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_10THD              (1<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_10TFD              (2<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_100TXHD            (3<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_100T4              (4<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_100TXFD            (5<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_1000THD            (6<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_1000TFD            (7<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_1000XFD            (7<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_2500THD            (8<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_2500TFD            (9<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_2500XFD            (9<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_10GTFD             (10<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_10GXFD             (10<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_12GTFD             (11<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_12GXFD             (11<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_12_5GTFD           (12<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_12_5GXFD           (12<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_13GTFD             (13<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_13GXFD             (13<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_15GTFD             (14<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_15GXFD             (14<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_16GTFD             (15<<1)
+#define LINK_STATUS_SPEED_AND_DUPLEX_16GXFD             (15<<1)
+
+#define LINK_STATUS_AUTO_NEGOTIATE_FLAG_MASK            0x00000020
+#define LINK_STATUS_AUTO_NEGOTIATE_ENABLED              0x00000020
+
+#define LINK_STATUS_AUTO_NEGOTIATE_COMPLETE             0x00000040
+#define LINK_STATUS_PARALLEL_DETECTION_FLAG_MASK        0x00000080
+#define LINK_STATUS_PARALLEL_DETECTION_USED             0x00000080
+
+#define LINK_STATUS_LINK_PARTNER_1000TFD_CAPABLE        0x00000200
+#define LINK_STATUS_LINK_PARTNER_1000THD_CAPABLE        0x00000400
+#define LINK_STATUS_LINK_PARTNER_100T4_CAPABLE          0x00000800
+#define LINK_STATUS_LINK_PARTNER_100TXFD_CAPABLE        0x00001000
+#define LINK_STATUS_LINK_PARTNER_100TXHD_CAPABLE        0x00002000
+#define LINK_STATUS_LINK_PARTNER_10TFD_CAPABLE          0x00004000
+#define LINK_STATUS_LINK_PARTNER_10THD_CAPABLE          0x00008000
+
+#define LINK_STATUS_TX_FLOW_CONTROL_FLAG_MASK           0x00010000
+#define LINK_STATUS_TX_FLOW_CONTROL_ENABLED             0x00010000
+
+#define LINK_STATUS_RX_FLOW_CONTROL_FLAG_MASK           0x00020000
+#define LINK_STATUS_RX_FLOW_CONTROL_ENABLED             0x00020000
+
+#define LINK_STATUS_LINK_PARTNER_FLOW_CONTROL_MASK      0x000C0000
+#define LINK_STATUS_LINK_PARTNER_NOT_PAUSE_CAPABLE      (0<<18)
+#define LINK_STATUS_LINK_PARTNER_SYMMETRIC_PAUSE        (1<<18)
+#define LINK_STATUS_LINK_PARTNER_ASYMMETRIC_PAUSE       (2<<18)
+#define LINK_STATUS_LINK_PARTNER_BOTH_PAUSE             (3<<18)
+
+#define LINK_STATUS_SERDES_LINK                         0x00100000
+
+#define LINK_STATUS_LINK_PARTNER_2500XFD_CAPABLE        0x00200000
+#define LINK_STATUS_LINK_PARTNER_2500XHD_CAPABLE        0x00400000
+#define LINK_STATUS_LINK_PARTNER_10GXFD_CAPABLE         0x00800000
+#define LINK_STATUS_LINK_PARTNER_12GXFD_CAPABLE         0x01000000
+#define LINK_STATUS_LINK_PARTNER_12_5GXFD_CAPABLE       0x02000000
+#define LINK_STATUS_LINK_PARTNER_13GXFD_CAPABLE         0x04000000
+#define LINK_STATUS_LINK_PARTNER_15GXFD_CAPABLE         0x08000000
+#define LINK_STATUS_LINK_PARTNER_16GXFD_CAPABLE         0x10000000
 
-        u32    bc_rev; /* 8 bits each: major, minor, build */          /* 4 */
+        u32 reserved[3];
 
-        struct shared_hw_cfg     shared_hw_config;                    /* 40 */
+};
+
+
+struct drv_func_mb {
+
+        u32 drv_mb_header;
+#define DRV_MSG_CODE_MASK                               0xffff0000
+#define DRV_MSG_CODE_LOAD_REQ                           0x10000000
+#define DRV_MSG_CODE_LOAD_DONE                          0x11000000
+#define DRV_MSG_CODE_UNLOAD_REQ_WOL_EN                  0x20000000
+#define DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS                 0x20010000
+#define DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP                 0x20020000
+#define DRV_MSG_CODE_UNLOAD_DONE                        0x21000000
+#define DRV_MSG_CODE_DIAG_ENTER_REQ                     0x50000000
+#define DRV_MSG_CODE_DIAG_EXIT_REQ                      0x60000000
+#define DRV_MSG_CODE_VALIDATE_KEY                       0x70000000
+#define DRV_MSG_CODE_GET_CURR_KEY                       0x80000000
+#define DRV_MSG_CODE_GET_UPGRADE_KEY                    0x81000000
+#define DRV_MSG_CODE_GET_MANUF_KEY                      0x82000000
+#define DRV_MSG_CODE_LOAD_L2B_PRAM                      0x90000000
+
+#define DRV_MSG_SEQ_NUMBER_MASK                         0x0000ffff
+
+        u32 drv_mb_param;
+
+        u32 fw_mb_header;
+#define FW_MSG_CODE_MASK                                0xffff0000
+#define FW_MSG_CODE_DRV_LOAD_COMMON                     0x10100000
+#define FW_MSG_CODE_DRV_LOAD_PORT                       0x10110000
+#define FW_MSG_CODE_DRV_LOAD_FUNCTION                   0x10120000
+#define FW_MSG_CODE_DRV_LOAD_REFUSED                    0x10200000
+#define FW_MSG_CODE_DRV_LOAD_DONE                       0x11100000
+#define FW_MSG_CODE_DRV_UNLOAD_COMMON                   0x20100000
+#define FW_MSG_CODE_DRV_UNLOAD_PORT                     0x20110000
+#define FW_MSG_CODE_DRV_UNLOAD_FUNCTION                 0x20120000
+#define FW_MSG_CODE_DRV_UNLOAD_DONE                     0x21100000
+#define FW_MSG_CODE_DIAG_ENTER_DONE                     0x50100000
+#define FW_MSG_CODE_DIAG_REFUSE                         0x50200000
+#define FW_MSG_CODE_DIAG_EXIT_DONE                      0x60100000
+#define FW_MSG_CODE_VALIDATE_KEY_SUCCESS                0x70100000
+#define FW_MSG_CODE_VALIDATE_KEY_FAILURE                0x70200000
+#define FW_MSG_CODE_GET_KEY_DONE                        0x80100000
+#define FW_MSG_CODE_NO_KEY                              0x80f00000
+#define FW_MSG_CODE_LIC_INFO_NOT_READY                  0x80f80000
+#define FW_MSG_CODE_L2B_PRAM_LOADED                     0x90100000
+#define FW_MSG_CODE_L2B_PRAM_T_LOAD_FAILURE             0x90210000
+#define FW_MSG_CODE_L2B_PRAM_C_LOAD_FAILURE             0x90220000
+#define FW_MSG_CODE_L2B_PRAM_X_LOAD_FAILURE             0x90230000
+#define FW_MSG_CODE_L2B_PRAM_U_LOAD_FAILURE             0x90240000
+
+#define FW_MSG_SEQ_NUMBER_MASK                          0x0000ffff
+
+        u32 fw_mb_param;
+
+        u32 drv_pulse_mb;
+#define DRV_PULSE_SEQ_MASK                              0x00007fff
+#define DRV_PULSE_SYSTEM_TIME_MASK                      0xffff0000
+        /* The system time is in the format of
+         * (year-2001)*12*32 + month*32 + day. */
+#define DRV_PULSE_ALWAYS_ALIVE                          0x00008000
+        /* Indicate to the firmware not to go into the
+         * OS-absent when it is not getting driver pulse.
+         * This is used for debugging as well for PXE(MBA). */
 
-        struct port_hw_cfg       port_hw_config[FUNC_MAX];     /* 400*2=800 */
+        u32 mcp_pulse_mb;
+#define MCP_PULSE_SEQ_MASK                              0x00007fff
+#define MCP_PULSE_ALWAYS_ALIVE                          0x00008000
+        /* Indicates to the driver not to assert due to lack
+         * of MCP response */
+#define MCP_EVENT_MASK                                  0xffff0000
+#define MCP_EVENT_OTHER_DRIVER_RESET_REQ                0x00010000
 
-        struct shared_feat_cfg   shared_feature_config;                /* 4 */
+        u32 iscsi_boot_signature;
+        u32 iscsi_boot_block_offset;
 
-        struct port_feat_cfg     port_feature_config[FUNC_MAX];/* 116*2=232 */
+        u32 reserved[3];
 
 };
 
@@ -678,9 +704,8 @@ struct dev_info {						    /* size */
 /****************************************************************************
  * Management firmware state                                                *
  ****************************************************************************/
-/* Allocate 320 bytes for management firmware: still not known exactly
- * how much IMD needs. */
-#define MGMTFW_STATE_WORD_SIZE                              80
+/* Allocate 440 bytes for management firmware */
+#define MGMTFW_STATE_WORD_SIZE                              110
 
 struct mgmtfw_state {
         u32 opaque[MGMTFW_STATE_WORD_SIZE];
@@ -691,31 +716,40 @@ struct mgmtfw_state {
  * Shared Memory Region                                                     *
  ****************************************************************************/
 struct shmem_region {                          /*   SharedMem Offset (size) */
-        u32                 validity_map[FUNC_MAX];    /* 0x0 (4 * 2 = 0x8) */
-#define SHR_MEM_VALIDITY_PCI_CFG                    0x00000001
-#define SHR_MEM_VALIDITY_MB                         0x00000002
-#define SHR_MEM_VALIDITY_DEV_INFO                   0x00000004
+
+        u32                     validity_map[PORT_MAX];  /* 0x0 (4*2 = 0x8) */
+#define SHR_MEM_FORMAT_REV_ID                       ('A'<<24)
+#define SHR_MEM_FORMAT_REV_MASK                     0xff000000
+        /* validity bits */
+#define SHR_MEM_VALIDITY_PCI_CFG                    0x00100000
+#define SHR_MEM_VALIDITY_MB                         0x00200000
+#define SHR_MEM_VALIDITY_DEV_INFO                   0x00400000
+#define SHR_MEM_VALIDITY_RESERVED                   0x00000007
         /* One licensing bit should be set */
 #define SHR_MEM_VALIDITY_LIC_KEY_IN_EFFECT_MASK     0x00000038
 #define SHR_MEM_VALIDITY_LIC_MANUF_KEY_IN_EFFECT    0x00000008
 #define SHR_MEM_VALIDITY_LIC_UPGRADE_KEY_IN_EFFECT  0x00000010
 #define SHR_MEM_VALIDITY_LIC_NO_KEY_IN_EFFECT       0x00000020
+        /* Active MFW */
+#define SHR_MEM_VALIDITY_ACTIVE_MFW_UNKNOWN         0x00000000
+#define SHR_MEM_VALIDITY_ACTIVE_MFW_IPMI            0x00000040
+#define SHR_MEM_VALIDITY_ACTIVE_MFW_UMP             0x00000080
+#define SHR_MEM_VALIDITY_ACTIVE_MFW_NCSI            0x000000c0
+#define SHR_MEM_VALIDITY_ACTIVE_MFW_NONE            0x000001c0
+#define SHR_MEM_VALIDITY_ACTIVE_MFW_MASK            0x000001c0
 
-        struct drv_fw_mb    drv_fw_mb[FUNC_MAX];     /* 0x8 (28 * 2 = 0x38) */
-
-        struct dev_info     dev_info;                       /* 0x40 (0x438) */
+        struct dev_info         dev_info;                /* 0x8     (0x438) */
 
-#ifdef _LICENSE_H
-        license_key_t       drv_lic_key[FUNC_MAX]; /* 0x478 (52 * 2 = 0x68) */
-#else /* Linux! */
-        u8                  reserved[52*FUNC_MAX];
-#endif
+        u8                      reserved[52*PORT_MAX];
 
         /* FW information (for internal FW use) */
-        u32                 fw_info_fio_offset;            /* 0x4e0 (0x4)   */
-        struct mgmtfw_state mgmtfw_state;                  /* 0x4e4 (0x140) */
+        u32                     fw_info_fio_offset;    /* 0x4a8       (0x4) */
+        struct mgmtfw_state     mgmtfw_state;          /* 0x4ac     (0x1b8) */
+
+        struct drv_port_mb      port_mb[PORT_MAX];     /* 0x664 (16*2=0x20) */
+        struct drv_func_mb      func_mb[FUNC_MAX];     /* 0x684 (44*2=0x58) */
 
-};                                                         /* 0x624 */
+};                                                     /* 0x6dc */
 
 
 #define BCM_5710_FW_MAJOR_VERSION                       4
diff --git a/drivers/net/bnx2x_init.h b/drivers/net/bnx2x_init.h
index 04f93bff2ef4..dcaecc53bdb1 100644
--- a/drivers/net/bnx2x_init.h
+++ b/drivers/net/bnx2x_init.h
@@ -1,6 +1,6 @@
 /* bnx2x_init.h: Broadcom Everest network driver.
  *
- * Copyright (c) 2007 Broadcom Corporation
+ * Copyright (c) 2007-2008 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -409,7 +409,7 @@ static void bnx2x_init_pxp(struct bnx2x *bp)
 
         pci_read_config_word(bp->pdev,
                              bp->pcie_cap + PCI_EXP_DEVCTL, (u16 *)&val);
-        DP(NETIF_MSG_HW, "read 0x%x from devctl\n", val);
+        DP(NETIF_MSG_HW, "read 0x%x from devctl\n", (u16)val);
         w_order = ((val & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
         r_order = ((val & PCI_EXP_DEVCTL_READRQ) >> 12);
 
@@ -472,10 +472,14 @@ static void bnx2x_init_pxp(struct bnx2x *bp)
         REG_WR(bp, PXP2_REG_PSWRQ_BW_WR, val);
 
         REG_WR(bp, PXP2_REG_RQ_WR_MBS0, w_order);
-        REG_WR(bp, PXP2_REG_RQ_WR_MBS0 + 8, w_order);
+        REG_WR(bp, PXP2_REG_RQ_WR_MBS1, w_order);
         REG_WR(bp, PXP2_REG_RQ_RD_MBS0, r_order);
-        REG_WR(bp, PXP2_REG_RQ_RD_MBS0 + 8, r_order);
+        REG_WR(bp, PXP2_REG_RQ_RD_MBS1, r_order);
 
+        if (r_order == MAX_RD_ORD)
+                REG_WR(bp, PXP2_REG_RQ_PDR_LIMIT, 0xe00);
+
+        REG_WR(bp, PXP2_REG_WR_USDMDP_TH, (0x18 << w_order));
         REG_WR(bp, PXP2_REG_WR_DMAE_TH, (128 << w_order)/16);
 }
 
diff --git a/drivers/net/bnx2x_reg.h b/drivers/net/bnx2x_reg.h
index 86055297ab02..5a1aa0b55044 100644
--- a/drivers/net/bnx2x_reg.h
+++ b/drivers/net/bnx2x_reg.h
@@ -1,6 +1,6 @@
 /* bnx2x_reg.h: Broadcom Everest network driver.
  *
- * Copyright (c) 2007 Broadcom Corporation
+ * Copyright (c) 2007-2008 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -24,6 +24,8 @@
 #define BRB1_REG_BRB1_INT_STS                                    0x6011c
 /* [RW 4] Parity mask register #0 read/write */
 #define BRB1_REG_BRB1_PRTY_MASK                                  0x60138
+/* [R 4] Parity register #0 read */
+#define BRB1_REG_BRB1_PRTY_STS                                   0x6012c
 /* [RW 10] At address BRB1_IND_FREE_LIST_PRS_CRDT initialize free head. At
    address BRB1_IND_FREE_LIST_PRS_CRDT+1 initialize free tail. At address
    BRB1_IND_FREE_LIST_PRS_CRDT+2 initialize parser initial credit. */
@@ -281,6 +283,8 @@
 #define CDU_REG_CDU_INT_STS                                      0x101030
 /* [RW 5] Parity mask register #0 read/write */
 #define CDU_REG_CDU_PRTY_MASK                                    0x10104c
+/* [R 5] Parity register #0 read */
+#define CDU_REG_CDU_PRTY_STS                                     0x101040
 /* [RC 32] logging of error data in case of a CDU load error:
    {expected_cid[15:0]; xpected_type[2:0]; xpected_region[2:0]; ctive_error;
    ype_error; ctual_active; ctual_compressed_context}; */
@@ -308,6 +312,8 @@
 #define CFC_REG_CFC_INT_STS_CLR                                  0x104100
 /* [RW 4] Parity mask register #0 read/write */
 #define CFC_REG_CFC_PRTY_MASK                                    0x104118
+/* [R 4] Parity register #0 read */
+#define CFC_REG_CFC_PRTY_STS                                     0x10410c
 /* [RW 21] CID cam access (21:1 - Data; alid - 0) */
 #define CFC_REG_CID_CAM                                          0x104800
 #define CFC_REG_CONTROL0                                         0x104028
@@ -354,6 +360,8 @@
 #define CSDM_REG_CSDM_INT_MASK_1                                 0xc22ac
 /* [RW 11] Parity mask register #0 read/write */
 #define CSDM_REG_CSDM_PRTY_MASK                                  0xc22bc
+/* [R 11] Parity register #0 read */
+#define CSDM_REG_CSDM_PRTY_STS                                   0xc22b0
 #define CSDM_REG_ENABLE_IN1                                      0xc2238
 #define CSDM_REG_ENABLE_IN2                                      0xc223c
 #define CSDM_REG_ENABLE_OUT1                                     0xc2240
@@ -438,6 +446,9 @@
 /* [RW 32] Parity mask register #0 read/write */
 #define CSEM_REG_CSEM_PRTY_MASK_0                                0x200130
 #define CSEM_REG_CSEM_PRTY_MASK_1                                0x200140
+/* [R 32] Parity register #0 read */
+#define CSEM_REG_CSEM_PRTY_STS_0                                 0x200124
+#define CSEM_REG_CSEM_PRTY_STS_1                                 0x200134
 #define CSEM_REG_ENABLE_IN                                       0x2000a4
 #define CSEM_REG_ENABLE_OUT                                      0x2000a8
 /* [RW 32] This address space contains all registers and memories that are
@@ -526,6 +537,8 @@
 #define CSEM_REG_TS_9_AS                                         0x20005c
 /* [RW 1] Parity mask register #0 read/write */
 #define DBG_REG_DBG_PRTY_MASK                                    0xc0a8
+/* [R 1] Parity register #0 read */
+#define DBG_REG_DBG_PRTY_STS                                     0xc09c
 /* [RW 2] debug only: These bits indicate the credit for PCI request type 4
    interface; MUST be configured AFTER pci_ext_buffer_strt_addr_lsb/msb are
    configured */
@@ -543,6 +556,8 @@
 #define DMAE_REG_DMAE_INT_MASK                                   0x102054
 /* [RW 4] Parity mask register #0 read/write */
 #define DMAE_REG_DMAE_PRTY_MASK                                  0x102064
+/* [R 4] Parity register #0 read */
+#define DMAE_REG_DMAE_PRTY_STS                                   0x102058
 /* [RW 1] Command 0 go. */
 #define DMAE_REG_GO_C0                                           0x102080
 /* [RW 1] Command 1 go. */
@@ -623,6 +638,8 @@
 #define DORQ_REG_DORQ_INT_STS_CLR                                0x170178
 /* [RW 2] Parity mask register #0 read/write */
 #define DORQ_REG_DORQ_PRTY_MASK                                  0x170190
+/* [R 2] Parity register #0 read */
+#define DORQ_REG_DORQ_PRTY_STS                                   0x170184
 /* [RW 8] The address to write the DPM CID to STORM. */
 #define DORQ_REG_DPM_CID_ADDR                                    0x170044
 /* [RW 5] The DPM mode CID extraction offset. */
@@ -692,6 +709,8 @@
 #define HC_REG_CONFIG_1                                          0x108004
 /* [RW 3] Parity mask register #0 read/write */
 #define HC_REG_HC_PRTY_MASK                                      0x1080a0
+/* [R 3] Parity register #0 read */
+#define HC_REG_HC_PRTY_STS                                       0x108094
 /* [RW 17] status block interrupt mask; one in each bit means unmask; zerow
    in each bit means mask; bit 0 - default SB; bit 1 - SB_0; bit 2 - SB_1...
    bit 16- SB_15; addr 0 - port 0; addr 1 - port 1 */
@@ -1127,6 +1146,7 @@
 #define MISC_REG_AEU_GENERAL_ATTN_17                             0xa044
 #define MISC_REG_AEU_GENERAL_ATTN_18                             0xa048
 #define MISC_REG_AEU_GENERAL_ATTN_19                             0xa04c
+#define MISC_REG_AEU_GENERAL_ATTN_10                             0xa028
 #define MISC_REG_AEU_GENERAL_ATTN_11                             0xa02c
 #define MISC_REG_AEU_GENERAL_ATTN_2                              0xa008
 #define MISC_REG_AEU_GENERAL_ATTN_20                             0xa050
@@ -1135,6 +1155,9 @@
 #define MISC_REG_AEU_GENERAL_ATTN_4                              0xa010
 #define MISC_REG_AEU_GENERAL_ATTN_5                              0xa014
 #define MISC_REG_AEU_GENERAL_ATTN_6                              0xa018
+#define MISC_REG_AEU_GENERAL_ATTN_7                              0xa01c
+#define MISC_REG_AEU_GENERAL_ATTN_8                              0xa020
+#define MISC_REG_AEU_GENERAL_ATTN_9                              0xa024
 /* [RW 32] first 32b for inverting the input for function 0; for each bit:
    0= do not invert; 1= invert; mapped as follows: [0] NIG attention for
    function0; [1] NIG attention for function1; [2] GPIO1 mcp; [3] GPIO2 mcp;
@@ -1183,6 +1206,40 @@
    starts at 0x0 for the A0 tape-out and increments by one for each
    all-layer tape-out. */
 #define MISC_REG_CHIP_REV                                        0xa40c
+/* [RW 32] The following driver registers(1..6) represent 6 drivers and 32
+   clients. Each client can be controlled by one driver only. One in each
+   bit represent that this driver control the appropriate client (Ex: bit 5
+   is set means this driver control client number 5). addr1 = set; addr0 =
+   clear; read from both addresses will give the same result = status. write
+   to address 1 will set a request to control all the clients that their
+   appropriate bit (in the write command) is set. if the client is free (the
+   appropriate bit in all the other drivers is clear) one will be written to
+   that driver register; if the client isn't free the bit will remain zero.
+   if the appropriate bit is set (the driver request to gain control on a
+   client it already controls the ~MISC_REGISTERS_INT_STS.GENERIC_SW
+   interrupt will be asserted). write to address 0 will set a request to
+   free all the clients that their appropriate bit (in the write command) is
+   set. if the appropriate bit is clear (the driver request to free a client
+   it doesn't controls the ~MISC_REGISTERS_INT_STS.GENERIC_SW interrupt will
+   be asserted). */
+#define MISC_REG_DRIVER_CONTROL_1                                0xa510
+/* [RW 32] GPIO. [31-28] FLOAT port 0; [27-24] FLOAT port 0; When any of
+   these bits is written as a '1'; the corresponding SPIO bit will turn off
+   it's drivers and become an input. This is the reset state of all GPIO
+   pins. The read value of these bits will be a '1' if that last command
+   (#SET; #CLR; or #FLOAT) for this bit was a #FLOAT. (reset value 0xff).
+   [23-20] CLR port 1; 19-16] CLR port 0; When any of these bits is written
+   as a '1'; the corresponding GPIO bit will drive low. The read value of
+   these bits will be a '1' if that last command (#SET; #CLR; or #FLOAT) for
+   this bit was a #CLR. (reset value 0). [15-12] SET port 1; 11-8] port 0;
+   SET When any of these bits is written as a '1'; the corresponding GPIO
+   bit will drive high (if it has that capability). The read value of these
+   bits will be a '1' if that last command (#SET; #CLR; or #FLOAT) for this
+   bit was a #SET. (reset value 0). [7-4] VALUE port 1; [3-0] VALUE port 0;
+   RO; These bits indicate the read value of each of the eight GPIO pins.
+   This is the result value of the pin; not the drive value. Writing these
+   bits will have not effect. */
+#define MISC_REG_GPIO                                            0xa490
 /* [RW 1] Setting this bit enables a timer in the GRC block to timeout any
    access that does not finish within
    ~misc_registers_grc_timout_val.grc_timeout_val cycles. When this bit is
@@ -1223,6 +1280,8 @@
 #define MISC_REG_MISC_INT_MASK                                   0xa388
 /* [RW 1] Parity mask register #0 read/write */
 #define MISC_REG_MISC_PRTY_MASK                                  0xa398
+/* [R 1] Parity register #0 read */
+#define MISC_REG_MISC_PRTY_STS                                   0xa38c
 /* [RW 32] 32 LSB of storm PLL first register; reset val = 0x 071d2911.
    inside order of the bits is: [0] P1 divider[0] (reset value 1); [1] P1
    divider[1] (reset value 0); [2] P1 divider[2] (reset value 0); [3] P1
@@ -1264,6 +1323,55 @@
 /* [RW 20] 20 bit GRC address where the scratch-pad of the MCP that is
    shared with the driver resides */
 #define MISC_REG_SHARED_MEM_ADDR                                 0xa2b4
+/* [RW 32] SPIO. [31-24] FLOAT When any of these bits is written as a '1';
+   the corresponding SPIO bit will turn off it's drivers and become an
+   input. This is the reset state of all SPIO pins. The read value of these
+   bits will be a '1' if that last command (#SET; #CL; or #FLOAT) for this
+   bit was a #FLOAT. (reset value 0xff). [23-16] CLR When any of these bits
+   is written as a '1'; the corresponding SPIO bit will drive low. The read
+   value of these bits will be a '1' if that last command (#SET; #CLR; or
+#FLOAT) for this bit was a #CLR. (reset value 0). [15-8] SET When any of
+   these bits is written as a '1'; the corresponding SPIO bit will drive
+   high (if it has that capability). The read value of these bits will be a
+   '1' if that last command (#SET; #CLR; or #FLOAT) for this bit was a #SET.
+   (reset value 0). [7-0] VALUE RO; These bits indicate the read value of
+   each of the eight SPIO pins. This is the result value of the pin; not the
+   drive value. Writing these bits will have not effect. Each 8 bits field
+   is divided as follows: [0] VAUX Enable; when pulsed low; enables supply
+   from VAUX. (This is an output pin only; the FLOAT field is not applicable
+   for this pin); [1] VAUX Disable; when pulsed low; disables supply form
+   VAUX. (This is an output pin only; FLOAT field is not applicable for this
+   pin); [2] SEL_VAUX_B - Control to power switching logic. Drive low to
+   select VAUX supply. (This is an output pin only; it is not controlled by
+   the SET and CLR fields; it is controlled by the Main Power SM; the FLOAT
+   field is not applicable for this pin; only the VALUE fields is relevant -
+   it reflects the output value); [3] reserved; [4] spio_4; [5] spio_5; [6]
+   Bit 0 of UMP device ID select; read by UMP firmware; [7] Bit 1 of UMP
+   device ID select; read by UMP firmware. */
+#define MISC_REG_SPIO                                            0xa4fc
+/* [RW 8] These bits enable the SPIO_INTs to signals event to the IGU/MC.
+   according to the following map: [3:0] reserved; [4] spio_4 [5] spio_5;
+   [7:0] reserved */
+#define MISC_REG_SPIO_EVENT_EN                                   0xa2b8
+/* [RW 32] SPIO INT. [31-24] OLD_CLR Writing a '1' to these bit clears the
+   corresponding bit in the #OLD_VALUE register. This will acknowledge an
+   interrupt on the falling edge of corresponding SPIO input (reset value
+   0). [23-16] OLD_SET Writing a '1' to these bit sets the corresponding bit
+   in the #OLD_VALUE register. This will acknowledge an interrupt on the
+   rising edge of corresponding SPIO input (reset value 0). [15-8] OLD_VALUE
+   RO; These bits indicate the old value of the SPIO input value. When the
+   ~INT_STATE bit is set; this bit indicates the OLD value of the pin such
+   that if ~INT_STATE is set and this bit is '0'; then the interrupt is due
+   to a low to high edge. If ~INT_STATE is set and this bit is '1'; then the
+   interrupt is due to a high to low edge (reset value 0). [7-0] INT_STATE
+   RO; These bits indicate the current SPIO interrupt state for each SPIO
+   pin. This bit is cleared when the appropriate #OLD_SET or #OLD_CLR
+   command bit is written. This bit is set when the SPIO input does not
+   match the current value in #OLD_VALUE (reset value 0). */
+#define MISC_REG_SPIO_INT                                        0xa500
+/* [RW 1] Set by the MCP to remember if one or more of the drivers is/are
+   loaded; 0-prepare; -unprepare */
+#define MISC_REG_UNPREPARED                                      0xa424
 #define NIG_MASK_INTERRUPT_PORT0_REG_MASK_EMAC0_MISC_MI_INT      (0x1<<0)
 #define NIG_MASK_INTERRUPT_PORT0_REG_MASK_SERDES0_LINK_STATUS    (0x1<<9)
 #define NIG_MASK_INTERRUPT_PORT0_REG_MASK_XGXS0_LINK10G          (0x1<<15)
@@ -1392,6 +1500,9 @@
 #define NIG_REG_NIG_INGRESS_EMAC0_NO_CRC                         0x10044
 /* [RW 1] Input enable for RX PBF LP IF */
 #define NIG_REG_PBF_LB_IN_EN                                     0x100b4
+/* [RW 1] Value of this register will be transmitted to port swap when
+   ~nig_registers_strap_override.strap_override =1 */
+#define NIG_REG_PORT_SWAP                                        0x10394
 /* [RW 1] output enable for RX parser descriptor IF */
 #define NIG_REG_PRS_EOP_OUT_EN                                   0x10104
 /* [RW 1] Input enable for RX parser request IF */
@@ -1410,6 +1521,10 @@
 #define NIG_REG_STAT2_BRB_OCTET                                  0x107e0
 #define NIG_REG_STATUS_INTERRUPT_PORT0                           0x10328
 #define NIG_REG_STATUS_INTERRUPT_PORT1                           0x1032c
+/* [RW 1] port swap mux selection. If this register equal to 0 then port
+   swap is equal to SPIO pin that inputs from ifmux_serdes_swap. If 1 then
+   ort swap is equal to ~nig_registers_port_swap.port_swap */
+#define NIG_REG_STRAP_OVERRIDE                                   0x10398
 /* [RW 1] output enable for RX_XCM0 IF */
 #define NIG_REG_XCM0_OUT_EN                                      0x100f0
 /* [RW 1] output enable for RX_XCM1 IF */
@@ -1499,6 +1614,8 @@
 #define PB_REG_PB_INT_STS                                        0x1c
 /* [RW 4] Parity mask register #0 read/write */
 #define PB_REG_PB_PRTY_MASK                                      0x38
+/* [R 4] Parity register #0 read */
+#define PB_REG_PB_PRTY_STS                                       0x2c
 #define PRS_REG_A_PRSU_20                                        0x40134
 /* [R 8] debug only: CFC load request current credit. Transaction based. */
 #define PRS_REG_CFC_LD_CURRENT_CREDIT                            0x40164
@@ -1590,6 +1707,8 @@
 #define PRS_REG_PRS_INT_STS                                      0x40188
 /* [RW 8] Parity mask register #0 read/write */
 #define PRS_REG_PRS_PRTY_MASK                                    0x401a4
+/* [R 8] Parity register #0 read */
+#define PRS_REG_PRS_PRTY_STS                                     0x40198
 /* [RW 8] Context region for pure acknowledge packets. Used in CFC load
    request message */
 #define PRS_REG_PURE_REGIONS                                     0x40024
@@ -1718,6 +1837,9 @@
 /* [RW 32] Parity mask register #0 read/write */
 #define PXP2_REG_PXP2_PRTY_MASK_0                                0x120588
 #define PXP2_REG_PXP2_PRTY_MASK_1                                0x120598
+/* [R 32] Parity register #0 read */
+#define PXP2_REG_PXP2_PRTY_STS_0                                 0x12057c
+#define PXP2_REG_PXP2_PRTY_STS_1                                 0x12058c
 /* [R 1] Debug only: The 'almost full' indication from each fifo (gives
    indication about backpressure) */
 #define PXP2_REG_RD_ALMOST_FULL_0                                0x120424
@@ -1911,6 +2033,8 @@
 #define PXP2_REG_RQ_HC_ENDIAN_M                                  0x1201a8
 /* [WB 53] Onchip address table */
 #define PXP2_REG_RQ_ONCHIP_AT                                    0x122000
+/* [RW 13] Pending read limiter threshold; in Dwords */
+#define PXP2_REG_RQ_PDR_LIMIT                                    0x12033c
 /* [RW 2] Endian mode for qm */
 #define PXP2_REG_RQ_QM_ENDIAN_M                                  0x120194
 /* [RW 3] page size in L2P table for QM module; -4k; -8k; -16k; -32k; -64k;
@@ -1921,6 +2045,9 @@
 /* [RW 3] Max burst size filed for read requests port 0; 000 - 128B;
    001:256B; 010: 512B; 11:1K:100:2K; 01:4K */
 #define PXP2_REG_RQ_RD_MBS0                                      0x120160
+/* [RW 3] Max burst size filed for read requests port 1; 000 - 128B;
+   001:256B; 010: 512B; 11:1K:100:2K; 01:4K */
+#define PXP2_REG_RQ_RD_MBS1                                      0x120168
 /* [RW 2] Endian mode for src */
 #define PXP2_REG_RQ_SRC_ENDIAN_M                                 0x12019c
 /* [RW 3] page size in L2P table for SRC module; -4k; -8k; -16k; -32k; -64k;
@@ -2000,10 +2127,17 @@
 /* [RW 3] Max burst size filed for write requests port 0; 000 - 128B;
    001:256B; 010: 512B; */
 #define PXP2_REG_RQ_WR_MBS0                                      0x12015c
+/* [RW 3] Max burst size filed for write requests port 1; 000 - 128B;
+   001:256B; 010: 512B; */
+#define PXP2_REG_RQ_WR_MBS1                                      0x120164
 /* [RW 10] if Number of entries in dmae fifo will be higer than this
    threshold then has_payload indication will be asserted; the default value
    should be equal to &gt;  write MBS size! */
 #define PXP2_REG_WR_DMAE_TH                                      0x120368
+/* [RW 10] if Number of entries in usdmdp fifo will be higer than this
+   threshold then has_payload indication will be asserted; the default value
+   should be equal to &gt;  write MBS size! */
+#define PXP2_REG_WR_USDMDP_TH                                    0x120348
 /* [R 1] debug only: Indication if PSWHST arbiter is idle */
 #define PXP_REG_HST_ARB_IS_IDLE                                  0x103004
 /* [R 8] debug only: A bit mask for all PSWHST arbiter clients. '1' means
@@ -2021,6 +2155,8 @@
 #define PXP_REG_PXP_INT_STS_CLR_0                                0x10306c
 /* [RW 26] Parity mask register #0 read/write */
 #define PXP_REG_PXP_PRTY_MASK                                    0x103094
+/* [R 26] Parity register #0 read */
+#define PXP_REG_PXP_PRTY_STS                                     0x103088
 /* [RW 4] The activity counter initial increment value sent in the load
    request */
 #define QM_REG_ACTCTRINITVAL_0                                   0x168040
@@ -2127,6 +2263,8 @@
 #define QM_REG_QM_INT_STS                                        0x168438
 /* [RW 9] Parity mask register #0 read/write */
 #define QM_REG_QM_PRTY_MASK                                      0x168454
+/* [R 9] Parity register #0 read */
+#define QM_REG_QM_PRTY_STS                                       0x168448
 /* [R 32] Current queues in pipeline: Queues from 32 to 63 */
 #define QM_REG_QSTATUS_HIGH                                      0x16802c
 /* [R 32] Current queues in pipeline: Queues from 0 to 31 */
@@ -2410,6 +2548,8 @@
 #define SRC_REG_SRC_INT_STS                                      0x404ac
 /* [RW 3] Parity mask register #0 read/write */
 #define SRC_REG_SRC_PRTY_MASK                                    0x404c8
+/* [R 3] Parity register #0 read */
+#define SRC_REG_SRC_PRTY_STS                                     0x404bc
 /* [R 4] Used to read the value of the XX protection CAM occupancy counter. */
 #define TCM_REG_CAM_OCCUP                                        0x5017c
 /* [RW 1] CDU AG read Interface enable. If 0 - the request input is
@@ -2730,6 +2870,8 @@
 #define TSDM_REG_TSDM_INT_MASK_1                                 0x422ac
 /* [RW 11] Parity mask register #0 read/write */
 #define TSDM_REG_TSDM_PRTY_MASK                                  0x422bc
+/* [R 11] Parity register #0 read */
+#define TSDM_REG_TSDM_PRTY_STS                                   0x422b0
 /* [RW 5] The number of time_slots in the arbitration cycle */
 #define TSEM_REG_ARB_CYCLE_SIZE                                  0x180034
 /* [RW 3] The source that is associated with arbitration element 0. Source
@@ -2854,6 +2996,9 @@
 /* [RW 32] Parity mask register #0 read/write */
 #define TSEM_REG_TSEM_PRTY_MASK_0                                0x180120
 #define TSEM_REG_TSEM_PRTY_MASK_1                                0x180130
+/* [R 32] Parity register #0 read */
+#define TSEM_REG_TSEM_PRTY_STS_0                                 0x180114
+#define TSEM_REG_TSEM_PRTY_STS_1                                 0x180124
 /* [R 5] Used to read the XX protection CAM occupancy counter. */
 #define UCM_REG_CAM_OCCUP                                        0xe0170
 /* [RW 1] CDU AG read Interface enable. If 0 - the request input is
@@ -3155,6 +3300,8 @@
 #define USDM_REG_USDM_INT_MASK_1                                 0xc42b0
 /* [RW 11] Parity mask register #0 read/write */
 #define USDM_REG_USDM_PRTY_MASK                                  0xc42c0
+/* [R 11] Parity register #0 read */
+#define USDM_REG_USDM_PRTY_STS                                   0xc42b4
 /* [RW 5] The number of time_slots in the arbitration cycle */
 #define USEM_REG_ARB_CYCLE_SIZE                                  0x300034
 /* [RW 3] The source that is associated with arbitration element 0. Source
@@ -3279,6 +3426,9 @@
 /* [RW 32] Parity mask register #0 read/write */
 #define USEM_REG_USEM_PRTY_MASK_0                                0x300130
 #define USEM_REG_USEM_PRTY_MASK_1                                0x300140
+/* [R 32] Parity register #0 read */
+#define USEM_REG_USEM_PRTY_STS_0                                 0x300124
+#define USEM_REG_USEM_PRTY_STS_1                                 0x300134
 /* [RW 2] The queue index for registration on Aux1 counter flag. */
 #define XCM_REG_AUX1_Q                                           0x20134
 /* [RW 2] Per each decision rule the queue index to register to. */
@@ -3684,6 +3834,8 @@
 #define XSDM_REG_XSDM_INT_MASK_1                                 0x1662ac
 /* [RW 11] Parity mask register #0 read/write */
 #define XSDM_REG_XSDM_PRTY_MASK                                  0x1662bc
+/* [R 11] Parity register #0 read */
+#define XSDM_REG_XSDM_PRTY_STS                                   0x1662b0
 /* [RW 5] The number of time_slots in the arbitration cycle */
 #define XSEM_REG_ARB_CYCLE_SIZE                                  0x280034
 /* [RW 3] The source that is associated with arbitration element 0. Source
@@ -3808,6 +3960,9 @@
 /* [RW 32] Parity mask register #0 read/write */
 #define XSEM_REG_XSEM_PRTY_MASK_0                                0x280130
 #define XSEM_REG_XSEM_PRTY_MASK_1                                0x280140
+/* [R 32] Parity register #0 read */
+#define XSEM_REG_XSEM_PRTY_STS_0                                 0x280124
+#define XSEM_REG_XSEM_PRTY_STS_1                                 0x280134
 #define MCPR_NVM_ACCESS_ENABLE_EN                                (1L<<0)
 #define MCPR_NVM_ACCESS_ENABLE_WR_EN                             (1L<<1)
 #define MCPR_NVM_ADDR_NVM_ADDR_VALUE                             (0xffffffL<<0)
@@ -3847,6 +4002,8 @@
 #define EMAC_MDIO_COMM_START_BUSY                                (1L<<29)
 #define EMAC_MDIO_MODE_AUTO_POLL                                 (1L<<4)
 #define EMAC_MDIO_MODE_CLAUSE_45                                 (1L<<31)
+#define EMAC_MDIO_MODE_CLOCK_CNT                                 (0x3fL<<16)
+#define EMAC_MDIO_MODE_CLOCK_CNT_BITSHIFT                        16
 #define EMAC_MODE_25G_MODE                                       (1L<<5)
 #define EMAC_MODE_ACPI_RCVD                                      (1L<<20)
 #define EMAC_MODE_HALF_DUPLEX                                    (1L<<1)
@@ -3874,6 +4031,17 @@
 #define EMAC_RX_MTU_SIZE_JUMBO_ENA                               (1L<<31)
 #define EMAC_TX_MODE_EXT_PAUSE_EN                                (1L<<3)
 #define EMAC_TX_MODE_RESET                                       (1L<<0)
+#define MISC_REGISTERS_GPIO_1                                    1
+#define MISC_REGISTERS_GPIO_2                                    2
+#define MISC_REGISTERS_GPIO_3                                    3
+#define MISC_REGISTERS_GPIO_CLR_POS                              16
+#define MISC_REGISTERS_GPIO_FLOAT                                (0xffL<<24)
+#define MISC_REGISTERS_GPIO_FLOAT_POS                            24
+#define MISC_REGISTERS_GPIO_INPUT_HI_Z                           2
+#define MISC_REGISTERS_GPIO_OUTPUT_HIGH                          1
+#define MISC_REGISTERS_GPIO_OUTPUT_LOW                           0
+#define MISC_REGISTERS_GPIO_PORT_SHIFT                           4
+#define MISC_REGISTERS_GPIO_SET_POS                              8
 #define MISC_REGISTERS_RESET_REG_1_CLEAR                         0x588
 #define MISC_REGISTERS_RESET_REG_1_SET                           0x584
 #define MISC_REGISTERS_RESET_REG_2_CLEAR                         0x598
@@ -3891,6 +4059,25 @@
 #define MISC_REGISTERS_RESET_REG_3_MISC_NIG_MUX_XGXS0_RSTB_HW    (0x1<<4)
 #define MISC_REGISTERS_RESET_REG_3_MISC_NIG_MUX_XGXS0_TXD_FIFO_RSTB (0x1<<8)
 #define MISC_REGISTERS_RESET_REG_3_SET                           0x5a4
+#define MISC_REGISTERS_SPIO_4                                    4
+#define MISC_REGISTERS_SPIO_5                                    5
+#define MISC_REGISTERS_SPIO_7                                    7
+#define MISC_REGISTERS_SPIO_CLR_POS                              16
+#define MISC_REGISTERS_SPIO_FLOAT                                (0xffL<<24)
+#define GRC_MISC_REGISTERS_SPIO_FLOAT7                           0x80000000
+#define GRC_MISC_REGISTERS_SPIO_FLOAT6                           0x40000000
+#define GRC_MISC_REGISTERS_SPIO_FLOAT5                           0x20000000
+#define GRC_MISC_REGISTERS_SPIO_FLOAT4                           0x10000000
+#define MISC_REGISTERS_SPIO_FLOAT_POS                            24
+#define MISC_REGISTERS_SPIO_INPUT_HI_Z                           2
+#define MISC_REGISTERS_SPIO_INT_OLD_SET_POS                      16
+#define MISC_REGISTERS_SPIO_OUTPUT_HIGH                          1
+#define MISC_REGISTERS_SPIO_OUTPUT_LOW                           0
+#define MISC_REGISTERS_SPIO_SET_POS                              8
+#define HW_LOCK_MAX_RESOURCE_VALUE                               31
+#define HW_LOCK_RESOURCE_8072_MDIO                               0
+#define HW_LOCK_RESOURCE_GPIO                                    1
+#define HW_LOCK_RESOURCE_SPIO                                    2
 #define AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR                 (1<<18)
 #define AEU_INPUTS_ATTN_BITS_CCM_HW_INTERRUPT                 (1<<31)
 #define AEU_INPUTS_ATTN_BITS_CDU_HW_INTERRUPT                 (1<<9)
@@ -3918,6 +4105,7 @@
 #define AEU_INPUTS_ATTN_BITS_QM_HW_INTERRUPT                  (1<<3)
 #define AEU_INPUTS_ATTN_BITS_QM_PARITY_ERROR                  (1<<2)
 #define AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR            (1<<22)
+#define AEU_INPUTS_ATTN_BITS_SPIO5                            (1<<15)
 #define AEU_INPUTS_ATTN_BITS_TCM_HW_INTERRUPT                 (1<<27)
 #define AEU_INPUTS_ATTN_BITS_TIMERS_HW_INTERRUPT              (1<<5)
 #define AEU_INPUTS_ATTN_BITS_TSDM_HW_INTERRUPT                (1<<25)
@@ -4206,6 +4394,9 @@
 #define MDIO_XGXS_BLOCK2_RX_LN_SWAP_FORCE_ENABLE        0x4000
 #define MDIO_XGXS_BLOCK2_TX_LN_SWAP                     0x11
 #define MDIO_XGXS_BLOCK2_TX_LN_SWAP_ENABLE              0x8000
+#define MDIO_XGXS_BLOCK2_UNICORE_MODE_10G               0x14
+#define MDIO_XGXS_BLOCK2_UNICORE_MODE_10G_CX4_XGXS      0x0001
+#define MDIO_XGXS_BLOCK2_UNICORE_MODE_10G_HIGIG_XGXS    0x0010
 #define MDIO_XGXS_BLOCK2_TEST_MODE_LANE                 0x15
 
 #define MDIO_REG_BANK_GP_STATUS                         0x8120
@@ -4362,11 +4553,13 @@
 #define MDIO_COMBO_IEEE0_AUTO_NEG_LINK_PARTNER_ABILITY1_SGMII_MODE   0x0001
 
 
+#define EXT_PHY_AUTO_NEG_DEVAD                          0x7
 #define EXT_PHY_OPT_PMA_PMD_DEVAD                       0x1
 #define EXT_PHY_OPT_WIS_DEVAD                           0x2
 #define EXT_PHY_OPT_PCS_DEVAD                           0x3
 #define EXT_PHY_OPT_PHY_XS_DEVAD                        0x4
 #define EXT_PHY_OPT_CNTL                                0x0
+#define EXT_PHY_OPT_CNTL2                               0x7
 #define EXT_PHY_OPT_PMD_RX_SD                           0xa
 #define EXT_PHY_OPT_PMD_MISC_CNTL                       0xca0a
 #define EXT_PHY_OPT_PHY_IDENTIFIER                      0xc800
@@ -4378,11 +4571,24 @@
 #define EXT_PHY_OPT_LASI_STATUS                         0x9005
 #define EXT_PHY_OPT_PCS_STATUS                          0x0020
 #define EXT_PHY_OPT_XGXS_LANE_STATUS                    0x0018
+#define EXT_PHY_OPT_AN_LINK_STATUS                      0x8304
+#define EXT_PHY_OPT_AN_CL37_CL73                        0x8370
+#define EXT_PHY_OPT_AN_CL37_FD                          0xffe4
+#define EXT_PHY_OPT_AN_CL37_AN                          0xffe0
+#define EXT_PHY_OPT_AN_ADV                              0x11
 
 #define EXT_PHY_KR_PMA_PMD_DEVAD                        0x1
 #define EXT_PHY_KR_PCS_DEVAD                            0x3
 #define EXT_PHY_KR_AUTO_NEG_DEVAD                       0x7
 #define EXT_PHY_KR_CTRL                                 0x0000
+#define EXT_PHY_KR_STATUS                               0x0001
+#define EXT_PHY_KR_AUTO_NEG_COMPLETE                    0x0020
+#define EXT_PHY_KR_AUTO_NEG_ADVERT                      0x0010
+#define EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE                0x0400
+#define EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_ASYMMETRIC     0x0800
+#define EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_BOTH           0x0C00
+#define EXT_PHY_KR_AUTO_NEG_ADVERT_PAUSE_MASK           0x0C00
+#define EXT_PHY_KR_LP_AUTO_NEG                          0x0013
 #define EXT_PHY_KR_CTRL2                                0x0007
 #define EXT_PHY_KR_PCS_STATUS                           0x0020
 #define EXT_PHY_KR_PMD_CTRL                             0x0096
@@ -4391,4 +4597,8 @@
 #define EXT_PHY_KR_MISC_CTRL1                           0xca85
 #define EXT_PHY_KR_GEN_CTRL                             0xca10
 #define EXT_PHY_KR_ROM_CODE                             0xca19
+#define EXT_PHY_KR_ROM_RESET_INTERNAL_MP                0x0188
+#define EXT_PHY_KR_ROM_MICRO_RESET                      0x018a
+
+#define EXT_PHY_SFX7101_XGXS_TEST1          0xc00a
 
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 571750975137..348371fda597 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -172,30 +172,30 @@ static char version[] __initdata =
    them to system IRQ numbers. This mapping is card specific and is set to
    the configuration of the Cirrus Eval board for this chip. */
 #ifdef CONFIG_ARCH_CLPS7500
-static unsigned int netcard_portlist[] __initdata =
+static unsigned int netcard_portlist[] __used __initdata =
    { 0x80090303, 0x300, 0x320, 0x340, 0x360, 0x200, 0x220, 0x240, 0x260, 0x280, 0x2a0, 0x2c0, 0x2e0, 0};
 static unsigned int cs8900_irq_map[] = {12,0,0,0};
 #elif defined(CONFIG_SH_HICOSH4)
-static unsigned int netcard_portlist[] __initdata =
+static unsigned int netcard_portlist[] __used __initdata =
    { 0x0300, 0};
 static unsigned int cs8900_irq_map[] = {1,0,0,0};
 #elif defined(CONFIG_MACH_IXDP2351)
-static unsigned int netcard_portlist[] __initdata = {IXDP2351_VIRT_CS8900_BASE, 0};
+static unsigned int netcard_portlist[] __used __initdata = {IXDP2351_VIRT_CS8900_BASE, 0};
 static unsigned int cs8900_irq_map[] = {IRQ_IXDP2351_CS8900, 0, 0, 0};
 #include <asm/irq.h>
 #elif defined(CONFIG_ARCH_IXDP2X01)
 #include <asm/irq.h>
-static unsigned int netcard_portlist[] __initdata = {IXDP2X01_CS8900_VIRT_BASE, 0};
+static unsigned int netcard_portlist[] __used __initdata = {IXDP2X01_CS8900_VIRT_BASE, 0};
 static unsigned int cs8900_irq_map[] = {IRQ_IXDP2X01_CS8900, 0, 0, 0};
 #elif defined(CONFIG_ARCH_PNX010X)
 #include <asm/irq.h>
 #include <asm/arch/gpio.h>
 #define CIRRUS_DEFAULT_BASE     IO_ADDRESS(EXT_STATIC2_s0_BASE + 0x200000)      /* = Physical address 0x48200000 */
 #define CIRRUS_DEFAULT_IRQ      VH_INTC_INT_NUM_CASCADED_INTERRUPT_1 /* Event inputs bank 1 - ID 35/bit 3 */
-static unsigned int netcard_portlist[] __initdata = {CIRRUS_DEFAULT_BASE, 0};
+static unsigned int netcard_portlist[] __used __initdata = {CIRRUS_DEFAULT_BASE, 0};
 static unsigned int cs8900_irq_map[] = {CIRRUS_DEFAULT_IRQ, 0, 0, 0};
 #else
-static unsigned int netcard_portlist[] __initdata =
+static unsigned int netcard_portlist[] __used __initdata =
    { 0x300, 0x320, 0x340, 0x360, 0x200, 0x220, 0x240, 0x260, 0x280, 0x2a0, 0x2c0, 0x2e0, 0};
 static unsigned int cs8900_irq_map[] = {10,11,12,5};
 #endif
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 36ba6dc96acc..cdf3090a1885 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2782,16 +2782,13 @@ static void __devexit e100_remove(struct pci_dev *pdev)
         }
 }
 
-#ifdef CONFIG_PM
 static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct nic *nic = netdev_priv(netdev);
 
         if (netif_running(netdev))
-                napi_disable(&nic->napi);
-        del_timer_sync(&nic->watchdog);
-        netif_carrier_off(nic->netdev);
+                e100_down(nic);
         netif_device_detach(netdev);
 
         pci_save_state(pdev);
@@ -2804,14 +2801,13 @@ static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
                 pci_enable_wake(pdev, PCI_D3cold, 0);
         }
 
-        free_irq(pdev->irq, netdev);
-
         pci_disable_device(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
 }
 
+#ifdef CONFIG_PM
 static int e100_resume(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
@@ -2832,26 +2828,7 @@ static int e100_resume(struct pci_dev *pdev)
 
 static void e100_shutdown(struct pci_dev *pdev)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct nic *nic = netdev_priv(netdev);
-
-        if (netif_running(netdev))
-                napi_disable(&nic->napi);
-        del_timer_sync(&nic->watchdog);
-        netif_carrier_off(nic->netdev);
-
-        if ((nic->flags & wol_magic) | e100_asf(nic)) {
-                pci_enable_wake(pdev, PCI_D3hot, 1);
-                pci_enable_wake(pdev, PCI_D3cold, 1);
-        } else {
-                pci_enable_wake(pdev, PCI_D3hot, 0);
-                pci_enable_wake(pdev, PCI_D3cold, 0);
-        }
-
-        free_irq(pdev->irq, netdev);
-
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
+        e100_suspend(pdev, PMSG_SUSPEND);
 }
 
 /* ------------------ PCI Error Recovery infrastructure  -------------- */
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 3beace55b58d..7fe20310eb5f 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -438,7 +438,7 @@ static void e1000_release_nvm_82571(struct e1000_hw *hw)
  *  For non-82573 silicon, write data to EEPROM at offset using SPI interface.
  *
  *  If e1000e_update_nvm_checksum is not called after this function, the
- *  EEPROM will most likley contain an invalid checksum.
+ *  EEPROM will most likely contain an invalid checksum.
  **/
 static s32 e1000_write_nvm_82571(struct e1000_hw *hw, u16 offset, u16 words,
                                  u16 *data)
@@ -547,7 +547,7 @@ static s32 e1000_validate_nvm_checksum_82571(struct e1000_hw *hw)
  *  poll for completion.
  *
  *  If e1000e_update_nvm_checksum is not called after this function, the
- *  EEPROM will most likley contain an invalid checksum.
+ *  EEPROM will most likely contain an invalid checksum.
  **/
 static s32 e1000_write_nvm_eewr_82571(struct e1000_hw *hw, u16 offset,
                                       u16 words, u16 *data)
@@ -1053,7 +1053,7 @@ static s32 e1000_setup_fiber_serdes_link_82571(struct e1000_hw *hw)
                 /* If SerDes loopback mode is entered, there is no form
                  * of reset to take the adapter out of that mode.  So we
                  * have to explicitly take the adapter out of loopback
-                 * mode.  This prevents drivers from twidling their thumbs
+                 * mode.  This prevents drivers from twiddling their thumbs
                  * if another tool failed to take it out of loopback mode.
                  */
                 ew32(SCTL,
@@ -1098,7 +1098,7 @@ static s32 e1000_valid_led_default_82571(struct e1000_hw *hw, u16 *data)
  *  e1000e_get_laa_state_82571 - Get locally administered address state
  *  @hw: pointer to the HW structure
  *
- *  Retrieve and return the current locally administed address state.
+ *  Retrieve and return the current locally administered address state.
  **/
 bool e1000e_get_laa_state_82571(struct e1000_hw *hw)
 {
@@ -1113,7 +1113,7 @@ bool e1000e_get_laa_state_82571(struct e1000_hw *hw)
  *  @hw: pointer to the HW structure
  *  @state: enable/disable locally administered address
  *
- *  Enable/Disable the current locally administed address state.
+ *  Enable/Disable the current locally administers address state.
  **/
 void e1000e_set_laa_state_82571(struct e1000_hw *hw, bool state)
 {
@@ -1281,16 +1281,6 @@ static struct e1000_phy_operations e82_phy_ops_m88 = {
 
 static struct e1000_nvm_operations e82571_nvm_ops = {
         .acquire_nvm            = e1000_acquire_nvm_82571,
-        .read_nvm               = e1000e_read_nvm_spi,
-        .release_nvm            = e1000_release_nvm_82571,
-        .update_nvm             = e1000_update_nvm_checksum_82571,
-        .valid_led_default      = e1000_valid_led_default_82571,
-        .validate_nvm           = e1000_validate_nvm_checksum_82571,
-        .write_nvm              = e1000_write_nvm_82571,
-};
-
-static struct e1000_nvm_operations e82573_nvm_ops = {
-        .acquire_nvm            = e1000_acquire_nvm_82571,
         .read_nvm               = e1000e_read_nvm_eerd,
         .release_nvm            = e1000_release_nvm_82571,
         .update_nvm             = e1000_update_nvm_checksum_82571,
@@ -1355,6 +1345,6 @@ struct e1000_info e1000_82573_info = {
         .get_invariants         = e1000_get_invariants_82571,
         .mac_ops                = &e82571_mac_ops,
         .phy_ops                = &e82_phy_ops_m88,
-        .nvm_ops                = &e82573_nvm_ops,
+        .nvm_ops                = &e82571_nvm_ops,
 };
 
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index 6232c3e96689..a4f511f549f7 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -66,7 +66,7 @@
 #define E1000_WUFC_ARP  0x00000020 /* ARP Request Packet Wakeup Enable */
 
 /* Extended Device Control */
-#define E1000_CTRL_EXT_SDP7_DATA 0x00000080 /* Value of SW Defineable Pin 7 */
+#define E1000_CTRL_EXT_SDP7_DATA 0x00000080 /* Value of SW Definable Pin 7 */
 #define E1000_CTRL_EXT_EE_RST    0x00002000 /* Reinitialize from EEPROM */
 #define E1000_CTRL_EXT_RO_DIS    0x00020000 /* Relaxed Ordering disable */
 #define E1000_CTRL_EXT_LINK_MODE_MASK 0x00C00000
@@ -75,12 +75,12 @@
 #define E1000_CTRL_EXT_IAME           0x08000000 /* Interrupt acknowledge Auto-mask */
 #define E1000_CTRL_EXT_INT_TIMER_CLR  0x20000000 /* Clear Interrupt timers after IMS clear */
 
-/* Receive Decriptor bit definitions */
+/* Receive Descriptor bit definitions */
 #define E1000_RXD_STAT_DD       0x01    /* Descriptor Done */
 #define E1000_RXD_STAT_EOP      0x02    /* End of Packet */
 #define E1000_RXD_STAT_IXSM     0x04    /* Ignore checksum */
 #define E1000_RXD_STAT_VP       0x08    /* IEEE VLAN Packet */
-#define E1000_RXD_STAT_UDPCS    0x10    /* UDP xsum caculated */
+#define E1000_RXD_STAT_UDPCS    0x10    /* UDP xsum calculated */
 #define E1000_RXD_STAT_TCPCS    0x20    /* TCP xsum calculated */
 #define E1000_RXD_ERR_CE        0x01    /* CRC Error */
 #define E1000_RXD_ERR_SE        0x02    /* Symbol Error */
@@ -223,7 +223,7 @@
 #define E1000_STATUS_LAN_INIT_DONE 0x00000200   /* Lan Init Completion by NVM */
 #define E1000_STATUS_GIO_MASTER_ENABLE 0x00080000 /* Status of Master requests. */
 
-/* Constants used to intrepret the masked PCI-X bus speed. */
+/* Constants used to interpret the masked PCI-X bus speed. */
 
 #define HALF_DUPLEX 1
 #define FULL_DUPLEX 2
@@ -517,7 +517,7 @@
 /* PHY 1000 MII Register/Bit Definitions */
 /* PHY Registers defined by IEEE */
 #define PHY_CONTROL      0x00 /* Control Register */
-#define PHY_STATUS       0x01 /* Status Regiser */
+#define PHY_STATUS       0x01 /* Status Register */
 #define PHY_ID1          0x02 /* Phy Id Reg (word 1) */
 #define PHY_ID2          0x03 /* Phy Id Reg (word 2) */
 #define PHY_AUTONEG_ADV  0x04 /* Autoneg Advertisement */
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 8b88c226e858..327c0620da31 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -42,8 +42,7 @@
 struct e1000_info;
 
 #define ndev_printk(level, netdev, format, arg...) \
-        printk(level "%s: %s: " format, (netdev)->dev.parent->bus_id, \
-               (netdev)->name, ## arg)
+        printk(level "%s: " format, (netdev)->name, ## arg)
 
 #ifdef DEBUG
 #define ndev_dbg(netdev, format, arg...) \
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 3c5862f97dbf..916025b30fc3 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -184,7 +184,7 @@ enum e1e_registers {
         E1000_ICRXDMTC = 0x04120, /* Irq Cause Rx Desc MinThreshold Count */
         E1000_ICRXOC   = 0x04124, /* Irq Cause Receiver Overrun Count */
         E1000_RXCSUM   = 0x05000, /* RX Checksum Control - RW */
-        E1000_RFCTL    = 0x05008, /* Receive Filter Control*/
+        E1000_RFCTL    = 0x05008, /* Receive Filter Control */
         E1000_MTA      = 0x05200, /* Multicast Table Array - RW Array */
         E1000_RA       = 0x05400, /* Receive Address - RW Array */
         E1000_VFTA     = 0x05600, /* VLAN Filter Table Array - RW Array */
@@ -202,7 +202,7 @@ enum e1e_registers {
         E1000_FACTPS    = 0x05B30, /* Function Active and Power State to MNG */
         E1000_SWSM      = 0x05B50, /* SW Semaphore */
         E1000_FWSM      = 0x05B54, /* FW Semaphore */
-        E1000_HICR      = 0x08F00, /* Host Inteface Control */
+        E1000_HICR      = 0x08F00, /* Host Interface Control */
 };
 
 /* RSS registers */
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 8f8139de1f48..0ae39550768d 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -671,7 +671,7 @@ static s32 e1000_get_phy_info_ich8lan(struct e1000_hw *hw)
  *  e1000_check_polarity_ife_ich8lan - Check cable polarity for IFE PHY
  *  @hw: pointer to the HW structure
  *
- *  Polarity is determined on the polarity reveral feature being enabled.
+ *  Polarity is determined on the polarity reversal feature being enabled.
  *  This function is only called by other family-specific
  *  routines.
  **/
@@ -947,7 +947,7 @@ static s32 e1000_flash_cycle_init_ich8lan(struct e1000_hw *hw)
         /* Either we should have a hardware SPI cycle in progress
          * bit to check against, in order to start a new cycle or
          * FDONE bit should be changed in the hardware so that it
-         * is 1 after harware reset, which can then be used as an
+         * is 1 after hardware reset, which can then be used as an
          * indication whether a cycle is in progress or has been
          * completed.
          */
@@ -1155,7 +1155,7 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
  *  which writes the checksum to the shadow ram.  The changes in the shadow
  *  ram are then committed to the EEPROM by processing each bank at a time
  *  checking for the modified bit and writing only the pending changes.
- *  After a succesful commit, the shadow ram is cleared and is ready for
+ *  After a successful commit, the shadow ram is cleared and is ready for
  *  future writes.
  **/
 static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
@@ -1680,7 +1680,7 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
  *   - initialize LED identification
  *   - setup receive address registers
  *   - setup flow control
- *   - setup transmit discriptors
+ *   - setup transmit descriptors
  *   - clear statistics
  **/
 static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw)
@@ -1961,7 +1961,7 @@ static s32 e1000_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw)
                      E1000_PHY_CTRL_NOND0A_GBE_DISABLE);
         ew32(PHY_CTRL, phy_ctrl);
 
-        /* Call gig speed drop workaround on Giga disable before accessing
+        /* Call gig speed drop workaround on Gig disable before accessing
          * any PHY registers */
         e1000e_gig_downshift_workaround_ich8lan(hw);
 
@@ -1972,7 +1972,7 @@ static s32 e1000_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw)
 /**
  *  e1000_set_kmrn_lock_loss_workaound_ich8lan - Set Kumeran workaround state
  *  @hw: pointer to the HW structure
- *  @state: boolean value used to set the current Kumaran workaround state
+ *  @state: boolean value used to set the current Kumeran workaround state
  *
  *  If ICH8, set the current Kumeran workaround state (enabled - TRUE
  *  /disabled - FALSE).
@@ -2017,7 +2017,7 @@ void e1000e_igp3_phy_powerdown_workaround_ich8lan(struct e1000_hw *hw)
                         E1000_PHY_CTRL_NOND0A_GBE_DISABLE);
                 ew32(PHY_CTRL, reg);
 
-                /* Call gig speed drop workaround on Giga disable before
+                /* Call gig speed drop workaround on Gig disable before
                  * accessing any PHY registers */
                 if (hw->mac.type == e1000_ich8lan)
                         e1000e_gig_downshift_workaround_ich8lan(hw);
@@ -2045,7 +2045,7 @@ void e1000e_igp3_phy_powerdown_workaround_ich8lan(struct e1000_hw *hw)
  *  @hw: pointer to the HW structure
  *
  *  Steps to take when dropping from 1Gb/s (eg. link cable removal (LSC),
- *  LPLU, Giga disable, MDIC PHY reset):
+ *  LPLU, Gig disable, MDIC PHY reset):
  *    1) Set Kumeran Near-end loopback
  *    2) Clear Kumeran Near-end loopback
  *  Should only be called for ICH8[m] devices with IGP_3 Phy.
@@ -2089,10 +2089,10 @@ static s32 e1000_cleanup_led_ich8lan(struct e1000_hw *hw)
 }
 
 /**
- *  e1000_led_on_ich8lan - Turn LED's on
+ *  e1000_led_on_ich8lan - Turn LEDs on
  *  @hw: pointer to the HW structure
  *
- *  Turn on the LED's.
+ *  Turn on the LEDs.
  **/
 static s32 e1000_led_on_ich8lan(struct e1000_hw *hw)
 {
@@ -2105,10 +2105,10 @@ static s32 e1000_led_on_ich8lan(struct e1000_hw *hw)
 }
 
 /**
- *  e1000_led_off_ich8lan - Turn LED's off
+ *  e1000_led_off_ich8lan - Turn LEDs off
  *  @hw: pointer to the HW structure
  *
- *  Turn off the LED's.
+ *  Turn off the LEDs.
  **/
 static s32 e1000_led_off_ich8lan(struct e1000_hw *hw)
 {
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index 16f35fadb74b..95f75a43c9f9 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -589,9 +589,6 @@ static s32 e1000_set_default_fc_generic(struct e1000_hw *hw)
         s32 ret_val;
         u16 nvm_data;
 
-        if (mac->fc != e1000_fc_default)
-                return 0;
-
         /* Read and store word 0x0F of the EEPROM. This word contains bits
          * that determine the hardware's default PAUSE (flow control) mode,
          * a bit that determines whether the HW defaults to enabling or
@@ -1107,34 +1104,13 @@ s32 e1000e_config_fc_after_link_up(struct e1000_hw *hw)
                          (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR)) {
                         mac->fc = e1000_fc_rx_pause;
                         hw_dbg(hw, "Flow Control = RX PAUSE frames only.\r\n");
-                }
-                /* Per the IEEE spec, at this point flow control should be
-                 * disabled.  However, we want to consider that we could
-                 * be connected to a legacy switch that doesn't advertise
-                 * desired flow control, but can be forced on the link
-                 * partner.  So if we advertised no flow control, that is
-                 * what we will resolve to.  If we advertised some kind of
-                 * receive capability (Rx Pause Only or Full Flow Control)
-                 * and the link partner advertised none, we will configure
-                 * ourselves to enable Rx Flow Control only.  We can do
-                 * this safely for two reasons:  If the link partner really
-                 * didn't want flow control enabled, and we enable Rx, no
-                 * harm done since we won't be receiving any PAUSE frames
-                 * anyway.  If the intent on the link partner was to have
-                 * flow control enabled, then by us enabling RX only, we
-                 * can at least receive pause frames and process them.
-                 * This is a good idea because in most cases, since we are
-                 * predominantly a server NIC, more times than not we will
-                 * be asked to delay transmission of packets than asking
-                 * our link partner to pause transmission of frames.
-                 */
-                else if ((mac->original_fc == e1000_fc_none) ||
-                         (mac->original_fc == e1000_fc_tx_pause)) {
+                } else {
+                        /*
+                         * Per the IEEE spec, at this point flow control
+                         * should be disabled.
+                         */
                         mac->fc = e1000_fc_none;
                         hw_dbg(hw, "Flow Control = NONE.\r\n");
-                } else {
-                        mac->fc = e1000_fc_rx_pause;
-                        hw_dbg(hw, "Flow Control = RX PAUSE frames only.\r\n");
                 }
 
                 /* Now we need to do one last check...  If we auto-
@@ -1164,7 +1140,7 @@ s32 e1000e_config_fc_after_link_up(struct e1000_hw *hw)
 }
 
 /**
- *  e1000e_get_speed_and_duplex_copper - Retreive current speed/duplex
+ *  e1000e_get_speed_and_duplex_copper - Retrieve current speed/duplex
  *  @hw: pointer to the HW structure
  *  @speed: stores the current speed
  *  @duplex: stores the current duplex
@@ -1200,7 +1176,7 @@ s32 e1000e_get_speed_and_duplex_copper(struct e1000_hw *hw, u16 *speed, u16 *dup
 }
 
 /**
- *  e1000e_get_speed_and_duplex_fiber_serdes - Retreive current speed/duplex
+ *  e1000e_get_speed_and_duplex_fiber_serdes - Retrieve current speed/duplex
  *  @hw: pointer to the HW structure
  *  @speed: stores the current speed
  *  @duplex: stores the current duplex
@@ -1410,7 +1386,7 @@ s32 e1000e_cleanup_led_generic(struct e1000_hw *hw)
  *  e1000e_blink_led - Blink LED
  *  @hw: pointer to the HW structure
  *
- *  Blink the led's which are set to be on.
+ *  Blink the LEDs which are set to be on.
  **/
 s32 e1000e_blink_led(struct e1000_hw *hw)
 {
@@ -1515,7 +1491,7 @@ void e1000e_set_pcie_no_snoop(struct e1000_hw *hw, u32 no_snoop)
  *  @hw: pointer to the HW structure
  *
  *  Returns 0 if successful, else returns -10
- *  (-E1000_ERR_MASTER_REQUESTS_PENDING) if master disable bit has not casued
+ *  (-E1000_ERR_MASTER_REQUESTS_PENDING) if master disable bit has not caused
  *  the master requests to be disabled.
  *
  *  Disables PCI-Express master access and verifies there are no pending
@@ -1876,7 +1852,7 @@ static s32 e1000_ready_nvm_eeprom(struct e1000_hw *hw)
 }
 
 /**
- *  e1000e_read_nvm_spi - Read EEPROM's using SPI
+ *  e1000e_read_nvm_spi - Reads EEPROM using SPI
  *  @hw: pointer to the HW structure
  *  @offset: offset of word in the EEPROM to read
  *  @words: number of words to read
@@ -1980,7 +1956,7 @@ s32 e1000e_read_nvm_eerd(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
  *  Writes data to EEPROM at offset using SPI interface.
  *
  *  If e1000e_update_nvm_checksum is not called after this function , the
- *  EEPROM will most likley contain an invalid checksum.
+ *  EEPROM will most likely contain an invalid checksum.
  **/
 s32 e1000e_write_nvm_spi(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
 {
@@ -2222,7 +2198,7 @@ static u8 e1000_calculate_checksum(u8 *buffer, u32 length)
  *
  *  Returns E1000_success upon success, else E1000_ERR_HOST_INTERFACE_COMMAND
  *
- *  This function checks whether the HOST IF is enabled for command operaton
+ *  This function checks whether the HOST IF is enabled for command operation
  *  and also checks whether the previous command is completed.  It busy waits
  *  in case of previous command is not completed.
  **/
@@ -2254,7 +2230,7 @@ static s32 e1000_mng_enable_host_if(struct e1000_hw *hw)
 }
 
 /**
- *  e1000e_check_mng_mode - check managament mode
+ *  e1000e_check_mng_mode - check management mode
  *  @hw: pointer to the HW structure
  *
  *  Reads the firmware semaphore register and returns true (>0) if
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 3031d6d16247..fc5c63f4f578 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -1006,7 +1006,7 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
  * e1000_get_hw_control - get control of the h/w from f/w
  * @adapter: address of board private structure
  *
- * e1000_get_hw_control sets {CTRL_EXT|FWSM}:DRV_LOAD bit.
+ * e1000_get_hw_control sets {CTRL_EXT|SWSM}:DRV_LOAD bit.
  * For ASF and Pass Through versions of f/w this means that
  * the driver is loaded. For AMT version (only with 82573)
  * of the f/w this means that the network i/f is open.
@@ -1032,7 +1032,7 @@ static void e1000_get_hw_control(struct e1000_adapter *adapter)
  * e1000_release_hw_control - release control of the h/w to f/w
  * @adapter: address of board private structure
  *
- * e1000_release_hw_control resets {CTRL_EXT|FWSM}:DRV_LOAD bit.
+ * e1000_release_hw_control resets {CTRL_EXT|SWSM}:DRV_LOAD bit.
  * For ASF and Pass Through versions of f/w this means that the
  * driver is no longer loaded. For AMT version (only with 82573) i
  * of the f/w this means that the network i/f is closed.
@@ -1241,6 +1241,11 @@ void e1000e_free_rx_resources(struct e1000_adapter *adapter)
 
 /**
  * e1000_update_itr - update the dynamic ITR value based on statistics
+ * @adapter: pointer to adapter
+ * @itr_setting: current adapter->itr
+ * @packets: the number of packets during this measurement interval
+ * @bytes: the number of bytes during this measurement interval
+ *
  *      Stores a new ITR value based on packets and byte
  *      counts during the last interrupt.  The advantage of per interrupt
  *      computation is faster updates and more accurate ITR for the current
@@ -1250,10 +1255,6 @@ void e1000e_free_rx_resources(struct e1000_adapter *adapter)
  *      while increasing bulk throughput.
  *      this functionality is controlled by the InterruptThrottleRate module
  *      parameter (see e1000_param.c)
- * @adapter: pointer to adapter
- * @itr_setting: current adapter->itr
- * @packets: the number of packets during this measurement interval
- * @bytes: the number of bytes during this measurement interval
  **/
 static unsigned int e1000_update_itr(struct e1000_adapter *adapter,
                                      u16 itr_setting, int packets,
@@ -1366,6 +1367,7 @@ set_itr_now:
 /**
  * e1000_clean - NAPI Rx polling callback
  * @adapter: board private structure
+ * @budget: amount of packets driver is allowed to process this poll
  **/
 static int e1000_clean(struct napi_struct *napi, int budget)
 {
@@ -2000,7 +2002,7 @@ static void e1000_power_down_phy(struct e1000_adapter *adapter)
             e1000_check_reset_block(hw))
                 return;
 
-        /* managebility (AMT) is enabled */
+        /* manageability (AMT) is enabled */
         if (er32(MANC) & E1000_MANC_SMBUS_EN)
                 return;
 
@@ -3488,7 +3490,6 @@ static int e1000_suspend(struct pci_dev *pdev, pm_message_t state)
 static void e1000e_disable_l1aspm(struct pci_dev *pdev)
 {
         int pos;
-        u32 cap;
         u16 val;
 
         /*
@@ -3503,7 +3504,6 @@ static void e1000e_disable_l1aspm(struct pci_dev *pdev)
          * active.
          */
         pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-        pci_read_config_dword(pdev, pos + PCI_EXP_LNKCAP, &cap);
         pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &val);
         if (val & 0x2) {
                 dev_warn(&pdev->dev, "Disabling L1 ASPM\n");
diff --git a/drivers/net/e1000e/phy.c b/drivers/net/e1000e/phy.c
index fc6fee112f1c..dab3c468a768 100644
--- a/drivers/net/e1000e/phy.c
+++ b/drivers/net/e1000e/phy.c
@@ -121,7 +121,7 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw *hw)
  *  @offset: register offset to be read
  *  @data: pointer to the read data
  *
- *  Reads the MDI control regsiter in the PHY at offset and stores the
+ *  Reads the MDI control register in the PHY at offset and stores the
  *  information read to data.
  **/
 static s32 e1000_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
@@ -1172,7 +1172,7 @@ s32 e1000e_set_d3_lplu_state(struct e1000_hw *hw, bool active)
 }
 
 /**
- *  e1000e_check_downshift - Checks whether a downshift in speed occured
+ *  e1000e_check_downshift - Checks whether a downshift in speed occurred
  *  @hw: pointer to the HW structure
  *
  *  Success returns 0, Failure returns 1
@@ -1388,8 +1388,8 @@ s32 e1000e_get_cable_length_m88(struct e1000_hw *hw)
  *
  *  The automatic gain control (agc) normalizes the amplitude of the
  *  received signal, adjusting for the attenuation produced by the
- *  cable.  By reading the AGC registers, which reperesent the
- *  cobination of course and fine gain value, the value can be put
+ *  cable.  By reading the AGC registers, which represent the
+ *  combination of course and fine gain value, the value can be put
  *  into a lookup table to obtain the approximate cable length
  *  for each channel.
  **/
@@ -1619,7 +1619,7 @@ s32 e1000e_phy_sw_reset(struct e1000_hw *hw)
  *  Verify the reset block is not blocking us from resetting.  Acquire
  *  semaphore (if necessary) and read/set/write the device control reset
  *  bit in the PHY.  Wait the appropriate delay time for the device to
- *  reset and relase the semaphore (if necessary).
+ *  reset and release the semaphore (if necessary).
  **/
 s32 e1000e_phy_hw_reset_generic(struct e1000_hw *hw)
 {
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 88fb53eba715..7c4ead35cfa2 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0083"
+#define DRV_VERSION     "EHEA_0087"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
@@ -386,6 +386,13 @@ struct ehea_port_res {
 
 
 #define EHEA_MAX_PORTS 16
+
+#define EHEA_NUM_PORTRES_FW_HANDLES    6  /* QP handle, SendCQ handle,
+                                             RecvCQ handle, EQ handle,
+                                             SendMR handle, RecvMR handle */
+#define EHEA_NUM_PORT_FW_HANDLES       1  /* EQ handle */
+#define EHEA_NUM_ADAPTER_FW_HANDLES    2  /* MR handle, NEQ handle */
+
 struct ehea_adapter {
         u64 handle;
         struct of_device *ofdev;
@@ -405,6 +412,31 @@ struct ehea_mc_list {
         u64 macaddr;
 };
 
+/* kdump support */
+struct ehea_fw_handle_entry {
+        u64 adh;               /* Adapter Handle */
+        u64 fwh;               /* Firmware Handle */
+};
+
+struct ehea_fw_handle_array {
+        struct ehea_fw_handle_entry *arr;
+        int num_entries;
+        struct semaphore lock;
+};
+
+struct ehea_bcmc_reg_entry {
+        u64 adh;               /* Adapter Handle */
+        u32 port_id;           /* Logical Port Id */
+        u8 reg_type;           /* Registration Type */
+        u64 macaddr;
+};
+
+struct ehea_bcmc_reg_array {
+        struct ehea_bcmc_reg_entry *arr;
+        int num_entries;
+        struct semaphore lock;
+};
+
 #define EHEA_PORT_UP 1
 #define EHEA_PORT_DOWN 0
 #define EHEA_PHY_LINK_UP 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index c051c7e09b9a..21af674b764e 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -35,6 +35,7 @@
 #include <linux/if_ether.h>
 #include <linux/notifier.h>
 #include <linux/reboot.h>
+#include <asm/kexec.h>
 
 #include <net/ip.h>
 
@@ -98,8 +99,10 @@ static int port_name_cnt;
 static LIST_HEAD(adapter_list);
 u64 ehea_driver_flags;
 struct work_struct ehea_rereg_mr_task;
-
 struct semaphore dlpar_mem_lock;
+struct ehea_fw_handle_array ehea_fw_handles;
+struct ehea_bcmc_reg_array ehea_bcmc_regs;
+
 
 static int __devinit ehea_probe_adapter(struct of_device *dev,
                                         const struct of_device_id *id);
@@ -132,6 +135,160 @@ void ehea_dump(void *adr, int len, char *msg)
         }
 }
 
+static void ehea_update_firmware_handles(void)
+{
+        struct ehea_fw_handle_entry *arr = NULL;
+        struct ehea_adapter *adapter;
+        int num_adapters = 0;
+        int num_ports = 0;
+        int num_portres = 0;
+        int i = 0;
+        int num_fw_handles, k, l;
+
+        /* Determine number of handles */
+        list_for_each_entry(adapter, &adapter_list, list) {
+                num_adapters++;
+
+                for (k = 0; k < EHEA_MAX_PORTS; k++) {
+                        struct ehea_port *port = adapter->port[k];
+
+                        if (!port || (port->state != EHEA_PORT_UP))
+                                continue;
+
+                        num_ports++;
+                        num_portres += port->num_def_qps + port->num_add_tx_qps;
+                }
+        }
+
+        num_fw_handles = num_adapters * EHEA_NUM_ADAPTER_FW_HANDLES +
+                         num_ports * EHEA_NUM_PORT_FW_HANDLES +
+                         num_portres * EHEA_NUM_PORTRES_FW_HANDLES;
+
+        if (num_fw_handles) {
+                arr = kzalloc(num_fw_handles * sizeof(*arr), GFP_KERNEL);
+                if (!arr)
+                        return;  /* Keep the existing array */
+        } else
+                goto out_update;
+
+        list_for_each_entry(adapter, &adapter_list, list) {
+                for (k = 0; k < EHEA_MAX_PORTS; k++) {
+                        struct ehea_port *port = adapter->port[k];
+
+                        if (!port || (port->state != EHEA_PORT_UP))
+                                continue;
+
+                        for (l = 0;
+                             l < port->num_def_qps + port->num_add_tx_qps;
+                             l++) {
+                                struct ehea_port_res *pr = &port->port_res[l];
+
+                                arr[i].adh = adapter->handle;
+                                arr[i++].fwh = pr->qp->fw_handle;
+                                arr[i].adh = adapter->handle;
+                                arr[i++].fwh = pr->send_cq->fw_handle;
+                                arr[i].adh = adapter->handle;
+                                arr[i++].fwh = pr->recv_cq->fw_handle;
+                                arr[i].adh = adapter->handle;
+                                arr[i++].fwh = pr->eq->fw_handle;
+                                arr[i].adh = adapter->handle;
+                                arr[i++].fwh = pr->send_mr.handle;
+                                arr[i].adh = adapter->handle;
+                                arr[i++].fwh = pr->recv_mr.handle;
+                        }
+                        arr[i].adh = adapter->handle;
+                        arr[i++].fwh = port->qp_eq->fw_handle;
+                }
+
+                arr[i].adh = adapter->handle;
+                arr[i++].fwh = adapter->neq->fw_handle;
+
+                if (adapter->mr.handle) {
+                        arr[i].adh = adapter->handle;
+                        arr[i++].fwh = adapter->mr.handle;
+                }
+        }
+
+out_update:
+        kfree(ehea_fw_handles.arr);
+        ehea_fw_handles.arr = arr;
+        ehea_fw_handles.num_entries = i;
+}
+
+static void ehea_update_bcmc_registrations(void)
+{
+        struct ehea_bcmc_reg_entry *arr = NULL;
+        struct ehea_adapter *adapter;
+        struct ehea_mc_list *mc_entry;
+        int num_registrations = 0;
+        int i = 0;
+        int k;
+
+        /* Determine number of registrations */
+        list_for_each_entry(adapter, &adapter_list, list)
+                for (k = 0; k < EHEA_MAX_PORTS; k++) {
+                        struct ehea_port *port = adapter->port[k];
+
+                        if (!port || (port->state != EHEA_PORT_UP))
+                                continue;
+
+                        num_registrations += 2; /* Broadcast registrations */
+
+                        list_for_each_entry(mc_entry, &port->mc_list->list,list)
+                                num_registrations += 2;
+                }
+
+        if (num_registrations) {
+                arr = kzalloc(num_registrations * sizeof(*arr), GFP_KERNEL);
+                if (!arr)
+                        return;  /* Keep the existing array */
+        } else
+                goto out_update;
+
+        list_for_each_entry(adapter, &adapter_list, list) {
+                for (k = 0; k < EHEA_MAX_PORTS; k++) {
+                        struct ehea_port *port = adapter->port[k];
+
+                        if (!port || (port->state != EHEA_PORT_UP))
+                                continue;
+
+                        arr[i].adh = adapter->handle;
+                        arr[i].port_id = port->logical_port_id;
+                        arr[i].reg_type = EHEA_BCMC_BROADCAST |
+                                          EHEA_BCMC_UNTAGGED;
+                        arr[i++].macaddr = port->mac_addr;
+
+                        arr[i].adh = adapter->handle;
+                        arr[i].port_id = port->logical_port_id;
+                        arr[i].reg_type = EHEA_BCMC_BROADCAST |
+                                          EHEA_BCMC_VLANID_ALL;
+                        arr[i++].macaddr = port->mac_addr;
+
+                        list_for_each_entry(mc_entry,
+                                            &port->mc_list->list, list) {
+                                arr[i].adh = adapter->handle;
+                                arr[i].port_id = port->logical_port_id;
+                                arr[i].reg_type = EHEA_BCMC_SCOPE_ALL |
+                                                  EHEA_BCMC_MULTICAST |
+                                                  EHEA_BCMC_UNTAGGED;
+                                arr[i++].macaddr = mc_entry->macaddr;
+
+                                arr[i].adh = adapter->handle;
+                                arr[i].port_id = port->logical_port_id;
+                                arr[i].reg_type = EHEA_BCMC_SCOPE_ALL |
+                                                  EHEA_BCMC_MULTICAST |
+                                                  EHEA_BCMC_VLANID_ALL;
+                                arr[i++].macaddr = mc_entry->macaddr;
+                        }
+                }
+        }
+
+out_update:
+        kfree(ehea_bcmc_regs.arr);
+        ehea_bcmc_regs.arr = arr;
+        ehea_bcmc_regs.num_entries = i;
+}
+
 static struct net_device_stats *ehea_get_stats(struct net_device *dev)
 {
         struct ehea_port *port = netdev_priv(dev);
@@ -1601,19 +1758,25 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa)
 
         memcpy(dev->dev_addr, mac_addr->sa_data, dev->addr_len);
 
+        down(&ehea_bcmc_regs.lock);
+
         /* Deregister old MAC in pHYP */
         ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
         if (ret)
-                goto out_free;
+                goto out_upregs;
 
         port->mac_addr = cb0->port_mac_addr << 16;
 
         /* Register new MAC in pHYP */
         ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
         if (ret)
-                goto out_free;
+                goto out_upregs;
 
         ret = 0;
+
+out_upregs:
+        ehea_update_bcmc_registrations();
+        up(&ehea_bcmc_regs.lock);
 out_free:
         kfree(cb0);
 out:
@@ -1775,9 +1938,11 @@ static void ehea_set_multicast_list(struct net_device *dev)
         }
         ehea_promiscuous(dev, 0);
 
+        down(&ehea_bcmc_regs.lock);
+
         if (dev->flags & IFF_ALLMULTI) {
                 ehea_allmulti(dev, 1);
-                return;
+                goto out;
         }
         ehea_allmulti(dev, 0);
 
@@ -1803,6 +1968,8 @@ static void ehea_set_multicast_list(struct net_device *dev)
 
         }
 out:
+        ehea_update_bcmc_registrations();
+        up(&ehea_bcmc_regs.lock);
         return;
 }
 
@@ -2285,6 +2452,8 @@ static int ehea_up(struct net_device *dev)
         if (port->state == EHEA_PORT_UP)
                 return 0;
 
+        down(&ehea_fw_handles.lock);
+
         ret = ehea_port_res_setup(port, port->num_def_qps,
                                   port->num_add_tx_qps);
         if (ret) {
@@ -2321,8 +2490,17 @@ static int ehea_up(struct net_device *dev)
                 }
         }
 
-        ret = 0;
+        down(&ehea_bcmc_regs.lock);
+
+        ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
+        if (ret) {
+                ret = -EIO;
+                goto out_free_irqs;
+        }
+
         port->state = EHEA_PORT_UP;
+
+        ret = 0;
         goto out;
 
 out_free_irqs:
@@ -2334,6 +2512,12 @@ out:
         if (ret)
                 ehea_info("Failed starting %s. ret=%i", dev->name, ret);
 
+        ehea_update_bcmc_registrations();
+        up(&ehea_bcmc_regs.lock);
+
+        ehea_update_firmware_handles();
+        up(&ehea_fw_handles.lock);
+
         return ret;
 }
 
@@ -2382,16 +2566,27 @@ static int ehea_down(struct net_device *dev)
         if (port->state == EHEA_PORT_DOWN)
                 return 0;
 
+        down(&ehea_bcmc_regs.lock);
         ehea_drop_multicast_list(dev);
+        ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
+
         ehea_free_interrupts(dev);
 
+        down(&ehea_fw_handles.lock);
+
         port->state = EHEA_PORT_DOWN;
 
+        ehea_update_bcmc_registrations();
+        up(&ehea_bcmc_regs.lock);
+
         ret = ehea_clean_all_portres(port);
         if (ret)
                 ehea_info("Failed freeing resources for %s. ret=%i",
                           dev->name, ret);
 
+        ehea_update_firmware_handles();
+        up(&ehea_fw_handles.lock);
+
         return ret;
 }
 
@@ -2920,19 +3115,12 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
         dev->watchdog_timeo = EHEA_WATCH_DOG_TIMEOUT;
 
         INIT_WORK(&port->reset_task, ehea_reset_port);
-
-        ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
-        if (ret) {
-                ret = -EIO;
-                goto out_unreg_port;
-        }
-
         ehea_set_ethtool_ops(dev);
 
         ret = register_netdev(dev);
         if (ret) {
                 ehea_error("register_netdev failed. ret=%d", ret);
-                goto out_dereg_bc;
+                goto out_unreg_port;
         }
 
         port->lro_max_aggr = lro_max_aggr;
@@ -2949,9 +3137,6 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
 
         return port;
 
-out_dereg_bc:
-        ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
-
 out_unreg_port:
         ehea_unregister_port(port);
 
@@ -2971,7 +3156,6 @@ static void ehea_shutdown_single_port(struct ehea_port *port)
 {
         unregister_netdev(port->netdev);
         ehea_unregister_port(port);
-        ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
         kfree(port->mc_list);
         free_netdev(port->netdev);
         port->adapter->active_ports--;
@@ -3014,7 +3198,6 @@ static int ehea_setup_ports(struct ehea_adapter *adapter)
 
                 i++;
         };
-
         return 0;
 }
 
@@ -3159,6 +3342,7 @@ static int __devinit ehea_probe_adapter(struct of_device *dev,
                 ehea_error("Invalid ibmebus device probed");
                 return -EINVAL;
         }
+        down(&ehea_fw_handles.lock);
 
         adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
         if (!adapter) {
@@ -3239,7 +3423,10 @@ out_kill_eq:
 
 out_free_ad:
         kfree(adapter);
+
 out:
+        ehea_update_firmware_handles();
+        up(&ehea_fw_handles.lock);
         return ret;
 }
 
@@ -3258,18 +3445,41 @@ static int __devexit ehea_remove(struct of_device *dev)
 
         flush_scheduled_work();
 
+        down(&ehea_fw_handles.lock);
+
         ibmebus_free_irq(adapter->neq->attr.ist1, adapter);
         tasklet_kill(&adapter->neq_tasklet);
 
         ehea_destroy_eq(adapter->neq);
         ehea_remove_adapter_mr(adapter);
         list_del(&adapter->list);
-
         kfree(adapter);
 
+        ehea_update_firmware_handles();
+        up(&ehea_fw_handles.lock);
+
         return 0;
 }
 
+void ehea_crash_handler(void)
+{
+        int i;
+
+        if (ehea_fw_handles.arr)
+                for (i = 0; i < ehea_fw_handles.num_entries; i++)
+                        ehea_h_free_resource(ehea_fw_handles.arr[i].adh,
+                                             ehea_fw_handles.arr[i].fwh,
+                                             FORCE_FREE);
+
+        if (ehea_bcmc_regs.arr)
+                for (i = 0; i < ehea_bcmc_regs.num_entries; i++)
+                        ehea_h_reg_dereg_bcmc(ehea_bcmc_regs.arr[i].adh,
+                                              ehea_bcmc_regs.arr[i].port_id,
+                                              ehea_bcmc_regs.arr[i].reg_type,
+                                              ehea_bcmc_regs.arr[i].macaddr,
+                                              0, H_DEREG_BCMC);
+}
+
 static int ehea_reboot_notifier(struct notifier_block *nb,
                                 unsigned long action, void *unused)
 {
@@ -3330,7 +3540,12 @@ int __init ehea_module_init(void)
 
 
         INIT_WORK(&ehea_rereg_mr_task, ehea_rereg_mrs);
+        memset(&ehea_fw_handles, 0, sizeof(ehea_fw_handles));
+        memset(&ehea_bcmc_regs, 0, sizeof(ehea_bcmc_regs));
+
         sema_init(&dlpar_mem_lock, 1);
+        sema_init(&ehea_fw_handles.lock, 1);
+        sema_init(&ehea_bcmc_regs.lock, 1);
 
         ret = check_module_parm();
         if (ret)
@@ -3340,12 +3555,18 @@ int __init ehea_module_init(void)
         if (ret)
                 goto out;
 
-        register_reboot_notifier(&ehea_reboot_nb);
+        ret = register_reboot_notifier(&ehea_reboot_nb);
+        if (ret)
+                ehea_info("failed registering reboot notifier");
+
+        ret = crash_shutdown_register(&ehea_crash_handler);
+        if (ret)
+                ehea_info("failed registering crash handler");
 
         ret = ibmebus_register_driver(&ehea_driver);
         if (ret) {
                 ehea_error("failed registering eHEA device driver on ebus");
-                goto out;
+                goto out2;
         }
 
         ret = driver_create_file(&ehea_driver.driver,
@@ -3353,21 +3574,33 @@ int __init ehea_module_init(void)
         if (ret) {
                 ehea_error("failed to register capabilities attribute, ret=%d",
                            ret);
-                unregister_reboot_notifier(&ehea_reboot_nb);
-                ibmebus_unregister_driver(&ehea_driver);
-                goto out;
+                goto out3;
         }
 
+        return ret;
+
+out3:
+        ibmebus_unregister_driver(&ehea_driver);
+out2:
+        unregister_reboot_notifier(&ehea_reboot_nb);
+        crash_shutdown_unregister(&ehea_crash_handler);
 out:
         return ret;
 }
 
 static void __exit ehea_module_exit(void)
 {
+        int ret;
+
         flush_scheduled_work();
         driver_remove_file(&ehea_driver.driver, &driver_attr_capabilities);
         ibmebus_unregister_driver(&ehea_driver);
         unregister_reboot_notifier(&ehea_reboot_nb);
+        ret = crash_shutdown_unregister(&ehea_crash_handler);
+        if (ret)
+                ehea_info("failed unregistering crash handler");
+        kfree(ehea_fw_handles.arr);
+        kfree(ehea_bcmc_regs.arr);
         ehea_destroy_busmap();
 }
 
diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index 0809a6a5a286..46a90e9ec563 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -900,7 +900,7 @@ static void enc28j60_hw_rx(struct net_device *ndev)
                 if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
                         ndev->stats.rx_frame_errors++;
         } else {
-                skb = dev_alloc_skb(len);
+                skb = dev_alloc_skb(len + NET_IP_ALIGN);
                 if (!skb) {
                         if (netif_msg_rx_err(priv))
                                 dev_err(&ndev->dev,
@@ -908,6 +908,7 @@ static void enc28j60_hw_rx(struct net_device *ndev)
                         ndev->stats.rx_dropped++;
                 } else {
                         skb->dev = ndev;
+                        skb_reserve(skb, NET_IP_ALIGN);
                         /* copy the packet from the receive buffer */
                         enc28j60_mem_read(priv, priv->next_pk_ptr + sizeof(rsv),
                                         len, skb_put(skb, len));
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 0fbf1bbbaee9..d7a3ea88eddb 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1253,7 +1253,7 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
 
         /* Setup interrupt handlers. */
         for (idp = id; idp->name; idp++) {
-                if (request_irq(idp->irq, idp->handler, 0, idp->name, dev) != 0)
+                if (request_irq(idp->irq, idp->handler, IRQF_DISABLED, idp->name, dev) != 0)
                         printk("FEC: Could not allocate %s IRQ(%d)!\n", idp->name, idp->irq);
         }
 
@@ -1382,7 +1382,7 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
 
         /* Setup interrupt handlers. */
         for (idp = id; idp->name; idp++) {
-                if (request_irq(b+idp->irq, fec_enet_interrupt, 0, idp->name, dev) != 0)
+                if (request_irq(b+idp->irq, fec_enet_interrupt, IRQF_DISABLED, idp->name, dev) != 0)
                         printk("FEC: Could not allocate %s IRQ(%d)!\n", idp->name, b+idp->irq);
         }
 
@@ -1553,7 +1553,7 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
 
         /* Setup interrupt handlers. */
         for (idp = id; idp->name; idp++) {
-                if (request_irq(b+idp->irq,fec_enet_interrupt,0,idp->name,dev)!=0)
+                if (request_irq(b+idp->irq, fec_enet_interrupt, IRQF_DISABLED, idp->name,dev) != 0)
                         printk("FEC: Could not allocate %s IRQ(%d)!\n", idp->name, b+idp->irq);
         }
 
@@ -1680,7 +1680,7 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
 
         /* Setup interrupt handlers. */
         for (idp = id; idp->name; idp++) {
-                if (request_irq(b+idp->irq,fec_enet_interrupt,0,idp->name,dev)!=0)
+                if (request_irq(b+idp->irq, fec_enet_interrupt, IRQF_DISABLED, idp->name,dev) != 0)
                         printk("FEC: Could not allocate %s IRQ(%d)!\n",
                                 idp->name, b+idp->irq);
         }
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index 42d94edeee26..af869cf9ae7d 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -946,16 +946,11 @@ static int fs_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
         struct fs_enet_private *fep = netdev_priv(dev);
         struct mii_ioctl_data *mii = (struct mii_ioctl_data *)&rq->ifr_data;
-        unsigned long flags;
-        int rc;
 
         if (!netif_running(dev))
                 return -EINVAL;
 
-        spin_lock_irqsave(&fep->lock, flags);
-        rc = phy_mii_ioctl(fep->phydev, mii, cmd);
-        spin_unlock_irqrestore(&fep->lock, flags);
-        return rc;
+        return phy_mii_ioctl(fep->phydev, mii, cmd);
 }
 
 extern int fs_mii_connect(struct net_device *dev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4244fc282f21..718cf77e345a 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -605,7 +605,7 @@ void stop_gfar(struct net_device *dev)
 
         free_skb_resources(priv);
 
-        dma_free_coherent(NULL,
+        dma_free_coherent(&dev->dev,
                         sizeof(struct txbd8)*priv->tx_ring_size
                         + sizeof(struct rxbd8)*priv->rx_ring_size,
                         priv->tx_bd_base,
@@ -626,7 +626,7 @@ static void free_skb_resources(struct gfar_private *priv)
         for (i = 0; i < priv->tx_ring_size; i++) {
 
                 if (priv->tx_skbuff[i]) {
-                        dma_unmap_single(NULL, txbdp->bufPtr,
+                        dma_unmap_single(&priv->dev->dev, txbdp->bufPtr,
                                         txbdp->length,
                                         DMA_TO_DEVICE);
                         dev_kfree_skb_any(priv->tx_skbuff[i]);
@@ -643,7 +643,7 @@ static void free_skb_resources(struct gfar_private *priv)
         if(priv->rx_skbuff != NULL) {
                 for (i = 0; i < priv->rx_ring_size; i++) {
                         if (priv->rx_skbuff[i]) {
-                                dma_unmap_single(NULL, rxbdp->bufPtr,
+                                dma_unmap_single(&priv->dev->dev, rxbdp->bufPtr,
                                                 priv->rx_buffer_size,
                                                 DMA_FROM_DEVICE);
 
@@ -708,7 +708,7 @@ int startup_gfar(struct net_device *dev)
         gfar_write(&regs->imask, IMASK_INIT_CLEAR);
 
         /* Allocate memory for the buffer descriptors */
-        vaddr = (unsigned long) dma_alloc_coherent(NULL,
+        vaddr = (unsigned long) dma_alloc_coherent(&dev->dev,
                         sizeof (struct txbd8) * priv->tx_ring_size +
                         sizeof (struct rxbd8) * priv->rx_ring_size,
                         &addr, GFP_KERNEL);
@@ -919,7 +919,7 @@ err_irq_fail:
 rx_skb_fail:
         free_skb_resources(priv);
 tx_skb_fail:
-        dma_free_coherent(NULL,
+        dma_free_coherent(&dev->dev,
                         sizeof(struct txbd8)*priv->tx_ring_size
                         + sizeof(struct rxbd8)*priv->rx_ring_size,
                         priv->tx_bd_base,
@@ -1053,7 +1053,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Set buffer length and pointer */
         txbdp->length = skb->len;
-        txbdp->bufPtr = dma_map_single(NULL, skb->data,
+        txbdp->bufPtr = dma_map_single(&dev->dev, skb->data,
                         skb->len, DMA_TO_DEVICE);
 
         /* Save the skb pointer so we can free it later */
@@ -1332,7 +1332,7 @@ struct sk_buff * gfar_new_skb(struct net_device *dev, struct rxbd8 *bdp)
          */
         skb_reserve(skb, alignamount);
 
-        bdp->bufPtr = dma_map_single(NULL, skb->data,
+        bdp->bufPtr = dma_map_single(&dev->dev, skb->data,
                         priv->rx_buffer_size, DMA_FROM_DEVICE);
 
         bdp->length = 0;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index bff280eff5e3..6a1f23092099 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -439,7 +439,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
                 err = igb_request_msix(adapter);
                 if (!err) {
                         /* enable IAM, auto-mask,
-                         * DO NOT USE EIAME or IAME in legacy mode */
+                         * DO NOT USE EIAM or IAM in legacy mode */
                         wr32(E1000_IAM, IMS_ENABLE_MASK);
                         goto request_done;
                 }
@@ -465,14 +465,9 @@ static int igb_request_irq(struct igb_adapter *adapter)
         err = request_irq(adapter->pdev->irq, &igb_intr, IRQF_SHARED,
                           netdev->name, netdev);
 
-        if (err) {
+        if (err)
                 dev_err(&adapter->pdev->dev, "Error %d getting interrupt\n",
                         err);
-                goto request_done;
-        }
-
-        /* enable IAM, auto-mask */
-        wr32(E1000_IAM, IMS_ENABLE_MASK);
 
 request_done:
         return err;
@@ -821,7 +816,8 @@ void igb_reset(struct igb_adapter *adapter)
         wr32(E1000_VET, ETHERNET_IEEE_VLAN_TYPE);
 
         igb_reset_adaptive(&adapter->hw);
-        adapter->hw.phy.ops.get_phy_info(&adapter->hw);
+        if (adapter->hw.phy.ops.get_phy_info)
+                adapter->hw.phy.ops.get_phy_info(&adapter->hw);
 }
 
 /**
@@ -2057,7 +2053,8 @@ static void igb_set_multi(struct net_device *netdev)
 static void igb_update_phy_info(unsigned long data)
 {
         struct igb_adapter *adapter = (struct igb_adapter *) data;
-        adapter->hw.phy.ops.get_phy_info(&adapter->hw);
+        if (adapter->hw.phy.ops.get_phy_info)
+                adapter->hw.phy.ops.get_phy_info(&adapter->hw);
 }
 
 /**
diff --git a/drivers/net/ixgb/ixgb_ethtool.c b/drivers/net/ixgb/ixgb_ethtool.c
index 53a9fd086f96..75f3a68ee354 100644
--- a/drivers/net/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ixgb/ixgb_ethtool.c
@@ -67,6 +67,7 @@ static struct ixgb_stats ixgb_gstrings_stats[] = {
         {"rx_over_errors", IXGB_STAT(net_stats.rx_over_errors)},
         {"rx_crc_errors", IXGB_STAT(net_stats.rx_crc_errors)},
         {"rx_frame_errors", IXGB_STAT(net_stats.rx_frame_errors)},
+        {"rx_no_buffer_count", IXGB_STAT(stats.rnbc)},
         {"rx_fifo_errors", IXGB_STAT(net_stats.rx_fifo_errors)},
         {"rx_missed_errors", IXGB_STAT(net_stats.rx_missed_errors)},
         {"tx_aborted_errors", IXGB_STAT(net_stats.tx_aborted_errors)},
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 23d0a4afe0e1..c2095ce531c9 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2133,7 +2133,7 @@ static void ixgbe_watchdog(unsigned long data)
                                 (link_speed == IXGBE_LINK_SPEED_10GB_FULL ?
                                  "10 Gbps" :
                                  (link_speed == IXGBE_LINK_SPEED_1GB_FULL ?
-                                  "1 Gpbs" : "unknown speed")),
+                                  "1 Gbps" : "unknown speed")),
                                 ((FLOW_RX && FLOW_TX) ? "RX/TX" :
                                  (FLOW_RX ? "RX" :
                                  (FLOW_TX ? "TX" : "None"))));
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 81bf005ff280..1d210ed46130 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -148,7 +148,7 @@ static void macb_handle_link_change(struct net_device *dev)
 
                         if (phydev->duplex)
                                 reg |= MACB_BIT(FD);
-                        if (phydev->speed)
+                        if (phydev->speed == SPEED_100)
                                 reg |= MACB_BIT(SPD);
 
                         macb_writel(bp, NCFGR, reg);
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b528ce77c406..771139e283af 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -2104,6 +2104,7 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR(  "Rabeeh Khoury, Assaf Hoffman, Matthew Dharm, Manish Lachwani"
                 " and Dale Farnsworth");
 MODULE_DESCRIPTION("Ethernet driver for Marvell MV643XX");
+MODULE_ALIAS("platform:mv643xx_eth");
 
 /*
  * The second part is the low level driver of the gigE ethernet ports.
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index e8a63e483a2b..ce95c5d168fe 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -1268,7 +1268,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
                 }
         }
     
-        if (interrupts && ei_debug) 
+        if (interrupts && ei_debug > 3) 
         {
                 handled = 1;
                 if (nr_serviced >= MAX_SERVICE) 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 6323988dfa1d..fd8158a86f64 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -590,6 +590,13 @@ static int pcnet_config(struct pcmcia_device *link)
         dev->if_port = 0;
     }
 
+    if ((link->conf.ConfigBase == 0x03c0)
+        && (link->manf_id == 0x149) && (link->card_id = 0xc1ab)) {
+        printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
+        printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
+        goto failed;
+    }
+
     local_hw_info = get_hwinfo(link);
     if (local_hw_info == NULL)
         local_hw_info = get_prom(link);
@@ -1567,12 +1574,11 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0x0104, 0x0145),
         PCMCIA_DEVICE_MANF_CARD(0x0149, 0x0230),
         PCMCIA_DEVICE_MANF_CARD(0x0149, 0x4530),
-/*      PCMCIA_DEVICE_MANF_CARD(0x0149, 0xc1ab), conflict with axnet_cs */
+        PCMCIA_DEVICE_MANF_CARD(0x0149, 0xc1ab),
         PCMCIA_DEVICE_MANF_CARD(0x0186, 0x0110),
         PCMCIA_DEVICE_MANF_CARD(0x01bf, 0x2328),
         PCMCIA_DEVICE_MANF_CARD(0x01bf, 0x8041),
         PCMCIA_DEVICE_MANF_CARD(0x0213, 0x2452),
-/*      PCMCIA_DEVICE_MANF_CARD(0x021b, 0x0202), conflict with axnet_cs */
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0300),
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0307),
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x030a),
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index f4ca0591231d..3ac8529bb92c 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -67,6 +67,7 @@ config REALTEK_PHY
 
 config FIXED_PHY
         bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+        depends on PHYLIB=y
         ---help---
           Adds the platform "fixed" MDIO Bus to cover the boards that use
           PHYs that are not connected to the real MDIO bus.
diff --git a/drivers/net/phy/davicom.c b/drivers/net/phy/davicom.c
index 7ed632db00d7..d926168bc780 100644
--- a/drivers/net/phy/davicom.c
+++ b/drivers/net/phy/davicom.c
@@ -37,6 +37,7 @@
 
 #define MII_DM9161_SCR          0x10
 #define MII_DM9161_SCR_INIT     0x0610
+#define MII_DM9161_SCR_RMII     0x0100
 
 /* DM9161 Interrupt Register */
 #define MII_DM9161_INTR 0x15
@@ -103,7 +104,7 @@ static int dm9161_config_aneg(struct phy_device *phydev)
 
 static int dm9161_config_init(struct phy_device *phydev)
 {
-        int err;
+        int err, temp;
 
         /* Isolate the PHY */
         err = phy_write(phydev, MII_BMCR, BMCR_ISOLATE);
@@ -111,9 +112,19 @@ static int dm9161_config_init(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
-        /* Do not bypass the scrambler/descrambler */
-        err = phy_write(phydev, MII_DM9161_SCR, MII_DM9161_SCR_INIT);
+        switch (phydev->interface) {
+        case PHY_INTERFACE_MODE_MII:
+                temp = MII_DM9161_SCR_INIT;
+                break;
+        case PHY_INTERFACE_MODE_RMII:
+                temp =  MII_DM9161_SCR_INIT | MII_DM9161_SCR_RMII;
+                break;
+        default:
+                return -EINVAL;
+        }
 
+        /* Do not bypass the scrambler/descrambler */
+        err = phy_write(phydev, MII_DM9161_SCR, temp);
         if (err < 0)
                 return err;
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 6e9f619c491f..963630c65ca9 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -49,13 +49,13 @@ int mdiobus_register(struct mii_bus *bus)
         int i;
         int err = 0;
 
-        mutex_init(&bus->mdio_lock);
-
         if (NULL == bus || NULL == bus->name ||
                         NULL == bus->read ||
                         NULL == bus->write)
                 return -EINVAL;
 
+        mutex_init(&bus->mdio_lock);
+
         if (bus->reset)
                 bus->reset(bus);
 
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e0b072d9fdb7..3d10ca050b79 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -302,14 +302,14 @@ pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)
         struct pppol2tp_session *session;
         struct hlist_node *walk;
 
-        read_lock(&tunnel->hlist_lock);
+        read_lock_bh(&tunnel->hlist_lock);
         hlist_for_each_entry(session, walk, session_list, hlist) {
                 if (session->tunnel_addr.s_session == session_id) {
-                        read_unlock(&tunnel->hlist_lock);
+                        read_unlock_bh(&tunnel->hlist_lock);
                         return session;
                 }
         }
-        read_unlock(&tunnel->hlist_lock);
+        read_unlock_bh(&tunnel->hlist_lock);
 
         return NULL;
 }
@@ -320,14 +320,14 @@ static struct pppol2tp_tunnel *pppol2tp_tunnel_find(u16 tunnel_id)
 {
         struct pppol2tp_tunnel *tunnel = NULL;
 
-        read_lock(&pppol2tp_tunnel_list_lock);
+        read_lock_bh(&pppol2tp_tunnel_list_lock);
         list_for_each_entry(tunnel, &pppol2tp_tunnel_list, list) {
                 if (tunnel->stats.tunnel_id == tunnel_id) {
-                        read_unlock(&pppol2tp_tunnel_list_lock);
+                        read_unlock_bh(&pppol2tp_tunnel_list_lock);
                         return tunnel;
                 }
         }
-        read_unlock(&pppol2tp_tunnel_list_lock);
+        read_unlock_bh(&pppol2tp_tunnel_list_lock);
 
         return NULL;
 }
@@ -342,10 +342,11 @@ static struct pppol2tp_tunnel *pppol2tp_tunnel_find(u16 tunnel_id)
 static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
 {
         struct sk_buff *skbp;
+        struct sk_buff *tmp;
         u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
 
-        spin_lock(&session->reorder_q.lock);
-        skb_queue_walk(&session->reorder_q, skbp) {
+        spin_lock_bh(&session->reorder_q.lock);
+        skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
                 if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {
                         __skb_insert(skb, skbp->prev, skbp, &session->reorder_q);
                         PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
@@ -360,7 +361,7 @@ static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_
         __skb_queue_tail(&session->reorder_q, skb);
 
 out:
-        spin_unlock(&session->reorder_q.lock);
+        spin_unlock_bh(&session->reorder_q.lock);
 }
 
 /* Dequeue a single skb.
@@ -371,10 +372,9 @@ static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct s
         int length = PPPOL2TP_SKB_CB(skb)->length;
         struct sock *session_sock = NULL;
 
-        /* We're about to requeue the skb, so unlink it and return resources
+        /* We're about to requeue the skb, so return resources
          * to its current owner (a socket receive buffer).
          */
-        skb_unlink(skb, &session->reorder_q);
         skb_orphan(skb);
 
         tunnel->stats.rx_packets++;
@@ -442,7 +442,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
          * expect to send up next, dequeue it and any other
          * in-sequence packets behind it.
          */
-        spin_lock(&session->reorder_q.lock);
+        spin_lock_bh(&session->reorder_q.lock);
         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
                 if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {
                         session->stats.rx_seq_discards++;
@@ -455,6 +455,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
                                skb_queue_len(&session->reorder_q));
                         __skb_unlink(skb, &session->reorder_q);
                         kfree_skb(skb);
+                        sock_put(session->sock);
                         continue;
                 }
 
@@ -469,13 +470,18 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
                                 goto out;
                         }
                 }
-                spin_unlock(&session->reorder_q.lock);
+                __skb_unlink(skb, &session->reorder_q);
+
+                /* Process the skb. We release the queue lock while we
+                 * do so to let other contexts process the queue.
+                 */
+                spin_unlock_bh(&session->reorder_q.lock);
                 pppol2tp_recv_dequeue_skb(session, skb);
-                spin_lock(&session->reorder_q.lock);
+                spin_lock_bh(&session->reorder_q.lock);
         }
 
 out:
-        spin_unlock(&session->reorder_q.lock);
+        spin_unlock_bh(&session->reorder_q.lock);
 }
 
 /* Internal receive frame. Do the real work of receiving an L2TP data frame
@@ -1058,7 +1064,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 
         /* Get routing info from the tunnel socket */
         dst_release(skb->dst);
-        skb->dst = sk_dst_get(sk_tun);
+        skb->dst = dst_clone(__sk_dst_get(sk_tun));
         skb_orphan(skb);
         skb->sk = sk_tun;
 
@@ -1106,10 +1112,12 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
         PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
                "%s: closing all sessions...\n", tunnel->name);
 
-        write_lock(&tunnel->hlist_lock);
+        write_lock_bh(&tunnel->hlist_lock);
         for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
 again:
                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+                        struct sk_buff *skb;
+
                         session = hlist_entry(walk, struct pppol2tp_session, hlist);
 
                         sk = session->sock;
@@ -1126,7 +1134,7 @@ again:
                          * disappear as we're jumping between locks.
                          */
                         sock_hold(sk);
-                        write_unlock(&tunnel->hlist_lock);
+                        write_unlock_bh(&tunnel->hlist_lock);
                         lock_sock(sk);
 
                         if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
@@ -1138,7 +1146,10 @@ again:
                         /* Purge any queued data */
                         skb_queue_purge(&sk->sk_receive_queue);
                         skb_queue_purge(&sk->sk_write_queue);
-                        skb_queue_purge(&session->reorder_q);
+                        while ((skb = skb_dequeue(&session->reorder_q))) {
+                                kfree_skb(skb);
+                                sock_put(sk);
+                        }
 
                         release_sock(sk);
                         sock_put(sk);
@@ -1148,11 +1159,11 @@ again:
                          * list so we are guaranteed to make forward
                          * progress.
                          */
-                        write_lock(&tunnel->hlist_lock);
+                        write_lock_bh(&tunnel->hlist_lock);
                         goto again;
                 }
         }
-        write_unlock(&tunnel->hlist_lock);
+        write_unlock_bh(&tunnel->hlist_lock);
 }
 
 /* Really kill the tunnel.
@@ -1161,9 +1172,9 @@ again:
 static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)
 {
         /* Remove from socket list */
-        write_lock(&pppol2tp_tunnel_list_lock);
+        write_lock_bh(&pppol2tp_tunnel_list_lock);
         list_del_init(&tunnel->list);
-        write_unlock(&pppol2tp_tunnel_list_lock);
+        write_unlock_bh(&pppol2tp_tunnel_list_lock);
 
         atomic_dec(&pppol2tp_tunnel_count);
         kfree(tunnel);
@@ -1239,9 +1250,9 @@ static void pppol2tp_session_destruct(struct sock *sk)
                                 /* Delete the session socket from the
                                  * hash
                                  */
-                                write_lock(&tunnel->hlist_lock);
+                                write_lock_bh(&tunnel->hlist_lock);
                                 hlist_del_init(&session->hlist);
-                                write_unlock(&tunnel->hlist_lock);
+                                write_unlock_bh(&tunnel->hlist_lock);
 
                                 atomic_dec(&pppol2tp_session_count);
                         }
@@ -1386,9 +1397,9 @@ static struct sock *pppol2tp_prepare_tunnel_socket(int fd, u16 tunnel_id,
 
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
-        write_lock(&pppol2tp_tunnel_list_lock);
+        write_lock_bh(&pppol2tp_tunnel_list_lock);
         list_add(&tunnel->list, &pppol2tp_tunnel_list);
-        write_unlock(&pppol2tp_tunnel_list_lock);
+        write_unlock_bh(&pppol2tp_tunnel_list_lock);
         atomic_inc(&pppol2tp_tunnel_count);
 
         /* Bump the reference count. The tunnel context is deleted
@@ -1593,11 +1604,11 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         sk->sk_user_data = session;
 
         /* Add session to the tunnel's hash list */
-        write_lock(&tunnel->hlist_lock);
+        write_lock_bh(&tunnel->hlist_lock);
         hlist_add_head(&session->hlist,
                        pppol2tp_session_id_hash(tunnel,
                                                 session->tunnel_addr.s_session));
-        write_unlock(&tunnel->hlist_lock);
+        write_unlock_bh(&tunnel->hlist_lock);
 
         atomic_inc(&pppol2tp_session_count);
 
@@ -2199,7 +2210,7 @@ static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, str
         int next = 0;
         int i;
 
-        read_lock(&tunnel->hlist_lock);
+        read_lock_bh(&tunnel->hlist_lock);
         for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {
                 hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {
                         if (curr == NULL) {
@@ -2217,7 +2228,7 @@ static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, str
                 }
         }
 out:
-        read_unlock(&tunnel->hlist_lock);
+        read_unlock_bh(&tunnel->hlist_lock);
         if (!found)
                 session = NULL;
 
@@ -2228,13 +2239,13 @@ static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_tunnel *curr)
 {
         struct pppol2tp_tunnel *tunnel = NULL;
 
-        read_lock(&pppol2tp_tunnel_list_lock);
+        read_lock_bh(&pppol2tp_tunnel_list_lock);
         if (list_is_last(&curr->list, &pppol2tp_tunnel_list)) {
                 goto out;
         }
         tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);
 out:
-        read_unlock(&pppol2tp_tunnel_list_lock);
+        read_unlock_bh(&pppol2tp_tunnel_list_lock);
 
         return tunnel;
 }
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index 750d2a99cb4f..daf5abab9534 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2690,6 +2690,7 @@ int gelic_wl_driver_probe(struct gelic_card *card)
                 return -ENOMEM;
 
         /* setup net_device structure */
+        SET_NETDEV_DEV(netdev, &card->dev->core);
         gelic_wl_setup_netdev_ops(netdev);
 
         /* setup some of net_device and register it */
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 6179a0a2032c..c72787adeba3 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -1088,7 +1088,7 @@ static int s2io_print_pci_mode(struct s2io_nic *nic)
  *  '-1' on failure
  */
 
-int init_tti(struct s2io_nic *nic, int link)
+static int init_tti(struct s2io_nic *nic, int link)
 {
         struct XENA_dev_config __iomem *bar0 = nic->bar0;
         register u64 val64 = 0;
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index 202fdf356621..20745fd4e973 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -1633,13 +1633,18 @@ static inline void sis190_init_rxfilter(struct net_device *dev)
 static int __devinit sis190_get_mac_addr(struct pci_dev *pdev, 
                                          struct net_device *dev)
 {
-        u8 from;
+        int rc;
+
+        rc = sis190_get_mac_addr_from_eeprom(pdev, dev);
+        if (rc < 0) {
+                u8 reg;
 
-        pci_read_config_byte(pdev, 0x73, &from);
+                pci_read_config_byte(pdev, 0x73, &reg);
 
-        return (from & 0x00000001) ?
-                sis190_get_mac_addr_from_apc(pdev, dev) :
-                sis190_get_mac_addr_from_eeprom(pdev, dev);
+                if (reg & 0x00000001)
+                        rc = sis190_get_mac_addr_from_apc(pdev, dev);
+        }
+        return rc;
 }
 
 static void sis190_set_speed_auto(struct net_device *dev)
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 9a6295909e43..54c662690f65 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -572,8 +572,9 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
         default:
                 /* set Tx LED (LED_TX) to blink mode on Rx OR Tx activity */
                 ledctrl |= PHY_M_LED_BLINK_RT(BLINK_84MS) | PHY_M_LEDC_TX_CTRL;
+
                 /* turn off the Rx LED (LED_RX) */
-                ledover &= ~PHY_M_LED_MO_RX;
+                ledover |= PHY_M_LED_MO_RX(MO_LED_OFF);
         }
 
         if (hw->chip_id == CHIP_ID_YUKON_EC_U &&
@@ -602,7 +603,7 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
 
                 if (sky2->autoneg == AUTONEG_DISABLE || sky2->speed == SPEED_100) {
                         /* turn on 100 Mbps LED (LED_LINK100) */
-                        ledover |= PHY_M_LED_MO_100;
+                        ledover |= PHY_M_LED_MO_100(MO_LED_ON);
                 }
 
                 if (ledover)
@@ -3322,82 +3323,80 @@ static void sky2_set_multicast(struct net_device *dev)
 /* Can have one global because blinking is controlled by
  * ethtool and that is always under RTNL mutex
  */
-static void sky2_led(struct sky2_hw *hw, unsigned port, int on)
+static void sky2_led(struct sky2_port *sky2, enum led_mode mode)
 {
-        u16 pg;
+        struct sky2_hw *hw = sky2->hw;
+        unsigned port = sky2->port;
 
-        switch (hw->chip_id) {
-        case CHIP_ID_YUKON_XL:
+        spin_lock_bh(&sky2->phy_lock);
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U ||
+            hw->chip_id == CHIP_ID_YUKON_EX ||
+            hw->chip_id == CHIP_ID_YUKON_SUPR) {
+                u16 pg;
                 pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
-                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
-                             on ? (PHY_M_LEDC_LOS_CTRL(1) |
-                                   PHY_M_LEDC_INIT_CTRL(7) |
-                                   PHY_M_LEDC_STA1_CTRL(7) |
-                                   PHY_M_LEDC_STA0_CTRL(7))
-                             : 0);
 
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
-                break;
+                switch (mode) {
+                case MO_LED_OFF:
+                        gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
+                                     PHY_M_LEDC_LOS_CTRL(8) |
+                                     PHY_M_LEDC_INIT_CTRL(8) |
+                                     PHY_M_LEDC_STA1_CTRL(8) |
+                                     PHY_M_LEDC_STA0_CTRL(8));
+                        break;
+                case MO_LED_ON:
+                        gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
+                                     PHY_M_LEDC_LOS_CTRL(9) |
+                                     PHY_M_LEDC_INIT_CTRL(9) |
+                                     PHY_M_LEDC_STA1_CTRL(9) |
+                                     PHY_M_LEDC_STA0_CTRL(9));
+                        break;
+                case MO_LED_BLINK:
+                        gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
+                                     PHY_M_LEDC_LOS_CTRL(0xa) |
+                                     PHY_M_LEDC_INIT_CTRL(0xa) |
+                                     PHY_M_LEDC_STA1_CTRL(0xa) |
+                                     PHY_M_LEDC_STA0_CTRL(0xa));
+                        break;
+                case MO_LED_NORM:
+                        gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
+                                     PHY_M_LEDC_LOS_CTRL(1) |
+                                     PHY_M_LEDC_INIT_CTRL(8) |
+                                     PHY_M_LEDC_STA1_CTRL(7) |
+                                     PHY_M_LEDC_STA0_CTRL(7));
+                }
 
-        default:
-                gm_phy_write(hw, port, PHY_MARV_LED_CTRL, 0);
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
+        } else
                 gm_phy_write(hw, port, PHY_MARV_LED_OVER, 
-                             on ? PHY_M_LED_ALL : 0);
-        }
+                                     PHY_M_LED_MO_DUP(mode) |
+                                     PHY_M_LED_MO_10(mode) |
+                                     PHY_M_LED_MO_100(mode) |
+                                     PHY_M_LED_MO_1000(mode) |
+                                     PHY_M_LED_MO_RX(mode) |
+                                     PHY_M_LED_MO_TX(mode));
+
+        spin_unlock_bh(&sky2->phy_lock);
 }
 
 /* blink LED's for finding board */
 static int sky2_phys_id(struct net_device *dev, u32 data)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
-        struct sky2_hw *hw = sky2->hw;
-        unsigned port = sky2->port;
-        u16 ledctrl, ledover = 0;
-        long ms;
-        int interrupted;
-        int onoff = 1;
+        unsigned int i;
 
-        if (!data || data > (u32) (MAX_SCHEDULE_TIMEOUT / HZ))
-                ms = jiffies_to_msecs(MAX_SCHEDULE_TIMEOUT);
-        else
-                ms = data * 1000;
-
-        /* save initial values */
-        spin_lock_bh(&sky2->phy_lock);
-        if (hw->chip_id == CHIP_ID_YUKON_XL) {
-                u16 pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
-                ledctrl = gm_phy_read(hw, port, PHY_MARV_PHY_CTRL);
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
-        } else {
-                ledctrl = gm_phy_read(hw, port, PHY_MARV_LED_CTRL);
-                ledover = gm_phy_read(hw, port, PHY_MARV_LED_OVER);
-        }
-
-        interrupted = 0;
-        while (!interrupted && ms > 0) {
-                sky2_led(hw, port, onoff);
-                onoff = !onoff;
-
-                spin_unlock_bh(&sky2->phy_lock);
-                interrupted = msleep_interruptible(250);
-                spin_lock_bh(&sky2->phy_lock);
-
-                ms -= 250;
-        }
+        if (data == 0)
+                data = UINT_MAX;
 
-        /* resume regularly scheduled programming */
-        if (hw->chip_id == CHIP_ID_YUKON_XL) {
-                u16 pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
-                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, ledctrl);
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
-        } else {
-                gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
-                gm_phy_write(hw, port, PHY_MARV_LED_OVER, ledover);
+        for (i = 0; i < data; i++) {
+                sky2_led(sky2, MO_LED_ON);
+                if (msleep_interruptible(500))
+                        break;
+                sky2_led(sky2, MO_LED_OFF);
+                if (msleep_interruptible(500))
+                        break;
         }
-        spin_unlock_bh(&sky2->phy_lock);
+        sky2_led(sky2, MO_LED_NORM);
 
         return 0;
 }
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 5ab5c1c7c5aa..7bb3ba9bcbd8 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -1318,18 +1318,21 @@ enum {
         BLINK_670MS     = 4,/* 670 ms */
 };
 
-/**** PHY_MARV_LED_OVER    16 bit r/w LED control */
-enum {
-        PHY_M_LED_MO_DUP  = 3<<10,/* Bit 11..10:  Duplex */
-        PHY_M_LED_MO_10   = 3<<8, /* Bit  9.. 8:  Link 10 */
-        PHY_M_LED_MO_100  = 3<<6, /* Bit  7.. 6:  Link 100 */
-        PHY_M_LED_MO_1000 = 3<<4, /* Bit  5.. 4:  Link 1000 */
-        PHY_M_LED_MO_RX   = 3<<2, /* Bit  3.. 2:  Rx */
-        PHY_M_LED_MO_TX   = 3<<0, /* Bit  1.. 0:  Tx */
-
-        PHY_M_LED_ALL     = PHY_M_LED_MO_DUP | PHY_M_LED_MO_10 
-                            | PHY_M_LED_MO_100 | PHY_M_LED_MO_1000
-                            | PHY_M_LED_MO_RX,
+/*****  PHY_MARV_LED_OVER       16 bit r/w      Manual LED Override Reg *****/
+#define PHY_M_LED_MO_SGMII(x)   ((x)<<14)       /* Bit 15..14:  SGMII AN Timer */
+
+#define PHY_M_LED_MO_DUP(x)     ((x)<<10)       /* Bit 11..10:  Duplex */
+#define PHY_M_LED_MO_10(x)      ((x)<<8)        /* Bit  9.. 8:  Link 10 */
+#define PHY_M_LED_MO_100(x)     ((x)<<6)        /* Bit  7.. 6:  Link 100 */
+#define PHY_M_LED_MO_1000(x)    ((x)<<4)        /* Bit  5.. 4:  Link 1000 */
+#define PHY_M_LED_MO_RX(x)      ((x)<<2)        /* Bit  3.. 2:  Rx */
+#define PHY_M_LED_MO_TX(x)      ((x)<<0)        /* Bit  1.. 0:  Tx */
+
+enum led_mode {
+        MO_LED_NORM  = 0,
+        MO_LED_BLINK = 1,
+        MO_LED_OFF   = 2,
+        MO_LED_ON    = 3,
 };
 
 /*****  PHY_MARV_EXT_CTRL_2     16 bit r/w      Ext. PHY Specific Ctrl 2 *****/
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index 3af5b92b48c8..0166407d7061 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -1400,7 +1400,7 @@ static void TLan_SetMulticastList( struct net_device *dev )
          *
          **************************************************************/
 
-u32 TLan_HandleInvalid( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleInvalid( struct net_device *dev, u16 host_int )
 {
         /* printk( "TLAN:  Invalid interrupt on %s.\n", dev->name ); */
         return 0;
@@ -1432,7 +1432,7 @@ u32 TLan_HandleInvalid( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleTxEOF( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleTxEOF( struct net_device *dev, u16 host_int )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         int             eoc = 0;
@@ -1518,7 +1518,7 @@ u32 TLan_HandleTxEOF( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleStatOverflow( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleStatOverflow( struct net_device *dev, u16 host_int )
 {
         TLan_ReadAndClearStats( dev, TLAN_RECORD );
 
@@ -1554,7 +1554,7 @@ u32 TLan_HandleStatOverflow( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleRxEOF( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleRxEOF( struct net_device *dev, u16 host_int )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u32             ack = 0;
@@ -1689,7 +1689,7 @@ u32 TLan_HandleRxEOF( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleDummy( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleDummy( struct net_device *dev, u16 host_int )
 {
         printk( "TLAN:  Test interrupt on %s.\n", dev->name );
         return 1;
@@ -1719,7 +1719,7 @@ u32 TLan_HandleDummy( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleTxEOC( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleTxEOC( struct net_device *dev, u16 host_int )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         TLanList                *head_list;
@@ -1767,7 +1767,7 @@ u32 TLan_HandleTxEOC( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleStatusCheck( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleStatusCheck( struct net_device *dev, u16 host_int )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u32             ack;
@@ -1842,7 +1842,7 @@ u32 TLan_HandleStatusCheck( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-u32 TLan_HandleRxEOC( struct net_device *dev, u16 host_int )
+static u32 TLan_HandleRxEOC( struct net_device *dev, u16 host_int )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         dma_addr_t      head_list_phys;
@@ -1902,7 +1902,7 @@ u32 TLan_HandleRxEOC( struct net_device *dev, u16 host_int )
          *
          **************************************************************/
 
-void TLan_Timer( unsigned long data )
+static void TLan_Timer( unsigned long data )
 {
         struct net_device       *dev = (struct net_device *) data;
         TLanPrivateInfo *priv = netdev_priv(dev);
@@ -1983,7 +1983,7 @@ void TLan_Timer( unsigned long data )
          *
          **************************************************************/
 
-void TLan_ResetLists( struct net_device *dev )
+static void TLan_ResetLists( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         int             i;
@@ -2043,7 +2043,7 @@ void TLan_ResetLists( struct net_device *dev )
 } /* TLan_ResetLists */
 
 
-void TLan_FreeLists( struct net_device *dev )
+static void TLan_FreeLists( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         int             i;
@@ -2092,7 +2092,7 @@ void TLan_FreeLists( struct net_device *dev )
          *
          **************************************************************/
 
-void TLan_PrintDio( u16 io_base )
+static void TLan_PrintDio( u16 io_base )
 {
         u32 data0, data1;
         int     i;
@@ -2127,7 +2127,7 @@ void TLan_PrintDio( u16 io_base )
          *
          **************************************************************/
 
-void TLan_PrintList( TLanList *list, char *type, int num)
+static void TLan_PrintList( TLanList *list, char *type, int num)
 {
         int i;
 
@@ -2163,7 +2163,7 @@ void TLan_PrintList( TLanList *list, char *type, int num)
          *
          **************************************************************/
 
-void TLan_ReadAndClearStats( struct net_device *dev, int record )
+static void TLan_ReadAndClearStats( struct net_device *dev, int record )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u32             tx_good, tx_under;
@@ -2238,7 +2238,7 @@ void TLan_ReadAndClearStats( struct net_device *dev, int record )
          *
          **************************************************************/
 
-void
+static void
 TLan_ResetAdapter( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
@@ -2324,7 +2324,7 @@ TLan_ResetAdapter( struct net_device *dev )
 
 
 
-void
+static void
 TLan_FinishReset( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
@@ -2448,7 +2448,7 @@ TLan_FinishReset( struct net_device *dev )
          *
          **************************************************************/
 
-void TLan_SetMac( struct net_device *dev, int areg, char *mac )
+static void TLan_SetMac( struct net_device *dev, int areg, char *mac )
 {
         int i;
 
@@ -2490,7 +2490,7 @@ void TLan_SetMac( struct net_device *dev, int areg, char *mac )
          *
          ********************************************************************/
 
-void TLan_PhyPrint( struct net_device *dev )
+static void TLan_PhyPrint( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16 i, data0, data1, data2, data3, phy;
@@ -2539,7 +2539,7 @@ void TLan_PhyPrint( struct net_device *dev )
          *
          ********************************************************************/
 
-void TLan_PhyDetect( struct net_device *dev )
+static void TLan_PhyDetect( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16             control;
@@ -2586,7 +2586,7 @@ void TLan_PhyDetect( struct net_device *dev )
 
 
 
-void TLan_PhyPowerDown( struct net_device *dev )
+static void TLan_PhyPowerDown( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16             value;
@@ -2611,7 +2611,7 @@ void TLan_PhyPowerDown( struct net_device *dev )
 
 
 
-void TLan_PhyPowerUp( struct net_device *dev )
+static void TLan_PhyPowerUp( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16             value;
@@ -2632,7 +2632,7 @@ void TLan_PhyPowerUp( struct net_device *dev )
 
 
 
-void TLan_PhyReset( struct net_device *dev )
+static void TLan_PhyReset( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16             phy;
@@ -2660,7 +2660,7 @@ void TLan_PhyReset( struct net_device *dev )
 
 
 
-void TLan_PhyStartLink( struct net_device *dev )
+static void TLan_PhyStartLink( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16             ability;
@@ -2747,7 +2747,7 @@ void TLan_PhyStartLink( struct net_device *dev )
 
 
 
-void TLan_PhyFinishAutoNeg( struct net_device *dev )
+static void TLan_PhyFinishAutoNeg( struct net_device *dev )
 {
         TLanPrivateInfo *priv = netdev_priv(dev);
         u16             an_adv;
@@ -2903,7 +2903,7 @@ void TLan_PhyMonitor( struct net_device *dev )
          *
          **************************************************************/
 
-int TLan_MiiReadReg( struct net_device *dev, u16 phy, u16 reg, u16 *val )
+static int TLan_MiiReadReg( struct net_device *dev, u16 phy, u16 reg, u16 *val )
 {
         u8      nack;
         u16     sio, tmp;
@@ -2993,7 +2993,7 @@ int TLan_MiiReadReg( struct net_device *dev, u16 phy, u16 reg, u16 *val )
          *
          **************************************************************/
 
-void TLan_MiiSendData( u16 base_port, u32 data, unsigned num_bits )
+static void TLan_MiiSendData( u16 base_port, u32 data, unsigned num_bits )
 {
         u16 sio;
         u32 i;
@@ -3035,7 +3035,7 @@ void TLan_MiiSendData( u16 base_port, u32 data, unsigned num_bits )
          *
          **************************************************************/
 
-void TLan_MiiSync( u16 base_port )
+static void TLan_MiiSync( u16 base_port )
 {
         int i;
         u16 sio;
@@ -3074,7 +3074,7 @@ void TLan_MiiSync( u16 base_port )
          *
          **************************************************************/
 
-void TLan_MiiWriteReg( struct net_device *dev, u16 phy, u16 reg, u16 val )
+static void TLan_MiiWriteReg( struct net_device *dev, u16 phy, u16 reg, u16 val )
 {
         u16     sio;
         int     minten;
@@ -3144,7 +3144,7 @@ void TLan_MiiWriteReg( struct net_device *dev, u16 phy, u16 reg, u16 val )
          *
          **************************************************************/
 
-void TLan_EeSendStart( u16 io_base )
+static void TLan_EeSendStart( u16 io_base )
 {
         u16     sio;
 
@@ -3184,7 +3184,7 @@ void TLan_EeSendStart( u16 io_base )
          *
          **************************************************************/
 
-int TLan_EeSendByte( u16 io_base, u8 data, int stop )
+static int TLan_EeSendByte( u16 io_base, u8 data, int stop )
 {
         int     err;
         u8      place;
@@ -3245,7 +3245,7 @@ int TLan_EeSendByte( u16 io_base, u8 data, int stop )
          *
          **************************************************************/
 
-void TLan_EeReceiveByte( u16 io_base, u8 *data, int stop )
+static void TLan_EeReceiveByte( u16 io_base, u8 *data, int stop )
 {
         u8  place;
         u16 sio;
@@ -3303,7 +3303,7 @@ void TLan_EeReceiveByte( u16 io_base, u8 *data, int stop )
          *
          **************************************************************/
 
-int TLan_EeReadByte( struct net_device *dev, u8 ee_addr, u8 *data )
+static int TLan_EeReadByte( struct net_device *dev, u8 ee_addr, u8 *data )
 {
         int err;
         TLanPrivateInfo *priv = netdev_priv(dev);
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 77d9dd7ea34f..567c62757e9d 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -910,7 +910,8 @@ static void de_set_media (struct de_private *de)
         unsigned media = de->media_type;
         u32 macmode = dr32(MacMode);
 
-        BUG_ON(de_is_running(de));
+        if (de_is_running(de))
+                printk(KERN_WARNING "%s: chip is running while changing media!\n", de->dev->name);
 
         if (de->de21040)
                 dw32(CSR11, FULL_DUPLEX_MAGIC);
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index a7afeea156bd..a59c1f224aa8 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -482,9 +482,11 @@ static void uli526x_init(struct net_device *dev)
         struct uli526x_board_info *db = netdev_priv(dev);
         unsigned long ioaddr = db->ioaddr;
         u8      phy_tmp;
+        u8      timeout;
         u16     phy_value;
         u16 phy_reg_reset;
 
+
         ULI526X_DBUG(0, "uli526x_init()", 0);
 
         /* Reset M526x MAC controller */
@@ -509,11 +511,19 @@ static void uli526x_init(struct net_device *dev)
         /* Parser SROM and media mode */
         db->media_mode = uli526x_media_mode;
 
-        /* Phyxcer capability setting */
+        /* phyxcer capability setting */
         phy_reg_reset = phy_read(db->ioaddr, db->phy_addr, 0, db->chip_id);
         phy_reg_reset = (phy_reg_reset | 0x8000);
         phy_write(db->ioaddr, db->phy_addr, 0, phy_reg_reset, db->chip_id);
+
+        /* See IEEE 802.3-2002.pdf (Section 2, Chapter "22.2.4 Management
+         * functions") or phy data sheet for details on phy reset
+         */
         udelay(500);
+        timeout = 10;
+        while (timeout-- &&
+                phy_read(db->ioaddr, db->phy_addr, 0, db->chip_id) & 0x8000)
+                        udelay(100);
 
         /* Process Phyxcer Media Mode */
         uli526x_set_phyxcer(db);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 038c1ef94d2e..7b816a032957 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -663,7 +663,11 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
         case SIOCSIFHWADDR:
         {
                 /* try to set the actual net device's hw address */
-                int ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+                int ret;
+
+                rtnl_lock();
+                ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+                rtnl_unlock();
 
                 if (ret == 0) {
                         /** Set the character device's hardware address. This is used when
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 7c851b1e6daa..8c9d6ae2bb31 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1893,7 +1893,7 @@ static void rhine_shutdown (struct pci_dev *pdev)
 
         /* Make sure we use pattern 0, 1 and not 4, 5 */
         if (rp->quirks & rq6patterns)
-                iowrite8(0x04, ioaddr + 0xA7);
+                iowrite8(0x04, ioaddr + WOLcgClr);
 
         if (rp->wolopts & WAKE_MAGIC) {
                 iowrite8(WOLmagic, ioaddr + WOLcrSet);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fdc23678117b..19fd4cb0ddf8 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -361,6 +361,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         netif_napi_add(dev, &vi->napi, virtnet_poll, napi_weight);
         vi->dev = dev;
         vi->vdev = vdev;
+        vdev->priv = vi;
 
         /* We expect two virtqueues, receive then send. */
         vi->rvq = vdev->config->find_vq(vdev, 0, skb_recv_done);
@@ -395,7 +396,6 @@ static int virtnet_probe(struct virtio_device *vdev)
         }
 
         pr_debug("virtnet: registered device %s\n", dev->name);
-        vdev->priv = vi;
         return 0;
 
 unregister:
diff --git a/drivers/net/wan/sbni.c b/drivers/net/wan/sbni.c
index 15d5c58e57bc..e59255a155a9 100644
--- a/drivers/net/wan/sbni.c
+++ b/drivers/net/wan/sbni.c
@@ -751,7 +751,7 @@ upload_data( struct net_device  *dev,  unsigned  framelen,  unsigned  frameno,
 }
 
 
-static __inline void
+static inline void
 send_complete( struct net_local  *nl )
 {
 #ifdef CONFIG_SBNI_MULTILINE
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 1a2141dabdc7..8bc4bc4c330e 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -32,6 +32,7 @@ config B43_PCI_AUTOSELECT
         bool
         depends on B43 && SSB_PCIHOST_POSSIBLE
         select SSB_PCIHOST
+        select SSB_B43_PCI_BRIDGE
         default y
 
 # Auto-select SSB PCICORE driver, if possible
diff --git a/drivers/net/wireless/b43legacy/Kconfig b/drivers/net/wireless/b43legacy/Kconfig
index 6745579ba96d..13c65faf0247 100644
--- a/drivers/net/wireless/b43legacy/Kconfig
+++ b/drivers/net/wireless/b43legacy/Kconfig
@@ -25,6 +25,7 @@ config B43LEGACY_PCI_AUTOSELECT
         bool
         depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
         select SSB_PCIHOST
+        select SSB_B43_PCI_BRIDGE
         default y
 
 # Auto-select SSB PCICORE driver, if possible
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c39de422e220..5f3f34e1dbfd 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(void)
 #ifdef CONFIG_B43LEGACY_DMA
         feat_dma = "D";
 #endif
-        printk(KERN_INFO "Broadcom 43xx driver loaded "
+        printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
                "[ Features: %s%s%s%s%s, Firmware-ID: "
                B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
                feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 0159701e8456..afb8f4305c24 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -1,6 +1,6 @@
 config BCM43XX
         tristate "Broadcom BCM43xx wireless support (DEPRECATED)"
-        depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && EXPERIMENTAL
+        depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && (!SSB_B43_PCI_BRIDGE || SSB != y) && EXPERIMENTAL
         select WIRELESS_EXT
         select FW_LOADER
         select HW_RANDOM
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index eab020338fde..b3c1acbcc655 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1040,7 +1040,6 @@ int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
         lbs_deb_leave(LBS_DEB_CMD);
         return ret;
 }
-EXPORT_SYMBOL_GPL(lbs_mesh_access);
 
 int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan)
 {
@@ -1576,7 +1575,6 @@ done:
         lbs_deb_leave_args(LBS_DEB_HOST, "ret %d", ret);
         return ret;
 }
-EXPORT_SYMBOL_GPL(lbs_prepare_and_send_command);
 
 /**
  *  @brief This function allocates the command buffer and link
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 159216a91903..f0ef7081bdeb 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
         }
 
         resp = (void *)priv->upld_buf;
-
-        curcmd = le16_to_cpu(resp->command);
-
+        curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command);
         respcmd = le16_to_cpu(resp->command);
         result = le16_to_cpu(resp->result);
 
@@ -572,15 +570,15 @@ int lbs_process_rx_command(struct lbs_private *priv)
                      respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
         lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
 
-        if (resp->seqnum != resp->seqnum) {
+        if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) {
                 lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
-                            le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum));
+                            le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum));
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 ret = -1;
                 goto done;
         }
         if (respcmd != CMD_RET(curcmd) &&
-            respcmd != CMD_802_11_ASSOCIATE && curcmd != CMD_RET_802_11_ASSOCIATE) {
+            respcmd != CMD_RET_802_11_ASSOCIATE && curcmd != CMD_802_11_ASSOCIATE) {
                 lbs_pr_info("Invalid CMD_RESP %x to command %x!\n", respcmd, curcmd);
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 ret = -1;
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index aaacd9bd6bd2..4e22341b4f3d 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -69,7 +69,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev);
 int lbs_remove_card(struct lbs_private *priv);
 int lbs_start_card(struct lbs_private *priv);
 int lbs_stop_card(struct lbs_private *priv);
-int lbs_reset_device(struct lbs_private *priv);
 void lbs_host_to_card_done(struct lbs_private *priv);
 
 int lbs_update_channel(struct lbs_private *priv);
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 84fb49ca0fae..4d4e2f3b66ac 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -1351,8 +1351,6 @@ done:
         lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
         return ret;
 }
-EXPORT_SYMBOL_GPL(lbs_add_mesh);
-
 
 static void lbs_remove_mesh(struct lbs_private *priv)
 {
@@ -1372,7 +1370,6 @@ static void lbs_remove_mesh(struct lbs_private *priv)
         free_netdev(mesh_dev);
         lbs_deb_leave(LBS_DEB_MESH);
 }
-EXPORT_SYMBOL_GPL(lbs_remove_mesh);
 
 /**
  *  @brief This function finds the CFP in
@@ -1458,20 +1455,6 @@ void lbs_interrupt(struct lbs_private *priv)
 }
 EXPORT_SYMBOL_GPL(lbs_interrupt);
 
-int lbs_reset_device(struct lbs_private *priv)
-{
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11_RESET,
-                                    CMD_ACT_HALT, 0, 0, NULL);
-        msleep_interruptible(10);
-
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(lbs_reset_device);
-
 static int __init lbs_init_module(void)
 {
         lbs_deb_enter(LBS_DEB_MAIN);
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c
index 5cda49aff3a8..d191e055a788 100644
--- a/drivers/net/wireless/p54common.c
+++ b/drivers/net/wireless/p54common.c
@@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
         struct p54_common *priv = dev->priv;
         struct eeprom_pda_wrap *wrap = NULL;
         struct pda_entry *entry;
-        int i = 0;
         unsigned int data_len, entry_len;
         void *tmp;
         int err;
+        u8 *end = (u8 *)eeprom + len;
 
         wrap = (struct eeprom_pda_wrap *) eeprom;
-        entry = (void *)wrap->data + wrap->len;
-        i += 2;
-        i += le16_to_cpu(entry->len)*2;
-        while (i < len) {
+        entry = (void *)wrap->data + le16_to_cpu(wrap->len);
+
+        /* verify that at least the entry length/code fits */
+        while ((u8 *)entry <= end - sizeof(*entry)) {
                 entry_len = le16_to_cpu(entry->len);
                 data_len = ((entry_len - 1) << 1);
+
+                /* abort if entry exceeds whole structure */
+                if ((u8 *)entry + sizeof(*entry) + data_len > end)
+                        break;
+
                 switch (le16_to_cpu(entry->code)) {
                 case PDR_MAC_ADDRESS:
                         SET_IEEE80211_PERM_ADDR(dev, entry->data);
@@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         priv->version = *(u8 *)(entry->data + 1);
                         break;
                 case PDR_END:
-                        i = len;
+                        /* make it overrun */
+                        entry_len = len;
                         break;
                 }
 
                 entry = (void *)entry + (entry_len + 1)*2;
-                i += 2;
-                i += entry_len*2;
         }
 
         if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h
index a721334e20d9..b67ff34e26fe 100644
--- a/drivers/net/wireless/p54common.h
+++ b/drivers/net/wireless/p54common.h
@@ -53,10 +53,10 @@ struct pda_entry {
 } __attribute__ ((packed));
 
 struct eeprom_pda_wrap {
-        u32 magic;
-        u16 pad;
-        u16 len;
-        u32 arm_opcode;
+        __le32 magic;
+        __le16 pad;
+        __le16 len;
+        __le32 arm_opcode;
         u8 data[0];
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 8ce2ddf8024f..10b776c1adc5 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -228,9 +228,9 @@ struct NDIS_WLAN_BSSID_EX {
         struct NDIS_802_11_SSID Ssid;
         __le32 Privacy;
         __le32 Rssi;
-        enum NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
+        __le32 NetworkTypeInUse;
         struct NDIS_802_11_CONFIGURATION Configuration;
-        enum NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
+        __le32 InfrastructureMode;
         u8 SupportedRates[NDIS_802_11_LENGTH_RATES_EX];
         __le32 IELength;
         u8 IEs[0];
@@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
         __le32 KeyLength;
         u8 Bssid[6];
         u8 Padding[6];
-        __le64 KeyRSC;
+        u8 KeyRSC[8];
         u8 KeyMaterial[32];
 } __attribute__((packed));
 
@@ -279,11 +279,11 @@ struct RNDIS_CONFIG_PARAMETER_INFOBUFFER {
 } __attribute__((packed));
 
 /* these have to match what is in wpa_supplicant */
-enum { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP } wpa_alg;
-enum { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP, CIPHER_WEP104 }
-        wpa_cipher;
-enum { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE, KEY_MGMT_802_1X_NO_WPA,
-        KEY_MGMT_WPA_NONE } wpa_key_mgmt;
+enum wpa_alg { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP };
+enum wpa_cipher { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP,
+                  CIPHER_WEP104 };
+enum wpa_key_mgmt { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE,
+                    KEY_MGMT_802_1X_NO_WPA, KEY_MGMT_WPA_NONE };
 
 /*
  *  private data
@@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
         struct usbnet *usbdev = dev->priv;
         struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
         struct NDIS_802_11_KEY ndis_key;
-        int i, keyidx, ret;
+        int keyidx, ret;
         u8 *addr;
 
         keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
@@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
         ndis_key.KeyIndex = cpu_to_le32(keyidx);
 
         if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-                for (i = 0; i < 6; i++)
-                        ndis_key.KeyRSC |=
-                                cpu_to_le64(ext->rx_seq[i] << (i * 8));
+                memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
                 ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index d6cba138c7ab..c69f85ed7669 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -960,8 +960,12 @@ static int rt2400pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2400pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt2400pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt2400pci_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2400pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index e874fdcae204..91e87b53374f 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1112,8 +1112,12 @@ static int rt2500pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2500pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt2500pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt2500pci_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2500pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 4ca9730e5e92..638c3d243108 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1001,8 +1001,12 @@ static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2500usb_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt2500usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt2500usb_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2500usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 72cfe00c1ed7..07adc576db49 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -97,12 +97,16 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         libconf.ant.rx = rx;
         libconf.ant.tx = tx;
 
+        if (rx == rt2x00dev->link.ant.active.rx &&
+            tx == rt2x00dev->link.ant.active.tx)
+                return;
+
         /*
          * Antenna setup changes require the RX to be disabled,
          * else the changes will be ignored by the device.
          */
         if (test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
+                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF_LINK);
 
         /*
          * Write new antenna setup to device and reset the link tuner.
@@ -116,7 +120,7 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->link.ant.active.tx = libconf.ant.tx;
 
         if (test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON_LINK);
 }
 
 void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c4be2ac4d7a4..0d51f478bcdf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -61,11 +61,33 @@ EXPORT_SYMBOL_GPL(rt2x00lib_get_ring);
 /*
  * Link tuning handlers
  */
-static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
+void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
 {
+        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
+                return;
+
+        /*
+         * Reset link information.
+         * Both the currently active vgc level as well as
+         * the link tuner counter should be reset. Resetting
+         * the counter is important for devices where the
+         * device should only perform link tuning during the
+         * first minute after being enabled.
+         */
         rt2x00dev->link.count = 0;
         rt2x00dev->link.vgc_level = 0;
 
+        /*
+         * Reset the link tuner.
+         */
+        rt2x00dev->ops->lib->reset_tuner(rt2x00dev);
+}
+
+static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
+{
+        /*
+         * Clear all (possibly) pre-existing quality statistics.
+         */
         memset(&rt2x00dev->link.qual, 0, sizeof(rt2x00dev->link.qual));
 
         /*
@@ -79,10 +101,7 @@ static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->link.qual.rx_percentage = 50;
         rt2x00dev->link.qual.tx_percentage = 50;
 
-        /*
-         * Reset the link tuner.
-         */
-        rt2x00dev->ops->lib->reset_tuner(rt2x00dev);
+        rt2x00lib_reset_link_tuner(rt2x00dev);
 
         queue_delayed_work(rt2x00dev->hw->workqueue,
                            &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
@@ -93,15 +112,6 @@ static void rt2x00lib_stop_link_tuner(struct rt2x00_dev *rt2x00dev)
         cancel_delayed_work_sync(&rt2x00dev->link.work);
 }
 
-void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
-{
-        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-                return;
-
-        rt2x00lib_stop_link_tuner(rt2x00dev);
-        rt2x00lib_start_link_tuner(rt2x00dev);
-}
-
 /*
  * Ring initialization
  */
@@ -260,19 +270,11 @@ static void rt2x00lib_evaluate_antenna_sample(struct rt2x00_dev *rt2x00dev)
         if (sample_a == sample_b)
                 return;
 
-        if (rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY) {
-                if (sample_a > sample_b && rx == ANTENNA_B)
-                        rx = ANTENNA_A;
-                else if (rx == ANTENNA_A)
-                        rx = ANTENNA_B;
-        }
+        if (rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY)
+                rx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
 
-        if (rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY) {
-                if (sample_a > sample_b && tx == ANTENNA_B)
-                        tx = ANTENNA_A;
-                else if (tx == ANTENNA_A)
-                        tx = ANTENNA_B;
-        }
+        if (rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY)
+                tx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
 
         rt2x00lib_config_antenna(rt2x00dev, rx, tx);
 }
@@ -293,7 +295,7 @@ static void rt2x00lib_evaluate_antenna_eval(struct rt2x00_dev *rt2x00dev)
          * sample the rssi from the other antenna to make a valid
          * comparison between the 2 antennas.
          */
-        if ((rssi_curr - rssi_old) > -5 || (rssi_curr - rssi_old) < 5)
+        if (abs(rssi_curr - rssi_old) < 5)
                 return;
 
         rt2x00dev->link.ant.flags |= ANTENNA_MODE_SAMPLE;
@@ -319,15 +321,15 @@ static void rt2x00lib_evaluate_antenna(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->link.ant.flags &= ~ANTENNA_TX_DIVERSITY;
 
         if (rt2x00dev->hw->conf.antenna_sel_rx == 0 &&
-            rt2x00dev->default_ant.rx != ANTENNA_SW_DIVERSITY)
+            rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
                 rt2x00dev->link.ant.flags |= ANTENNA_RX_DIVERSITY;
         if (rt2x00dev->hw->conf.antenna_sel_tx == 0 &&
-            rt2x00dev->default_ant.tx != ANTENNA_SW_DIVERSITY)
+            rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
                 rt2x00dev->link.ant.flags |= ANTENNA_TX_DIVERSITY;
 
         if (!(rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY) &&
             !(rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY)) {
-                rt2x00dev->link.ant.flags &= ~ANTENNA_MODE_SAMPLE;
+                rt2x00dev->link.ant.flags = 0;
                 return;
         }
 
@@ -441,17 +443,18 @@ static void rt2x00lib_link_tuner(struct work_struct *work)
                 rt2x00dev->ops->lib->link_tuner(rt2x00dev);
 
         /*
-         * Evaluate antenna setup.
-         */
-        rt2x00lib_evaluate_antenna(rt2x00dev);
-
-        /*
          * Precalculate a portion of the link signal which is
          * in based on the tx/rx success/failure counters.
          */
         rt2x00lib_precalculate_link_signal(&rt2x00dev->link.qual);
 
         /*
+         * Evaluate antenna setup, make this the last step since this could
+         * possibly reset some statistics.
+         */
+        rt2x00lib_evaluate_antenna(rt2x00dev);
+
+        /*
          * Increase tuner counter, and reschedule the next link tuner run.
          */
         rt2x00dev->link.count++;
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 838421216da0..b1915dc7dda1 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -85,6 +85,8 @@ enum dev_state {
         STATE_RADIO_OFF,
         STATE_RADIO_RX_ON,
         STATE_RADIO_RX_OFF,
+        STATE_RADIO_RX_ON_LINK,
+        STATE_RADIO_RX_OFF_LINK,
         STATE_RADIO_IRQ_ON,
         STATE_RADIO_IRQ_OFF,
 };
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index b31f0c26c32b..93ea212fedd5 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1482,8 +1482,12 @@ static int rt61pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt61pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt61pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt61pci_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt61pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
@@ -2298,9 +2302,9 @@ static void rt61pci_configure_filter(struct ieee80211_hw *hw,
          * Apply some rules to the filters:
          * - Some filters imply different filters to be set.
          * - Some things we can't filter out at all.
+         * - Multicast filter seems to kill broadcast traffic so never use it.
          */
-        if (mc_count)
-                *total_flags |= FIF_ALLMULTI;
+        *total_flags |= FIF_ALLMULTI;
         if (*total_flags & FIF_OTHER_BSS ||
             *total_flags & FIF_PROMISC_IN_BSS)
                 *total_flags |= FIF_PROMISC_IN_BSS | FIF_OTHER_BSS;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 4d576ab3e7f9..8103d41a1543 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1208,8 +1208,12 @@ static int rt73usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt73usb_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt73usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt73usb_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt73usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
@@ -1865,9 +1869,9 @@ static void rt73usb_configure_filter(struct ieee80211_hw *hw,
          * Apply some rules to the filters:
          * - Some filters imply different filters to be set.
          * - Some things we can't filter out at all.
+         * - Multicast filter seems to kill broadcast traffic so never use it.
          */
-        if (mc_count)
-                *total_flags |= FIF_ALLMULTI;
+        *total_flags |= FIF_ALLMULTI;
         if (*total_flags & FIF_OTHER_BSS ||
             *total_flags & FIF_PROMISC_IN_BSS)
                 *total_flags |= FIF_PROMISC_IN_BSS | FIF_OTHER_BSS;
@@ -2094,6 +2098,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* D-Link */
         { USB_DEVICE(0x07d1, 0x3c03), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c04), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c07), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0004), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gigabyte */
diff --git a/drivers/parisc/Kconfig b/drivers/parisc/Kconfig
index 1d3b84b4af3f..553a9905299a 100644
--- a/drivers/parisc/Kconfig
+++ b/drivers/parisc/Kconfig
@@ -103,6 +103,11 @@ config IOMMU_SBA
         depends on PCI_LBA
         default PCI_LBA
 
+config IOMMU_HELPER
+        bool
+        depends on IOMMU_SBA || IOMMU_CCIO
+        default y
+
 #config PCI_EPIC
 #       bool "EPIC/SAGA PCI support"
 #       depends on PCI
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index d08b284de196..62db3c3fe4dc 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -43,6 +43,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/scatterlist.h>
+#include <linux/iommu-helper.h>
 
 #include <asm/byteorder.h>
 #include <asm/cache.h>          /* for L1_CACHE_BYTES */
@@ -302,13 +303,17 @@ static int ioc_count;
 */
 #define CCIO_SEARCH_LOOP(ioc, res_idx, mask, size)  \
        for(; res_ptr < res_end; ++res_ptr) { \
-               if(0 == (*res_ptr & mask)) { \
-                       *res_ptr |= mask; \
-                       res_idx = (unsigned int)((unsigned long)res_ptr - (unsigned long)ioc->res_map); \
-                       ioc->res_hint = res_idx + (size >> 3); \
-                       goto resource_found; \
-               } \
-       }
+                int ret;\
+                unsigned int idx;\
+                idx = (unsigned int)((unsigned long)res_ptr - (unsigned long)ioc->res_map); \
+                ret = iommu_is_span_boundary(idx << 3, pages_needed, 0, boundary_size);\
+                if ((0 == (*res_ptr & mask)) && !ret) { \
+                        *res_ptr |= mask; \
+                        res_idx = idx;\
+                        ioc->res_hint = res_idx + (size >> 3); \
+                        goto resource_found; \
+                } \
+        }
 
 #define CCIO_FIND_FREE_MAPPING(ioa, res_idx, mask, size) \
        u##size *res_ptr = (u##size *)&((ioc)->res_map[ioa->res_hint & ~((size >> 3) - 1)]); \
@@ -341,10 +346,11 @@ static int ioc_count;
  * of available pages for the requested size.
  */
 static int
-ccio_alloc_range(struct ioc *ioc, size_t size)
+ccio_alloc_range(struct ioc *ioc, struct device *dev, size_t size)
 {
         unsigned int pages_needed = size >> IOVP_SHIFT;
         unsigned int res_idx;
+        unsigned long boundary_size;
 #ifdef CCIO_SEARCH_TIME
         unsigned long cr_start = mfctl(16);
 #endif
@@ -360,6 +366,9 @@ ccio_alloc_range(struct ioc *ioc, size_t size)
         ** ggg sacrifices another 710 to the computer gods.
         */
 
+        boundary_size = ALIGN((unsigned long long)dma_get_seg_boundary(dev) + 1,
+                              1ULL << IOVP_SHIFT) >> IOVP_SHIFT;
+
         if (pages_needed <= 8) {
                 /*
                  * LAN traffic will not thrash the TLB IFF the same NIC
@@ -760,7 +769,7 @@ ccio_map_single(struct device *dev, void *addr, size_t size,
         ioc->msingle_pages += size >> IOVP_SHIFT;
 #endif
 
-        idx = ccio_alloc_range(ioc, size);
+        idx = ccio_alloc_range(ioc, dev, size);
         iovp = (dma_addr_t)MKIOVP(idx);
 
         pdir_start = &(ioc->pdir_base[idx]);
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index 97ba8286c596..a9c46cc2db37 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -96,8 +96,8 @@ iommu_fill_pdir(struct ioc *ioc, struct scatterlist *startsg, int nents,
 
 static inline unsigned int
 iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
-                      struct scatterlist *startsg, int nents,
-                      int (*iommu_alloc_range)(struct ioc *, size_t))
+                struct scatterlist *startsg, int nents,
+                int (*iommu_alloc_range)(struct ioc *, struct device *, size_t))
 {
         struct scatterlist *contig_sg;     /* contig chunk head */
         unsigned long dma_offset, dma_len; /* start/len of DMA stream */
@@ -166,7 +166,7 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
                 dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
                 sg_dma_address(contig_sg) =
                         PIDE_FLAG 
-                        | (iommu_alloc_range(ioc, dma_len) << IOVP_SHIFT)
+                        | (iommu_alloc_range(ioc, dev, dma_len) << IOVP_SHIFT)
                         | dma_offset;
                 n_mappings++;
         }
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index d06627c3f353..bdbe780e21c5 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -29,6 +29,7 @@
 #include <linux/string.h>
 #include <linux/pci.h>
 #include <linux/scatterlist.h>
+#include <linux/iommu-helper.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -313,6 +314,12 @@ sba_dump_sg( struct ioc *ioc, struct scatterlist *startsg, int nents)
 #define RESMAP_MASK(n)    (~0UL << (BITS_PER_LONG - (n)))
 #define RESMAP_IDX_MASK   (sizeof(unsigned long) - 1)
 
+unsigned long ptr_to_pide(struct ioc *ioc, unsigned long *res_ptr,
+                          unsigned int bitshiftcnt)
+{
+        return (((unsigned long)res_ptr - (unsigned long)ioc->res_map) << 3)
+                + bitshiftcnt;
+}
 
 /**
  * sba_search_bitmap - find free space in IO PDIR resource bitmap
@@ -324,19 +331,36 @@ sba_dump_sg( struct ioc *ioc, struct scatterlist *startsg, int nents)
  * Cool perf optimization: search for log2(size) bits at a time.
  */
 static SBA_INLINE unsigned long
-sba_search_bitmap(struct ioc *ioc, unsigned long bits_wanted)
+sba_search_bitmap(struct ioc *ioc, struct device *dev,
+                  unsigned long bits_wanted)
 {
         unsigned long *res_ptr = ioc->res_hint;
         unsigned long *res_end = (unsigned long *) &(ioc->res_map[ioc->res_size]);
-        unsigned long pide = ~0UL;
+        unsigned long pide = ~0UL, tpide;
+        unsigned long boundary_size;
+        unsigned long shift;
+        int ret;
+
+        boundary_size = ALIGN((unsigned long long)dma_get_seg_boundary(dev) + 1,
+                              1ULL << IOVP_SHIFT) >> IOVP_SHIFT;
+
+#if defined(ZX1_SUPPORT)
+        BUG_ON(ioc->ibase & ~IOVP_MASK);
+        shift = ioc->ibase >> IOVP_SHIFT;
+#else
+        shift = 0;
+#endif
 
         if (bits_wanted > (BITS_PER_LONG/2)) {
                 /* Search word at a time - no mask needed */
                 for(; res_ptr < res_end; ++res_ptr) {
-                        if (*res_ptr == 0) {
+                        tpide = ptr_to_pide(ioc, res_ptr, 0);
+                        ret = iommu_is_span_boundary(tpide, bits_wanted,
+                                                     shift,
+                                                     boundary_size);
+                        if ((*res_ptr == 0) && !ret) {
                                 *res_ptr = RESMAP_MASK(bits_wanted);
-                                pide = ((unsigned long)res_ptr - (unsigned long)ioc->res_map);
-                                pide <<= 3;     /* convert to bit address */
+                                pide = tpide;
                                 break;
                         }
                 }
@@ -365,11 +389,13 @@ sba_search_bitmap(struct ioc *ioc, unsigned long bits_wanted)
                 { 
                         DBG_RES("    %p %lx %lx\n", res_ptr, mask, *res_ptr);
                         WARN_ON(mask == 0);
-                        if(((*res_ptr) & mask) == 0) {
+                        tpide = ptr_to_pide(ioc, res_ptr, bitshiftcnt);
+                        ret = iommu_is_span_boundary(tpide, bits_wanted,
+                                                     shift,
+                                                     boundary_size);
+                        if ((((*res_ptr) & mask) == 0) && !ret) {
                                 *res_ptr |= mask;     /* mark resources busy! */
-                                pide = ((unsigned long)res_ptr - (unsigned long)ioc->res_map);
-                                pide <<= 3;     /* convert to bit address */
-                                pide += bitshiftcnt;
+                                pide = tpide;
                                 break;
                         }
                         mask >>= o;
@@ -404,7 +430,7 @@ sba_search_bitmap(struct ioc *ioc, unsigned long bits_wanted)
  * resource bit map.
  */
 static int
-sba_alloc_range(struct ioc *ioc, size_t size)
+sba_alloc_range(struct ioc *ioc, struct device *dev, size_t size)
 {
         unsigned int pages_needed = size >> IOVP_SHIFT;
 #ifdef SBA_COLLECT_STATS
@@ -412,9 +438,9 @@ sba_alloc_range(struct ioc *ioc, size_t size)
 #endif
         unsigned long pide;
 
-        pide = sba_search_bitmap(ioc, pages_needed);
+        pide = sba_search_bitmap(ioc, dev, pages_needed);
         if (pide >= (ioc->res_size << 3)) {
-                pide = sba_search_bitmap(ioc, pages_needed);
+                pide = sba_search_bitmap(ioc, dev, pages_needed);
                 if (pide >= (ioc->res_size << 3))
                         panic("%s: I/O MMU @ %p is out of mapping resources\n",
                               __FILE__, ioc->ioc_hpa);
@@ -710,7 +736,7 @@ sba_map_single(struct device *dev, void *addr, size_t size,
         ioc->msingle_calls++;
         ioc->msingle_pages += size >> IOVP_SHIFT;
 #endif
-        pide = sba_alloc_range(ioc, size);
+        pide = sba_alloc_range(ioc, dev, size);
         iovp = (dma_addr_t) pide << IOVP_SHIFT;
 
         DBG_RUN("%s() 0x%p -> 0x%lx\n",
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index ef5a6a245f5f..6a9403d79e0c 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -145,13 +145,15 @@ void pci_bus_add_devices(struct pci_bus *bus)
                         child_bus = dev->subordinate;
                         child_bus->dev.parent = child_bus->bridge;
                         retval = device_register(&child_bus->dev);
-                        if (!retval)
+                        if (retval)
+                                dev_err(&dev->dev, "Error registering pci_bus,"
+                                        " continuing...\n");
+                        else
                                 retval = device_create_file(&child_bus->dev,
                                                         &dev_attr_cpuaffinity);
                         if (retval)
-                                dev_err(&dev->dev, "Error registering pci_bus"
-                                        " device bridge symlink,"
-                                        " continuing...\n");
+                                dev_err(&dev->dev, "Error creating cpuaffinity"
+                                        " file, continuing...\n");
                 }
         }
 }
diff --git a/drivers/pci/hotplug-pci.c b/drivers/pci/hotplug-pci.c
index a590ef682153..4d4a64478404 100644
--- a/drivers/pci/hotplug-pci.c
+++ b/drivers/pci/hotplug-pci.c
@@ -4,7 +4,7 @@
 #include "pci.h"
 
 
-unsigned int pci_do_scan_bus(struct pci_bus *bus)
+unsigned int __devinit pci_do_scan_bus(struct pci_bus *bus)
 {
         unsigned int max;
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index cf22f9e01e00..5e50008d1181 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -1085,7 +1085,7 @@ static int acpiphp_bus_trim(acpi_handle handle)
  * This function should be called per *physical slot*,
  * not per each slot object in ACPI namespace.
  */
-static int enable_device(struct acpiphp_slot *slot)
+static int __ref enable_device(struct acpiphp_slot *slot)
 {
         struct pci_dev *dev;
         struct pci_bus *bus = slot->bridge->pci_bus;
diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
index 5e9be44817cb..b3515fc4cd38 100644
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -250,7 +250,7 @@ int cpci_led_off(struct slot* slot)
  * Device configuration functions
  */
 
-int cpci_configure_slot(struct slot* slot)
+int __ref cpci_configure_slot(struct slot *slot)
 {
         struct pci_bus *parent;
         int fn;
diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
index 600ed7b67ae7..bbccde9f228f 100644
--- a/drivers/pci/hotplug/ibmphp_ebda.c
+++ b/drivers/pci/hotplug/ibmphp_ebda.c
@@ -963,6 +963,7 @@ static int __init ebda_rsrc_controller (void)
 
                         bus_info_ptr1 = ibmphp_find_same_bus_num (hpc_ptr->slots[index].slot_bus_num);
                         if (!bus_info_ptr1) {
+                                kfree(tmp_slot);
                                 rc = -ENODEV;
                                 goto error;
                         }
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 6eba9b2cfb90..698975a6a21c 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -711,7 +711,8 @@ static int hpc_power_off_slot(struct slot * slot)
         retval = pcie_write_cmd(slot, slot_cmd, cmd_mask);
         if (retval) {
                 err("%s: Write command failed!\n", __FUNCTION__);
-                return -1;
+                retval = -1;
+                goto out;
         }
         dbg("%s: SLOTCTRL %x write cmd %x\n",
             __FUNCTION__, ctrl->cap_base + SLOTCTRL, slot_cmd);
@@ -722,7 +723,7 @@ static int hpc_power_off_slot(struct slot * slot)
          * removed from the slot/adapter.
          */
         msleep(1000);
-
+ out:
         if (changed)
                 pcie_unmask_bad_dllp(ctrl);
 
diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index dd50713966d1..9372a840b63d 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -167,7 +167,7 @@ static void program_fw_provided_values(struct pci_dev *dev)
         }
 }
 
-static int pciehp_add_bridge(struct pci_dev *dev)
+static int __ref pciehp_add_bridge(struct pci_dev *dev)
 {
         struct pci_bus *parent = dev->bus;
         int pass, busnr, start = parent->secondary;
diff --git a/drivers/pci/hotplug/shpchp_pci.c b/drivers/pci/hotplug/shpchp_pci.c
index 0a6b25ef194c..a69a21520895 100644
--- a/drivers/pci/hotplug/shpchp_pci.c
+++ b/drivers/pci/hotplug/shpchp_pci.c
@@ -96,7 +96,7 @@ static void program_fw_provided_values(struct pci_dev *dev)
         }
 }
 
-int shpchp_configure_device(struct slot *p_slot)
+int __ref shpchp_configure_device(struct slot *p_slot)
 {
         struct pci_dev *dev;
         struct pci_bus *parent = p_slot->ctrl->pci_dev->subordinate;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 4d23b9fb551b..2db2e4bb0d1e 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -286,7 +286,7 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
         }
 }
 
-void pci_read_bridge_bases(struct pci_bus *child)
+void __devinit pci_read_bridge_bases(struct pci_bus *child)
 {
         struct pci_dev *dev = child->self;
         u8 io_base_lo, io_limit_lo;
@@ -472,7 +472,7 @@ static void pci_fixup_parent_subordinate_busnr(struct pci_bus *child, int max)
  * them, we proceed to assigning numbers to the remaining buses in
  * order to avoid overlaps between old and new bus numbers.
  */
-int pci_scan_bridge(struct pci_bus *bus, struct pci_dev * dev, int max, int pass)
+int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max, int pass)
 {
         struct pci_bus *child;
         int is_cardbus = (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS);
@@ -1008,7 +1008,7 @@ int pci_scan_slot(struct pci_bus *bus, int devfn)
         return nr;
 }
 
-unsigned int pci_scan_child_bus(struct pci_bus *bus)
+unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus)
 {
         unsigned int devfn, pass, max = bus->secondary;
         struct pci_dev *dev;
@@ -1116,7 +1116,7 @@ err_out:
         return NULL;
 }
 
-struct pci_bus *pci_scan_bus_parented(struct device *parent,
+struct pci_bus * __devinit pci_scan_bus_parented(struct device *parent,
                 int bus, struct pci_ops *ops, void *sysdata)
 {
         struct pci_bus *b;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index bbad4a9f264f..e9a333d98552 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1652,9 +1652,8 @@ static void __devinit quirk_via_cx700_pci_parking_caching(struct pci_dev *dev)
                         pci_write_config_byte(dev, 0x75, 0x1);
                         pci_write_config_byte(dev, 0x77, 0x0);
 
-                        printk(KERN_INFO
-                                "PCI: VIA CX700 PCI parking/caching fixup on %s\n",
-                                pci_name(dev));
+                        dev_info(&dev->dev,
+                                "Disabling VIA CX700 PCI parking/caching\n");
                 }
         }
 }
@@ -1726,32 +1725,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT2
                         quirk_msi_ht_cap);
 
 
-/*
- *  Force enable MSI mapping capability on HT bridges
- */
-static void __devinit quirk_msi_ht_cap_enable(struct pci_dev *dev)
-{
-        int pos, ttl = 48;
-
-        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
-        while (pos && ttl--) {
-                u8 flags;
-
-                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS, &flags) == 0) {
-                        printk(KERN_INFO "PCI: Enabling HT MSI Mapping on %s\n",
-                               pci_name(dev));
-
-                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
-                                              flags | HT_MSI_FLAGS_ENABLE);
-                }
-                pos = pci_find_next_ht_capability(dev, pos,
-                                                  HT_CAPTYPE_MSI_MAPPING);
-        }
-}
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
-                         PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB,
-                         quirk_msi_ht_cap_enable);
-
 /* The nVidia CK804 chipset may have 2 HT MSI mappings.
  * MSI are supported if the MSI capability set in any of these mappings.
  */
@@ -1778,9 +1751,8 @@ static void __devinit quirk_nvidia_ck804_msi_ht_cap(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_CK804_PCIE,
                         quirk_nvidia_ck804_msi_ht_cap);
 
-/*
- *  Force enable MSI mapping capability on HT bridges  */
-static inline void ht_enable_msi_mapping(struct pci_dev *dev)
+/* Force enable MSI mapping capability on HT bridges */
+static void __devinit ht_enable_msi_mapping(struct pci_dev *dev)
 {
         int pos, ttl = 48;
 
@@ -1799,6 +1771,9 @@ static inline void ht_enable_msi_mapping(struct pci_dev *dev)
                                                   HT_CAPTYPE_MSI_MAPPING);
         }
 }
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
+                         PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB,
+                         ht_enable_msi_mapping);
 
 static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
 {
@@ -1830,7 +1805,7 @@ static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
 
                 if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
                                          &flags) == 0) {
-                        dev_info(&dev->dev, "Quirk disabling HT MSI mapping");
+                        dev_info(&dev->dev, "Disabling HT MSI mapping");
                         pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
                                               flags & ~HT_MSI_FLAGS_ENABLE);
                 }
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index a98b2470b9ea..bd5c0e031398 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -242,8 +242,7 @@ void pci_remove_rom(struct pci_dev *pdev)
 #endif  /*  0  */
 
 /**
- * pci_cleanup_rom - internal routine for freeing the ROM copy created
- * by pci_map_rom_copy called from remove.c
+ * pci_cleanup_rom - free the ROM copy created by pci_map_rom_copy
  * @pdev: pointer to pci device struct
  *
  * Free the copied ROM if we allocated one.
diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
index 4065139753b6..37993206ae5d 100644
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -17,7 +17,6 @@
 #include <linux/slab.h>
 #include <linux/pnp.h>
 #include <linux/io.h>
-#include <linux/dmi.h>
 #include <linux/kallsyms.h>
 #include "base.h"
 
@@ -109,42 +108,73 @@ static void quirk_sb16audio_resources(struct pnp_dev *dev)
                        "pnp: SB audio device quirk - increasing port range\n");
 }
 
-static void quirk_supermicro_h8dce_system(struct pnp_dev *dev)
+
+#include <linux/pci.h>
+
+static void quirk_system_pci_resources(struct pnp_dev *dev)
 {
-        int i;
-        static struct dmi_system_id supermicro_h8dce[] = {
-                {
-                        .ident = "Supermicro H8DCE",
-                        .matches = {
-                                DMI_MATCH(DMI_SYS_VENDOR, "Supermicro"),
-                                DMI_MATCH(DMI_PRODUCT_NAME, "H8DCE"),
-                        },
-                },
-                { }
-        };
-
-        if (!dmi_check_system(supermicro_h8dce))
-                return;
+        struct pci_dev *pdev = NULL;
+        resource_size_t pnp_start, pnp_end, pci_start, pci_end;
+        int i, j;
 
         /*
-         * On the Supermicro H8DCE, there's a system device with resources
-         * that overlap BAR 6 of the built-in SATA PCI adapter.  If the PNP
-         * system device claims them, the sata_nv driver won't be able to.
-         * More details at:
-         *     https://bugzilla.redhat.com/show_bug.cgi?id=280641
-         *     https://bugzilla.redhat.com/show_bug.cgi?id=313491
-         *     http://lkml.org/lkml/2008/1/9/449
-         *     http://thread.gmane.org/gmane.linux.acpi.devel/27312
+         * Some BIOSes have PNP motherboard devices with resources that
+         * partially overlap PCI BARs.  The PNP system driver claims these
+         * motherboard resources, which prevents the normal PCI driver from
+         * requesting them later.
+         *
+         * This patch disables the PNP resources that conflict with PCI BARs
+         * so they won't be claimed by the PNP system driver.
          */
-        for (i = 0; i < PNP_MAX_MEM; i++) {
-                if (pnp_mem_valid(dev, i) && pnp_mem_len(dev, i) &&
-                    (pnp_mem_start(dev, i) & 0xdfef0000) == 0xdfef0000) {
-                        dev_warn(&dev->dev, "disabling 0x%llx-0x%llx to prevent"
-                                " conflict with sata_nv PCI device\n",
-                                (unsigned long long) pnp_mem_start(dev, i),
-                                (unsigned long long) (pnp_mem_start(dev, i) +
-                                        pnp_mem_len(dev, i) - 1));
-                        pnp_mem_flags(dev, i) = 0;
+        for_each_pci_dev(pdev) {
+                for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+                        if (!(pci_resource_flags(pdev, i) & IORESOURCE_MEM) ||
+                            pci_resource_len(pdev, i) == 0)
+                                continue;
+
+                        pci_start = pci_resource_start(pdev, i);
+                        pci_end = pci_resource_end(pdev, i);
+                        for (j = 0; j < PNP_MAX_MEM; j++) {
+                                if (!pnp_mem_valid(dev, j) ||
+                                    pnp_mem_len(dev, j) == 0)
+                                        continue;
+
+                                pnp_start = pnp_mem_start(dev, j);
+                                pnp_end = pnp_mem_end(dev, j);
+
+                                /*
+                                 * If the PNP region doesn't overlap the PCI
+                                 * region at all, there's no problem.
+                                 */
+                                if (pnp_end < pci_start || pnp_start > pci_end)
+                                        continue;
+
+                                /*
+                                 * If the PNP region completely encloses (or is
+                                 * at least as large as) the PCI region, that's
+                                 * also OK.  For example, this happens when the
+                                 * PNP device describes a bridge with PCI
+                                 * behind it.
+                                 */
+                                if (pnp_start <= pci_start &&
+                                    pnp_end >= pci_end)
+                                        continue;
+
+                                /*
+                                 * Otherwise, the PNP region overlaps *part* of
+                                 * the PCI region, and that might prevent a PCI
+                                 * driver from requesting its resources.
+                                 */
+                                dev_warn(&dev->dev, "mem resource "
+                                        "(0x%llx-0x%llx) overlaps %s BAR %d "
+                                        "(0x%llx-0x%llx), disabling\n",
+                                        (unsigned long long) pnp_start,
+                                        (unsigned long long) pnp_end,
+                                        pci_name(pdev), i,
+                                        (unsigned long long) pci_start,
+                                        (unsigned long long) pci_end);
+                                pnp_mem_flags(dev, j) = 0;
+                        }
                 }
         }
 }
@@ -169,8 +199,8 @@ static struct pnp_fixup pnp_fixups[] = {
         {"CTL0043", quirk_sb16audio_resources},
         {"CTL0044", quirk_sb16audio_resources},
         {"CTL0045", quirk_sb16audio_resources},
-        {"PNP0c01", quirk_supermicro_h8dce_system},
-        {"PNP0c02", quirk_supermicro_h8dce_system},
+        {"PNP0c01", quirk_system_pci_resources},
+        {"PNP0c02", quirk_system_pci_resources},
         {""}
 };
 
diff --git a/drivers/rapidio/rio-driver.c b/drivers/rapidio/rio-driver.c
index 5480119ff9d3..3ce9f3defc12 100644
--- a/drivers/rapidio/rio-driver.c
+++ b/drivers/rapidio/rio-driver.c
@@ -78,8 +78,7 @@ void rio_dev_put(struct rio_dev *rdev)
 }
 
 /**
- *  rio_device_probe - Tell if a RIO device structure has a matching RIO
- *                     device id structure
+ *  rio_device_probe - Tell if a RIO device structure has a matching RIO device id structure
  *  @id: the RIO device id structure to match against
  *  @dev: the RIO device structure to match against
  *
@@ -137,7 +136,7 @@ static int rio_device_remove(struct device *dev)
  *  rio_register_driver - register a new RIO driver
  *  @rdrv: the RIO driver structure to register
  *
- *  Adds a &struct rio_driver to the list of registered drivers
+ *  Adds a &struct rio_driver to the list of registered drivers.
  *  Returns a negative value on error, otherwise 0. If no error
  *  occurred, the driver remains registered even if no device
  *  was claimed during registration.
@@ -167,8 +166,7 @@ void rio_unregister_driver(struct rio_driver *rdrv)
 }
 
 /**
- *  rio_match_bus - Tell if a RIO device structure has a matching RIO
- *                  driver device id structure
+ *  rio_match_bus - Tell if a RIO device structure has a matching RIO driver device id structure
  *  @dev: the standard device structure to match against
  *  @drv: the standard driver structure containing the ids to match against
  *
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 6402d699072b..82f5ad9c3af4 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -250,6 +250,15 @@ config RTC_DRV_TWL92330
           platforms.  The support is integrated with the rest of
           the Menelaus driver; it's not separate module.
 
+config RTC_DRV_S35390A
+        tristate "Seiko Instruments S-35390A"
+        help
+          If you say yes here you will get support for the Seiko
+          Instruments S-35390A.
+
+          This driver can also be built as a module. If so the module
+          will be called rtc-s35390a.
+
 endif # I2C
 
 comment "SPI RTC drivers"
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index ec703f34ab86..872f1218ff9f 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -45,6 +45,7 @@ obj-$(CONFIG_RTC_DRV_R9701)	+= rtc-r9701.o
 obj-$(CONFIG_RTC_DRV_RS5C313)   += rtc-rs5c313.o
 obj-$(CONFIG_RTC_DRV_RS5C348)   += rtc-rs5c348.o
 obj-$(CONFIG_RTC_DRV_RS5C372)   += rtc-rs5c372.o
+obj-$(CONFIG_RTC_DRV_S35390A)   += rtc-s35390a.o
 obj-$(CONFIG_RTC_DRV_S3C)       += rtc-s3c.o
 obj-$(CONFIG_RTC_DRV_SA1100)    += rtc-sa1100.o
 obj-$(CONFIG_RTC_DRV_SH)        += rtc-sh.o
diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
new file mode 100644
index 000000000000..e8abc90c32c5
--- /dev/null
+++ b/drivers/rtc/rtc-s35390a.c
@@ -0,0 +1,316 @@
+/*
+ * Seiko Instruments S-35390A RTC Driver
+ *
+ * Copyright (c) 2007 Byron Bradley
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/rtc.h>
+#include <linux/i2c.h>
+#include <linux/bitrev.h>
+#include <linux/bcd.h>
+#include <linux/slab.h>
+
+#define S35390A_CMD_STATUS1     0
+#define S35390A_CMD_STATUS2     1
+#define S35390A_CMD_TIME1       2
+
+#define S35390A_BYTE_YEAR       0
+#define S35390A_BYTE_MONTH      1
+#define S35390A_BYTE_DAY        2
+#define S35390A_BYTE_WDAY       3
+#define S35390A_BYTE_HOURS      4
+#define S35390A_BYTE_MINS       5
+#define S35390A_BYTE_SECS       6
+
+#define S35390A_FLAG_POC        0x01
+#define S35390A_FLAG_BLD        0x02
+#define S35390A_FLAG_24H        0x40
+#define S35390A_FLAG_RESET      0x80
+#define S35390A_FLAG_TEST       0x01
+
+struct s35390a {
+        struct i2c_client *client[8];
+        struct rtc_device *rtc;
+        int twentyfourhour;
+};
+
+static int s35390a_set_reg(struct s35390a *s35390a, int reg, char *buf, int len)
+{
+        struct i2c_client *client = s35390a->client[reg];
+        struct i2c_msg msg[] = {
+                { client->addr, 0, len, buf },
+        };
+
+        if ((i2c_transfer(client->adapter, msg, 1)) != 1)
+                return -EIO;
+
+        return 0;
+}
+
+static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len)
+{
+        struct i2c_client *client = s35390a->client[reg];
+        struct i2c_msg msg[] = {
+                { client->addr, I2C_M_RD, len, buf },
+        };
+
+        if ((i2c_transfer(client->adapter, msg, 1)) != 1)
+                return -EIO;
+
+        return 0;
+}
+
+static int s35390a_reset(struct s35390a *s35390a)
+{
+        char buf[1];
+
+        if (s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)) < 0)
+                return -EIO;
+
+        if (!(buf[0] & (S35390A_FLAG_POC | S35390A_FLAG_BLD)))
+                return 0;
+
+        buf[0] |= (S35390A_FLAG_RESET | S35390A_FLAG_24H);
+        buf[0] &= 0xf0;
+        return s35390a_set_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf));
+}
+
+static int s35390a_disable_test_mode(struct s35390a *s35390a)
+{
+        char buf[1];
+
+        if (s35390a_get_reg(s35390a, S35390A_CMD_STATUS2, buf, sizeof(buf)) < 0)
+                return -EIO;
+
+        if (!(buf[0] & S35390A_FLAG_TEST))
+                return 0;
+
+        buf[0] &= ~S35390A_FLAG_TEST;
+        return s35390a_set_reg(s35390a, S35390A_CMD_STATUS2, buf, sizeof(buf));
+}
+
+static char s35390a_hr2reg(struct s35390a *s35390a, int hour)
+{
+        if (s35390a->twentyfourhour)
+                return BIN2BCD(hour);
+
+        if (hour < 12)
+                return BIN2BCD(hour);
+
+        return 0x40 | BIN2BCD(hour - 12);
+}
+
+static int s35390a_reg2hr(struct s35390a *s35390a, char reg)
+{
+        unsigned hour;
+
+        if (s35390a->twentyfourhour)
+                return BCD2BIN(reg & 0x3f);
+
+        hour = BCD2BIN(reg & 0x3f);
+        if (reg & 0x40)
+                hour += 12;
+
+        return hour;
+}
+
+static int s35390a_set_datetime(struct i2c_client *client, struct rtc_time *tm)
+{
+        struct s35390a  *s35390a = i2c_get_clientdata(client);
+        int i, err;
+        char buf[7];
+
+        dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d mday=%d, "
+                "mon=%d, year=%d, wday=%d\n", __func__, tm->tm_sec,
+                tm->tm_min, tm->tm_hour, tm->tm_mday, tm->tm_mon, tm->tm_year,
+                tm->tm_wday);
+
+        buf[S35390A_BYTE_YEAR] = BIN2BCD(tm->tm_year - 100);
+        buf[S35390A_BYTE_MONTH] = BIN2BCD(tm->tm_mon + 1);
+        buf[S35390A_BYTE_DAY] = BIN2BCD(tm->tm_mday);
+        buf[S35390A_BYTE_WDAY] = BIN2BCD(tm->tm_wday);
+        buf[S35390A_BYTE_HOURS] = s35390a_hr2reg(s35390a, tm->tm_hour);
+        buf[S35390A_BYTE_MINS] = BIN2BCD(tm->tm_min);
+        buf[S35390A_BYTE_SECS] = BIN2BCD(tm->tm_sec);
+
+        /* This chip expects the bits of each byte to be in reverse order */
+        for (i = 0; i < 7; ++i)
+                buf[i] = bitrev8(buf[i]);
+
+        err = s35390a_set_reg(s35390a, S35390A_CMD_TIME1, buf, sizeof(buf));
+
+        return err;
+}
+
+static int s35390a_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+{
+        struct s35390a *s35390a = i2c_get_clientdata(client);
+        char buf[7];
+        int i, err;
+
+        err = s35390a_get_reg(s35390a, S35390A_CMD_TIME1, buf, sizeof(buf));
+        if (err < 0)
+                return err;
+
+        /* This chip returns the bits of each byte in reverse order */
+        for (i = 0; i < 7; ++i)
+                buf[i] = bitrev8(buf[i]);
+
+        tm->tm_sec = BCD2BIN(buf[S35390A_BYTE_SECS]);
+        tm->tm_min = BCD2BIN(buf[S35390A_BYTE_MINS]);
+        tm->tm_hour = s35390a_reg2hr(s35390a, buf[S35390A_BYTE_HOURS]);
+        tm->tm_wday = BCD2BIN(buf[S35390A_BYTE_WDAY]);
+        tm->tm_mday = BCD2BIN(buf[S35390A_BYTE_DAY]);
+        tm->tm_mon = BCD2BIN(buf[S35390A_BYTE_MONTH]) - 1;
+        tm->tm_year = BCD2BIN(buf[S35390A_BYTE_YEAR]) + 100;
+
+        dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d, mday=%d, "
+                "mon=%d, year=%d, wday=%d\n", __func__, tm->tm_sec,
+                tm->tm_min, tm->tm_hour, tm->tm_mday, tm->tm_mon, tm->tm_year,
+                tm->tm_wday);
+
+        return rtc_valid_tm(tm);
+}
+
+static int s35390a_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        return s35390a_get_datetime(to_i2c_client(dev), tm);
+}
+
+static int s35390a_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        return s35390a_set_datetime(to_i2c_client(dev), tm);
+}
+
+static const struct rtc_class_ops s35390a_rtc_ops = {
+        .read_time      = s35390a_rtc_read_time,
+        .set_time       = s35390a_rtc_set_time,
+};
+
+static struct i2c_driver s35390a_driver;
+
+static int s35390a_probe(struct i2c_client *client)
+{
+        int err;
+        unsigned int i;
+        struct s35390a *s35390a;
+        struct rtc_time tm;
+        char buf[1];
+
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+                err = -ENODEV;
+                goto exit;
+        }
+
+        s35390a = kzalloc(sizeof(struct s35390a), GFP_KERNEL);
+        if (!s35390a) {
+                err = -ENOMEM;
+                goto exit;
+        }
+
+        s35390a->client[0] = client;
+        i2c_set_clientdata(client, s35390a);
+
+        /* This chip uses multiple addresses, use dummy devices for them */
+        for (i = 1; i < 8; ++i) {
+                s35390a->client[i] = i2c_new_dummy(client->adapter,
+                                        client->addr + i, "rtc-s35390a");
+                if (!s35390a->client[i]) {
+                        dev_err(&client->dev, "Address %02x unavailable\n",
+                                                client->addr + i);
+                        err = -EBUSY;
+                        goto exit_dummy;
+                }
+        }
+
+        err = s35390a_reset(s35390a);
+        if (err < 0) {
+                dev_err(&client->dev, "error resetting chip\n");
+                goto exit_dummy;
+        }
+
+        err = s35390a_disable_test_mode(s35390a);
+        if (err < 0) {
+                dev_err(&client->dev, "error disabling test mode\n");
+                goto exit_dummy;
+        }
+
+        err = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf));
+        if (err < 0) {
+                dev_err(&client->dev, "error checking 12/24 hour mode\n");
+                goto exit_dummy;
+        }
+        if (buf[0] & S35390A_FLAG_24H)
+                s35390a->twentyfourhour = 1;
+        else
+                s35390a->twentyfourhour = 0;
+
+        if (s35390a_get_datetime(client, &tm) < 0)
+                dev_warn(&client->dev, "clock needs to be set\n");
+
+        s35390a->rtc = rtc_device_register(s35390a_driver.driver.name,
+                                &client->dev, &s35390a_rtc_ops, THIS_MODULE);
+
+        if (IS_ERR(s35390a->rtc)) {
+                err = PTR_ERR(s35390a->rtc);
+                goto exit_dummy;
+        }
+        return 0;
+
+exit_dummy:
+        for (i = 1; i < 8; ++i)
+                if (s35390a->client[i])
+                        i2c_unregister_device(s35390a->client[i]);
+        kfree(s35390a);
+        i2c_set_clientdata(client, NULL);
+
+exit:
+        return err;
+}
+
+static int s35390a_remove(struct i2c_client *client)
+{
+        unsigned int i;
+
+        struct s35390a *s35390a = i2c_get_clientdata(client);
+        for (i = 1; i < 8; ++i)
+                if (s35390a->client[i])
+                        i2c_unregister_device(s35390a->client[i]);
+
+        rtc_device_unregister(s35390a->rtc);
+        kfree(s35390a);
+        i2c_set_clientdata(client, NULL);
+
+        return 0;
+}
+
+static struct i2c_driver s35390a_driver = {
+        .driver         = {
+                .name   = "rtc-s35390a",
+        },
+        .probe          = s35390a_probe,
+        .remove         = s35390a_remove,
+};
+
+static int __init s35390a_rtc_init(void)
+{
+        return i2c_add_driver(&s35390a_driver);
+}
+
+static void __exit s35390a_rtc_exit(void)
+{
+        i2c_del_driver(&s35390a_driver);
+}
+
+MODULE_AUTHOR("Byron Bradley <byron.bbradley@gmail.com>");
+MODULE_DESCRIPTION("S35390A RTC driver");
+MODULE_LICENSE("GPL");
+
+module_init(s35390a_rtc_init);
+module_exit(s35390a_rtc_exit);
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index f69714a0e9e7..b19db20a0bef 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -2310,10 +2310,8 @@ static int
 dasd_3990_erp_error_match(struct dasd_ccw_req *cqr1, struct dasd_ccw_req *cqr2)
 {
 
-        /* check failed CCW */
-        if (cqr1->irb.scsw.cpa != cqr2->irb.scsw.cpa) {
-                //      return 0;       /* CCW doesn't match */
-        }
+        if (cqr1->startdev != cqr2->startdev)
+                return 0;
 
         if (cqr1->irb.esw.esw0.erw.cons != cqr2->irb.esw.esw0.erw.cons)
                 return 0;
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 28a86f070048..556063e8f7a9 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -62,8 +62,10 @@ dasd_devices_show(struct seq_file *m, void *v)
                 return 0;
         if (device->block)
                 block = device->block;
-        else
+        else {
+                dasd_put_device(device);
                 return 0;
+        }
         /* Print device number. */
         seq_printf(m, "%s", device->cdev->dev.bus_id);
         /* Print discipline string. */
diff --git a/drivers/s390/char/defkeymap.c b/drivers/s390/char/defkeymap.c
index 389346cda6c8..07c7f31081bc 100644
--- a/drivers/s390/char/defkeymap.c
+++ b/drivers/s390/char/defkeymap.c
@@ -151,8 +151,8 @@ char *func_table[MAX_NR_FUNC] = {
 };
 
 struct kbdiacruc accent_table[MAX_DIACR] = {
-        {'^', 'c', '\003'},     {'^', 'd', '\004'},
-        {'^', 'z', '\032'},     {'^', '\012', '\000'},
+        {'^', 'c', 0003},       {'^', 'd', 0004},
+        {'^', 'z', 0032},       {'^', 0012, 0000},
 };
 
 unsigned int accent_table_size = 4;
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 92f527201792..f7b258dfd52c 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -367,7 +367,7 @@ sclp_vt220_timeout(unsigned long data)
         sclp_vt220_emit_current();
 }
 
-#define BUFFER_MAX_DELAY        HZ/2
+#define BUFFER_MAX_DELAY        HZ/20
 
 /* 
  * Internal implementation of the write function. Write COUNT bytes of data
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index d0c6fd3b1c19..7b0b81901297 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -490,10 +490,12 @@ static int ap_device_probe(struct device *dev)
         int rc;
 
         ap_dev->drv = ap_drv;
-        spin_lock_bh(&ap_device_lock);
-        list_add(&ap_dev->list, &ap_device_list);
-        spin_unlock_bh(&ap_device_lock);
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
+        if (!rc) {
+                spin_lock_bh(&ap_device_lock);
+                list_add(&ap_dev->list, &ap_device_list);
+                spin_unlock_bh(&ap_device_lock);
+        }
         return rc;
 }
 
@@ -532,11 +534,11 @@ static int ap_device_remove(struct device *dev)
 
         ap_flush_queue(ap_dev);
         del_timer_sync(&ap_dev->timeout);
-        if (ap_drv->remove)
-                ap_drv->remove(ap_dev);
         spin_lock_bh(&ap_device_lock);
         list_del_init(&ap_dev->list);
         spin_unlock_bh(&ap_device_lock);
+        if (ap_drv->remove)
+                ap_drv->remove(ap_dev);
         spin_lock_bh(&ap_dev->lock);
         atomic_sub(ap_dev->queue_count, &ap_poll_requests);
         spin_unlock_bh(&ap_dev->lock);
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index c3076217871e..d8a5c229c5a7 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -1851,8 +1851,7 @@ claw_hw_tx(struct sk_buff *skb, struct net_device *dev, long linkid)
                 }
         }
         /*      See how many write buffers are required to hold this data */
-        numBuffers= ( skb->len + privptr->p_env->write_size - 1) /
-                        ( privptr->p_env->write_size);
+        numBuffers = DIV_ROUND_UP(skb->len, privptr->p_env->write_size);
 
         /*      If that number of buffers isn't available, give up for now */
         if (privptr->write_free_count < numBuffers ||
@@ -2114,8 +2113,7 @@ init_ccw_bk(struct net_device *dev)
         */
         ccw_blocks_perpage= PAGE_SIZE /  CCWBK_SIZE;
         ccw_pages_required=
-                (ccw_blocks_required+ccw_blocks_perpage -1) /
-                         ccw_blocks_perpage;
+                DIV_ROUND_UP(ccw_blocks_required, ccw_blocks_perpage);
 
 #ifdef DEBUGMSG
         printk(KERN_INFO "%s: %s() > ccw_blocks_perpage=%d\n",
@@ -2131,30 +2129,29 @@ init_ccw_bk(struct net_device *dev)
          * provide good performance. With packing buffers support 32k
          * buffers are used.
          */
-        if (privptr->p_env->read_size < PAGE_SIZE) {
-            claw_reads_perpage= PAGE_SIZE / privptr->p_env->read_size;
-            claw_read_pages= (privptr->p_env->read_buffers +
-                claw_reads_perpage -1) / claw_reads_perpage;
+        if (privptr->p_env->read_size < PAGE_SIZE) {
+                claw_reads_perpage = PAGE_SIZE / privptr->p_env->read_size;
+                claw_read_pages = DIV_ROUND_UP(privptr->p_env->read_buffers,
+                                                claw_reads_perpage);
          }
          else {       /* > or equal  */
-            privptr->p_buff_pages_perread=
-                (privptr->p_env->read_size + PAGE_SIZE - 1) / PAGE_SIZE;
-            claw_read_pages=
-                privptr->p_env->read_buffers * privptr->p_buff_pages_perread;
+                privptr->p_buff_pages_perread =
+                        DIV_ROUND_UP(privptr->p_env->read_size, PAGE_SIZE);
+                claw_read_pages = privptr->p_env->read_buffers *
+                                        privptr->p_buff_pages_perread;
          }
         if (privptr->p_env->write_size < PAGE_SIZE) {
-            claw_writes_perpage=
-                PAGE_SIZE / privptr->p_env->write_size;
-            claw_write_pages=
-                (privptr->p_env->write_buffers + claw_writes_perpage -1) /
-                        claw_writes_perpage;
+                claw_writes_perpage =
+                        PAGE_SIZE / privptr->p_env->write_size;
+                claw_write_pages = DIV_ROUND_UP(privptr->p_env->write_buffers,
+                                                claw_writes_perpage);
 
         }
         else {      /* >  or equal  */
-            privptr->p_buff_pages_perwrite=
-                 (privptr->p_env->read_size + PAGE_SIZE - 1) / PAGE_SIZE;
-            claw_write_pages=
-                privptr->p_env->write_buffers * privptr->p_buff_pages_perwrite;
+                privptr->p_buff_pages_perwrite =
+                        DIV_ROUND_UP(privptr->p_env->read_size, PAGE_SIZE);
+                claw_write_pages = privptr->p_env->write_buffers *
+                                        privptr->p_buff_pages_perwrite;
         }
 #ifdef DEBUGMSG
         if (privptr->p_env->read_size < PAGE_SIZE) {
diff --git a/drivers/scsi/aic94xx/aic94xx.h b/drivers/scsi/aic94xx/aic94xx.h
index 32f513b1b78a..eb8efdcefe48 100644
--- a/drivers/scsi/aic94xx/aic94xx.h
+++ b/drivers/scsi/aic94xx/aic94xx.h
@@ -102,6 +102,7 @@ int  asd_abort_task_set(struct domain_device *, u8 *lun);
 int  asd_clear_aca(struct domain_device *, u8 *lun);
 int  asd_clear_task_set(struct domain_device *, u8 *lun);
 int  asd_lu_reset(struct domain_device *, u8 *lun);
+int  asd_I_T_nexus_reset(struct domain_device *dev);
 int  asd_query_task(struct sas_task *);
 
 /* ---------- Adapter and Port management ---------- */
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.h b/drivers/scsi/aic94xx/aic94xx_hwi.h
index 150f6706d23f..abc757559c1a 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.h
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.h
@@ -140,7 +140,7 @@ struct asd_ascb {
 
         /* internally generated command */
         struct timer_list timer;
-        struct completion completion;
+        struct completion *completion;
         u8        tag_valid:1;
         __be16    tag;            /* error recovery only */
 
@@ -294,7 +294,6 @@ static inline void asd_init_ascb(struct asd_ha_struct *asd_ha,
         ascb->timer.function = NULL;
         init_timer(&ascb->timer);
         ascb->tc_index = -1;
-        init_completion(&ascb->completion);
 }
 
 /* Must be called with the tc_index_lock held!
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 5d761eb67442..88d1e731b65e 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -1003,7 +1003,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
         .lldd_abort_task_set    = asd_abort_task_set,
         .lldd_clear_aca         = asd_clear_aca,
         .lldd_clear_task_set    = asd_clear_task_set,
-        .lldd_I_T_nexus_reset   = NULL,
+        .lldd_I_T_nexus_reset   = asd_I_T_nexus_reset,
         .lldd_lu_reset          = asd_lu_reset,
         .lldd_query_task        = asd_query_task,
 
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index 965d4bb999d9..008df9ab92a5 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -343,11 +343,13 @@ Again:
         task->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
         task->task_state_flags |= SAS_TASK_STATE_DONE;
         if (unlikely((task->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+                struct completion *completion = ascb->completion;
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
                 ASD_DPRINTK("task 0x%p done with opcode 0x%x resp 0x%x "
                             "stat 0x%x but aborted by upper layer!\n",
                             task, opcode, ts->resp, ts->stat);
-                complete(&ascb->completion);
+                if (completion)
+                        complete(completion);
         } else {
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
                 task->lldd_task = NULL;
diff --git a/drivers/scsi/aic94xx/aic94xx_tmf.c b/drivers/scsi/aic94xx/aic94xx_tmf.c
index 144f5ad20453..b9ac8f703a1d 100644
--- a/drivers/scsi/aic94xx/aic94xx_tmf.c
+++ b/drivers/scsi/aic94xx/aic94xx_tmf.c
@@ -53,50 +53,64 @@ static int asd_enqueue_internal(struct asd_ascb *ascb,
         return res;
 }
 
-static inline void asd_timedout_common(unsigned long data)
-{
-        struct asd_ascb *ascb = (void *) data;
-        struct asd_seq_data *seq = &ascb->ha->seq;
-        unsigned long flags;
+/* ---------- CLEAR NEXUS ---------- */
 
-        spin_lock_irqsave(&seq->pend_q_lock, flags);
-        seq->pending--;
-        list_del_init(&ascb->list);
-        spin_unlock_irqrestore(&seq->pend_q_lock, flags);
-}
+struct tasklet_completion_status {
+        int     dl_opcode;
+        int     tmf_state;
+        u8      tag_valid:1;
+        __be16  tag;
+};
+
+#define DECLARE_TCS(tcs) \
+        struct tasklet_completion_status tcs = { \
+                .dl_opcode = 0, \
+                .tmf_state = 0, \
+                .tag_valid = 0, \
+                .tag = 0, \
+        }
 
-/* ---------- CLEAR NEXUS ---------- */
 
 static void asd_clear_nexus_tasklet_complete(struct asd_ascb *ascb,
                                              struct done_list_struct *dl)
 {
+        struct tasklet_completion_status *tcs = ascb->uldd_task;
         ASD_DPRINTK("%s: here\n", __FUNCTION__);
         if (!del_timer(&ascb->timer)) {
                 ASD_DPRINTK("%s: couldn't delete timer\n", __FUNCTION__);
                 return;
         }
         ASD_DPRINTK("%s: opcode: 0x%x\n", __FUNCTION__, dl->opcode);
-        ascb->uldd_task = (void *) (unsigned long) dl->opcode;
-        complete(&ascb->completion);
+        tcs->dl_opcode = dl->opcode;
+        complete(ascb->completion);
+        asd_ascb_free(ascb);
 }
 
 static void asd_clear_nexus_timedout(unsigned long data)
 {
-        struct asd_ascb *ascb = (void *) data;
+        struct asd_ascb *ascb = (void *)data;
+        struct tasklet_completion_status *tcs = ascb->uldd_task;
 
         ASD_DPRINTK("%s: here\n", __FUNCTION__);
-        asd_timedout_common(data);
-        ascb->uldd_task = (void *) TMF_RESP_FUNC_FAILED;
-        complete(&ascb->completion);
+        tcs->dl_opcode = TMF_RESP_FUNC_FAILED;
+        complete(ascb->completion);
 }
 
 #define CLEAR_NEXUS_PRE         \
+        struct asd_ascb *ascb; \
+        struct scb *scb; \
+        int res; \
+        DECLARE_COMPLETION_ONSTACK(completion); \
+        DECLARE_TCS(tcs); \
+                \
         ASD_DPRINTK("%s: PRE\n", __FUNCTION__); \
         res = 1;                \
         ascb = asd_ascb_alloc_list(asd_ha, &res, GFP_KERNEL); \
         if (!ascb)              \
                 return -ENOMEM; \
                                 \
+        ascb->completion = &completion; \
+        ascb->uldd_task = &tcs; \
         scb = ascb->scb;        \
         scb->header.opcode = CLEAR_NEXUS
 
@@ -107,10 +121,11 @@ static void asd_clear_nexus_timedout(unsigned long data)
         if (res)                \
                 goto out_err;   \
         ASD_DPRINTK("%s: clear nexus posted, waiting...\n", __FUNCTION__); \
-        wait_for_completion(&ascb->completion); \
-        res = (int) (unsigned long) ascb->uldd_task; \
+        wait_for_completion(&completion); \
+        res = tcs.dl_opcode; \
         if (res == TC_NO_ERROR) \
                 res = TMF_RESP_FUNC_COMPLETE;   \
+        return res; \
 out_err:                        \
         asd_ascb_free(ascb);    \
         return res
@@ -118,9 +133,6 @@ out_err:                        \
 int asd_clear_nexus_ha(struct sas_ha_struct *sas_ha)
 {
         struct asd_ha_struct *asd_ha = sas_ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_ADAPTER;
@@ -130,9 +142,6 @@ int asd_clear_nexus_ha(struct sas_ha_struct *sas_ha)
 int asd_clear_nexus_port(struct asd_sas_port *port)
 {
         struct asd_ha_struct *asd_ha = port->ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_PORT;
@@ -140,29 +149,73 @@ int asd_clear_nexus_port(struct asd_sas_port *port)
         CLEAR_NEXUS_POST;
 }
 
-#if 0
-static int asd_clear_nexus_I_T(struct domain_device *dev)
+enum clear_nexus_phase {
+        NEXUS_PHASE_PRE,
+        NEXUS_PHASE_POST,
+        NEXUS_PHASE_RESUME,
+};
+
+static int asd_clear_nexus_I_T(struct domain_device *dev,
+                               enum clear_nexus_phase phase)
 {
         struct asd_ha_struct *asd_ha = dev->port->ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_I_T;
-        scb->clear_nexus.flags = SEND_Q | EXEC_Q | NOTINQ;
+        switch (phase) {
+        case NEXUS_PHASE_PRE:
+                scb->clear_nexus.flags = EXEC_Q | SUSPEND_TX;
+                break;
+        case NEXUS_PHASE_POST:
+                scb->clear_nexus.flags = SEND_Q | NOTINQ;
+                break;
+        case NEXUS_PHASE_RESUME:
+                scb->clear_nexus.flags = RESUME_TX;
+        }
         scb->clear_nexus.conn_handle = cpu_to_le16((u16)(unsigned long)
                                                    dev->lldd_dev);
         CLEAR_NEXUS_POST;
 }
-#endif
+
+int asd_I_T_nexus_reset(struct domain_device *dev)
+{
+        int res, tmp_res, i;
+        struct sas_phy *phy = sas_find_local_phy(dev);
+        /* Standard mandates link reset for ATA  (type 0) and
+         * hard reset for SSP (type 1) */
+        int reset_type = (dev->dev_type == SATA_DEV ||
+                          (dev->tproto & SAS_PROTOCOL_STP)) ? 0 : 1;
+
+        asd_clear_nexus_I_T(dev, NEXUS_PHASE_PRE);
+        /* send a hard reset */
+        ASD_DPRINTK("sending %s reset to %s\n",
+                    reset_type ? "hard" : "soft", phy->dev.bus_id);
+        res = sas_phy_reset(phy, reset_type);
+        if (res == TMF_RESP_FUNC_COMPLETE) {
+                /* wait for the maximum settle time */
+                msleep(500);
+                /* clear all outstanding commands (keep nexus suspended) */
+                asd_clear_nexus_I_T(dev, NEXUS_PHASE_POST);
+        }
+        for (i = 0 ; i < 3; i++) {
+                tmp_res = asd_clear_nexus_I_T(dev, NEXUS_PHASE_RESUME);
+                if (tmp_res == TC_RESUME)
+                        return res;
+                msleep(500);
+        }
+
+        /* This is a bit of a problem:  the sequencer is still suspended
+         * and is refusing to resume.  Hope it will resume on a bigger hammer
+         * or the disk is lost */
+        dev_printk(KERN_ERR, &phy->dev,
+                   "Failed to resume nexus after reset 0x%x\n", tmp_res);
+
+        return TMF_RESP_FUNC_FAILED;
+}
 
 static int asd_clear_nexus_I_T_L(struct domain_device *dev, u8 *lun)
 {
         struct asd_ha_struct *asd_ha = dev->port->ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_I_T_L;
@@ -177,9 +230,6 @@ static int asd_clear_nexus_tag(struct sas_task *task)
 {
         struct asd_ha_struct *asd_ha = task->dev->port->ha->lldd_ha;
         struct asd_ascb *tascb = task->lldd_task;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_TAG;
@@ -195,9 +245,6 @@ static int asd_clear_nexus_index(struct sas_task *task)
 {
         struct asd_ha_struct *asd_ha = task->dev->port->ha->lldd_ha;
         struct asd_ascb *tascb = task->lldd_task;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_TRANS_CX;
@@ -213,11 +260,11 @@ static int asd_clear_nexus_index(struct sas_task *task)
 static void asd_tmf_timedout(unsigned long data)
 {
         struct asd_ascb *ascb = (void *) data;
+        struct tasklet_completion_status *tcs = ascb->uldd_task;
 
         ASD_DPRINTK("tmf timed out\n");
-        asd_timedout_common(data);
-        ascb->uldd_task = (void *) TMF_RESP_FUNC_FAILED;
-        complete(&ascb->completion);
+        tcs->tmf_state = TMF_RESP_FUNC_FAILED;
+        complete(ascb->completion);
 }
 
 static int asd_get_tmf_resp_tasklet(struct asd_ascb *ascb,
@@ -269,18 +316,24 @@ static int asd_get_tmf_resp_tasklet(struct asd_ascb *ascb,
 static void asd_tmf_tasklet_complete(struct asd_ascb *ascb,
                                      struct done_list_struct *dl)
 {
+        struct tasklet_completion_status *tcs;
+
         if (!del_timer(&ascb->timer))
                 return;
 
+        tcs = ascb->uldd_task;
         ASD_DPRINTK("tmf tasklet complete\n");
 
-        if (dl->opcode == TC_SSP_RESP)
-                ascb->uldd_task = (void *) (unsigned long)
-                        asd_get_tmf_resp_tasklet(ascb, dl);
-        else
-                ascb->uldd_task = (void *) 0xFF00 + (unsigned long) dl->opcode;
+        tcs->dl_opcode = dl->opcode;
+
+        if (dl->opcode == TC_SSP_RESP) {
+                tcs->tmf_state = asd_get_tmf_resp_tasklet(ascb, dl);
+                tcs->tag_valid = ascb->tag_valid;
+                tcs->tag = ascb->tag;
+        }
 
-        complete(&ascb->completion);
+        complete(ascb->completion);
+        asd_ascb_free(ascb);
 }
 
 static inline int asd_clear_nexus(struct sas_task *task)
@@ -288,15 +341,19 @@ static inline int asd_clear_nexus(struct sas_task *task)
         int res = TMF_RESP_FUNC_FAILED;
         int leftover;
         struct asd_ascb *tascb = task->lldd_task;
+        DECLARE_COMPLETION_ONSTACK(completion);
         unsigned long flags;
 
+        tascb->completion = &completion;
+
         ASD_DPRINTK("task not done, clearing nexus\n");
         if (tascb->tag_valid)
                 res = asd_clear_nexus_tag(task);
         else
                 res = asd_clear_nexus_index(task);
-        leftover = wait_for_completion_timeout(&tascb->completion,
+        leftover = wait_for_completion_timeout(&completion,
                                                AIC94XX_SCB_TIMEOUT);
+        tascb->completion = NULL;
         ASD_DPRINTK("came back from clear nexus\n");
         spin_lock_irqsave(&task->task_state_lock, flags);
         if (leftover < 1)
@@ -350,6 +407,11 @@ int asd_abort_task(struct sas_task *task)
         struct asd_ascb *ascb = NULL;
         struct scb *scb;
         int leftover;
+        DECLARE_TCS(tcs);
+        DECLARE_COMPLETION_ONSTACK(completion);
+        DECLARE_COMPLETION_ONSTACK(tascb_completion);
+
+        tascb->completion = &tascb_completion;
 
         spin_lock_irqsave(&task->task_state_lock, flags);
         if (task->task_state_flags & SAS_TASK_STATE_DONE) {
@@ -363,8 +425,10 @@ int asd_abort_task(struct sas_task *task)
         ascb = asd_ascb_alloc_list(asd_ha, &res, GFP_KERNEL);
         if (!ascb)
                 return -ENOMEM;
-        scb = ascb->scb;
 
+        ascb->uldd_task = &tcs;
+        ascb->completion = &completion;
+        scb = ascb->scb;
         scb->header.opcode = SCB_ABORT_TASK;
 
         switch (task->task_proto) {
@@ -406,13 +470,12 @@ int asd_abort_task(struct sas_task *task)
         res = asd_enqueue_internal(ascb, asd_tmf_tasklet_complete,
                                    asd_tmf_timedout);
         if (res)
-                goto out;
-        wait_for_completion(&ascb->completion);
+                goto out_free;
+        wait_for_completion(&completion);
         ASD_DPRINTK("tmf came back\n");
 
-        res = (int) (unsigned long) ascb->uldd_task;
-        tascb->tag = ascb->tag;
-        tascb->tag_valid = ascb->tag_valid;
+        tascb->tag = tcs.tag;
+        tascb->tag_valid = tcs.tag_valid;
 
         spin_lock_irqsave(&task->task_state_lock, flags);
         if (task->task_state_flags & SAS_TASK_STATE_DONE) {
@@ -423,63 +486,68 @@ int asd_abort_task(struct sas_task *task)
         }
         spin_unlock_irqrestore(&task->task_state_lock, flags);
 
-        switch (res) {
-        /* The task to be aborted has been sent to the device.
-         * We got a Response IU for the ABORT TASK TMF. */
-        case TC_NO_ERROR + 0xFF00:
-        case TMF_RESP_FUNC_COMPLETE:
-        case TMF_RESP_FUNC_FAILED:
-                res = asd_clear_nexus(task);
-                break;
-        case TMF_RESP_INVALID_FRAME:
-        case TMF_RESP_OVERLAPPED_TAG:
-        case TMF_RESP_FUNC_ESUPP:
-        case TMF_RESP_NO_LUN:
-                goto out_done; break;
-        }
-        /* In the following we assume that the managing layer
-         * will _never_ make a mistake, when issuing ABORT TASK.
-         */
-        switch (res) {
-        default:
-                res = asd_clear_nexus(task);
-                /* fallthrough */
-        case TC_NO_ERROR + 0xFF00:
-        case TMF_RESP_FUNC_COMPLETE:
-                break;
-        /* The task hasn't been sent to the device xor we never got
-         * a (sane) Response IU for the ABORT TASK TMF.
-         */
-        case TF_NAK_RECV + 0xFF00:
-                res = TMF_RESP_INVALID_FRAME;
-                break;
-        case TF_TMF_TASK_DONE + 0xFF00: /* done but not reported yet */
+        if (tcs.dl_opcode == TC_SSP_RESP) {
+                /* The task to be aborted has been sent to the device.
+                 * We got a Response IU for the ABORT TASK TMF. */
+                if (tcs.tmf_state == TMF_RESP_FUNC_COMPLETE)
+                        res = asd_clear_nexus(task);
+                else
+                        res = tcs.tmf_state;
+        } else if (tcs.dl_opcode == TC_NO_ERROR &&
+                   tcs.tmf_state == TMF_RESP_FUNC_FAILED) {
+                /* timeout */
                 res = TMF_RESP_FUNC_FAILED;
-                leftover = wait_for_completion_timeout(&tascb->completion,
-                                                       AIC94XX_SCB_TIMEOUT);
-                spin_lock_irqsave(&task->task_state_lock, flags);
-                if (leftover < 1)
+        } else {
+                /* In the following we assume that the managing layer
+                 * will _never_ make a mistake, when issuing ABORT
+                 * TASK.
+                 */
+                switch (tcs.dl_opcode) {
+                default:
+                        res = asd_clear_nexus(task);
+                        /* fallthrough */
+                case TC_NO_ERROR:
+                        break;
+                        /* The task hasn't been sent to the device xor
+                         * we never got a (sane) Response IU for the
+                         * ABORT TASK TMF.
+                         */
+                case TF_NAK_RECV:
+                        res = TMF_RESP_INVALID_FRAME;
+                        break;
+                case TF_TMF_TASK_DONE:  /* done but not reported yet */
                         res = TMF_RESP_FUNC_FAILED;
-                if (task->task_state_flags & SAS_TASK_STATE_DONE)
+                        leftover =
+                                wait_for_completion_timeout(&tascb_completion,
+                                                          AIC94XX_SCB_TIMEOUT);
+                        spin_lock_irqsave(&task->task_state_lock, flags);
+                        if (leftover < 1)
+                                res = TMF_RESP_FUNC_FAILED;
+                        if (task->task_state_flags & SAS_TASK_STATE_DONE)
+                                res = TMF_RESP_FUNC_COMPLETE;
+                        spin_unlock_irqrestore(&task->task_state_lock, flags);
+                        break;
+                case TF_TMF_NO_TAG:
+                case TF_TMF_TAG_FREE: /* the tag is in the free list */
+                case TF_TMF_NO_CONN_HANDLE: /* no such device */
                         res = TMF_RESP_FUNC_COMPLETE;
-                spin_unlock_irqrestore(&task->task_state_lock, flags);
-                goto out_done;
-        case TF_TMF_NO_TAG + 0xFF00:
-        case TF_TMF_TAG_FREE + 0xFF00: /* the tag is in the free list */
-        case TF_TMF_NO_CONN_HANDLE + 0xFF00: /* no such device */
-                res = TMF_RESP_FUNC_COMPLETE;
-                goto out_done;
-        case TF_TMF_NO_CTX + 0xFF00: /* not in seq, or proto != SSP */
-                res = TMF_RESP_FUNC_ESUPP;
-                goto out;
+                        break;
+                case TF_TMF_NO_CTX: /* not in seq, or proto != SSP */
+                        res = TMF_RESP_FUNC_ESUPP;
+                        break;
+                }
         }
-out_done:
+ out_done:
+        tascb->completion = NULL;
         if (res == TMF_RESP_FUNC_COMPLETE) {
                 task->lldd_task = NULL;
                 mb();
                 asd_ascb_free(tascb);
         }
-out:
+        ASD_DPRINTK("task 0x%p aborted, res: 0x%x\n", task, res);
+        return res;
+
+ out_free:
         asd_ascb_free(ascb);
         ASD_DPRINTK("task 0x%p aborted, res: 0x%x\n", task, res);
         return res;
@@ -507,6 +575,8 @@ static int asd_initiate_ssp_tmf(struct domain_device *dev, u8 *lun,
         struct asd_ascb *ascb;
         int res = 1;
         struct scb *scb;
+        DECLARE_COMPLETION_ONSTACK(completion);
+        DECLARE_TCS(tcs);
 
         if (!(dev->tproto & SAS_PROTOCOL_SSP))
                 return TMF_RESP_FUNC_ESUPP;
@@ -514,6 +584,9 @@ static int asd_initiate_ssp_tmf(struct domain_device *dev, u8 *lun,
         ascb = asd_ascb_alloc_list(asd_ha, &res, GFP_KERNEL);
         if (!ascb)
                 return -ENOMEM;
+
+        ascb->completion = &completion;
+        ascb->uldd_task = &tcs;
         scb = ascb->scb;
 
         if (tmf == TMF_QUERY_TASK)
@@ -546,31 +619,32 @@ static int asd_initiate_ssp_tmf(struct domain_device *dev, u8 *lun,
                                    asd_tmf_timedout);
         if (res)
                 goto out_err;
-        wait_for_completion(&ascb->completion);
-        res = (int) (unsigned long) ascb->uldd_task;
+        wait_for_completion(&completion);
 
-        switch (res) {
-        case TC_NO_ERROR + 0xFF00:
+        switch (tcs.dl_opcode) {
+        case TC_NO_ERROR:
                 res = TMF_RESP_FUNC_COMPLETE;
                 break;
-        case TF_NAK_RECV + 0xFF00:
+        case TF_NAK_RECV:
                 res = TMF_RESP_INVALID_FRAME;
                 break;
-        case TF_TMF_TASK_DONE + 0xFF00:
+        case TF_TMF_TASK_DONE:
                 res = TMF_RESP_FUNC_FAILED;
                 break;
-        case TF_TMF_NO_TAG + 0xFF00:
-        case TF_TMF_TAG_FREE + 0xFF00: /* the tag is in the free list */
-        case TF_TMF_NO_CONN_HANDLE + 0xFF00: /* no such device */
+        case TF_TMF_NO_TAG:
+        case TF_TMF_TAG_FREE: /* the tag is in the free list */
+        case TF_TMF_NO_CONN_HANDLE: /* no such device */
                 res = TMF_RESP_FUNC_COMPLETE;
                 break;
-        case TF_TMF_NO_CTX + 0xFF00: /* not in seq, or proto != SSP */
+        case TF_TMF_NO_CTX: /* not in seq, or proto != SSP */
                 res = TMF_RESP_FUNC_ESUPP;
                 break;
         default:
                 /* Allow TMF response codes to propagate upwards */
+                res = tcs.dl_opcode;
                 break;
         }
+        return res;
 out_err:
         asd_ascb_free(ascb);
         return res;
diff --git a/drivers/scsi/arcmsr/arcmsr.h b/drivers/scsi/arcmsr/arcmsr.h
index 57786502e3ec..0393707bdfce 100644
--- a/drivers/scsi/arcmsr/arcmsr.h
+++ b/drivers/scsi/arcmsr/arcmsr.h
@@ -48,7 +48,7 @@ struct class_device_attribute;
 /*The limit of outstanding scsi command that firmware can handle*/
 #define ARCMSR_MAX_OUTSTANDING_CMD                                              256
 #define ARCMSR_MAX_FREECCB_NUM                                                  320
-#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2007/12/24"
+#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2008/02/27"
 #define ARCMSR_SCSI_INITIATOR_ID                                                255
 #define ARCMSR_MAX_XFER_SECTORS                                                 512
 #define ARCMSR_MAX_XFER_SECTORS_B                                               4096
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 6d67f5c0eb8e..27ebd336409b 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -160,7 +160,7 @@ static void gdth_readapp_event(gdth_ha_str *ha, unchar application,
 static void gdth_clear_events(void);
 
 static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
-                                    char *buffer, ushort count, int to_buffer);
+                                    char *buffer, ushort count);
 static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp);
 static int gdth_fill_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, ushort hdrive);
 
@@ -182,7 +182,6 @@ static int gdth_ioctl(struct inode *inode, struct file *filep,
                       unsigned int cmd, unsigned long arg);
 
 static void gdth_flush(gdth_ha_str *ha);
-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf);
 static int gdth_queuecommand(Scsi_Cmnd *scp,void (*done)(Scsi_Cmnd *));
 static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp,
                                 struct gdth_cmndinfo *cmndinfo);
@@ -417,12 +416,6 @@ static inline void gdth_set_sglist(struct scsi_cmnd *cmd,
 #include "gdth_proc.h"
 #include "gdth_proc.c"
 
-/* notifier block to get a notify on system shutdown/halt/reboot */
-static struct notifier_block gdth_notifier = {
-    gdth_halt, NULL, 0
-};
-static int notifier_disabled = 0;
-
 static gdth_ha_str *gdth_find_ha(int hanum)
 {
         gdth_ha_str *ha;
@@ -445,8 +438,8 @@ static struct gdth_cmndinfo *gdth_get_cmndinfo(gdth_ha_str *ha)
         for (i=0; i<GDTH_MAXCMDS; ++i) {
                 if (ha->cmndinfo[i].index == 0) {
                         priv = &ha->cmndinfo[i];
-                        priv->index = i+1;
                         memset(priv, 0, sizeof(*priv));
+                        priv->index = i+1;
                         break;
                 }
         }
@@ -493,7 +486,6 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
     gdth_ha_str *ha = shost_priv(sdev->host);
     Scsi_Cmnd *scp;
     struct gdth_cmndinfo cmndinfo;
-    struct scatterlist one_sg;
     DECLARE_COMPLETION_ONSTACK(wait);
     int rval;
 
@@ -507,13 +499,10 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
     /* use request field to save the ptr. to completion struct. */
     scp->request = (struct request *)&wait;
     scp->timeout_per_command = timeout*HZ;
-    sg_init_one(&one_sg, gdtcmd, sizeof(*gdtcmd));
-    gdth_set_sglist(scp, &one_sg);
-    gdth_set_sg_count(scp, 1);
-    gdth_set_bufflen(scp, sizeof(*gdtcmd));
     scp->cmd_len = 12;
     memcpy(scp->cmnd, cmnd, 12);
     cmndinfo.priority = IOCTL_PRI;
+    cmndinfo.internal_cmd_str = gdtcmd;
     cmndinfo.internal_command = 1;
 
     TRACE(("__gdth_execute() cmd 0x%x\n", scp->cmnd[0]));
@@ -2355,7 +2344,7 @@ static void gdth_next(gdth_ha_str *ha)
  * buffers, kmap_atomic() as needed.
  */
 static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
-                                    char *buffer, ushort count, int to_buffer)
+                                    char *buffer, ushort count)
 {
     ushort cpcount,i, max_sg = gdth_sg_count(scp);
     ushort cpsum,cpnow;
@@ -2381,10 +2370,7 @@ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
             }
             local_irq_save(flags);
             address = kmap_atomic(sg_page(sl), KM_BIO_SRC_IRQ) + sl->offset;
-            if (to_buffer)
-                memcpy(buffer, address, cpnow);
-            else
-                memcpy(address, buffer, cpnow);
+            memcpy(address, buffer, cpnow);
             flush_dcache_page(sg_page(sl));
             kunmap_atomic(address, KM_BIO_SRC_IRQ);
             local_irq_restore(flags);
@@ -2438,7 +2424,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         strcpy(inq.vendor,ha->oem_name);
         sprintf(inq.product,"Host Drive  #%02d",t);
         strcpy(inq.revision,"   ");
-        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data));
         break;
 
       case REQUEST_SENSE:
@@ -2448,7 +2434,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         sd.key       = NO_SENSE;
         sd.info      = 0;
         sd.add_length= 0;
-        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data));
         break;
 
       case MODE_SENSE:
@@ -2460,7 +2446,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         mpd.bd.block_length[0] = (SECTOR_SIZE & 0x00ff0000) >> 16;
         mpd.bd.block_length[1] = (SECTOR_SIZE & 0x0000ff00) >> 8;
         mpd.bd.block_length[2] = (SECTOR_SIZE & 0x000000ff);
-        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data));
         break;
 
       case READ_CAPACITY:
@@ -2470,7 +2456,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         else
             rdc.last_block_no = cpu_to_be32(ha->hdr[t].size-1);
         rdc.block_length  = cpu_to_be32(SECTOR_SIZE);
-        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data));
         break;
 
       case SERVICE_ACTION_IN:
@@ -2482,7 +2468,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
             rdc16.last_block_no = cpu_to_be64(ha->hdr[t].size-1);
             rdc16.block_length  = cpu_to_be32(SECTOR_SIZE);
             gdth_copy_internal_data(ha, scp, (char*)&rdc16,
-                                                 sizeof(gdth_rdcap16_data), 0);
+                                                 sizeof(gdth_rdcap16_data));
         } else { 
             scp->result = DID_ABORT << 16;
         }
@@ -2852,6 +2838,7 @@ static int gdth_fill_raw_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, unchar b)
 static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
 {
     register gdth_cmd_str *cmdp;
+    struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
     int cmd_index;
 
     cmdp= ha->pccb;
@@ -2860,7 +2847,7 @@ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
     if (ha->type==GDT_EISA && ha->cmd_cnt>0) 
         return 0;
 
-    gdth_copy_internal_data(ha, scp, (char *)cmdp, sizeof(gdth_cmd_str), 1);
+    *cmdp = *cmndinfo->internal_cmd_str;
     cmdp->RequestBuffer = scp;
 
     /* search free command index */
@@ -3794,6 +3781,8 @@ static void gdth_timeout(ulong data)
     gdth_ha_str *ha;
     ulong flags;
 
+    BUG_ON(list_empty(&gdth_instances));
+
     ha = list_first_entry(&gdth_instances, gdth_ha_str, list);
     spin_lock_irqsave(&ha->smp_lock, flags);
 
@@ -4669,45 +4658,6 @@ static void gdth_flush(gdth_ha_str *ha)
     }
 }
 
-/* shutdown routine */
-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
-{
-    gdth_ha_str *ha;
-#ifndef __alpha__
-    gdth_cmd_str    gdtcmd;
-    char            cmnd[MAX_COMMAND_SIZE];   
-#endif
-
-    if (notifier_disabled)
-        return NOTIFY_OK;
-
-    TRACE2(("gdth_halt() event %d\n",(int)event));
-    if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
-        return NOTIFY_DONE;
-
-    notifier_disabled = 1;
-    printk("GDT-HA: Flushing all host drives .. ");
-    list_for_each_entry(ha, &gdth_instances, list) {
-        gdth_flush(ha);
-
-#ifndef __alpha__
-        /* controller reset */
-        memset(cmnd, 0xff, MAX_COMMAND_SIZE);
-        gdtcmd.BoardNode = LOCALBOARD;
-        gdtcmd.Service = CACHESERVICE;
-        gdtcmd.OpCode = GDT_RESET;
-        TRACE2(("gdth_halt(): reset controller %d\n", ha->hanum));
-        gdth_execute(ha->shost, &gdtcmd, cmnd, 10, NULL);
-#endif
-    }
-    printk("Done.\n");
-
-#ifdef GDTH_STATISTICS
-    del_timer(&gdth_timer);
-#endif
-    return NOTIFY_OK;
-}
-
 /* configure lun */
 static int gdth_slave_configure(struct scsi_device *sdev)
 {
@@ -5142,13 +5092,13 @@ static void gdth_remove_one(gdth_ha_str *ha)
 
         scsi_remove_host(shp);
 
+        gdth_flush(ha);
+
         if (ha->sdev) {
                 scsi_free_host_dev(ha->sdev);
                 ha->sdev = NULL;
         }
 
-        gdth_flush(ha);
-
         if (shp->irq)
                 free_irq(shp->irq,ha);
 
@@ -5174,6 +5124,24 @@ static void gdth_remove_one(gdth_ha_str *ha)
         scsi_host_put(shp);
 }
 
+static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
+{
+        gdth_ha_str *ha;
+
+        TRACE2(("gdth_halt() event %d\n", (int)event));
+        if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
+                return NOTIFY_DONE;
+
+        list_for_each_entry(ha, &gdth_instances, list)
+                gdth_flush(ha);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block gdth_notifier = {
+    gdth_halt, NULL, 0
+};
+
 static int __init gdth_init(void)
 {
         if (disable) {
@@ -5236,7 +5204,6 @@ static int __init gdth_init(void)
         add_timer(&gdth_timer);
 #endif
         major = register_chrdev(0,"gdth", &gdth_fops);
-        notifier_disabled = 0;
         register_reboot_notifier(&gdth_notifier);
         gdth_polling = FALSE;
         return 0;
@@ -5246,14 +5213,15 @@ static void __exit gdth_exit(void)
 {
         gdth_ha_str *ha;
 
-        list_for_each_entry(ha, &gdth_instances, list)
-                gdth_remove_one(ha);
+        unregister_chrdev(major, "gdth");
+        unregister_reboot_notifier(&gdth_notifier);
 
 #ifdef GDTH_STATISTICS
-        del_timer(&gdth_timer);
+        del_timer_sync(&gdth_timer);
 #endif
-        unregister_chrdev(major,"gdth");
-        unregister_reboot_notifier(&gdth_notifier);
+
+        list_for_each_entry(ha, &gdth_instances, list)
+                gdth_remove_one(ha);
 }
 
 module_init(gdth_init);
diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
index 1434c6b0297c..26e4e92515e0 100644
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -915,6 +915,7 @@ typedef struct {
     struct gdth_cmndinfo {                      /* per-command private info */
         int index;
         int internal_command;                   /* don't call scsi_done */
+        gdth_cmd_str *internal_cmd_str;         /* crier for internal messages*/
         dma_addr_t sense_paddr;                 /* sense dma-addr */
         unchar priority;
         int timeout;
diff --git a/drivers/scsi/ibmvscsi/ibmvstgt.c b/drivers/scsi/ibmvscsi/ibmvstgt.c
index bd62131b97a1..e5881e92d0fb 100644
--- a/drivers/scsi/ibmvscsi/ibmvstgt.c
+++ b/drivers/scsi/ibmvscsi/ibmvstgt.c
@@ -290,7 +290,7 @@ static int ibmvstgt_cmd_done(struct scsi_cmnd *sc,
         int err = 0;
 
         dprintk("%p %p %x %u\n", iue, target, vio_iu(iue)->srp.cmd.cdb[0],
-                cmd->usg_sg);
+                scsi_sg_count(sc));
 
         if (scsi_sg_count(sc))
                 err = srp_transfer_data(sc, &vio_iu(iue)->srp.cmd, ibmvstgt_rdma, 1, 1);
@@ -838,9 +838,6 @@ static int ibmvstgt_probe(struct vio_dev *dev, const struct vio_device_id *id)
         if (!shost)
                 goto free_vport;
         shost->transportt = ibmvstgt_transport_template;
-        err = scsi_tgt_alloc_queue(shost);
-        if (err)
-                goto put_host;
 
         target = host_to_srp_target(shost);
         target->shost = shost;
@@ -872,6 +869,10 @@ static int ibmvstgt_probe(struct vio_dev *dev, const struct vio_device_id *id)
         if (err)
                 goto destroy_queue;
 
+        err = scsi_tgt_alloc_queue(shost);
+        if (err)
+                goto destroy_queue;
+
         return 0;
 destroy_queue:
         crq_queue_destroy(target);
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 59f8445eab0d..bdd7de7da39a 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1708,8 +1708,8 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
                 qdepth = ISCSI_DEF_CMD_PER_LUN;
         }
 
-        if (!is_power_of_2(cmds_max) ||
-            cmds_max >= ISCSI_MGMT_ITT_OFFSET) {
+        if (!is_power_of_2(cmds_max) || cmds_max >= ISCSI_MGMT_ITT_OFFSET ||
+            cmds_max < 2) {
                 if (cmds_max != 0)
                         printk(KERN_ERR "iscsi: invalid can_queue of %d. "
                                "can_queue must be a power of 2 and between "
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 7cd05b599a12..b0e5ac372a32 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -236,12 +236,12 @@ static void sas_ata_phy_reset(struct ata_port *ap)
         struct domain_device *dev = ap->private_data;
         struct sas_internal *i =
                 to_sas_internal(dev->port->ha->core.shost->transportt);
-        int res = 0;
+        int res = TMF_RESP_FUNC_FAILED;
 
         if (i->dft->lldd_I_T_nexus_reset)
                 res = i->dft->lldd_I_T_nexus_reset(dev);
 
-        if (res)
+        if (res != TMF_RESP_FUNC_COMPLETE)
                 SAS_DPRINTK("%s: Unable to reset I T nexus?\n", __FUNCTION__);
 
         switch (dev->sata_dev.command_set) {
@@ -656,21 +656,6 @@ out:
         return res;
 }
 
-static void sas_sata_propagate_sas_addr(struct domain_device *dev)
-{
-        unsigned long flags;
-        struct asd_sas_port *port = dev->port;
-        struct asd_sas_phy  *phy;
-
-        BUG_ON(dev->parent);
-
-        memcpy(port->attached_sas_addr, dev->sas_addr, SAS_ADDR_SIZE);
-        spin_lock_irqsave(&port->phy_list_lock, flags);
-        list_for_each_entry(phy, &port->phy_list, port_phy_el)
-                memcpy(phy->attached_sas_addr, dev->sas_addr, SAS_ADDR_SIZE);
-        spin_unlock_irqrestore(&port->phy_list_lock, flags);
-}
-
 #define ATA_IDENTIFY_DEV         0xEC
 #define ATA_IDENTIFY_PACKET_DEV  0xA1
 #define ATA_SET_FEATURES         0xEF
@@ -728,26 +713,6 @@ static int sas_discover_sata_dev(struct domain_device *dev)
                         goto out_err;
         }
 cont1:
-        /* Get WWN */
-        if (dev->port->oob_mode != SATA_OOB_MODE) {
-                memcpy(dev->sas_addr, dev->sata_dev.rps_resp.rps.stp_sas_addr,
-                       SAS_ADDR_SIZE);
-        } else if (dev->sata_dev.command_set == ATA_COMMAND_SET &&
-                   (le16_to_cpu(dev->sata_dev.identify_device[108]) & 0xF000)
-                   == 0x5000) {
-                int i;
-
-                for (i = 0; i < 4; i++) {
-                        dev->sas_addr[2*i] =
-             (le16_to_cpu(dev->sata_dev.identify_device[108+i]) & 0xFF00) >> 8;
-                        dev->sas_addr[2*i+1] =
-              le16_to_cpu(dev->sata_dev.identify_device[108+i]) & 0x00FF;
-                }
-        }
-        sas_hash_addr(dev->hashed_sas_addr, dev->sas_addr);
-        if (!dev->parent)
-                sas_sata_propagate_sas_addr(dev);
-
         /* XXX Hint: register this SATA device with SATL.
            When this returns, dev->sata_dev->lu is alive and
            present.
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index e1e2d085c920..39ae68a3b0ef 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -92,9 +92,6 @@ static void sas_form_port(struct asd_sas_phy *phy)
         if (!port->phy)
                 port->phy = phy->phy;
 
-        SAS_DPRINTK("phy%d added to port%d, phy_mask:0x%x\n", phy->id,
-                    port->id, port->phy_mask);
-
         if (*(u64 *)port->attached_sas_addr == 0) {
                 port->class = phy->class;
                 memcpy(port->attached_sas_addr, phy->attached_sas_addr,
@@ -115,6 +112,11 @@ static void sas_form_port(struct asd_sas_phy *phy)
         }
         sas_port_add_phy(port->port, phy->phy);
 
+        SAS_DPRINTK("%s added to %s, phy_mask:0x%x (%16llx)\n",
+                    phy->phy->dev.bus_id,port->port->dev.bus_id,
+                    port->phy_mask,
+                    SAS_ADDR(port->attached_sas_addr));
+
         if (port->port_dev)
                 port->port_dev->pathways = port->num_phys;
 
@@ -255,12 +257,11 @@ void sas_porte_hard_reset(struct work_struct *work)
 static void sas_init_port(struct asd_sas_port *port,
                           struct sas_ha_struct *sas_ha, int i)
 {
+        memset(port, 0, sizeof(*port));
         port->id = i;
         INIT_LIST_HEAD(&port->dev_list);
         spin_lock_init(&port->phy_list_lock);
         INIT_LIST_HEAD(&port->phy_list);
-        port->num_phys = 0;
-        port->phy_mask = 0;
         port->ha = sas_ha;
 
         spin_lock_init(&port->dev_list_lock);
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 704ea06a6e50..1f8241563c6c 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -434,7 +434,7 @@ static int sas_recover_I_T(struct domain_device *dev)
 }
 
 /* Find the sas_phy that's attached to this device */
-static struct sas_phy *find_local_sas_phy(struct domain_device *dev)
+struct sas_phy *sas_find_local_phy(struct domain_device *dev)
 {
         struct domain_device *pdev = dev->parent;
         struct ex_phy *exphy = NULL;
@@ -456,6 +456,7 @@ static struct sas_phy *find_local_sas_phy(struct domain_device *dev)
         BUG_ON(!exphy);
         return exphy->phy;
 }
+EXPORT_SYMBOL_GPL(sas_find_local_phy);
 
 /* Attempt to send a LUN reset message to a device */
 int sas_eh_device_reset_handler(struct scsi_cmnd *cmd)
@@ -482,7 +483,7 @@ int sas_eh_device_reset_handler(struct scsi_cmnd *cmd)
 int sas_eh_bus_reset_handler(struct scsi_cmnd *cmd)
 {
         struct domain_device *dev = cmd_to_domain_dev(cmd);
-        struct sas_phy *phy = find_local_sas_phy(dev);
+        struct sas_phy *phy = sas_find_local_phy(dev);
         int res;
 
         res = sas_phy_reset(phy, 1);
@@ -497,10 +498,10 @@ int sas_eh_bus_reset_handler(struct scsi_cmnd *cmd)
 }
 
 /* Try to reset a device */
-static int try_to_reset_cmd_device(struct Scsi_Host *shost,
-                                   struct scsi_cmnd *cmd)
+static int try_to_reset_cmd_device(struct scsi_cmnd *cmd)
 {
         int res;
+        struct Scsi_Host *shost = cmd->device->host;
 
         if (!shost->hostt->eh_device_reset_handler)
                 goto try_bus_reset;
@@ -540,6 +541,12 @@ Again:
                 need_reset = task->task_state_flags & SAS_TASK_NEED_DEV_RESET;
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
 
+                if (need_reset) {
+                        SAS_DPRINTK("%s: task 0x%p requests reset\n",
+                                    __FUNCTION__, task);
+                        goto reset;
+                }
+
                 SAS_DPRINTK("trying to find task 0x%p\n", task);
                 res = sas_scsi_find_task(task);
 
@@ -550,18 +557,15 @@ Again:
                         SAS_DPRINTK("%s: task 0x%p is done\n", __FUNCTION__,
                                     task);
                         sas_eh_finish_cmd(cmd);
-                        if (need_reset)
-                                try_to_reset_cmd_device(shost, cmd);
                         continue;
                 case TASK_IS_ABORTED:
                         SAS_DPRINTK("%s: task 0x%p is aborted\n",
                                     __FUNCTION__, task);
                         sas_eh_finish_cmd(cmd);
-                        if (need_reset)
-                                try_to_reset_cmd_device(shost, cmd);
                         continue;
                 case TASK_IS_AT_LU:
                         SAS_DPRINTK("task 0x%p is at LU: lu recover\n", task);
+ reset:
                         tmf_resp = sas_recover_lu(task->dev, cmd);
                         if (tmf_resp == TMF_RESP_FUNC_COMPLETE) {
                                 SAS_DPRINTK("dev %016llx LU %x is "
@@ -569,8 +573,6 @@ Again:
                                             SAS_ADDR(task->dev),
                                             cmd->device->lun);
                                 sas_eh_finish_cmd(cmd);
-                                if (need_reset)
-                                        try_to_reset_cmd_device(shost, cmd);
                                 sas_scsi_clear_queue_lu(work_q, cmd);
                                 goto Again;
                         }
@@ -581,15 +583,15 @@ Again:
                                     task);
                         tmf_resp = sas_recover_I_T(task->dev);
                         if (tmf_resp == TMF_RESP_FUNC_COMPLETE) {
+                                struct domain_device *dev = task->dev;
                                 SAS_DPRINTK("I_T %016llx recovered\n",
                                             SAS_ADDR(task->dev->sas_addr));
                                 sas_eh_finish_cmd(cmd);
-                                if (need_reset)
-                                        try_to_reset_cmd_device(shost, cmd);
-                                sas_scsi_clear_queue_I_T(work_q, task->dev);
+                                sas_scsi_clear_queue_I_T(work_q, dev);
                                 goto Again;
                         }
                         /* Hammer time :-) */
+                        try_to_reset_cmd_device(cmd);
                         if (i->dft->lldd_clear_nexus_port) {
                                 struct asd_sas_port *port = task->dev->port;
                                 SAS_DPRINTK("clearing nexus for port:%d\n",
@@ -599,8 +601,6 @@ Again:
                                         SAS_DPRINTK("clear nexus port:%d "
                                                     "succeeded\n", port->id);
                                         sas_eh_finish_cmd(cmd);
-                                        if (need_reset)
-                                                try_to_reset_cmd_device(shost, cmd);
                                         sas_scsi_clear_queue_port(work_q,
                                                                   port);
                                         goto Again;
@@ -613,8 +613,6 @@ Again:
                                         SAS_DPRINTK("clear nexus ha "
                                                     "succeeded\n");
                                         sas_eh_finish_cmd(cmd);
-                                        if (need_reset)
-                                                try_to_reset_cmd_device(shost, cmd);
                                         goto clear_q;
                                 }
                         }
@@ -628,8 +626,6 @@ Again:
                                     cmd->device->lun);
 
                         sas_eh_finish_cmd(cmd);
-                        if (need_reset)
-                                try_to_reset_cmd_device(shost, cmd);
                         goto clear_q;
                 }
         }
diff --git a/drivers/scsi/mvsas.c b/drivers/scsi/mvsas.c
index d4a6ac3c9c47..5ec0665b3a3d 100644
--- a/drivers/scsi/mvsas.c
+++ b/drivers/scsi/mvsas.c
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "mvsas"
-#define DRV_VERSION     "0.5"
+#define DRV_VERSION     "0.5.1"
 #define _MV_DUMP 0
 #define MVS_DISABLE_NVRAM
 #define MVS_DISABLE_MSI
@@ -1005,7 +1005,7 @@ err_out:
         return rc;
 #else
         /* FIXME , For SAS target mode */
-        memcpy(buf, "\x00\x00\xab\x11\x30\x04\x05\x50", 8);
+        memcpy(buf, "\x50\x05\x04\x30\x11\xab\x00\x00", 8);
         return 0;
 #endif
 }
@@ -1330,7 +1330,7 @@ static int mvs_int_rx(struct mvs_info *mvi, bool self_clear)
 
                 mvs_hba_cq_dump(mvi);
 
-                if (unlikely(rx_desc & RXQ_DONE))
+                if (likely(rx_desc & RXQ_DONE))
                         mvs_slot_complete(mvi, rx_desc);
                 if (rx_desc & RXQ_ATTN) {
                         attn = true;
@@ -2720,9 +2720,8 @@ static int __devinit mvs_hw_init(struct mvs_info *mvi)
         msleep(100);
         /* init and reset phys */
         for (i = 0; i < mvi->chip->n_phy; i++) {
-                /* FIXME: is this the correct dword order? */
-                u32 lo = *((u32 *)&mvi->sas_addr[0]);
-                u32 hi = *((u32 *)&mvi->sas_addr[4]);
+                u32 lo = be32_to_cpu(*(u32 *)&mvi->sas_addr[4]);
+                u32 hi = be32_to_cpu(*(u32 *)&mvi->sas_addr[0]);
 
                 mvs_detect_porttype(mvi, i);
 
diff --git a/drivers/scsi/ps3rom.c b/drivers/scsi/ps3rom.c
index 0cd614a0fa73..fad6cb5cba28 100644
--- a/drivers/scsi/ps3rom.c
+++ b/drivers/scsi/ps3rom.c
@@ -124,7 +124,7 @@ static int fill_from_dev_buffer(struct scsi_cmnd *cmd, const void *buf)
                 }
                 req_len += sgpnt->length;
         }
-        scsi_set_resid(cmd, req_len - act_len);
+        scsi_set_resid(cmd, buflen - act_len);
         return 0;
 }
 
@@ -427,7 +427,7 @@ static struct scsi_host_template ps3rom_host_template = {
         .cmd_per_lun =          1,
         .emulated =             1,              /* only sg driver uses this */
         .max_sectors =          PS3ROM_MAX_SECTORS,
-        .use_clustering =       ENABLE_CLUSTERING,
+        .use_clustering =       DISABLE_CLUSTERING,
         .module =               THIS_MODULE,
 };
 
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 6226d88479f5..c1808763d40e 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -39,7 +39,7 @@ qla2x00_prep_ms_iocb(scsi_qla_host_t *ha, uint32_t req_size, uint32_t rsp_size)
         ms_pkt->entry_count = 1;
         SET_TARGET_ID(ha, ms_pkt->loop_id, SIMPLE_NAME_SERVER);
         ms_pkt->control_flags = __constant_cpu_to_le16(CF_READ | CF_HEAD_TAG);
-        ms_pkt->timeout = __constant_cpu_to_le16(25);
+        ms_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ms_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ms_pkt->total_dsd_count = __constant_cpu_to_le16(2);
         ms_pkt->rsp_bytecount = cpu_to_le32(rsp_size);
@@ -75,7 +75,7 @@ qla24xx_prep_ms_iocb(scsi_qla_host_t *ha, uint32_t req_size, uint32_t rsp_size)
         ct_pkt->entry_type = CT_IOCB_TYPE;
         ct_pkt->entry_count = 1;
         ct_pkt->nport_handle = __constant_cpu_to_le16(NPH_SNS);
-        ct_pkt->timeout = __constant_cpu_to_le16(25);
+        ct_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ct_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_byte_count = cpu_to_le32(rsp_size);
@@ -1144,7 +1144,7 @@ qla2x00_prep_ms_fdmi_iocb(scsi_qla_host_t *ha, uint32_t req_size,
         ms_pkt->entry_count = 1;
         SET_TARGET_ID(ha, ms_pkt->loop_id, ha->mgmt_svr_loop_id);
         ms_pkt->control_flags = __constant_cpu_to_le16(CF_READ | CF_HEAD_TAG);
-        ms_pkt->timeout = __constant_cpu_to_le16(59);
+        ms_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ms_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ms_pkt->total_dsd_count = __constant_cpu_to_le16(2);
         ms_pkt->rsp_bytecount = cpu_to_le32(rsp_size);
@@ -1181,7 +1181,7 @@ qla24xx_prep_ms_fdmi_iocb(scsi_qla_host_t *ha, uint32_t req_size,
         ct_pkt->entry_type = CT_IOCB_TYPE;
         ct_pkt->entry_count = 1;
         ct_pkt->nport_handle = cpu_to_le16(ha->mgmt_svr_loop_id);
-        ct_pkt->timeout = __constant_cpu_to_le16(59);
+        ct_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ct_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_byte_count = cpu_to_le32(rsp_size);
@@ -1761,7 +1761,7 @@ qla24xx_prep_ms_fm_iocb(scsi_qla_host_t *ha, uint32_t req_size,
         ct_pkt->entry_type = CT_IOCB_TYPE;
         ct_pkt->entry_count = 1;
         ct_pkt->nport_handle = cpu_to_le16(ha->mgmt_svr_loop_id);
-        ct_pkt->timeout = __constant_cpu_to_le16(59);
+        ct_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ct_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_byte_count = cpu_to_le32(rsp_size);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index d5c7853e7eba..364be7d06875 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1733,8 +1733,8 @@ qla2x00_nvram_config(scsi_qla_host_t *ha)
         ha->login_timeout = nv->login_timeout;
         icb->login_timeout = nv->login_timeout;
 
-        /* Set minimum RATOV to 200 tenths of a second. */
-        ha->r_a_tov = 200;
+        /* Set minimum RATOV to 100 tenths of a second. */
+        ha->r_a_tov = 100;
 
         ha->loop_reset_delay = nv->reset_delay;
 
@@ -3645,8 +3645,8 @@ qla24xx_nvram_config(scsi_qla_host_t *ha)
         ha->login_timeout = le16_to_cpu(nv->login_timeout);
         icb->login_timeout = cpu_to_le16(nv->login_timeout);
 
-        /* Set minimum RATOV to 200 tenths of a second. */
-        ha->r_a_tov = 200;
+        /* Set minimum RATOV to 100 tenths of a second. */
+        ha->r_a_tov = 100;
 
         ha->loop_reset_delay = nv->reset_delay;
 
@@ -4022,7 +4022,8 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *ha)
                 return;
 
         ret = qla2x00_stop_firmware(ha);
-        for (retries = 5; ret != QLA_SUCCESS && retries ; retries--) {
+        for (retries = 5; ret != QLA_SUCCESS && ret != QLA_FUNCTION_TIMEOUT &&
+            retries ; retries--) {
                 qla2x00_reset_chip(ha);
                 if (qla2x00_chip_diag(ha) != QLA_SUCCESS)
                         continue;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 14e6f22944b7..f0337036c7bb 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -958,6 +958,11 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                 }
         }
 
+        /* Check for overrun. */
+        if (IS_FWI2_CAPABLE(ha) && comp_status == CS_COMPLETE &&
+            scsi_status & SS_RESIDUAL_OVER)
+                comp_status = CS_DATA_OVERRUN;
+
         /*
          * Based on Host and scsi status generate status code for Linux
          */
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 99d29fff836d..bb103580e1ba 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2206,7 +2206,7 @@ qla24xx_abort_target(fc_port_t *fcport)
         tsk->p.tsk.entry_type = TSK_MGMT_IOCB_TYPE;
         tsk->p.tsk.entry_count = 1;
         tsk->p.tsk.nport_handle = cpu_to_le16(fcport->loop_id);
-        tsk->p.tsk.timeout = __constant_cpu_to_le16(25);
+        tsk->p.tsk.timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         tsk->p.tsk.control_flags = __constant_cpu_to_le32(TCF_TARGET_RESET);
         tsk->p.tsk.port_id[0] = fcport->d_id.b.al_pa;
         tsk->p.tsk.port_id[1] = fcport->d_id.b.area;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index c5742cc15abb..ea08a129fee9 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.02.00-k8"
+#define QLA2XXX_VERSION      "8.02.00-k9"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    2
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index 10b3b9a620f3..109c5f5985ec 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -1299,9 +1299,9 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha,
         ddb_entry->fw_ddb_device_state = state;
         /* Device is back online. */
         if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) {
+                atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
                 atomic_set(&ddb_entry->port_down_timer,
                            ha->port_down_retry_count);
-                atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
                 atomic_set(&ddb_entry->relogin_retry_count, 0);
                 atomic_set(&ddb_entry->relogin_timer, 0);
                 clear_bit(DF_RELOGIN, &ddb_entry->flags);
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index c3c59d763037..8b92f348f02c 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -75,6 +75,7 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd);
 static int qla4xxx_slave_alloc(struct scsi_device *device);
 static int qla4xxx_slave_configure(struct scsi_device *device);
 static void qla4xxx_slave_destroy(struct scsi_device *sdev);
+static void qla4xxx_scan_start(struct Scsi_Host *shost);
 
 static struct scsi_host_template qla4xxx_driver_template = {
         .module                 = THIS_MODULE,
@@ -90,6 +91,7 @@ static struct scsi_host_template qla4xxx_driver_template = {
         .slave_destroy          = qla4xxx_slave_destroy,
 
         .scan_finished          = iscsi_scan_finished,
+        .scan_start             = qla4xxx_scan_start,
 
         .this_id                = -1,
         .cmd_per_lun            = 3,
@@ -299,6 +301,18 @@ struct ddb_entry *qla4xxx_alloc_sess(struct scsi_qla_host *ha)
         return ddb_entry;
 }
 
+static void qla4xxx_scan_start(struct Scsi_Host *shost)
+{
+        struct scsi_qla_host *ha = shost_priv(shost);
+        struct ddb_entry *ddb_entry, *ddbtemp;
+
+        /* finish setup of sessions that were already setup in firmware */
+        list_for_each_entry_safe(ddb_entry, ddbtemp, &ha->ddb_list, list) {
+                if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE)
+                        qla4xxx_add_sess(ddb_entry);
+        }
+}
+
 /*
  * Timer routines
  */
@@ -864,8 +878,9 @@ static void qla4xxx_flush_active_srbs(struct scsi_qla_host *ha)
  * qla4xxx_recover_adapter - recovers adapter after a fatal error
  * @ha: Pointer to host adapter structure.
  * @renew_ddb_list: Indicates what to do with the adapter's ddb list
- *      after adapter recovery has completed.
- *      0=preserve ddb list, 1=destroy and rebuild ddb list
+ *
+ * renew_ddb_list value can be 0=preserve ddb list, 1=destroy and rebuild
+ * ddb list.
  **/
 static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
                                 uint8_t renew_ddb_list)
@@ -874,6 +889,7 @@ static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
 
         /* Stall incoming I/O until we are done */
         clear_bit(AF_ONLINE, &ha->flags);
+
         DEBUG2(printk("scsi%ld: %s calling qla4xxx_cmd_wait\n", ha->host_no,
                       __func__));
 
@@ -1176,7 +1192,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         int ret = -ENODEV, status;
         struct Scsi_Host *host;
         struct scsi_qla_host *ha;
-        struct ddb_entry *ddb_entry, *ddbtemp;
         uint8_t init_retry_count = 0;
         char buf[34];
 
@@ -1295,13 +1310,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         if (ret)
                 goto probe_failed;
 
-        /* Update transport device information for all devices. */
-        list_for_each_entry_safe(ddb_entry, ddbtemp, &ha->ddb_list, list) {
-                if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE)
-                        if (qla4xxx_add_sess(ddb_entry))
-                                goto remove_host;
-        }
-
         printk(KERN_INFO
                " QLogic iSCSI HBA Driver version: %s\n"
                "  QLogic ISP%04x @ %s, host#=%ld, fw=%02d.%02d.%02d.%02d\n",
@@ -1311,10 +1319,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         scsi_scan_host(host);
         return 0;
 
-remove_host:
-        qla4xxx_free_ddb_list(ha);
-        scsi_remove_host(host);
-
 probe_failed:
         qla4xxx_free_adapter(ha);
         scsi_host_put(ha->host);
@@ -1600,9 +1604,12 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd)
                 return FAILED;
         }
 
-        if (qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST) == QLA_SUCCESS) {
+        /* make sure the dpc thread is stopped while we reset the hba */
+        clear_bit(AF_ONLINE, &ha->flags);
+        flush_workqueue(ha->dpc_thread);
+
+        if (qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST) == QLA_SUCCESS)
                 return_status = SUCCESS;
-        }
 
         dev_info(&ha->pdev->dev, "HOST RESET %s.\n",
                    return_status == FAILED ? "FAILED" : "SUCCEDED");
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index fecba05b4e77..e5c6f6af8765 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -757,7 +757,7 @@ void scsi_finish_command(struct scsi_cmnd *cmd)
                                 "Notifying upper driver of completion "
                                 "(result %x)\n", cmd->result));
 
-        good_bytes = scsi_bufflen(cmd);
+        good_bytes = scsi_bufflen(cmd) + cmd->request->extra_len;
         if (cmd->request->cmd_type != REQ_TYPE_BLOCK_PC) {
                 drv = scsi_cmd_to_driver(cmd);
                 if (drv->done)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 1dc165ad17fb..e67c14e31bab 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1577,8 +1577,7 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
 }
 
 /**
- * scsi_scan_target - scan a target id, possibly including all LUNs on the
- *     target.
+ * scsi_scan_target - scan a target id, possibly including all LUNs on the target.
  * @parent:     host to scan
  * @channel:    channel to scan
  * @id:         target id to scan
diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index 3677fbb30b72..a0f308bd145b 100644
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -103,7 +103,6 @@ struct scsi_cmnd *scsi_host_get_command(struct Scsi_Host *shost,
         if (!cmd)
                 goto release_rq;
 
-        memset(cmd, 0, sizeof(*cmd));
         cmd->sc_data_direction = data_dir;
         cmd->jiffies_at_alloc = jiffies;
         cmd->request = rq;
@@ -382,6 +381,11 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
                 scsi_release_buffers(cmd);
                 goto unmap_rq;
         }
+        /*
+         * we use REQ_TYPE_BLOCK_PC so scsi_init_io doesn't set the
+         * length for us.
+         */
+        cmd->sdb.length = rq->data_len;
 
         return 0;
 
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 9981682d5302..ca7bb6f63bde 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -33,7 +33,7 @@
 #define ISCSI_SESSION_ATTRS 19
 #define ISCSI_CONN_ATTRS 13
 #define ISCSI_HOST_ATTRS 4
-#define ISCSI_TRANSPORT_VERSION "2.0-868"
+#define ISCSI_TRANSPORT_VERSION "2.0-869"
 
 struct iscsi_internal {
         int daemon_pid;
@@ -373,24 +373,25 @@ static void session_recovery_timedout(struct work_struct *work)
         scsi_target_unblock(&session->dev);
 }
 
-static void __iscsi_unblock_session(struct iscsi_cls_session *session)
-{
-        if (!cancel_delayed_work(&session->recovery_work))
-                flush_workqueue(iscsi_eh_timer_workq);
-        scsi_target_unblock(&session->dev);
-}
-
-void iscsi_unblock_session(struct iscsi_cls_session *session)
+static void __iscsi_unblock_session(struct work_struct *work)
 {
+        struct iscsi_cls_session *session =
+                        container_of(work, struct iscsi_cls_session,
+                                     unblock_work);
         struct Scsi_Host *shost = iscsi_session_to_shost(session);
         struct iscsi_host *ihost = shost->shost_data;
         unsigned long flags;
 
+        /*
+         * The recovery and unblock work get run from the same workqueue,
+         * so try to cancel it if it was going to run after this unblock.
+         */
+        cancel_delayed_work(&session->recovery_work);
         spin_lock_irqsave(&session->lock, flags);
         session->state = ISCSI_SESSION_LOGGED_IN;
         spin_unlock_irqrestore(&session->lock, flags);
-
-        __iscsi_unblock_session(session);
+        /* start IO */
+        scsi_target_unblock(&session->dev);
         /*
          * Only do kernel scanning if the driver is properly hooked into
          * the async scanning code (drivers like iscsi_tcp do login and
@@ -401,20 +402,43 @@ void iscsi_unblock_session(struct iscsi_cls_session *session)
                         atomic_inc(&ihost->nr_scans);
         }
 }
+
+/**
+ * iscsi_unblock_session - set a session as logged in and start IO.
+ * @session: iscsi session
+ *
+ * Mark a session as ready to accept IO.
+ */
+void iscsi_unblock_session(struct iscsi_cls_session *session)
+{
+        queue_work(iscsi_eh_timer_workq, &session->unblock_work);
+        /*
+         * make sure all the events have completed before tell the driver
+         * it is safe
+         */
+        flush_workqueue(iscsi_eh_timer_workq);
+}
 EXPORT_SYMBOL_GPL(iscsi_unblock_session);
 
-void iscsi_block_session(struct iscsi_cls_session *session)
+static void __iscsi_block_session(struct work_struct *work)
 {
+        struct iscsi_cls_session *session =
+                        container_of(work, struct iscsi_cls_session,
+                                     block_work);
         unsigned long flags;
 
         spin_lock_irqsave(&session->lock, flags);
         session->state = ISCSI_SESSION_FAILED;
         spin_unlock_irqrestore(&session->lock, flags);
-
         scsi_target_block(&session->dev);
         queue_delayed_work(iscsi_eh_timer_workq, &session->recovery_work,
                            session->recovery_tmo * HZ);
 }
+
+void iscsi_block_session(struct iscsi_cls_session *session)
+{
+        queue_work(iscsi_eh_timer_workq, &session->block_work);
+}
 EXPORT_SYMBOL_GPL(iscsi_block_session);
 
 static void __iscsi_unbind_session(struct work_struct *work)
@@ -463,6 +487,8 @@ iscsi_alloc_session(struct Scsi_Host *shost,
         INIT_DELAYED_WORK(&session->recovery_work, session_recovery_timedout);
         INIT_LIST_HEAD(&session->host_list);
         INIT_LIST_HEAD(&session->sess_list);
+        INIT_WORK(&session->unblock_work, __iscsi_unblock_session);
+        INIT_WORK(&session->block_work, __iscsi_block_session);
         INIT_WORK(&session->unbind_work, __iscsi_unbind_session);
         INIT_WORK(&session->scan_work, iscsi_scan_session);
         spin_lock_init(&session->lock);
@@ -575,24 +601,25 @@ void iscsi_remove_session(struct iscsi_cls_session *session)
         list_del(&session->sess_list);
         spin_unlock_irqrestore(&sesslock, flags);
 
+        /* make sure there are no blocks/unblocks queued */
+        flush_workqueue(iscsi_eh_timer_workq);
+        /* make sure the timedout callout is not running */
+        if (!cancel_delayed_work(&session->recovery_work))
+                flush_workqueue(iscsi_eh_timer_workq);
         /*
          * If we are blocked let commands flow again. The lld or iscsi
          * layer should set up the queuecommand to fail commands.
+         * We assume that LLD will not be calling block/unblock while
+         * removing the session.
          */
         spin_lock_irqsave(&session->lock, flags);
         session->state = ISCSI_SESSION_FREE;
         spin_unlock_irqrestore(&session->lock, flags);
-        __iscsi_unblock_session(session);
-        __iscsi_unbind_session(&session->unbind_work);
 
-        /* flush running scans */
+        scsi_target_unblock(&session->dev);
+        /* flush running scans then delete devices */
         flush_workqueue(ihost->scan_workq);
-        /*
-         * If the session dropped while removing devices then we need to make
-         * sure it is not blocked
-         */
-        if (!cancel_delayed_work(&session->recovery_work))
-                flush_workqueue(iscsi_eh_timer_workq);
+        __iscsi_unbind_session(&session->unbind_work);
 
         /* hw iscsi may not have removed all connections from session */
         err = device_for_each_child(&session->dev, NULL,
@@ -802,23 +829,16 @@ EXPORT_SYMBOL_GPL(iscsi_recv_pdu);
 
 void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error)
 {
-        struct iscsi_cls_session *session = iscsi_conn_to_session(conn);
         struct nlmsghdr *nlh;
         struct sk_buff  *skb;
         struct iscsi_uevent *ev;
         struct iscsi_internal *priv;
         int len = NLMSG_SPACE(sizeof(*ev));
-        unsigned long flags;
 
         priv = iscsi_if_transport_lookup(conn->transport);
         if (!priv)
                 return;
 
-        spin_lock_irqsave(&session->lock, flags);
-        if (session->state == ISCSI_SESSION_LOGGED_IN)
-                session->state = ISCSI_SESSION_FAILED;
-        spin_unlock_irqrestore(&session->lock, flags);
-
         skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
                 iscsi_cls_conn_printk(KERN_ERR, conn, "gracefully ignored "
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index 6f09cbd7fc48..97c68d021d28 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -91,6 +91,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
         /* Archtek America Corp. */
         /* Archtek SmartLink Modem 3334BT Plug & Play */
         {       "GVC000F",              0       },
+        /* Archtek SmartLink Modem 3334BRV 33.6K Data Fax Voice */
+        {       "GVC0303",              0       },
         /* Hayes */
         /* Hayes Optima 288 V.34-V.FC + FAX + Voice Plug & Play */
         {       "HAY0001",              0       },
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index b82595cf13e8..cf627cd1b4c8 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -686,7 +686,7 @@ config UART0_RTS_PIN
 
 config SERIAL_BFIN_UART1
         bool "Enable UART1"
-        depends on SERIAL_BFIN && (BF534 || BF536 || BF537 || BF54x)
+        depends on SERIAL_BFIN && (!BF531 && !BF532 && !BF533 && !BF561)
         help
           Enable UART1
 
@@ -699,14 +699,14 @@ config BFIN_UART1_CTSRTS
 
 config UART1_CTS_PIN
         int "UART1 CTS pin"
-        depends on BFIN_UART1_CTSRTS && (BF53x || BF561)
+        depends on BFIN_UART1_CTSRTS && !BF54x
         default -1
         help
           Refer to ./include/asm-blackfin/gpio.h to see the GPIO map.
 
 config UART1_RTS_PIN
         int "UART1 RTS pin"
-        depends on BFIN_UART1_CTSRTS && (BF53x || BF561)
+        depends on BFIN_UART1_CTSRTS && !BF54x
         default -1
         help
           Refer to ./include/asm-blackfin/gpio.h to see the GPIO map.
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index ac2a3ef28d55..0aa345b9a38b 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -1,30 +1,11 @@
 /*
- * File:         drivers/serial/bfin_5xx.c
- * Based on:     Based on drivers/serial/sa1100.c
- * Author:       Aubrey Li <aubrey.li@analog.com>
+ * Blackfin On-Chip Serial Driver
  *
- * Created:
- * Description:  Driver for blackfin 5xx serial ports
+ * Copyright 2006-2007 Analog Devices Inc.
  *
- * Modified:
- *               Copyright 2006 Analog Devices Inc.
+ * Enter bugs at http://blackfin.uclinux.org/
  *
- * Bugs:         Enter bugs at http://blackfin.uclinux.org/
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see the file COPYING, or write
- * to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ * Licensed under the GPL-2 or later.
  */
 
 #if defined(CONFIG_SERIAL_BFIN_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
@@ -67,14 +48,12 @@
 #define DMA_RX_XCOUNT           512
 #define DMA_RX_YCOUNT           (PAGE_SIZE / DMA_RX_XCOUNT)
 
-#define DMA_RX_FLUSH_JIFFIES    5
+#define DMA_RX_FLUSH_JIFFIES    (HZ / 50)
 
 #ifdef CONFIG_SERIAL_BFIN_DMA
 static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart);
 #else
-static void bfin_serial_do_work(struct work_struct *work);
 static void bfin_serial_tx_chars(struct bfin_serial_port *uart);
-static void local_put_char(struct bfin_serial_port *uart, char ch);
 #endif
 
 static void bfin_serial_mctrl_check(struct bfin_serial_port *uart);
@@ -85,23 +64,26 @@ static void bfin_serial_mctrl_check(struct bfin_serial_port *uart);
 static void bfin_serial_stop_tx(struct uart_port *port)
 {
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
+        struct circ_buf *xmit = &uart->port.info->xmit;
+#if !defined(CONFIG_BF54x) && !defined(CONFIG_SERIAL_BFIN_DMA)
+        unsigned short ier;
+#endif
 
         while (!(UART_GET_LSR(uart) & TEMT))
-                continue;
+                cpu_relax();
 
 #ifdef CONFIG_SERIAL_BFIN_DMA
         disable_dma(uart->tx_dma_channel);
+        xmit->tail = (xmit->tail + uart->tx_count) & (UART_XMIT_SIZE - 1);
+        uart->port.icount.tx += uart->tx_count;
+        uart->tx_count = 0;
+        uart->tx_done = 1;
 #else
 #ifdef CONFIG_BF54x
-        /* Waiting for Transmission Finished */
-        while (!(UART_GET_LSR(uart) & TFI))
-                continue;
         /* Clear TFI bit */
         UART_PUT_LSR(uart, TFI);
         UART_CLEAR_IER(uart, ETBEI);
 #else
-        unsigned short ier;
-
         ier = UART_GET_IER(uart);
         ier &= ~ETBEI;
         UART_PUT_IER(uart, ier);
@@ -117,7 +99,8 @@ static void bfin_serial_start_tx(struct uart_port *port)
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
 
 #ifdef CONFIG_SERIAL_BFIN_DMA
-        bfin_serial_dma_tx_chars(uart);
+        if (uart->tx_done)
+                bfin_serial_dma_tx_chars(uart);
 #else
 #ifdef CONFIG_BF54x
         UART_SET_IER(uart, ETBEI);
@@ -209,34 +192,27 @@ int kgdb_get_debug_char(void)
 }
 #endif
 
-#ifdef CONFIG_SERIAL_BFIN_PIO
-static void local_put_char(struct bfin_serial_port *uart, char ch)
-{
-        unsigned short status;
-        int flags = 0;
-
-        spin_lock_irqsave(&uart->port.lock, flags);
-
-        do {
-                status = UART_GET_LSR(uart);
-        } while (!(status & THRE));
-
-        UART_PUT_CHAR(uart, ch);
-        SSYNC();
-
-        spin_unlock_irqrestore(&uart->port.lock, flags);
-}
+#if ANOMALY_05000230 && defined(CONFIG_SERIAL_BFIN_PIO)
+# define UART_GET_ANOMALY_THRESHOLD(uart)    ((uart)->anomaly_threshold)
+# define UART_SET_ANOMALY_THRESHOLD(uart, v) ((uart)->anomaly_threshold = (v))
+#else
+# define UART_GET_ANOMALY_THRESHOLD(uart)    0
+# define UART_SET_ANOMALY_THRESHOLD(uart, v)
+#endif
 
+#ifdef CONFIG_SERIAL_BFIN_PIO
 static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
 {
         struct tty_struct *tty = uart->port.info->tty;
         unsigned int status, ch, flg;
-        static int in_break = 0;
+        static struct timeval anomaly_start = { .tv_sec = 0 };
 #ifdef CONFIG_KGDB_UART
         struct pt_regs *regs = get_irq_regs();
 #endif
 
         status = UART_GET_LSR(uart);
+        UART_CLEAR_LSR(uart);
+
         ch = UART_GET_CHAR(uart);
         uart->port.icount.rx++;
 
@@ -262,28 +238,56 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
 #endif
 
         if (ANOMALY_05000230) {
-                /* The BF533 family of processors have a nice misbehavior where
-                 * they continuously generate characters for a "single" break.
+                /* The BF533 (and BF561) family of processors have a nice anomaly
+                 * where they continuously generate characters for a "single" break.
                  * We have to basically ignore this flood until the "next" valid
-                 * character comes across.  All other Blackfin families operate
-                 * properly though.
+                 * character comes across.  Due to the nature of the flood, it is
+                 * not possible to reliably catch bytes that are sent too quickly
+                 * after this break.  So application code talking to the Blackfin
+                 * which sends a break signal must allow at least 1.5 character
+                 * times after the end of the break for things to stabilize.  This
+                 * timeout was picked as it must absolutely be larger than 1
+                 * character time +/- some percent.  So 1.5 sounds good.  All other
+                 * Blackfin families operate properly.  Woo.
                  * Note: While Anomaly 05000230 does not directly address this,
                  *       the changes that went in for it also fixed this issue.
+                 *       That anomaly was fixed in 0.5+ silicon.  I like bunnies.
                  */
-                if (in_break) {
-                        if (ch != 0) {
-                                in_break = 0;
-                                ch = UART_GET_CHAR(uart);
-                                if (bfin_revid() < 5)
-                                        return;
-                        } else
-                                return;
+                if (anomaly_start.tv_sec) {
+                        struct timeval curr;
+                        suseconds_t usecs;
+
+                        if ((~ch & (~ch + 1)) & 0xff)
+                                goto known_good_char;
+
+                        do_gettimeofday(&curr);
+                        if (curr.tv_sec - anomaly_start.tv_sec > 1)
+                                goto known_good_char;
+
+                        usecs = 0;
+                        if (curr.tv_sec != anomaly_start.tv_sec)
+                                usecs += USEC_PER_SEC;
+                        usecs += curr.tv_usec - anomaly_start.tv_usec;
+
+                        if (usecs > UART_GET_ANOMALY_THRESHOLD(uart))
+                                goto known_good_char;
+
+                        if (ch)
+                                anomaly_start.tv_sec = 0;
+                        else
+                                anomaly_start = curr;
+
+                        return;
+
+ known_good_char:
+                        anomaly_start.tv_sec = 0;
                 }
         }
 
         if (status & BI) {
                 if (ANOMALY_05000230)
-                        in_break = 1;
+                        if (bfin_revid() < 5)
+                                do_gettimeofday(&anomaly_start);
                 uart->port.icount.brk++;
                 if (uart_handle_break(&uart->port))
                         goto ignore_char;
@@ -324,7 +328,6 @@ static void bfin_serial_tx_chars(struct bfin_serial_port *uart)
                 UART_PUT_CHAR(uart, uart->port.x_char);
                 uart->port.icount.tx++;
                 uart->port.x_char = 0;
-                return;
         }
         /*
          * Check the modem control lines before
@@ -337,9 +340,12 @@ static void bfin_serial_tx_chars(struct bfin_serial_port *uart)
                 return;
         }
 
-        local_put_char(uart, xmit->buf[xmit->tail]);
-        xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
-        uart->port.icount.tx++;
+        while ((UART_GET_LSR(uart) & THRE) && xmit->tail != xmit->head) {
+                UART_PUT_CHAR(uart, xmit->buf[xmit->tail]);
+                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+                uart->port.icount.tx++;
+                SSYNC();
+        }
 
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                 uart_write_wakeup(&uart->port);
@@ -352,21 +358,11 @@ static irqreturn_t bfin_serial_rx_int(int irq, void *dev_id)
 {
         struct bfin_serial_port *uart = dev_id;
 
-#ifdef CONFIG_BF54x
-        unsigned short status;
-        spin_lock(&uart->port.lock);
-        status = UART_GET_LSR(uart);
-        while ((UART_GET_IER(uart) & ERBFI) && (status & DR)) {
-                bfin_serial_rx_chars(uart);
-                status = UART_GET_LSR(uart);
-        }
-        spin_unlock(&uart->port.lock);
-#else
         spin_lock(&uart->port.lock);
-        while ((UART_GET_IIR(uart) & IIR_STATUS) == IIR_RX_READY)
+        while (UART_GET_LSR(uart) & DR)
                 bfin_serial_rx_chars(uart);
         spin_unlock(&uart->port.lock);
-#endif
+
         return IRQ_HANDLED;
 }
 
@@ -374,25 +370,16 @@ static irqreturn_t bfin_serial_tx_int(int irq, void *dev_id)
 {
         struct bfin_serial_port *uart = dev_id;
 
-#ifdef CONFIG_BF54x
-        unsigned short status;
         spin_lock(&uart->port.lock);
-        status = UART_GET_LSR(uart);
-        while ((UART_GET_IER(uart) & ETBEI) && (status & THRE)) {
+        if (UART_GET_LSR(uart) & THRE)
                 bfin_serial_tx_chars(uart);
-                status = UART_GET_LSR(uart);
-        }
         spin_unlock(&uart->port.lock);
-#else
-        spin_lock(&uart->port.lock);
-        while ((UART_GET_IIR(uart) & IIR_STATUS) == IIR_TX_READY)
-                bfin_serial_tx_chars(uart);
-        spin_unlock(&uart->port.lock);
-#endif
+
         return IRQ_HANDLED;
 }
+#endif
 
-
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
 static void bfin_serial_do_work(struct work_struct *work)
 {
         struct bfin_serial_port *uart = container_of(work, struct bfin_serial_port, cts_workqueue);
@@ -406,33 +393,27 @@ static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
 {
         struct circ_buf *xmit = &uart->port.info->xmit;
         unsigned short ier;
-        int flags = 0;
-
-        if (!uart->tx_done)
-                return;
 
         uart->tx_done = 0;
 
+        if (uart_circ_empty(xmit) || uart_tx_stopped(&uart->port)) {
+                uart->tx_count = 0;
+                uart->tx_done = 1;
+                return;
+        }
+
         if (uart->port.x_char) {
                 UART_PUT_CHAR(uart, uart->port.x_char);
                 uart->port.icount.tx++;
                 uart->port.x_char = 0;
-                uart->tx_done = 1;
-                return;
         }
+
         /*
          * Check the modem control lines before
          * transmitting anything.
          */
         bfin_serial_mctrl_check(uart);
 
-        if (uart_circ_empty(xmit) || uart_tx_stopped(&uart->port)) {
-                bfin_serial_stop_tx(&uart->port);
-                uart->tx_done = 1;
-                return;
-        }
-
-        spin_lock_irqsave(&uart->port.lock, flags);
         uart->tx_count = CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE);
         if (uart->tx_count > (UART_XMIT_SIZE - xmit->tail))
                 uart->tx_count = UART_XMIT_SIZE - xmit->tail;
@@ -448,6 +429,7 @@ static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
         set_dma_x_count(uart->tx_dma_channel, uart->tx_count);
         set_dma_x_modify(uart->tx_dma_channel, 1);
         enable_dma(uart->tx_dma_channel);
+
 #ifdef CONFIG_BF54x
         UART_SET_IER(uart, ETBEI);
 #else
@@ -455,7 +437,6 @@ static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
         ier |= ETBEI;
         UART_PUT_IER(uart, ier);
 #endif
-        spin_unlock_irqrestore(&uart->port.lock, flags);
 }
 
 static void bfin_serial_dma_rx_chars(struct bfin_serial_port *uart)
@@ -464,7 +445,11 @@ static void bfin_serial_dma_rx_chars(struct bfin_serial_port *uart)
         int i, flg, status;
 
         status = UART_GET_LSR(uart);
-        uart->port.icount.rx += CIRC_CNT(uart->rx_dma_buf.head, uart->rx_dma_buf.tail, UART_XMIT_SIZE);;
+        UART_CLEAR_LSR(uart);
+
+        uart->port.icount.rx +=
+                CIRC_CNT(uart->rx_dma_buf.head, uart->rx_dma_buf.tail,
+                UART_XMIT_SIZE);
 
         if (status & BI) {
                 uart->port.icount.brk++;
@@ -490,10 +475,12 @@ static void bfin_serial_dma_rx_chars(struct bfin_serial_port *uart)
         else
                 flg = TTY_NORMAL;
 
-        for (i = uart->rx_dma_buf.head; i < uart->rx_dma_buf.tail; i++) {
-                if (uart_handle_sysrq_char(&uart->port, uart->rx_dma_buf.buf[i]))
-                        goto dma_ignore_char;
-                uart_insert_char(&uart->port, status, OE, uart->rx_dma_buf.buf[i], flg);
+        for (i = uart->rx_dma_buf.tail; i != uart->rx_dma_buf.head; i++) {
+                if (i >= UART_XMIT_SIZE)
+                        i = 0;
+                if (!uart_handle_sysrq_char(&uart->port, uart->rx_dma_buf.buf[i]))
+                        uart_insert_char(&uart->port, status, OE,
+                                uart->rx_dma_buf.buf[i], flg);
         }
 
  dma_ignore_char:
@@ -503,23 +490,23 @@ static void bfin_serial_dma_rx_chars(struct bfin_serial_port *uart)
 void bfin_serial_rx_dma_timeout(struct bfin_serial_port *uart)
 {
         int x_pos, pos;
-        int flags = 0;
-
-        bfin_serial_dma_tx_chars(uart);
 
-        spin_lock_irqsave(&uart->port.lock, flags);
-        x_pos = DMA_RX_XCOUNT - get_dma_curr_xcount(uart->rx_dma_channel);
+        uart->rx_dma_nrows = get_dma_curr_ycount(uart->rx_dma_channel);
+        x_pos = get_dma_curr_xcount(uart->rx_dma_channel);
+        uart->rx_dma_nrows = DMA_RX_YCOUNT - uart->rx_dma_nrows;
+        if (uart->rx_dma_nrows == DMA_RX_YCOUNT)
+                uart->rx_dma_nrows = 0;
+        x_pos = DMA_RX_XCOUNT - x_pos;
         if (x_pos == DMA_RX_XCOUNT)
                 x_pos = 0;
 
         pos = uart->rx_dma_nrows * DMA_RX_XCOUNT + x_pos;
-
-        if (pos>uart->rx_dma_buf.tail) {
-                uart->rx_dma_buf.tail = pos;
+        if (pos != uart->rx_dma_buf.tail) {
+                uart->rx_dma_buf.head = pos;
                 bfin_serial_dma_rx_chars(uart);
-                uart->rx_dma_buf.head = uart->rx_dma_buf.tail;
+                uart->rx_dma_buf.tail = uart->rx_dma_buf.head;
         }
-        spin_unlock_irqrestore(&uart->port.lock, flags);
+
         uart->rx_dma_timer.expires = jiffies + DMA_RX_FLUSH_JIFFIES;
         add_timer(&(uart->rx_dma_timer));
 }
@@ -532,8 +519,8 @@ static irqreturn_t bfin_serial_dma_tx_int(int irq, void *dev_id)
 
         spin_lock(&uart->port.lock);
         if (!(get_dma_curr_irqstat(uart->tx_dma_channel)&DMA_RUN)) {
-                clear_dma_irqstat(uart->tx_dma_channel);
                 disable_dma(uart->tx_dma_channel);
+                clear_dma_irqstat(uart->tx_dma_channel);
 #ifdef CONFIG_BF54x
                 UART_CLEAR_IER(uart, ETBEI);
 #else
@@ -541,15 +528,13 @@ static irqreturn_t bfin_serial_dma_tx_int(int irq, void *dev_id)
                 ier &= ~ETBEI;
                 UART_PUT_IER(uart, ier);
 #endif
-                xmit->tail = (xmit->tail+uart->tx_count) &(UART_XMIT_SIZE -1);
-                uart->port.icount.tx+=uart->tx_count;
+                xmit->tail = (xmit->tail + uart->tx_count) & (UART_XMIT_SIZE - 1);
+                uart->port.icount.tx += uart->tx_count;
 
                 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                         uart_write_wakeup(&uart->port);
 
-                if (uart_circ_empty(xmit))
-                        bfin_serial_stop_tx(&uart->port);
-                uart->tx_done = 1;
+                bfin_serial_dma_tx_chars(uart);
         }
 
         spin_unlock(&uart->port.lock);
@@ -561,18 +546,15 @@ static irqreturn_t bfin_serial_dma_rx_int(int irq, void *dev_id)
         struct bfin_serial_port *uart = dev_id;
         unsigned short irqstat;
 
-        uart->rx_dma_nrows++;
-        if (uart->rx_dma_nrows == DMA_RX_YCOUNT) {
-                uart->rx_dma_nrows = 0;
-                uart->rx_dma_buf.tail = DMA_RX_XCOUNT*DMA_RX_YCOUNT;
-                bfin_serial_dma_rx_chars(uart);
-                uart->rx_dma_buf.head = uart->rx_dma_buf.tail = 0;
-        }
         spin_lock(&uart->port.lock);
         irqstat = get_dma_curr_irqstat(uart->rx_dma_channel);
         clear_dma_irqstat(uart->rx_dma_channel);
-
         spin_unlock(&uart->port.lock);
+
+        del_timer(&(uart->rx_dma_timer));
+        uart->rx_dma_timer.expires = jiffies;
+        add_timer(&(uart->rx_dma_timer));
+
         return IRQ_HANDLED;
 }
 #endif
@@ -599,7 +581,11 @@ static unsigned int bfin_serial_get_mctrl(struct uart_port *port)
         if (uart->cts_pin < 0)
                 return TIOCM_CTS | TIOCM_DSR | TIOCM_CAR;
 
+# ifdef BF54x
+        if (UART_GET_MSR(uart) & CTS)
+# else
         if (gpio_get_value(uart->cts_pin))
+# endif
                 return TIOCM_DSR | TIOCM_CAR;
         else
 #endif
@@ -614,9 +600,17 @@ static void bfin_serial_set_mctrl(struct uart_port *port, unsigned int mctrl)
                 return;
 
         if (mctrl & TIOCM_RTS)
+# ifdef BF54x
+                UART_PUT_MCR(uart, UART_GET_MCR(uart) & ~MRTS);
+# else
                 gpio_set_value(uart->rts_pin, 0);
+# endif
         else
+# ifdef BF54x
+                UART_PUT_MCR(uart, UART_GET_MCR(uart) | MRTS);
+# else
                 gpio_set_value(uart->rts_pin, 1);
+# endif
 #endif
 }
 
@@ -627,22 +621,17 @@ static void bfin_serial_mctrl_check(struct bfin_serial_port *uart)
 {
 #ifdef CONFIG_SERIAL_BFIN_CTSRTS
         unsigned int status;
-# ifdef CONFIG_SERIAL_BFIN_DMA
         struct uart_info *info = uart->port.info;
         struct tty_struct *tty = info->tty;
 
         status = bfin_serial_get_mctrl(&uart->port);
+        uart_handle_cts_change(&uart->port, status & TIOCM_CTS);
         if (!(status & TIOCM_CTS)) {
                 tty->hw_stopped = 1;
+                schedule_work(&uart->cts_workqueue);
         } else {
                 tty->hw_stopped = 0;
         }
-# else
-        status = bfin_serial_get_mctrl(&uart->port);
-        uart_handle_cts_change(&uart->port, status & TIOCM_CTS);
-        if (!(status & TIOCM_CTS))
-                schedule_work(&uart->cts_workqueue);
-# endif
 #endif
 }
 
@@ -743,6 +732,7 @@ static void bfin_serial_shutdown(struct uart_port *port)
         disable_dma(uart->rx_dma_channel);
         free_dma(uart->rx_dma_channel);
         del_timer(&(uart->rx_dma_timer));
+        dma_free_coherent(NULL, PAGE_SIZE, uart->rx_dma_buf.buf, 0);
 #else
 #ifdef  CONFIG_KGDB_UART
         if (uart->port.line != CONFIG_KGDB_UART_PORT)
@@ -814,6 +804,8 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
         quot = uart_get_divisor(port, baud);
         spin_lock_irqsave(&uart->port.lock, flags);
 
+        UART_SET_ANOMALY_THRESHOLD(uart, USEC_PER_SEC / baud * 15);
+
         do {
                 lsr = UART_GET_LSR(uart);
         } while (!(lsr & TEMT));
@@ -956,10 +948,9 @@ static void __init bfin_serial_init_ports(void)
                 bfin_serial_ports[i].rx_dma_channel =
                         bfin_serial_resource[i].uart_rx_dma_channel;
                 init_timer(&(bfin_serial_ports[i].rx_dma_timer));
-#else
-                INIT_WORK(&bfin_serial_ports[i].cts_workqueue, bfin_serial_do_work);
 #endif
 #ifdef CONFIG_SERIAL_BFIN_CTSRTS
+                INIT_WORK(&bfin_serial_ports[i].cts_workqueue, bfin_serial_do_work);
                 bfin_serial_ports[i].cts_pin        =
                         bfin_serial_resource[i].uart_cts_pin;
                 bfin_serial_ports[i].rts_pin        =
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index 348ee2c19b58..c2bb11c02bde 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -421,7 +421,7 @@ static void transmit_chars(struct uart_sio_port *up)
                 up->port.icount.tx++;
                 if (uart_circ_empty(xmit))
                         break;
-                while (!serial_in(up, UART_LSR) & UART_LSR_THRE);
+                while (!(serial_in(up, UART_LSR) & UART_LSR_THRE));
 
         } while (--count > 0);
 
diff --git a/drivers/serial/of_serial.c b/drivers/serial/of_serial.c
index a64d85821996..c0e50a461055 100644
--- a/drivers/serial/of_serial.c
+++ b/drivers/serial/of_serial.c
@@ -138,7 +138,7 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
         { /* end of list */ },
 };
 
-static struct of_platform_driver __devinitdata of_platform_serial_driver = {
+static struct of_platform_driver of_platform_serial_driver = {
         .owner = THIS_MODULE,
         .name = "of_serial",
         .probe = of_platform_serial_probe,
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 9ce12cb2cebc..a8c116b80bff 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -41,6 +41,7 @@
 #include <linux/delay.h>
 #include <linux/console.h>
 #include <linux/platform_device.h>
+#include <linux/serial_sci.h>
 
 #ifdef CONFIG_CPU_FREQ
 #include <linux/notifier.h>
@@ -54,7 +55,6 @@
 #include <asm/kgdb.h>
 #endif
 
-#include <asm/sci.h>
 #include "sh-sci.h"
 
 struct sci_port {
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index 9cfcfd8dad5e..617efb1640b1 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -1,7 +1,7 @@
 /*
  * Core maple bus functionality
  *
- *  Copyright (C) 2007 Adrian McMenamin
+ *  Copyright (C) 2007, 2008 Adrian McMenamin
  *
  * Based on 2.4 code by:
  *
@@ -18,7 +18,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/device.h>
-#include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/io.h>
@@ -54,7 +53,7 @@ static struct device maple_bus;
 static int subdevice_map[MAPLE_PORTS];
 static unsigned long *maple_sendbuf, *maple_sendptr, *maple_lastptr;
 static unsigned long maple_pnp_time;
-static int started, scanning, liststatus, realscan;
+static int started, scanning, liststatus, fullscan;
 static struct kmem_cache *maple_queue_cache;
 
 struct maple_device_specify {
@@ -62,6 +61,9 @@ struct maple_device_specify {
         int unit;
 };
 
+static bool checked[4];
+static struct maple_device *baseunits[4];
+
 /**
  *  maple_driver_register - register a device driver
  *  automatically makes the driver bus a maple bus
@@ -309,11 +311,9 @@ static void maple_attach_driver(struct maple_device *mdev)
                 else
                         break;
 
-        if (realscan) {
-                printk(KERN_INFO "Maple device detected: %s\n",
-                        mdev->product_name);
-                printk(KERN_INFO "Maple device: %s\n", mdev->product_licence);
-        }
+        printk(KERN_INFO "Maple device detected: %s\n",
+                mdev->product_name);
+        printk(KERN_INFO "Maple device: %s\n", mdev->product_licence);
 
         function = be32_to_cpu(mdev->devinfo.function);
 
@@ -323,10 +323,9 @@ static void maple_attach_driver(struct maple_device *mdev)
                 mdev->driver = &maple_dummy_driver;
                 sprintf(mdev->dev.bus_id, "%d:0.port", mdev->port);
         } else {
-                if (realscan)
-                        printk(KERN_INFO
-                                "Maple bus at (%d, %d): Function 0x%lX\n",
-                                mdev->port, mdev->unit, function);
+                printk(KERN_INFO
+                        "Maple bus at (%d, %d): Function 0x%lX\n",
+                        mdev->port, mdev->unit, function);
 
                 matched =
                     bus_for_each_drv(&maple_bus_type, NULL, mdev,
@@ -334,9 +333,8 @@ static void maple_attach_driver(struct maple_device *mdev)
 
                 if (matched == 0) {
                         /* Driver does not exist yet */
-                        if (realscan)
-                                printk(KERN_INFO
-                                        "No maple driver found.\n");
+                        printk(KERN_INFO
+                                "No maple driver found.\n");
                         mdev->driver = &maple_dummy_driver;
                 }
                 sprintf(mdev->dev.bus_id, "%d:0%d.%lX", mdev->port,
@@ -472,9 +470,12 @@ static void maple_response_none(struct maple_device *mdev,
                 maple_detach_driver(mdev);
                 return;
         }
-        if (!started) {
-                printk(KERN_INFO "No maple devices attached to port %d\n",
-                       mdev->port);
+        if (!started || !fullscan) {
+                if (checked[mdev->port] == false) {
+                        checked[mdev->port] = true;
+                        printk(KERN_INFO "No maple devices attached"
+                                " to port %d\n", mdev->port);
+                }
                 return;
         }
         maple_clean_submap(mdev);
@@ -485,8 +486,14 @@ static void maple_response_devinfo(struct maple_device *mdev,
                                    char *recvbuf)
 {
         char submask;
-        if ((!started) || (scanning == 2)) {
-                maple_attach_driver(mdev);
+        if (!started || (scanning == 2) || !fullscan) {
+                if ((mdev->unit == 0) && (checked[mdev->port] == false)) {
+                        checked[mdev->port] = true;
+                        maple_attach_driver(mdev);
+                } else {
+                        if (mdev->unit != 0)
+                                maple_attach_driver(mdev);
+                }
                 return;
         }
         if (mdev->unit == 0) {
@@ -505,6 +512,7 @@ static void maple_dma_handler(struct work_struct *work)
         struct maple_device *dev;
         char *recvbuf;
         enum maple_code code;
+        int i;
 
         if (!maple_dma_done())
                 return;
@@ -557,6 +565,19 @@ static void maple_dma_handler(struct work_struct *work)
                 } else
                         scanning = 0;
 
+                if (!fullscan) {
+                        fullscan = 1;
+                        for (i = 0; i < MAPLE_PORTS; i++) {
+                                if (checked[i] == false) {
+                                        fullscan = 0;
+                                        dev = baseunits[i];
+                                        dev->mq->command =
+                                                MAPLE_COMMAND_DEVINFO;
+                                        dev->mq->length = 0;
+                                        maple_add_packet(dev->mq);
+                                }
+                        }
+                }
                 if (started == 0)
                         started = 1;
         }
@@ -694,7 +715,9 @@ static int __init maple_bus_init(void)
 
         /* setup maple ports */
         for (i = 0; i < MAPLE_PORTS; i++) {
+                checked[i] = false;
                 mdev[i] = maple_alloc_dev(i, 0);
+                baseunits[i] = mdev[i];
                 if (!mdev[i]) {
                         while (i-- > 0)
                                 maple_free_dev(mdev[i]);
@@ -703,12 +726,9 @@ static int __init maple_bus_init(void)
                 mdev[i]->mq->command = MAPLE_COMMAND_DEVINFO;
                 mdev[i]->mq->length = 0;
                 maple_add_packet(mdev[i]->mq);
-                /* delay aids hardware detection */
-                mdelay(5);
                 subdevice_map[i] = 0;
         }
 
-        realscan = 1;
         /* setup maplebus hardware */
         maplebus_dma_reset();
         /* initial detection */
diff --git a/drivers/spi/mpc52xx_psc_spi.c b/drivers/spi/mpc52xx_psc_spi.c
index 253ed5682a6d..a86315a0c5b8 100644
--- a/drivers/spi/mpc52xx_psc_spi.c
+++ b/drivers/spi/mpc52xx_psc_spi.c
@@ -42,6 +42,7 @@ struct mpc52xx_psc_spi {
 
         /* driver internal data */
         struct mpc52xx_psc __iomem *psc;
+        struct mpc52xx_psc_fifo __iomem *fifo;
         unsigned int irq;
         u8 bits_per_word;
         u8 busy;
@@ -139,6 +140,7 @@ static int mpc52xx_psc_spi_transfer_rxtx(struct spi_device *spi,
 {
         struct mpc52xx_psc_spi *mps = spi_master_get_devdata(spi->master);
         struct mpc52xx_psc __iomem *psc = mps->psc;
+        struct mpc52xx_psc_fifo __iomem *fifo = mps->fifo;
         unsigned rb = 0;        /* number of bytes receieved */
         unsigned sb = 0;        /* number of bytes sent */
         unsigned char *rx_buf = (unsigned char *)t->rx_buf;
@@ -190,11 +192,11 @@ static int mpc52xx_psc_spi_transfer_rxtx(struct spi_device *spi,
                         out_8(&psc->mode, 0);
                 } else {
                         out_8(&psc->mode, MPC52xx_PSC_MODE_FFULL);
-                        out_be16(&psc->rfalarm, rfalarm);
+                        out_be16(&fifo->rfalarm, rfalarm);
                 }
                 out_be16(&psc->mpc52xx_psc_imr, MPC52xx_PSC_IMR_RXRDY);
                 wait_for_completion(&mps->done);
-                recv_at_once = in_be16(&psc->rfnum);
+                recv_at_once = in_be16(&fifo->rfnum);
                 dev_dbg(&spi->dev, "%d bytes received\n", recv_at_once);
 
                 send_at_once = recv_at_once;
@@ -331,6 +333,7 @@ static void mpc52xx_psc_spi_cleanup(struct spi_device *spi)
 static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
 {
         struct mpc52xx_psc __iomem *psc = mps->psc;
+        struct mpc52xx_psc_fifo __iomem *fifo = mps->fifo;
         u32 mclken_div;
         int ret = 0;
 
@@ -346,7 +349,7 @@ static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
         /* Disable interrupts, interrupts are based on alarm level */
         out_be16(&psc->mpc52xx_psc_imr, 0);
         out_8(&psc->command, MPC52xx_PSC_SEL_MODE_REG_1);
-        out_8(&psc->rfcntl, 0);
+        out_8(&fifo->rfcntl, 0);
         out_8(&psc->mode, MPC52xx_PSC_MODE_FFULL);
 
         /* Configure 8bit codec mode as a SPI master and use EOF flags */
@@ -419,6 +422,8 @@ static int __init mpc52xx_psc_spi_do_probe(struct device *dev, u32 regaddr,
                 ret = -EFAULT;
                 goto free_master;
         }
+        /* On the 5200, fifo regs are immediately ajacent to the psc regs */
+        mps->fifo = ((void __iomem *)mps->psc) + sizeof(struct mpc52xx_psc);
 
         ret = request_irq(mps->irq, mpc52xx_psc_spi_isr, 0, "mpc52xx-psc-spi",
                                 mps);
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index 78fd33125e02..adea792fb675 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -35,6 +35,11 @@ config SSB_PCIHOST
 
           If unsure, say Y
 
+config SSB_B43_PCI_BRIDGE
+        bool
+        depends on SSB_PCIHOST
+        default n
+
 config SSB_PCMCIAHOST_POSSIBLE
         bool
         depends on SSB && (PCMCIA = y || PCMCIA = SSB) && EXPERIMENTAL
diff --git a/drivers/ssb/Makefile b/drivers/ssb/Makefile
index e235144add7c..de94c2eb7a37 100644
--- a/drivers/ssb/Makefile
+++ b/drivers/ssb/Makefile
@@ -14,6 +14,6 @@ ssb-$(CONFIG_SSB_DRIVER_PCICORE)	+= driver_pcicore.o
 
 # b43 pci-ssb-bridge driver
 # Not strictly a part of SSB, but kept here for convenience
-ssb-$(CONFIG_SSB_PCIHOST)               += b43_pci_bridge.o
+ssb-$(CONFIG_SSB_B43_PCI_BRIDGE)        += b43_pci_bridge.o
 
 obj-$(CONFIG_SSB)                       += ssb.o
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 6d99a9880055..74b9a8aea52b 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -111,7 +111,10 @@ static void __init ssb_fixup_pcibridge(struct pci_dev *dev)
 
         /* Enable PCI bridge bus mastering and memory space */
         pci_set_master(dev);
-        pcibios_enable_device(dev, ~0);
+        if (pcibios_enable_device(dev, ~0) < 0) {
+                ssb_printk(KERN_ERR "PCI: SSB bridge enable failed\n");
+                return;
+        }
 
         /* Enable PCI bridge BAR1 prefetch and burst */
         pci_write_config_dword(dev, SSB_BAR1_CONTROL, 3);
@@ -393,7 +396,7 @@ static int pcicore_is_in_hostmode(struct ssb_pcicore *pc)
             chipid_top != 0x5300)
                 return 0;
 
-        if (bus->sprom.r1.boardflags_lo & SSB_PCICORE_BFL_NOPCI)
+        if (bus->sprom.boardflags_lo & SSB_PCICORE_BFL_NOPCI)
                 return 0;
 
         /* The 200-pin BCM4712 package does not bond out PCI. Even when
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index a789364264a6..21eca2b5118b 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -120,10 +120,10 @@ extern int ssb_devices_thaw(struct ssb_bus *bus);
 extern struct ssb_bus *ssb_pci_dev_to_bus(struct pci_dev *pdev);
 
 /* b43_pci_bridge.c */
-#ifdef CONFIG_SSB_PCIHOST
+#ifdef CONFIG_SSB_B43_PCI_BRIDGE
 extern int __init b43_pci_ssb_bridge_init(void);
 extern void __exit b43_pci_ssb_bridge_exit(void);
-#else /* CONFIG_SSB_PCIHOST */
+#else /* CONFIG_SSB_B43_PCI_BRIDGR */
 static inline int b43_pci_ssb_bridge_init(void)
 {
         return 0;
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 5c33cdb9cac7..a2b0aa48b8ea 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -87,12 +87,13 @@ config USB_DYNAMIC_MINORS
           If you are unsure about this, say N here.
 
 config USB_SUSPEND
-        bool "USB selective suspend/resume and wakeup (EXPERIMENTAL)"
-        depends on USB && PM && EXPERIMENTAL
+        bool "USB selective suspend/resume and wakeup"
+        depends on USB && PM
         help
           If you say Y here, you can use driver calls or the sysfs
-          "power/state" file to suspend or resume individual USB
-          peripherals.
+          "power/level" file to suspend or resume individual USB
+          peripherals and to enable or disable autosuspend (see
+          Documentation/usb/power-management.txt for more details).
 
           Also, USB "remote wakeup" signaling is supported, whereby some
           USB devices (like keyboards and network adapters) can wake up
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f90ab5e94c58..d9d1eb19f2a1 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -28,35 +28,38 @@
  * devices is broken...
  */
 static const struct usb_device_id usb_quirk_list[] = {
-        /* Action Semiconductor flash disk */
-        { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255},
-
         /* CBM - Flash disk */
         { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* HP 5300/5370C scanner */
-        { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
+        { USB_DEVICE(0x03f0, 0x0701), .driver_info =
+                        USB_QUIRK_STRING_FETCH_255 },
 
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Philips PSC805 audio device */
+        { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Roland SC-8820 */
         { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
 
         /* Edirol SD-20 */
         { USB_DEVICE(0x0582, 0x0027), .driver_info = USB_QUIRK_RESET_RESUME },
 
-        /* INTEL VALUE SSD */
-        { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
-
         /* M-Systems Flash Disk Pioneers */
         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
 
-        /* Philips PSC805 audio device */
-        { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Action Semiconductor flash disk */
+        { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+                        USB_QUIRK_STRING_FETCH_255 },
 
         /* SKYMEDI USB_DRIVE */
         { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* INTEL VALUE SSD */
+        { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
         { }  /* terminating entry must be last */
 };
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 4e984060c984..1f0db51190cc 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -99,8 +99,7 @@ struct usb_interface *usb_ifnum_to_if(const struct usb_device *dev,
 EXPORT_SYMBOL_GPL(usb_ifnum_to_if);
 
 /**
- * usb_altnum_to_altsetting - get the altsetting structure with a given
- *      alternate setting number.
+ * usb_altnum_to_altsetting - get the altsetting structure with a given alternate setting number.
  * @intf: the interface containing the altsetting in question
  * @altnum: the desired alternate setting number
  *
@@ -234,7 +233,7 @@ static int ksuspend_usb_init(void)
          * singlethreaded.  Its job doesn't justify running on more
          * than one CPU.
          */
-        ksuspend_usb_wq = create_singlethread_workqueue("ksuspend_usbd");
+        ksuspend_usb_wq = create_freezeable_workqueue("ksuspend_usbd");
         if (!ksuspend_usb_wq)
                 return -ENOMEM;
         return 0;
@@ -442,8 +441,7 @@ EXPORT_SYMBOL_GPL(usb_put_intf);
  */
 
 /**
- * usb_lock_device_for_reset - cautiously acquire the lock for a
- *      usb device structure
+ * usb_lock_device_for_reset - cautiously acquire the lock for a usb device structure
  * @udev: device that's being locked
  * @iface: interface bound to the driver making the request (optional)
  *
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index c13955164686..6f45dd669b33 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -131,7 +131,7 @@ config USB_ATMEL_USBA
 
 config USB_GADGET_FSL_USB2
         boolean "Freescale Highspeed USB DR Peripheral Controller"
-        depends on MPC834x || PPC_MPC831x
+        depends on FSL_SOC
         select USB_GADGET_DUALSPEED
         help
            Some of Freescale PowerPC processors have a High Speed
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 4f6bfa100f2a..2c32bd08ee7d 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -92,7 +92,6 @@ struct printer_dev {
         u8                      *current_rx_buf;
         u8                      printer_status;
         u8                      reset_printer;
-        struct class_device     *printer_class_dev;
         struct cdev             printer_cdev;
         struct device           *pdev;
         u8                      printer_cdev_open;
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index 4402d6f042d9..096c41cc40d1 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -103,6 +103,12 @@ static const char ep0name [] = "ep0";
 #error "Can't configure both IXP and PXA"
 #endif
 
+/* IXP doesn't yet support <linux/clk.h> */
+#define clk_get(dev,name)       NULL
+#define clk_enable(clk)         do { } while (0)
+#define clk_disable(clk)        do { } while (0)
+#define clk_put(clk)            do { } while (0)
+
 #endif
 
 #include "pxa2xx_udc.h"
@@ -934,20 +940,31 @@ static void udc_disable(struct pxa2xx_udc *);
 /* We disable the UDC -- and its 48 MHz clock -- whenever it's not
  * in active use.
  */
-static int pullup(struct pxa2xx_udc *udc, int is_active)
+static int pullup(struct pxa2xx_udc *udc)
 {
-        is_active = is_active && udc->vbus && udc->pullup;
+        int is_active = udc->vbus && udc->pullup && !udc->suspended;
         DMSG("%s\n", is_active ? "active" : "inactive");
-        if (is_active)
-                udc_enable(udc);
-        else {
-                if (udc->gadget.speed != USB_SPEED_UNKNOWN) {
-                        DMSG("disconnect %s\n", udc->driver
-                                ? udc->driver->driver.name
-                                : "(no driver)");
-                        stop_activity(udc, udc->driver);
+        if (is_active) {
+                if (!udc->active) {
+                        udc->active = 1;
+                        /* Enable clock for USB device */
+                        clk_enable(udc->clk);
+                        udc_enable(udc);
                 }
-                udc_disable(udc);
+        } else {
+                if (udc->active) {
+                        if (udc->gadget.speed != USB_SPEED_UNKNOWN) {
+                                DMSG("disconnect %s\n", udc->driver
+                                        ? udc->driver->driver.name
+                                        : "(no driver)");
+                                stop_activity(udc, udc->driver);
+                        }
+                        udc_disable(udc);
+                        /* Disable clock for USB device */
+                        clk_disable(udc->clk);
+                        udc->active = 0;
+                }
+
         }
         return 0;
 }
@@ -958,9 +975,9 @@ static int pxa2xx_udc_vbus_session(struct usb_gadget *_gadget, int is_active)
         struct pxa2xx_udc       *udc;
 
         udc = container_of(_gadget, struct pxa2xx_udc, gadget);
-        udc->vbus = is_active = (is_active != 0);
+        udc->vbus = (is_active != 0);
         DMSG("vbus %s\n", is_active ? "supplied" : "inactive");
-        pullup(udc, is_active);
+        pullup(udc);
         return 0;
 }
 
@@ -975,9 +992,8 @@ static int pxa2xx_udc_pullup(struct usb_gadget *_gadget, int is_active)
         if (!udc->mach->gpio_pullup && !udc->mach->udc_command)
                 return -EOPNOTSUPP;
 
-        is_active = (is_active != 0);
-        udc->pullup = is_active;
-        pullup(udc, is_active);
+        udc->pullup = (is_active != 0);
+        pullup(udc);
         return 0;
 }
 
@@ -997,7 +1013,7 @@ static const struct usb_gadget_ops pxa2xx_udc_ops = {
 #ifdef CONFIG_USB_GADGET_DEBUG_FS
 
 static int
-udc_seq_show(struct seq_file *m, void *d)
+udc_seq_show(struct seq_file *m, void *_d)
 {
         struct pxa2xx_udc       *dev = m->private;
         unsigned long           flags;
@@ -1146,11 +1162,6 @@ static void udc_disable(struct pxa2xx_udc *dev)
 
         udc_clear_mask_UDCCR(UDCCR_UDE);
 
-#ifdef  CONFIG_ARCH_PXA
-        /* Disable clock for USB device */
-        clk_disable(dev->clk);
-#endif
-
         ep0_idle (dev);
         dev->gadget.speed = USB_SPEED_UNKNOWN;
 }
@@ -1191,11 +1202,6 @@ static void udc_enable (struct pxa2xx_udc *dev)
 {
         udc_clear_mask_UDCCR(UDCCR_UDE);
 
-#ifdef  CONFIG_ARCH_PXA
-        /* Enable clock for USB device */
-        clk_enable(dev->clk);
-#endif
-
         /* try to clear these bits before we enable the udc */
         udc_ack_int_UDCCR(UDCCR_SUSIR|/*UDCCR_RSTIR|*/UDCCR_RESIR);
 
@@ -1286,7 +1292,7 @@ fail:
          * for set_configuration as well as eventual disconnect.
          */
         DMSG("registered gadget driver '%s'\n", driver->driver.name);
-        pullup(dev, 1);
+        pullup(dev);
         dump_state(dev);
         return 0;
 }
@@ -1329,7 +1335,8 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
                 return -EINVAL;
 
         local_irq_disable();
-        pullup(dev, 0);
+        dev->pullup = 0;
+        pullup(dev);
         stop_activity(dev, driver);
         local_irq_enable();
 
@@ -2131,13 +2138,11 @@ static int __init pxa2xx_udc_probe(struct platform_device *pdev)
         if (irq < 0)
                 return -ENODEV;
 
-#ifdef  CONFIG_ARCH_PXA
         dev->clk = clk_get(&pdev->dev, "UDCCLK");
         if (IS_ERR(dev->clk)) {
                 retval = PTR_ERR(dev->clk);
                 goto err_clk;
         }
-#endif
 
         pr_debug("%s: IRQ %d%s%s\n", driver_name, irq,
                 dev->has_cfr ? "" : " (!cfr)",
@@ -2250,10 +2255,8 @@ lubbock_fail0:
         if (dev->mach->gpio_vbus)
                 gpio_free(dev->mach->gpio_vbus);
  err_gpio_vbus:
-#ifdef  CONFIG_ARCH_PXA
         clk_put(dev->clk);
  err_clk:
-#endif
         return retval;
 }
 
@@ -2269,7 +2272,9 @@ static int __exit pxa2xx_udc_remove(struct platform_device *pdev)
         if (dev->driver)
                 return -EBUSY;
 
-        udc_disable(dev);
+        dev->pullup = 0;
+        pullup(dev);
+
         remove_debug_files(dev);
 
         if (dev->got_irq) {
@@ -2289,9 +2294,7 @@ static int __exit pxa2xx_udc_remove(struct platform_device *pdev)
         if (dev->mach->gpio_pullup)
                 gpio_free(dev->mach->gpio_pullup);
 
-#ifdef  CONFIG_ARCH_PXA
         clk_put(dev->clk);
-#endif
 
         platform_set_drvdata(pdev, NULL);
         the_controller = NULL;
@@ -2317,10 +2320,15 @@ static int __exit pxa2xx_udc_remove(struct platform_device *pdev)
 static int pxa2xx_udc_suspend(struct platform_device *dev, pm_message_t state)
 {
         struct pxa2xx_udc       *udc = platform_get_drvdata(dev);
+        unsigned long flags;
 
         if (!udc->mach->gpio_pullup && !udc->mach->udc_command)
                 WARN("USB host won't detect disconnect!\n");
-        pullup(udc, 0);
+        udc->suspended = 1;
+
+        local_irq_save(flags);
+        pullup(udc);
+        local_irq_restore(flags);
 
         return 0;
 }
@@ -2328,8 +2336,12 @@ static int pxa2xx_udc_suspend(struct platform_device *dev, pm_message_t state)
 static int pxa2xx_udc_resume(struct platform_device *dev)
 {
         struct pxa2xx_udc       *udc = platform_get_drvdata(dev);
+        unsigned long flags;
 
-        pullup(udc, 1);
+        udc->suspended = 0;
+        local_irq_save(flags);
+        pullup(udc);
+        local_irq_restore(flags);
 
         return 0;
 }
diff --git a/drivers/usb/gadget/pxa2xx_udc.h b/drivers/usb/gadget/pxa2xx_udc.h
index b67e3ff5e4eb..e2c19e88c875 100644
--- a/drivers/usb/gadget/pxa2xx_udc.h
+++ b/drivers/usb/gadget/pxa2xx_udc.h
@@ -119,7 +119,9 @@ struct pxa2xx_udc {
                                                 has_cfr : 1,
                                                 req_pending : 1,
                                                 req_std : 1,
-                                                req_config : 1;
+                                                req_config : 1,
+                                                suspended : 1,
+                                                active : 1;
 
 #define start_watchdog(dev) mod_timer(&dev->timer, jiffies + (HZ/200))
         struct timer_list                       timer;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index b8ad55aff842..46ee7f4c0912 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -281,23 +281,44 @@ static void ehci_iaa_watchdog(unsigned long param)
 {
         struct ehci_hcd         *ehci = (struct ehci_hcd *) param;
         unsigned long           flags;
-        u32                     status, cmd;
 
         spin_lock_irqsave (&ehci->lock, flags);
-        WARN_ON(!ehci->reclaim);
 
-        status = ehci_readl(ehci, &ehci->regs->status);
-        cmd = ehci_readl(ehci, &ehci->regs->command);
-        ehci_dbg(ehci, "IAA watchdog: status %x cmd %x\n", status, cmd);
-
-        /* lost IAA irqs wedge things badly; seen first with a vt8235 */
-        if (ehci->reclaim) {
-                if (status & STS_IAA) {
-                        ehci_vdbg (ehci, "lost IAA\n");
+        /* Lost IAA irqs wedge things badly; seen first with a vt8235.
+         * So we need this watchdog, but must protect it against both
+         * (a) SMP races against real IAA firing and retriggering, and
+         * (b) clean HC shutdown, when IAA watchdog was pending.
+         */
+        if (ehci->reclaim
+                        && !timer_pending(&ehci->iaa_watchdog)
+                        && HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) {
+                u32 cmd, status;
+
+                /* If we get here, IAA is *REALLY* late.  It's barely
+                 * conceivable that the system is so busy that CMD_IAAD
+                 * is still legitimately set, so let's be sure it's
+                 * clear before we read STS_IAA.  (The HC should clear
+                 * CMD_IAAD when it sets STS_IAA.)
+                 */
+                cmd = ehci_readl(ehci, &ehci->regs->command);
+                if (cmd & CMD_IAAD)
+                        ehci_writel(ehci, cmd & ~CMD_IAAD,
+                                        &ehci->regs->command);
+
+                /* If IAA is set here it either legitimately triggered
+                 * before we cleared IAAD above (but _way_ late, so we'll
+                 * still count it as lost) ... or a silicon erratum:
+                 * - VIA seems to set IAA without triggering the IRQ;
+                 * - IAAD potentially cleared without setting IAA.
+                 */
+                status = ehci_readl(ehci, &ehci->regs->status);
+                if ((status & STS_IAA) || !(cmd & CMD_IAAD)) {
                         COUNT (ehci->stats.lost_iaa);
                         ehci_writel(ehci, STS_IAA, &ehci->regs->status);
                 }
-                ehci_writel(ehci, cmd & ~CMD_IAAD, &ehci->regs->command);
+
+                ehci_vdbg(ehci, "IAA watchdog: status %x cmd %x\n",
+                                status, cmd);
                 end_unlink_async(ehci);
         }
 
@@ -631,7 +652,7 @@ static int ehci_run (struct usb_hcd *hcd)
 static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 {
         struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
-        u32                     status, pcd_status = 0;
+        u32                     status, pcd_status = 0, cmd;
         int                     bh;
 
         spin_lock (&ehci->lock);
@@ -652,7 +673,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 
         /* clear (just) interrupts */
         ehci_writel(ehci, status, &ehci->regs->status);
-        ehci_readl(ehci, &ehci->regs->command); /* unblock posted write */
+        cmd = ehci_readl(ehci, &ehci->regs->command);
         bh = 0;
 
 #ifdef  EHCI_VERBOSE_DEBUG
@@ -673,8 +694,17 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 
         /* complete the unlinking of some qh [4.15.2.3] */
         if (status & STS_IAA) {
-                COUNT (ehci->stats.reclaim);
-                end_unlink_async(ehci);
+                /* guard against (alleged) silicon errata */
+                if (cmd & CMD_IAAD) {
+                        ehci_writel(ehci, cmd & ~CMD_IAAD,
+                                        &ehci->regs->command);
+                        ehci_dbg(ehci, "IAA with IAAD still set?\n");
+                }
+                if (ehci->reclaim) {
+                        COUNT(ehci->stats.reclaim);
+                        end_unlink_async(ehci);
+                } else
+                        ehci_dbg(ehci, "IAA with nothing to reclaim?\n");
         }
 
         /* remote wakeup [4.3.1] */
@@ -781,7 +811,7 @@ static int ehci_urb_enqueue (
 static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
         /* failfast */
-        if (!HC_IS_RUNNING(ehci_to_hcd(ehci)->state))
+        if (!HC_IS_RUNNING(ehci_to_hcd(ehci)->state) && ehci->reclaim)
                 end_unlink_async(ehci);
 
         /* if it's not linked then there's nothing to do */
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 776a97f33914..2e49de820b14 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -319,10 +319,10 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                         if (likely (last->urb != urb)) {
                                 ehci_urb_done(ehci, last->urb, last_status);
                                 count++;
+                                last_status = -EINPROGRESS;
                         }
                         ehci_qtd_free (ehci, last);
                         last = NULL;
-                        last_status = -EINPROGRESS;
                 }
 
                 /* ignore urbs submitted during completions we reported */
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 0130fd8571e4..d7071c855758 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -911,8 +911,7 @@ static int isp116x_hub_status_data(struct usb_hcd *hcd, char *buf)
                 buf[0] = 0;
 
         for (i = 0; i < ports; i++) {
-                u32 status = isp116x->rhport[i] =
-                    isp116x_read_reg32(isp116x, i ? HCRHPORT2 : HCRHPORT1);
+                u32 status = isp116x_read_reg32(isp116x, i ? HCRHPORT2 : HCRHPORT1);
 
                 if (status & (RH_PS_CSC | RH_PS_PESC | RH_PS_PSSC
                               | RH_PS_OCIC | RH_PS_PRSC)) {
@@ -1031,7 +1030,9 @@ static int isp116x_hub_control(struct usb_hcd *hcd,
                 DBG("GetPortStatus\n");
                 if (!wIndex || wIndex > ports)
                         goto error;
-                tmp = isp116x->rhport[--wIndex];
+                spin_lock_irqsave(&isp116x->lock, flags);
+                tmp = isp116x_read_reg32(isp116x, (--wIndex) ? HCRHPORT2 : HCRHPORT1);
+                spin_unlock_irqrestore(&isp116x->lock, flags);
                 *(__le32 *) buf = cpu_to_le32(tmp);
                 DBG("GetPortStatus: port[%d]  %08x\n", wIndex + 1, tmp);
                 break;
@@ -1080,8 +1081,6 @@ static int isp116x_hub_control(struct usb_hcd *hcd,
                 spin_lock_irqsave(&isp116x->lock, flags);
                 isp116x_write_reg32(isp116x, wIndex
                                     ? HCRHPORT2 : HCRHPORT1, tmp);
-                isp116x->rhport[wIndex] =
-                    isp116x_read_reg32(isp116x, wIndex ? HCRHPORT2 : HCRHPORT1);
                 spin_unlock_irqrestore(&isp116x->lock, flags);
                 break;
         case SetPortFeature:
@@ -1095,24 +1094,22 @@ static int isp116x_hub_control(struct usb_hcd *hcd,
                         spin_lock_irqsave(&isp116x->lock, flags);
                         isp116x_write_reg32(isp116x, wIndex
                                             ? HCRHPORT2 : HCRHPORT1, RH_PS_PSS);
+                        spin_unlock_irqrestore(&isp116x->lock, flags);
                         break;
                 case USB_PORT_FEAT_POWER:
                         DBG("USB_PORT_FEAT_POWER\n");
                         spin_lock_irqsave(&isp116x->lock, flags);
                         isp116x_write_reg32(isp116x, wIndex
                                             ? HCRHPORT2 : HCRHPORT1, RH_PS_PPS);
+                        spin_unlock_irqrestore(&isp116x->lock, flags);
                         break;
                 case USB_PORT_FEAT_RESET:
                         DBG("USB_PORT_FEAT_RESET\n");
                         root_port_reset(isp116x, wIndex);
-                        spin_lock_irqsave(&isp116x->lock, flags);
                         break;
                 default:
                         goto error;
                 }
-                isp116x->rhport[wIndex] =
-                    isp116x_read_reg32(isp116x, wIndex ? HCRHPORT2 : HCRHPORT1);
-                spin_unlock_irqrestore(&isp116x->lock, flags);
                 break;
 
         default:
diff --git a/drivers/usb/host/isp116x.h b/drivers/usb/host/isp116x.h
index b91e2edd9c5c..595b90a99848 100644
--- a/drivers/usb/host/isp116x.h
+++ b/drivers/usb/host/isp116x.h
@@ -270,7 +270,6 @@ struct isp116x {
         u32 rhdesca;
         u32 rhdescb;
         u32 rhstatus;
-        u32 rhport[2];
 
         /* async schedule: control, bulk */
         struct list_head async;
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 08c65c1a3771..779d07851a4d 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -94,6 +94,7 @@ static struct usb_device_id id_table_earthmate [] = {
 
 static struct usb_device_id id_table_cyphidcomrs232 [] = {
         { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
+        { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
         { }                                             /* Terminating entry */
 };
 
@@ -106,6 +107,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
         { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
         { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
+        { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
         { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
         { }                                             /* Terminating entry */
 };
diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
index e1c7c27e18b7..0388065bb794 100644
--- a/drivers/usb/serial/cypress_m8.h
+++ b/drivers/usb/serial/cypress_m8.h
@@ -19,6 +19,10 @@
 #define VENDOR_ID_CYPRESS                0x04b4
 #define PRODUCT_ID_CYPHIDCOM             0x5500
 
+/* Powercom UPS, chip CY7C63723 */
+#define VENDOR_ID_POWERCOM               0x0d9f
+#define PRODUCT_ID_UPS                   0x0002
+
 /* Nokia CA-42 USB to serial cable */
 #define VENDOR_ID_DAZZLE                0x07d0
 #define PRODUCT_ID_CA42                 0x4101
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 76db2fef4657..3abb3c863647 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -92,6 +92,7 @@ struct ftdi_sio_quirk {
 };
 
 static int   ftdi_jtag_probe            (struct usb_serial *serial);
+static int   ftdi_mtxorb_hack_setup     (struct usb_serial *serial);
 static void  ftdi_USB_UIRT_setup        (struct ftdi_private *priv);
 static void  ftdi_HE_TIRA1_setup        (struct ftdi_private *priv);
 
@@ -99,6 +100,10 @@ static struct ftdi_sio_quirk ftdi_jtag_quirk = {
         .probe  = ftdi_jtag_probe,
 };
 
+static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
+        .probe  = ftdi_mtxorb_hack_setup,
+};
+
 static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
         .port_probe = ftdi_USB_UIRT_setup,
 };
@@ -161,6 +166,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_4_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
+        { USB_DEVICE(MTXORB_VK_VID, MTXORB_VK_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
@@ -274,6 +281,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
         { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
         { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
@@ -351,6 +359,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
         { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
@@ -1088,6 +1097,23 @@ static int ftdi_jtag_probe(struct usb_serial *serial)
         return 0;
 }
 
+/*
+ * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
+ * We have to correct it if we want to read from it.
+ */
+static int ftdi_mtxorb_hack_setup(struct usb_serial *serial)
+{
+        struct usb_host_endpoint *ep = serial->dev->ep_in[1];
+        struct usb_endpoint_descriptor *ep_desc = &ep->desc;
+
+        if (ep->enabled && ep_desc->wMaxPacketSize == 0) {
+                ep_desc->wMaxPacketSize = 0x40;
+                info("Fixing invalid wMaxPacketSize on read pipe");
+        }
+
+        return 0;
+}
+
 /* ftdi_shutdown is called from usbserial:usb_serial_disconnect
  *   it is called when the usb device is disconnected
  *
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 6eee2ab914ec..6da539ede0ee 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -102,6 +102,13 @@
  * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
 #define FTDI_OOCDLINK_PID       0xbaf8  /* Amontec JTAGkey */
 
+/*
+ * The following are the values for the Matrix Orbital VK204-25-USB
+ * display, which use the FT232RL.
+ */
+#define MTXORB_VK_VID           0x1b3d
+#define MTXORB_VK_PID           0x0158
+
 /* Interbiometrics USB I/O Board */
 /* Developed for Interbiometrics by Rudolf Gugler */
 #define INTERBIOMETRICS_VID              0x1209
@@ -550,6 +557,9 @@
 #define TML_VID                 0x1B91  /* Vendor ID */
 #define TML_USB_SERIAL_PID      0x0064  /* USB - Serial Converter */
 
+/* Propox devices */
+#define FTDI_PROPOX_JTAGCABLEII_PID     0xD738
+
 /* Commands */
 #define FTDI_SIO_RESET          0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL     1 /* Set the modem control register */
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 97fa3c428435..7cfce9dabb90 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -323,7 +323,7 @@ static void flush_and_resubmit_read_urb (struct usb_serial_port *port)
                 room = tty_buffer_request_room(tty, urb->actual_length);
                 if (room) {
                         tty_insert_flip_string(tty, urb->transfer_buffer, room);
-                        tty_flip_buffer_push(tty); /* is this allowed from an URB callback ? */
+                        tty_flip_buffer_push(tty);
                 }
         }
 
@@ -349,10 +349,12 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb)
 
         /* Throttle the device if requested by tty */
         spin_lock_irqsave(&port->lock, flags);
-        if (!(port->throttled = port->throttle_req))
-                /* Handle data and continue reading from device */
+        if (!(port->throttled = port->throttle_req)) {
+                spin_unlock_irqrestore(&port->lock, flags);
                 flush_and_resubmit_read_urb(port);
-        spin_unlock_irqrestore(&port->lock, flags);
+        } else {
+                spin_unlock_irqrestore(&port->lock, flags);
+        }
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_read_bulk_callback);
 
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 869ecd374cb4..aeeb9cb20999 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -110,11 +110,20 @@
 
 /* vendor id and device id defines */
 
+/* The native mos7840/7820 component */
 #define USB_VENDOR_ID_MOSCHIP           0x9710
 #define MOSCHIP_DEVICE_ID_7840          0x7840
 #define MOSCHIP_DEVICE_ID_7820          0x7820
+/* The native component can have its vendor/device id's overridden
+ * in vendor-specific implementations.  Such devices can be handled
+ * by making a change here, in moschip_port_id_table, and in
+ * moschip_id_table_combined
+ */
+#define USB_VENDOR_ID_BANDB             0x0856
+#define BANDB_DEVICE_ID_USOPTL4_4       0xAC44
+#define BANDB_DEVICE_ID_USOPTL4_2       0xAC42
 
-/* Interrupt Rotinue Defines    */
+/* Interrupt Routine Defines    */
 
 #define SERIAL_IIR_RLS      0x06
 #define SERIAL_IIR_MS       0x00
@@ -159,12 +168,16 @@
 static struct usb_device_id moschip_port_id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
+        {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+        {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
         {}                      /* terminating entry */
 };
 
 static __devinitdata struct usb_device_id moschip_id_table_combined[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
+        {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+        {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
         {}                      /* terminating entry */
 };
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index af2674c57414..a396fbbdc9c2 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -111,6 +111,42 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define HUAWEI_PRODUCT_E220BIS                  0x1004
 
 #define NOVATELWIRELESS_VENDOR_ID               0x1410
+
+/* MERLIN EVDO PRODUCTS */
+#define NOVATELWIRELESS_PRODUCT_V640            0x1100
+#define NOVATELWIRELESS_PRODUCT_V620            0x1110
+#define NOVATELWIRELESS_PRODUCT_V740            0x1120
+#define NOVATELWIRELESS_PRODUCT_V720            0x1130
+
+/* MERLIN HSDPA/HSPA PRODUCTS */
+#define NOVATELWIRELESS_PRODUCT_U730            0x1400
+#define NOVATELWIRELESS_PRODUCT_U740            0x1410
+#define NOVATELWIRELESS_PRODUCT_U870            0x1420
+#define NOVATELWIRELESS_PRODUCT_XU870           0x1430
+#define NOVATELWIRELESS_PRODUCT_X950D           0x1450
+
+/* EXPEDITE PRODUCTS */
+#define NOVATELWIRELESS_PRODUCT_EV620           0x2100
+#define NOVATELWIRELESS_PRODUCT_ES720           0x2110
+#define NOVATELWIRELESS_PRODUCT_E725            0x2120
+#define NOVATELWIRELESS_PRODUCT_EU730           0x2400
+#define NOVATELWIRELESS_PRODUCT_EU740           0x2410
+#define NOVATELWIRELESS_PRODUCT_EU870D          0x2420
+
+/* OVATION PRODUCTS */
+#define NOVATELWIRELESS_PRODUCT_MC727           0x4100
+#define NOVATELWIRELESS_PRODUCT_MC950D          0x4400
+
+/* FUTURE NOVATEL PRODUCTS */
+#define NOVATELWIRELESS_PRODUCT_EVDO_1          0x6000
+#define NOVATELWIRELESS_PRODUCT_HSPA_1          0x7000
+#define NOVATELWIRELESS_PRODUCT_EMBEDDED_1      0x8000
+#define NOVATELWIRELESS_PRODUCT_GLOBAL_1        0x9000
+#define NOVATELWIRELESS_PRODUCT_EVDO_2          0x6001
+#define NOVATELWIRELESS_PRODUCT_HSPA_2          0x7001
+#define NOVATELWIRELESS_PRODUCT_EMBEDDED_2      0x8001
+#define NOVATELWIRELESS_PRODUCT_GLOBAL_2        0x9001
+
 #define DELL_VENDOR_ID                          0x413C
 
 #define KYOCERA_VENDOR_ID                       0x0c88
@@ -120,6 +156,9 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define ANYDATA_PRODUCT_ADU_E100A               0x6501
 #define ANYDATA_PRODUCT_ADU_500A                0x6502
 
+#define AXESSTEL_VENDOR_ID                      0x1726
+#define AXESSTEL_PRODUCT_MV110H                 0x1000
+
 #define BANDRICH_VENDOR_ID                      0x1A8D
 #define BANDRICH_PRODUCT_C100_1                 0x1002
 #define BANDRICH_PRODUCT_C100_2                 0x1003
@@ -165,21 +204,34 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1100) }, /* Novatel Merlin XS620/S640 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1110) }, /* Novatel Merlin S620 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1120) }, /* Novatel Merlin EX720 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1130) }, /* Novatel Merlin S720 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1400) }, /* Novatel U730 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1410) }, /* Novatel U740 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1420) }, /* Novatel EU870 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1430) }, /* Novatel Merlin XU870 HSDPA/3G */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2100) }, /* Novatel EV620 CDMA/EV-DO */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2110) }, /* Novatel Merlin ES620 / Merlin ES720 / Ovation U720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) }, /* Novatel Merlin EX720/V740/X720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V720) }, /* Novatel Merlin V720/S720/PC720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U730) }, /* Novatel U730/U740 (VF version) */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U740) }, /* Novatel U740 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U870) }, /* Novatel U870 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_XU870) }, /* Novatel Merlin XU870 HSDPA/3G */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_X950D) }, /* Novatel X950D */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EV620) }, /* Novatel EV620/ES620 CDMA/EV-DO */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_ES720) }, /* Novatel ES620/ES720/U720/USB720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E725) }, /* Novatel E725/E726 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2130) }, /* Novatel Merlin ES620 SM Bus */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2410) }, /* Novatel EU740 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x4100) }, /* Novatel U727 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x4400) }, /* Novatel MC950 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU730) }, /* Novatel EU730 and Vodafone EU740 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU740) }, /* Novatel non-Vodafone EU740 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU870D) }, /* Novatel EU850D/EU860D/EU870D */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC950D) }, /* Novatel MC930D/MC950D */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x5010) }, /* Novatel U727 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_1) }, /* Novatel EVDO product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_1) }, /* Novatel HSPA product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_1) }, /* Novatel Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_1) }, /* Novatel Global product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_2) }, /* Novatel EVDO product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_2) }, /* Novatel HSPA product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_2) }, /* Novatel Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_2) }, /* Novatel Global product */
+
         { USB_DEVICE(DELL_VENDOR_ID, 0x8114) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
         { USB_DEVICE(DELL_VENDOR_ID, 0x8115) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
         { USB_DEVICE(DELL_VENDOR_ID, 0x8116) }, /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
@@ -192,6 +244,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+        { USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_1) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_2) },
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
diff --git a/drivers/usb/storage/protocol.c b/drivers/usb/storage/protocol.c
index 958f5b17847c..b9b8ede61fb3 100644
--- a/drivers/usb/storage/protocol.c
+++ b/drivers/usb/storage/protocol.c
@@ -170,7 +170,6 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
 
         if (!sg)
                 sg = scsi_sglist(srb);
-        buflen = min(buflen, scsi_bufflen(srb));
 
         /* This loop handles a single s-g list entry, which may
          * include multiple pages.  Find the initial page structure
@@ -232,6 +231,7 @@ void usb_stor_set_xfer_buf(unsigned char *buffer,
         unsigned int offset = 0;
         struct scatterlist *sg = NULL;
 
+        buflen = min(buflen, scsi_bufflen(srb));
         buflen = usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
                         TO_XFER_BUF);
         if (buflen < scsi_bufflen(srb))
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
index d43a3415e12f..6d14327c921d 100644
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -522,8 +522,8 @@ int sddr55_reset(struct us_data *us) {
 
 static unsigned long sddr55_get_capacity(struct us_data *us) {
 
-        unsigned char manufacturerID;
-        unsigned char deviceID;
+        unsigned char uninitialized_var(manufacturerID);
+        unsigned char uninitialized_var(deviceID);
         int result;
         struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
 
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 758435f8a6f8..e0b0580705e4 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -553,6 +553,19 @@ config FB_BF54X_LQ043
         help
          This is the framebuffer device driver for a SHARP LQ043T1DG01 TFT LCD
 
+config FB_BFIN_T350MCQB
+        tristate "Varitronix COG-T350MCQB TFT LCD display (BF527 EZKIT)"
+        depends on FB && BLACKFIN
+        select BFIN_GPTIMERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+         This is the framebuffer device driver for a Varitronix VL-PS-COG-T350MCQB-01 display TFT LCD
+         This display is a QVGA 320x240 24-bit RGB display interfaced by an 8-bit wide PPI
+         It uses PPI[0..7] PPI_FS1, PPI_FS2 and PPI_CLK.
+
+
 config FB_STI
         tristate "HP STI frame buffer device support"
         depends on FB && PARISC
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 83e02b3429b6..03371c789039 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -122,6 +122,7 @@ obj-$(CONFIG_FB_EFI)              += efifb.o
 obj-$(CONFIG_FB_VGA16)            += vga16fb.o
 obj-$(CONFIG_FB_OF)               += offb.o
 obj-$(CONFIG_FB_BF54X_LQ043)      += bf54x-lq043fb.o
+obj-$(CONFIG_FB_BFIN_T350MCQB)    += bfin-t350mcqb-fb.o
 
 # the test framebuffer is last
 obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
diff --git a/drivers/video/bf54x-lq043fb.c b/drivers/video/bf54x-lq043fb.c
index 0ce791e6f79c..986a550c0439 100644
--- a/drivers/video/bf54x-lq043fb.c
+++ b/drivers/video/bf54x-lq043fb.c
@@ -8,7 +8,7 @@
  *
  *
  * Modified:
- *               Copyright 2004-2007 Analog Devices Inc.
+ *               Copyright 2007-2008 Analog Devices Inc.
  *
  * Bugs:         Enter bugs at http://blackfin.uclinux.org/
  *
@@ -241,7 +241,7 @@ static int request_ports(struct bfin_bf54xfb_info *fbi)
         u16 eppi_req_18[] = EPPI0_18;
         u16 disp = fbi->mach_info->disp;
 
-        if (gpio_request(disp, NULL)) {
+        if (gpio_request(disp, DRIVER_NAME)) {
                 printk(KERN_ERR "Requesting GPIO %d faild\n", disp);
                 return -EFAULT;
         }
@@ -672,7 +672,7 @@ static int __init bfin_bf54x_probe(struct platform_device *pdev)
                                       &bfin_lq043fb_bl_ops);
         bl_dev->props.max_brightness = 255;
 
-        lcd_dev = lcd_device_register(DRIVER_NAME, NULL, &bfin_lcd_ops);
+        lcd_dev = lcd_device_register(DRIVER_NAME, &pdev->dev, NULL, &bfin_lcd_ops);
         lcd_dev->props.max_contrast = 255, printk(KERN_INFO "Done.\n");
 #endif
 
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
new file mode 100644
index 000000000000..a2bb2de9e020
--- /dev/null
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -0,0 +1,685 @@
+/*
+ * File:         drivers/video/bfin-t350mcqb-fb.c
+ * Based on:
+ * Author:       Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * Created:
+ * Description:  Blackfin LCD Framebufer driver
+ *
+ *
+ * Modified:
+ *               Copyright 2004-2007 Analog Devices Inc.
+ *
+ * Bugs:         Enter bugs at http://blackfin.uclinux.org/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see the file COPYING, or write
+ * to the Free Software Foundation, Inc.,
+ * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/interrupt.h>
+#include <linux/device.h>
+#include <linux/backlight.h>
+#include <linux/lcd.h>
+#include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
+
+#include <asm/blackfin.h>
+#include <asm/irq.h>
+#include <asm/dma-mapping.h>
+#include <asm/dma.h>
+#include <asm/portmux.h>
+#include <asm/gptimers.h>
+
+#define NO_BL_SUPPORT
+
+#define LCD_X_RES               320     /* Horizontal Resolution */
+#define LCD_Y_RES               240     /* Vertical Resolution */
+#define LCD_BPP                 24      /* Bit Per Pixel */
+
+#define DMA_BUS_SIZE            16
+#define LCD_CLK                 (12*1000*1000)  /* 12MHz */
+
+#define CLOCKS_PER_PIX          3
+
+        /*
+         * HS and VS timing parameters (all in number of PPI clk ticks)
+         */
+
+#define U_LINE          1                               /* Blanking Lines */
+
+#define H_ACTPIX        (LCD_X_RES * CLOCKS_PER_PIX)    /* active horizontal pixel */
+#define H_PERIOD        (408 * CLOCKS_PER_PIX)          /* HS period */
+#define H_PULSE         90                              /* HS pulse width */
+#define H_START         204                             /* first valid pixel */
+
+#define V_LINES         (LCD_Y_RES + U_LINE)            /* total vertical lines */
+#define V_PULSE         (3 * H_PERIOD)                  /* VS pulse width (1-5 H_PERIODs) */
+#define V_PERIOD        (H_PERIOD * V_LINES)            /* VS period */
+
+#define ACTIVE_VIDEO_MEM_OFFSET (U_LINE * H_ACTPIX)
+
+#define BFIN_LCD_NBR_PALETTE_ENTRIES    256
+
+#define DRIVER_NAME "bfin-t350mcqb"
+static char driver_name[] = DRIVER_NAME;
+
+struct bfin_t350mcqbfb_info {
+        struct fb_info *fb;
+        struct device *dev;
+        unsigned char *fb_buffer;       /* RGB Buffer */
+        dma_addr_t dma_handle;
+        int lq043_mmap;
+        int lq043_open_cnt;
+        int irq;
+        spinlock_t lock;        /* lock */
+};
+
+static int nocursor;
+module_param(nocursor, int, 0644);
+MODULE_PARM_DESC(nocursor, "cursor enable/disable");
+
+#define PPI_TX_MODE             0x2
+#define PPI_XFER_TYPE_11        0xC
+#define PPI_PORT_CFG_01         0x10
+#define PPI_PACK_EN             0x80
+#define PPI_POLS_1              0x8000
+
+static void bfin_t350mcqb_config_ppi(struct bfin_t350mcqbfb_info *fbi)
+{
+        bfin_write_PPI_DELAY(H_START);
+        bfin_write_PPI_COUNT(H_ACTPIX-1);
+        bfin_write_PPI_FRAME(V_LINES);
+
+        bfin_write_PPI_CONTROL(PPI_TX_MODE |       /* output mode , PORT_DIR */
+                                PPI_XFER_TYPE_11 | /* sync mode XFR_TYPE */
+                                PPI_PORT_CFG_01 |  /* two frame sync PORT_CFG */
+                                PPI_PACK_EN |      /* packing enabled PACK_EN */
+                                PPI_POLS_1);       /* faling edge syncs POLS */
+}
+
+static inline void bfin_t350mcqb_disable_ppi(void)
+{
+        bfin_write_PPI_CONTROL(bfin_read_PPI_CONTROL() & ~PORT_EN);
+}
+
+static inline void bfin_t350mcqb_enable_ppi(void)
+{
+        bfin_write_PPI_CONTROL(bfin_read_PPI_CONTROL() | PORT_EN);
+}
+
+static void bfin_t350mcqb_start_timers(void)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+                enable_gptimers(TIMER1bit);
+                enable_gptimers(TIMER0bit);
+        local_irq_restore(flags);
+}
+
+static void bfin_t350mcqb_stop_timers(void)
+{
+        disable_gptimers(TIMER0bit | TIMER1bit);
+
+        set_gptimer_status(0, TIMER_STATUS_TRUN0 | TIMER_STATUS_TRUN1 |
+                                TIMER_STATUS_TIMIL0 | TIMER_STATUS_TIMIL1 |
+                                 TIMER_STATUS_TOVF0 | TIMER_STATUS_TOVF1);
+
+}
+
+static void bfin_t350mcqb_init_timers(void)
+{
+
+        bfin_t350mcqb_stop_timers();
+
+        set_gptimer_period(TIMER0_id, H_PERIOD);
+        set_gptimer_pwidth(TIMER0_id, H_PULSE);
+        set_gptimer_config(TIMER0_id, TIMER_MODE_PWM | TIMER_PERIOD_CNT |
+                                      TIMER_TIN_SEL | TIMER_CLK_SEL|
+                                      TIMER_EMU_RUN);
+
+        set_gptimer_period(TIMER1_id, V_PERIOD);
+        set_gptimer_pwidth(TIMER1_id, V_PULSE);
+        set_gptimer_config(TIMER1_id, TIMER_MODE_PWM | TIMER_PERIOD_CNT |
+                                      TIMER_TIN_SEL | TIMER_CLK_SEL |
+                                      TIMER_EMU_RUN);
+
+}
+
+static void bfin_t350mcqb_config_dma(struct bfin_t350mcqbfb_info *fbi)
+{
+
+        set_dma_config(CH_PPI,
+                       set_bfin_dma_config(DIR_READ, DMA_FLOW_AUTO,
+                                           INTR_DISABLE, DIMENSION_2D,
+                                           DATA_SIZE_16,
+                                           DMA_NOSYNC_KEEP_DMA_BUF));
+        set_dma_x_count(CH_PPI, (LCD_X_RES * LCD_BPP) / DMA_BUS_SIZE);
+        set_dma_x_modify(CH_PPI, DMA_BUS_SIZE / 8);
+        set_dma_y_count(CH_PPI, V_LINES);
+
+        set_dma_y_modify(CH_PPI, DMA_BUS_SIZE / 8);
+        set_dma_start_addr(CH_PPI, (unsigned long)fbi->fb_buffer);
+
+}
+
+static int bfin_t350mcqb_request_ports(int action)
+{
+        u16 ppi0_req_8[] = {P_PPI0_CLK, P_PPI0_FS1, P_PPI0_FS2,
+                            P_PPI0_D0, P_PPI0_D1, P_PPI0_D2,
+                            P_PPI0_D3, P_PPI0_D4, P_PPI0_D5,
+                            P_PPI0_D6, P_PPI0_D7, 0};
+
+        if (action) {
+                if (peripheral_request_list(ppi0_req_8, DRIVER_NAME)) {
+                        printk(KERN_ERR "Requesting Peripherals faild\n");
+                        return -EFAULT;
+                }
+        } else
+                peripheral_free_list(ppi0_req_8);
+
+        return 0;
+}
+
+static int bfin_t350mcqb_fb_open(struct fb_info *info, int user)
+{
+        struct bfin_t350mcqbfb_info *fbi = info->par;
+
+        spin_lock(&fbi->lock);
+        fbi->lq043_open_cnt++;
+
+        if (fbi->lq043_open_cnt <= 1) {
+
+                bfin_t350mcqb_disable_ppi();
+                SSYNC();
+
+                bfin_t350mcqb_config_dma(fbi);
+                bfin_t350mcqb_config_ppi(fbi);
+                bfin_t350mcqb_init_timers();
+
+                /* start dma */
+                enable_dma(CH_PPI);
+                bfin_t350mcqb_enable_ppi();
+                bfin_t350mcqb_start_timers();
+        }
+
+        spin_unlock(&fbi->lock);
+
+        return 0;
+}
+
+static int bfin_t350mcqb_fb_release(struct fb_info *info, int user)
+{
+        struct bfin_t350mcqbfb_info *fbi = info->par;
+
+        spin_lock(&fbi->lock);
+
+        fbi->lq043_open_cnt--;
+        fbi->lq043_mmap = 0;
+
+        if (fbi->lq043_open_cnt <= 0) {
+                bfin_t350mcqb_disable_ppi();
+                SSYNC();
+                disable_dma(CH_PPI);
+                bfin_t350mcqb_stop_timers();
+                memset(fbi->fb_buffer, 0, info->fix.smem_len);
+        }
+
+        spin_unlock(&fbi->lock);
+
+        return 0;
+}
+
+static int bfin_t350mcqb_fb_check_var(struct fb_var_screeninfo *var,
+                                   struct fb_info *info)
+{
+
+        if (var->bits_per_pixel != LCD_BPP) {
+                pr_debug("%s: depth not supported: %u BPP\n", __FUNCTION__,
+                         var->bits_per_pixel);
+                return -EINVAL;
+        }
+
+        if (info->var.xres != var->xres || info->var.yres != var->yres ||
+            info->var.xres_virtual != var->xres_virtual ||
+            info->var.yres_virtual != var->yres_virtual) {
+                pr_debug("%s: Resolution not supported: X%u x Y%u \n",
+                         __FUNCTION__, var->xres, var->yres);
+                return -EINVAL;
+        }
+
+        /*
+         *  Memory limit
+         */
+
+        if ((info->fix.line_length * var->yres_virtual) > info->fix.smem_len) {
+                pr_debug("%s: Memory Limit requested yres_virtual = %u\n",
+                         __FUNCTION__, var->yres_virtual);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+static int bfin_t350mcqb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+{
+        struct bfin_t350mcqbfb_info *fbi = info->par;
+
+        if (fbi->lq043_mmap)
+                return -1;
+
+        spin_lock(&fbi->lock);
+        fbi->lq043_mmap = 1;
+        spin_unlock(&fbi->lock);
+
+        vma->vm_start = (unsigned long)(fbi->fb_buffer + ACTIVE_VIDEO_MEM_OFFSET);
+
+        vma->vm_end = vma->vm_start + info->fix.smem_len;
+        /* For those who don't understand how mmap works, go read
+         *   Documentation/nommu-mmap.txt.
+         * For those that do, you will know that the VM_MAYSHARE flag
+         * must be set in the vma->vm_flags structure on noMMU
+         *   Other flags can be set, and are documented in
+         *   include/linux/mm.h
+         */
+        vma->vm_flags |= VM_MAYSHARE;
+
+        return 0;
+}
+
+int bfin_t350mcqb_fb_cursor(struct fb_info *info, struct fb_cursor *cursor)
+{
+        if (nocursor)
+                return 0;
+        else
+                return -EINVAL; /* just to force soft_cursor() call */
+}
+
+static int bfin_t350mcqb_fb_setcolreg(u_int regno, u_int red, u_int green,
+                                   u_int blue, u_int transp,
+                                   struct fb_info *info)
+{
+        if (regno >= BFIN_LCD_NBR_PALETTE_ENTRIES)
+                return -EINVAL;
+
+        if (info->var.grayscale) {
+                /* grayscale = 0.30*R + 0.59*G + 0.11*B */
+                red = green = blue = (red * 77 + green * 151 + blue * 28) >> 8;
+        }
+
+        if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
+
+                u32 value;
+                /* Place color in the pseudopalette */
+                if (regno > 16)
+                        return -EINVAL;
+
+                red >>= (16 - info->var.red.length);
+                green >>= (16 - info->var.green.length);
+                blue >>= (16 - info->var.blue.length);
+
+                value = (red << info->var.red.offset) |
+                    (green << info->var.green.offset) |
+                    (blue << info->var.blue.offset);
+                value &= 0xFFFFFF;
+
+                ((u32 *) (info->pseudo_palette))[regno] = value;
+
+        }
+
+        return 0;
+}
+
+static struct fb_ops bfin_t350mcqb_fb_ops = {
+        .owner = THIS_MODULE,
+        .fb_open = bfin_t350mcqb_fb_open,
+        .fb_release = bfin_t350mcqb_fb_release,
+        .fb_check_var = bfin_t350mcqb_fb_check_var,
+        .fb_fillrect = cfb_fillrect,
+        .fb_copyarea = cfb_copyarea,
+        .fb_imageblit = cfb_imageblit,
+        .fb_mmap = bfin_t350mcqb_fb_mmap,
+        .fb_cursor = bfin_t350mcqb_fb_cursor,
+        .fb_setcolreg = bfin_t350mcqb_fb_setcolreg,
+};
+
+#ifndef NO_BL_SUPPORT
+static int bl_get_brightness(struct backlight_device *bd)
+{
+        return 0;
+}
+
+static struct backlight_ops bfin_lq043fb_bl_ops = {
+        .get_brightness = bl_get_brightness,
+};
+
+static struct backlight_device *bl_dev;
+
+static int bfin_lcd_get_power(struct lcd_device *dev)
+{
+        return 0;
+}
+
+static int bfin_lcd_set_power(struct lcd_device *dev, int power)
+{
+        return 0;
+}
+
+static int bfin_lcd_get_contrast(struct lcd_device *dev)
+{
+        return 0;
+}
+
+static int bfin_lcd_set_contrast(struct lcd_device *dev, int contrast)
+{
+
+        return 0;
+}
+
+static int bfin_lcd_check_fb(struct fb_info *fi)
+{
+        if (!fi || (fi == &bfin_t350mcqb_fb))
+                return 1;
+        return 0;
+}
+
+static struct lcd_ops bfin_lcd_ops = {
+        .get_power = bfin_lcd_get_power,
+        .set_power = bfin_lcd_set_power,
+        .get_contrast = bfin_lcd_get_contrast,
+        .set_contrast = bfin_lcd_set_contrast,
+        .check_fb = bfin_lcd_check_fb,
+};
+
+static struct lcd_device *lcd_dev;
+#endif
+
+static irqreturn_t bfin_t350mcqb_irq_error(int irq, void *dev_id)
+{
+        /*struct bfin_t350mcqbfb_info *info = (struct bfin_t350mcqbfb_info *)dev_id;*/
+
+        u16 status = bfin_read_PPI_STATUS();
+        bfin_write_PPI_STATUS(0xFFFF);
+
+        if (status) {
+                bfin_t350mcqb_disable_ppi();
+                disable_dma(CH_PPI);
+
+                /* start dma */
+                enable_dma(CH_PPI);
+                bfin_t350mcqb_enable_ppi();
+                bfin_write_PPI_STATUS(0xFFFF);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static int __init bfin_t350mcqb_probe(struct platform_device *pdev)
+{
+        struct bfin_t350mcqbfb_info *info;
+        struct fb_info *fbinfo;
+        int ret;
+
+        printk(KERN_INFO DRIVER_NAME ": %dx%d %d-bit RGB FrameBuffer initializing...\n",
+                                         LCD_X_RES, LCD_Y_RES, LCD_BPP);
+
+        if (request_dma(CH_PPI, "CH_PPI") < 0) {
+                printk(KERN_ERR DRIVER_NAME
+                       ": couldn't request CH_PPI DMA\n");
+                ret = -EFAULT;
+                goto out1;
+        }
+
+        fbinfo =
+            framebuffer_alloc(sizeof(struct bfin_t350mcqbfb_info), &pdev->dev);
+        if (!fbinfo) {
+                ret = -ENOMEM;
+                goto out2;
+        }
+
+        info = fbinfo->par;
+        info->fb = fbinfo;
+        info->dev = &pdev->dev;
+
+        platform_set_drvdata(pdev, fbinfo);
+
+        strcpy(fbinfo->fix.id, driver_name);
+
+        fbinfo->fix.type = FB_TYPE_PACKED_PIXELS;
+        fbinfo->fix.type_aux = 0;
+        fbinfo->fix.xpanstep = 0;
+        fbinfo->fix.ypanstep = 0;
+        fbinfo->fix.ywrapstep = 0;
+        fbinfo->fix.accel = FB_ACCEL_NONE;
+        fbinfo->fix.visual = FB_VISUAL_TRUECOLOR;
+
+        fbinfo->var.nonstd = 0;
+        fbinfo->var.activate = FB_ACTIVATE_NOW;
+        fbinfo->var.height = -1;
+        fbinfo->var.width = -1;
+        fbinfo->var.accel_flags = 0;
+        fbinfo->var.vmode = FB_VMODE_NONINTERLACED;
+
+        fbinfo->var.xres = LCD_X_RES;
+        fbinfo->var.xres_virtual = LCD_X_RES;
+        fbinfo->var.yres = LCD_Y_RES;
+        fbinfo->var.yres_virtual = LCD_Y_RES;
+        fbinfo->var.bits_per_pixel = LCD_BPP;
+
+        fbinfo->var.red.offset = 0;
+        fbinfo->var.green.offset = 8;
+        fbinfo->var.blue.offset = 16;
+        fbinfo->var.transp.offset = 0;
+        fbinfo->var.red.length = 8;
+        fbinfo->var.green.length = 8;
+        fbinfo->var.blue.length = 8;
+        fbinfo->var.transp.length = 0;
+        fbinfo->fix.smem_len = LCD_X_RES * LCD_Y_RES * LCD_BPP / 8;
+
+        fbinfo->fix.line_length = fbinfo->var.xres_virtual *
+            fbinfo->var.bits_per_pixel / 8;
+
+
+        fbinfo->fbops = &bfin_t350mcqb_fb_ops;
+        fbinfo->flags = FBINFO_FLAG_DEFAULT;
+
+        info->fb_buffer =
+            dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
+                               GFP_KERNEL);
+
+        if (NULL == info->fb_buffer) {
+                printk(KERN_ERR DRIVER_NAME
+                       ": couldn't allocate dma buffer.\n");
+                ret = -ENOMEM;
+                goto out3;
+        }
+
+        memset(info->fb_buffer, 0, fbinfo->fix.smem_len);
+
+        fbinfo->screen_base = (void *)info->fb_buffer + ACTIVE_VIDEO_MEM_OFFSET;
+        fbinfo->fix.smem_start = (int)info->fb_buffer + ACTIVE_VIDEO_MEM_OFFSET;
+
+        fbinfo->fbops = &bfin_t350mcqb_fb_ops;
+
+        fbinfo->pseudo_palette = kmalloc(sizeof(u32) * 16, GFP_KERNEL);
+        if (!fbinfo->pseudo_palette) {
+                printk(KERN_ERR DRIVER_NAME
+                       "Fail to allocate pseudo_palette\n");
+
+                ret = -ENOMEM;
+                goto out4;
+        }
+
+        memset(fbinfo->pseudo_palette, 0, sizeof(u32) * 16);
+
+        if (fb_alloc_cmap(&fbinfo->cmap, BFIN_LCD_NBR_PALETTE_ENTRIES, 0)
+            < 0) {
+                printk(KERN_ERR DRIVER_NAME
+                       "Fail to allocate colormap (%d entries)\n",
+                       BFIN_LCD_NBR_PALETTE_ENTRIES);
+                ret = -EFAULT;
+                goto out5;
+        }
+
+        if (bfin_t350mcqb_request_ports(1)) {
+                printk(KERN_ERR DRIVER_NAME ": couldn't request gpio port.\n");
+                ret = -EFAULT;
+                goto out6;
+        }
+
+        info->irq = platform_get_irq(pdev, 0);
+        if (info->irq < 0) {
+                ret = -EINVAL;
+                goto out7;
+        }
+
+        if (request_irq(info->irq, (void *)bfin_t350mcqb_irq_error, IRQF_DISABLED,
+                        "PPI ERROR", info) < 0) {
+                printk(KERN_ERR DRIVER_NAME
+                       ": unable to request PPI ERROR IRQ\n");
+                ret = -EFAULT;
+                goto out7;
+        }
+
+        if (register_framebuffer(fbinfo) < 0) {
+                printk(KERN_ERR DRIVER_NAME
+                       ": unable to register framebuffer.\n");
+                ret = -EINVAL;
+                goto out8;
+        }
+#ifndef NO_BL_SUPPORT
+        bl_dev =
+            backlight_device_register("bf52x-bl", NULL, NULL,
+                                      &bfin_lq043fb_bl_ops);
+        bl_dev->props.max_brightness = 255;
+
+        lcd_dev = lcd_device_register(DRIVER_NAME, NULL, &bfin_lcd_ops);
+        lcd_dev->props.max_contrast = 255, printk(KERN_INFO "Done.\n");
+#endif
+
+        return 0;
+
+out8:
+        free_irq(info->irq, info);
+out7:
+        bfin_t350mcqb_request_ports(0);
+out6:
+        fb_dealloc_cmap(&fbinfo->cmap);
+out5:
+        kfree(fbinfo->pseudo_palette);
+out4:
+        dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+                          info->dma_handle);
+out3:
+        framebuffer_release(fbinfo);
+out2:
+        free_dma(CH_PPI);
+out1:
+        platform_set_drvdata(pdev, NULL);
+
+        return ret;
+}
+
+static int bfin_t350mcqb_remove(struct platform_device *pdev)
+{
+
+        struct fb_info *fbinfo = platform_get_drvdata(pdev);
+        struct bfin_t350mcqbfb_info *info = fbinfo->par;
+
+        free_dma(CH_PPI);
+        free_irq(info->irq, info);
+
+        if (info->fb_buffer != NULL)
+                dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+                                  info->dma_handle);
+
+        kfree(fbinfo->pseudo_palette);
+        fb_dealloc_cmap(&fbinfo->cmap);
+
+#ifndef NO_BL_SUPPORT
+        lcd_device_unregister(lcd_dev);
+        backlight_device_unregister(bl_dev);
+#endif
+
+        unregister_framebuffer(fbinfo);
+
+        bfin_t350mcqb_request_ports(0);
+
+        printk(KERN_INFO DRIVER_NAME ": Unregister LCD driver.\n");
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int bfin_t350mcqb_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct fb_info *fbinfo = platform_get_drvdata(pdev);
+        struct bfin_t350mcqbfb_info *info = fbinfo->par;
+
+        bfin_t350mcqb_disable_ppi();
+        disable_dma(CH_PPI);
+        bfin_write_PPI_STATUS(0xFFFF);
+
+        return 0;
+}
+
+static int bfin_t350mcqb_resume(struct platform_device *pdev)
+{
+        struct fb_info *fbinfo = platform_get_drvdata(pdev);
+        struct bfin_t350mcqbfb_info *info = fbinfo->par;
+
+        enable_dma(CH_PPI);
+        bfin_t350mcqb_enable_ppi();
+
+        return 0;
+}
+#else
+#define bfin_t350mcqb_suspend   NULL
+#define bfin_t350mcqb_resume    NULL
+#endif
+
+static struct platform_driver bfin_t350mcqb_driver = {
+        .probe = bfin_t350mcqb_probe,
+        .remove = bfin_t350mcqb_remove,
+        .suspend = bfin_t350mcqb_suspend,
+        .resume = bfin_t350mcqb_resume,
+        .driver = {
+                   .name = DRIVER_NAME,
+                   .owner = THIS_MODULE,
+                   },
+};
+
+static int __devinit bfin_t350mcqb_driver_init(void)
+{
+        return platform_driver_register(&bfin_t350mcqb_driver);
+}
+
+static void __exit bfin_t350mcqb_driver_cleanup(void)
+{
+        platform_driver_unregister(&bfin_t350mcqb_driver);
+}
+
+MODULE_DESCRIPTION("Blackfin TFT LCD Driver");
+MODULE_LICENSE("GPL");
+
+module_init(bfin_t350mcqb_driver_init);
+module_exit(bfin_t350mcqb_driver_cleanup);
diff --git a/drivers/video/hitfb.c b/drivers/video/hitfb.c
index 756c0ce85911..392a8be6aa76 100644
--- a/drivers/video/hitfb.c
+++ b/drivers/video/hitfb.c
@@ -403,7 +403,7 @@ static int __init hitfb_probe(struct platform_device *dev)
         return 0;
 }
 
-static int __devexit hitfb_remove(struct platform_device *dev)
+static int __exit hitfb_remove(struct platform_device *dev)
 {
         return unregister_framebuffer(&fb_info);
 }
@@ -439,7 +439,7 @@ static int hitfb_resume(struct platform_device *dev)
 
 static struct platform_driver hitfb_driver = {
         .probe          = hitfb_probe,
-        .remove         = __devexit_p(hitfb_remove),
+        .remove         = __exit_p(hitfb_remove),
 #ifdef CONFIG_PM
         .suspend        = hitfb_suspend,
         .resume         = hitfb_resume,
diff --git a/drivers/video/mbx/mbxfb.c b/drivers/video/mbx/mbxfb.c
index 80cd117ca65c..01f77bcc68f9 100644
--- a/drivers/video/mbx/mbxfb.c
+++ b/drivers/video/mbx/mbxfb.c
@@ -889,7 +889,7 @@ static int __devinit mbxfb_probe(struct platform_device *dev)
         struct mbxfb_info *mfbi;
         struct mbxfb_platform_data *pdata;
 
-        dev_dbg(dev, "mbxfb_probe\n");
+        dev_dbg(&dev->dev, "mbxfb_probe\n");
 
         pdata = dev->dev.platform_data;
         if (!pdata) {
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index 6a3d0b574897..8c863a7f654b 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -1,16 +1,12 @@
-/* drivers/video/pvr2fb.c
+/*
+ * drivers/video/pvr2fb.c
  *
  * Frame buffer and fbcon support for the NEC PowerVR2 found within the Sega
  * Dreamcast.
  *
  * Copyright (c) 2001 M. R. Brown <mrbrown@0xd6.org>
- * Copyright (c) 2001, 2002, 2003, 2004, 2005 Paul Mundt <lethal@linux-sh.org>
- *
- * This file is part of the LinuxDC project (linuxdc.sourceforge.net).
+ * Copyright (c) 2001 - 2008  Paul Mundt <lethal@linux-sh.org>
  *
- */
-
-/*
  * This driver is mostly based on the excellent amifb and vfb sources.  It uses
  * an odd scheme for converting hardware values to/from framebuffer values,
  * here are some hacked-up formulas:
@@ -490,7 +486,7 @@ static int pvr2fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
         } else {
                 var->sync &= ~FB_SYNC_BROADCAST;
                 var->vmode &= ~FB_VMODE_INTERLACED;
-                var->vmode |= pvr2_var.vmode;
+                var->vmode |= FB_VMODE_NONINTERLACED;
         }
 
         if ((var->activate & FB_ACTIVATE_MASK) != FB_ACTIVATE_TEST) {
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index e83dfba7e636..742b5c656d66 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -237,12 +237,14 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,
 
         /* check we can fit these values into the registers */
 
-        if (var->hsync_len > 255 || var->vsync_len > 255)
+        if (var->hsync_len > 255 || var->vsync_len > 63)
                 return -EINVAL;
 
-        if ((var->xres + var->right_margin) >= 4096)
+        /* hdisplay end and hsync start */
+        if ((var->xres + var->right_margin) > 4096)
                 return -EINVAL;
 
+        /* vdisplay end and vsync start */
         if ((var->yres + var->lower_margin) > 2048)
                 return -EINVAL;
 
@@ -281,19 +283,21 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,
                 var->blue.length        = var->bits_per_pixel;
                 var->blue.offset        = 0;
                 var->transp.length      = 0;
+                var->transp.offset      = 0;
 
                 break;
 
         case 16:
                 if (sm->pdata->flags & SM501_FBPD_SWAP_FB_ENDIAN) {
-                        var->red.offset         = 11;
-                        var->green.offset       = 5;
-                        var->blue.offset        = 0;
-                } else {
                         var->blue.offset        = 11;
                         var->green.offset       = 5;
                         var->red.offset         = 0;
+                } else {
+                        var->red.offset         = 11;
+                        var->green.offset       = 5;
+                        var->blue.offset        = 0;
                 }
+                var->transp.offset      = 0;
 
                 var->red.length         = 5;
                 var->green.length       = 6;
@@ -397,7 +401,7 @@ static int sm501fb_set_par_common(struct fb_info *info,
                 break;
 
         case 16:
-                info->fix.visual = FB_VISUAL_DIRECTCOLOR;
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                 break;
 
         case 32:
@@ -613,6 +617,7 @@ static int sm501fb_set_par_crt(struct fb_info *info)
 
         case 16:
                 control |= SM501_DC_CRT_CONTROL_16BPP;
+                sm501fb_setup_gamma(fbi, SM501_DC_CRT_PALETTE);
                 break;
 
         case 32:
@@ -750,6 +755,7 @@ static int sm501fb_set_par_pnl(struct fb_info *info)
 
         case 16:
                 control |= SM501_DC_PANEL_CONTROL_16BPP;
+                sm501fb_setup_gamma(fbi, SM501_DC_PANEL_PALETTE);
                 break;
 
         case 32:
diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
index e7c8db2eb49b..f98be301140c 100644
--- a/drivers/video/stifb.c
+++ b/drivers/video/stifb.c
@@ -505,16 +505,24 @@ ngleSetupAttrPlanes(struct stifb_info *fb, int BufferNumber)
 static void
 rattlerSetupPlanes(struct stifb_info *fb)
 {
+        int saved_id, y;
+
+        /* Write RAMDAC pixel read mask register so all overlay
+         * planes are display-enabled.  (CRX24 uses Bt462 pixel
+         * read mask register for overlay planes, not image planes).
+         */
         CRX24_SETUP_RAMDAC(fb);
     
-        /* replacement for: SETUP_FB(fb, CRX24_OVERLAY_PLANES); */
-        WRITE_WORD(0x83000300, fb, REG_14);
-        SETUP_HW(fb);
-        WRITE_BYTE(1, fb, REG_16b1);
+        /* change fb->id temporarily to fool SETUP_FB() */
+        saved_id = fb->id;
+        fb->id = CRX24_OVERLAY_PLANES;
+        SETUP_FB(fb);
+        fb->id = saved_id;
+
+        for (y = 0; y < fb->info.var.yres; ++y)
+                memset(fb->info.screen_base + y * fb->info.fix.line_length,
+                        0xff, fb->info.var.xres * fb->info.var.bits_per_pixel/8);
 
-        fb_memset((void*)fb->info.fix.smem_start, 0xff,
-                fb->info.var.yres*fb->info.fix.line_length);
-    
         CRX24_SET_OVLY_MASK(fb);
         SETUP_FB(fb);
 }
diff --git a/drivers/video/tridentfb.c b/drivers/video/tridentfb.c
index 70fb4ee2b421..0a4e07d43d2d 100644
--- a/drivers/video/tridentfb.c
+++ b/drivers/video/tridentfb.c
@@ -564,7 +564,7 @@ static inline void write3CE(int reg, unsigned char val)
         t_outb(val, 0x3CF);
 }
 
-static inline void enable_mmio(void)
+static void enable_mmio(void)
 {
         /* Goto New Mode */
         outb(0x0B, 0x3C4);
@@ -579,6 +579,21 @@ static inline void enable_mmio(void)
         outb(inb(0x3D5) | 0x01, 0x3D5);
 }
 
+static void disable_mmio(void)
+{
+        /* Goto New Mode */
+        t_outb(0x0B, 0x3C4);
+        t_inb(0x3C5);
+
+        /* Unprotect registers */
+        t_outb(NewMode1, 0x3C4);
+        t_outb(0x80, 0x3C5);
+
+        /* Disable MMIO */
+        t_outb(PCIReg, 0x3D4);
+        t_outb(t_inb(0x3D5) & ~0x01, 0x3D5);
+}
+
 #define crtc_unlock()   write3X4(CRTVSyncEnd, read3X4(CRTVSyncEnd) & 0x7F)
 
 /*  Return flat panel's maximum x resolution */
@@ -730,7 +745,7 @@ static unsigned int __devinit get_memsize(void)
                         switch (tmp) {
 
                         case 0x01:
-                                k = 512;
+                                k = 512 * Kb;
                                 break;
                         case 0x02:
                                 k = 6 * Mb;     /* XP */
@@ -1239,9 +1254,9 @@ static int __devinit trident_pci_probe(struct pci_dev * dev,
         default_par.io_virt = ioremap_nocache(tridentfb_fix.mmio_start, tridentfb_fix.mmio_len);
 
         if (!default_par.io_virt) {
-                release_region(tridentfb_fix.mmio_start, tridentfb_fix.mmio_len);
                 debug("ioremap failed\n");
-                return -1;
+                err = -1;
+                goto out_unmap1;
         }
 
         enable_mmio();
@@ -1252,25 +1267,21 @@ static int __devinit trident_pci_probe(struct pci_dev * dev,
 
         if (!request_mem_region(tridentfb_fix.smem_start, tridentfb_fix.smem_len, "tridentfb")) {
                 debug("request_mem_region failed!\n");
+                disable_mmio();
                 err = -1;
-                goto out_unmap;
+                goto out_unmap1;
         }
 
         fb_info.screen_base = ioremap_nocache(tridentfb_fix.smem_start,
                                               tridentfb_fix.smem_len);
 
         if (!fb_info.screen_base) {
-                release_mem_region(tridentfb_fix.smem_start, tridentfb_fix.smem_len);
                 debug("ioremap failed\n");
                 err = -1;
-                goto out_unmap;
+                goto out_unmap2;
         }
 
         output("%s board found\n", pci_name(dev));
-#if 0
-        output("Trident board found : mem = %X, io = %X, mem_v = %X, io_v = %X\n",
-                tridentfb_fix.smem_start, tridentfb_fix.mmio_start, fb_info.screen_base, default_par.io_virt);
-#endif
         displaytype = get_displaytype();
 
         if (flatpanel)
@@ -1288,9 +1299,12 @@ static int __devinit trident_pci_probe(struct pci_dev * dev,
 
         if (!fb_find_mode(&default_var, &fb_info, mode, NULL, 0, NULL, bpp)) {
                 err = -EINVAL;
-                goto out_unmap;
+                goto out_unmap2;
         }
-        fb_alloc_cmap(&fb_info.cmap, 256, 0);
+        err = fb_alloc_cmap(&fb_info.cmap, 256, 0);
+        if (err < 0)
+                goto out_unmap2;
+
         if (defaultaccel && acc)
                 default_var.accel_flags |= FB_ACCELF_TEXT;
         else
@@ -1300,19 +1314,24 @@ static int __devinit trident_pci_probe(struct pci_dev * dev,
         fb_info.device = &dev->dev;
         if (register_framebuffer(&fb_info) < 0) {
                 printk(KERN_ERR "tridentfb: could not register Trident framebuffer\n");
+                fb_dealloc_cmap(&fb_info.cmap);
                 err = -EINVAL;
-                goto out_unmap;
+                goto out_unmap2;
         }
         output("fb%d: %s frame buffer device %dx%d-%dbpp\n",
            fb_info.node, fb_info.fix.id, default_var.xres,
            default_var.yres, default_var.bits_per_pixel);
         return 0;
 
-out_unmap:
-        if (default_par.io_virt)
-                iounmap(default_par.io_virt);
+out_unmap2:
         if (fb_info.screen_base)
                 iounmap(fb_info.screen_base);
+        release_mem_region(tridentfb_fix.smem_start, tridentfb_fix.smem_len);
+        disable_mmio();
+out_unmap1:
+        if (default_par.io_virt)
+                iounmap(default_par.io_virt);
+        release_mem_region(tridentfb_fix.mmio_start, tridentfb_fix.mmio_len);
         return err;
 }
 
@@ -1323,7 +1342,7 @@ static void __devexit trident_pci_remove(struct pci_dev *dev)
         iounmap(par->io_virt);
         iounmap(fb_info.screen_base);
         release_mem_region(tridentfb_fix.smem_start, tridentfb_fix.smem_len);
-        release_region(tridentfb_fix.mmio_start, tridentfb_fix.mmio_len);
+        release_mem_region(tridentfb_fix.mmio_start, tridentfb_fix.mmio_len);
 }
 
 /* List of boards that we are trying to support */
diff --git a/drivers/w1/masters/ds1wm.c b/drivers/w1/masters/ds1wm.c
index 688e435b4d9a..10211e493001 100644
--- a/drivers/w1/masters/ds1wm.c
+++ b/drivers/w1/masters/ds1wm.c
@@ -17,6 +17,7 @@
 #include <linux/pm.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/err.h>
 #include <linux/delay.h>
 #include <linux/ds1wm.h>
 
@@ -102,12 +103,12 @@ struct ds1wm_data {
 static inline void ds1wm_write_register(struct ds1wm_data *ds1wm_data, u32 reg,
                                         u8 val)
 {
-        __raw_writeb(val, ds1wm_data->map + (reg << ds1wm_data->bus_shift));
+        __raw_writeb(val, ds1wm_data->map + (reg << ds1wm_data->bus_shift));
 }
 
 static inline u8 ds1wm_read_register(struct ds1wm_data *ds1wm_data, u32 reg)
 {
-        return __raw_readb(ds1wm_data->map + (reg << ds1wm_data->bus_shift));
+        return __raw_readb(ds1wm_data->map + (reg << ds1wm_data->bus_shift));
 }
 
 
@@ -149,8 +150,8 @@ static int ds1wm_reset(struct ds1wm_data *ds1wm_data)
         timeleft = wait_for_completion_timeout(&reset_done, DS1WM_TIMEOUT);
         ds1wm_data->reset_complete = NULL;
         if (!timeleft) {
-                dev_dbg(&ds1wm_data->pdev->dev, "reset failed\n");
-                return 1;
+                dev_err(&ds1wm_data->pdev->dev, "reset failed\n");
+                return 1;
         }
 
         /* Wait for the end of the reset. According to the specs, the time
@@ -167,11 +168,11 @@ static int ds1wm_reset(struct ds1wm_data *ds1wm_data)
                 (ds1wm_data->active_high ? DS1WM_INTEN_IAS : 0));
 
         if (!ds1wm_data->slave_present) {
-                dev_dbg(&ds1wm_data->pdev->dev, "reset: no devices found\n");
-                return 1;
-        }
+                dev_dbg(&ds1wm_data->pdev->dev, "reset: no devices found\n");
+                return 1;
+        }
 
-        return 0;
+        return 0;
 }
 
 static int ds1wm_write(struct ds1wm_data *ds1wm_data, u8 data)
@@ -334,7 +335,7 @@ static int ds1wm_probe(struct platform_device *pdev)
         if (!pdev)
                 return -ENODEV;
 
-        ds1wm_data = kzalloc(sizeof (*ds1wm_data), GFP_KERNEL);
+        ds1wm_data = kzalloc(sizeof(*ds1wm_data), GFP_KERNEL);
         if (!ds1wm_data)
                 return -ENOMEM;
 
@@ -374,8 +375,8 @@ static int ds1wm_probe(struct platform_device *pdev)
                 goto err1;
 
         ds1wm_data->clk = clk_get(&pdev->dev, "ds1wm");
-        if (!ds1wm_data->clk) {
-                ret = -ENOENT;
+        if (IS_ERR(ds1wm_data->clk)) {
+                ret = PTR_ERR(ds1wm_data->clk);
                 goto err2;
         }
 
diff --git a/drivers/watchdog/cpu5wdt.c b/drivers/watchdog/cpu5wdt.c
index 5941ca601a3a..df72f90123df 100644
--- a/drivers/watchdog/cpu5wdt.c
+++ b/drivers/watchdog/cpu5wdt.c
@@ -59,9 +59,9 @@ static int ticks = 10000;
 
 static struct {
         struct completion stop;
-        volatile int running;
+        int running;
         struct timer_list timer;
-        volatile int queue;
+        int queue;
         int default_ticks;
         unsigned long inuse;
 } cpu5wdt_device;
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index a2e174b09fe7..6483d1066b95 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -58,41 +58,6 @@ struct bios32_service_dir {
         u8 reserved[5];
 };
 
-/*
- * smbios_entry_point     - defines SMBIOS entry point structure
- *
- * anchor[4]              - anchor string (_SM_)
- * checksum               - checksum of the entry point structure
- * length                 - length of the entry point structure
- * major_ver              - major version (02h for revision 2.1)
- * minor_ver              - minor version (01h for revision 2.1)
- * max_struct_size        - size of the largest SMBIOS structure
- * revision               - entry point structure revision implemented
- * formatted_area[5]      - reserved
- * intermediate_anchor[5] - intermediate anchor string (_DMI_)
- * intermediate_checksum  - intermediate checksum
- * table_length           - structure table length
- * table_address          - structure table address
- * table_num_structs      - number of SMBIOS structures present
- * bcd_revision           - BCD revision
- */
-struct smbios_entry_point {
-        u8 anchor[4];
-        u8 checksum;
-        u8 length;
-        u8 major_ver;
-        u8 minor_ver;
-        u16 max_struct_size;
-        u8 revision;
-        u8 formatted_area[5];
-        u8 intermediate_anchor[5];
-        u8 intermediate_checksum;
-        u16 table_length;
-        u64 table_address;
-        u16 table_num_structs;
-        u8 bcd_revision;
-};
-
 /* type 212 */
 struct smbios_cru64_info {
         u8 type;
@@ -175,31 +140,13 @@ static struct pci_device_id hpwdt_devices[] = {
 };
 MODULE_DEVICE_TABLE(pci, hpwdt_devices);
 
-/*
- *      bios_checksum
- */
-static int __devinit bios_checksum(const char __iomem *ptr, int len)
-{
-        char sum = 0;
-        int i;
-
-        /*
-         * calculate checksum of size bytes. This should add up
-         * to zero if we have a valid header.
-         */
-        for (i = 0; i < len; i++)
-                sum += ptr[i];
-
-        return ((sum == 0) && (len > 0));
-}
-
 #ifndef CONFIG_X86_64
 /* --32 Bit Bios------------------------------------------------------------ */
 
 #define HPWDT_ARCH      32
 
-asmlinkage void asminline_call(struct cmn_registers *pi86Regs,
-                               unsigned long *pRomEntry)
+static void asminline_call(struct cmn_registers *pi86Regs,
+                           unsigned long *pRomEntry)
 {
         asm("pushl       %ebp               \n\t"
             "movl        %esp, %ebp         \n\t"
@@ -303,6 +250,24 @@ static int __devinit cru_detect(unsigned long map_entry,
 }
 
 /*
+ *      bios_checksum
+ */
+static int __devinit bios_checksum(const char __iomem *ptr, int len)
+{
+        char sum = 0;
+        int i;
+
+        /*
+         * calculate checksum of size bytes. This should add up
+         * to zero if we have a valid header.
+         */
+        for (i = 0; i < len; i++)
+                sum += ptr[i];
+
+        return ((sum == 0) && (len > 0));
+}
+
+/*
  *      bios32_present
  *
  *      Routine Description:
@@ -368,8 +333,8 @@ static int __devinit detect_cru_service(void)
 
 #define HPWDT_ARCH      64
 
-asmlinkage void asminline_call(struct cmn_registers *pi86Regs,
-                               unsigned long *pRomEntry)
+static void asminline_call(struct cmn_registers *pi86Regs,
+                           unsigned long *pRomEntry)
 {
         asm("pushq      %rbp            \n\t"
             "movq       %rsp, %rbp      \n\t"
@@ -410,12 +375,8 @@ asmlinkage void asminline_call(struct cmn_registers *pi86Regs,
  *      dmi_find_cru
  *
  *      Routine Description:
- *      This function checks wether or not a SMBIOS/DMI record is
+ *      This function checks whether or not a SMBIOS/DMI record is
  *      the 64bit CRU info or not
- *
- *      Return Value:
- *      0        :  SUCCESS - if record found
- *      <0       :  FAILURE - if record not found
  */
 static void __devinit dmi_find_cru(const struct dmi_header *dm)
 {
@@ -434,138 +395,11 @@ static void __devinit dmi_find_cru(const struct dmi_header *dm)
         }
 }
 
-/*
- *      dmi_table
- *
- *      Routine Description:
- *      Decode the SMBIOS/DMI table and check if we have a 64bit CRU record
- *      or not.
- *
- *      We have to be cautious here. We have seen BIOSes with DMI pointers
- *      pointing to completely the wrong place for example
- */
-static void __devinit dmi_table(u8 *buf, int len, int num,
-                      void (*decode)(const struct dmi_header *))
-{
-        u8 *data = buf;
-        int i = 0;
-
-        /*
-         *      Stop when we see all the items the table claimed to have
-         *      OR we run off the end of the table (also happens)
-         */
-        while ((i < num) && (data - buf + sizeof(struct dmi_header)) <= len) {
-                const struct dmi_header *dm = (const struct dmi_header *)data;
-
-                /*
-                 *  We want to know the total length (formated area and strings)
-                 *  before decoding to make sure we won't run off the table in
-                 *  dmi_decode or dmi_string
-                 */
-                data += dm->length;
-                while ((data - buf < len - 1) && (data[0] || data[1]))
-                        data++;
-                if (data - buf < len - 1)
-                        decode(dm);
-                data += 2;
-                i++;
-        }
-}
-
-/*
- *      smbios_present
- *
- *      Routine Description:
- *      This function parses the SMBIOS entry point table to retrieve
- *      the 64 bit CRU Service.
- *
- *      Return Value:
- *      0        :  SUCCESS
- *      <0       :  FAILURE
- */
-static int __devinit smbios_present(const char __iomem *p)
-{
-        struct smbios_entry_point *eps =
-                (struct smbios_entry_point *) p;
-        int length;
-        u8 *buf;
-
-        /* check if we have indeed the SMBIOS table entry point */
-        if ((strncmp((char *)eps->anchor, "_SM_",
-                             sizeof(eps->anchor))) == 0) {
-                length = eps->length;
-
-                /* SMBIOS v2.1 implementation might use 0x1e */
-                if ((length == 0x1e) &&
-                    (eps->major_ver == 2) &&
-                    (eps->minor_ver == 1))
-                        length = 0x1f;
-
-                /*
-                 * Now we will check:
-                 * - SMBIOS checksum must be 0
-                 * - intermediate anchor should be _DMI_
-                 * - intermediate checksum should be 0
-                 */
-                if ((bios_checksum(p, length)) &&
-                    (strncmp((char *)eps->intermediate_anchor, "_DMI_",
-                             sizeof(eps->intermediate_anchor)) == 0) &&
-                    (bios_checksum(p+0x10, 15))) {
-                        buf = ioremap(eps->table_address, eps->table_length);
-                        if (buf == NULL)
-                                return -ENODEV;
-
-
-                        /* Scan the DMI table for the 64 bit CRU service */
-                        dmi_table(buf, eps->table_length,
-                                  eps->table_num_structs, dmi_find_cru);
-
-                        iounmap(buf);
-                        return 0;
-                }
-        }
-
-        return -ENODEV;
-}
-
-static int __devinit smbios_scan_machine(void)
-{
-        char __iomem *p, *q;
-        int rc;
-
-        if (efi_enabled) {
-                if (efi.smbios == EFI_INVALID_TABLE_ADDR)
-                        return -ENODEV;
-
-                p = ioremap(efi.smbios, 32);
-                if (p == NULL)
-                        return -ENOMEM;
-
-                rc = smbios_present(p);
-                iounmap(p);
-        } else {
-                /*
-                 * Search from 0x0f0000 through 0x0fffff, inclusive.
-                 */
-                p = ioremap(PCI_ROM_BASE1, ROM_SIZE);
-                if (p == NULL)
-                        return -ENOMEM;
-
-                for (q = p; q < p + ROM_SIZE; q += 16) {
-                        rc = smbios_present(q);
-                        if (!rc) {
-                                break;
-                        }
-                }
-                iounmap(p);
-        }
-}
-
 static int __devinit detect_cru_service(void)
 {
         cru_rom_addr = NULL;
 
-        smbios_scan_machine();  /* will become dmi_walk(dmi_find_cru); */
+        dmi_walk(dmi_find_cru);
 
         /* if cru_rom_addr has been set then we found a CRU service */
         return ((cru_rom_addr != NULL)? 0: -ENODEV);
diff --git a/drivers/watchdog/it8712f_wdt.c b/drivers/watchdog/it8712f_wdt.c
index 1b6d7d1b715d..1efcad3b6fca 100644
--- a/drivers/watchdog/it8712f_wdt.c
+++ b/drivers/watchdog/it8712f_wdt.c
@@ -7,7 +7,8 @@
  *
  *      drivers/char/watchdog/scx200_wdt.c
  *      drivers/hwmon/it87.c
- *      IT8712F EC-LPC I/O Preliminary Specification 0.9.2.pdf
+ *      IT8712F EC-LPC I/O Preliminary Specification 0.8.2
+ *      IT8712F EC-LPC I/O Preliminary Specification 0.9.3
  *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License as
@@ -40,6 +41,7 @@ MODULE_DESCRIPTION("IT8712F Watchdog Driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
 
+static int max_units = 255;
 static int margin = 60;         /* in seconds */
 module_param(margin, int, 0);
 MODULE_PARM_DESC(margin, "Watchdog margin in seconds");
@@ -51,6 +53,7 @@ MODULE_PARM_DESC(nowayout, "Disable watchdog shutdown on close");
 static struct semaphore it8712f_wdt_sem;
 static unsigned expect_close;
 static spinlock_t io_lock;
+static unsigned char revision;
 
 /* Dog Food address - We use the game port address */
 static unsigned short address;
@@ -108,6 +111,15 @@ superio_inw(int reg)
         return val;
 }
 
+static void
+superio_outw(int val, int reg)
+{
+        outb(reg++, REG);
+        outb((val >> 8) & 0xff, VAL);
+        outb(reg, REG);
+        outb(val & 0xff, VAL);
+}
+
 static inline void
 superio_select(int ldn)
 {
@@ -143,15 +155,33 @@ static void
 it8712f_wdt_update_margin(void)
 {
         int config = WDT_OUT_KRST | WDT_OUT_PWROK;
-
-        printk(KERN_INFO NAME ": timer margin %d seconds\n", margin);
-
-        /* The timeout register only has 8bits wide */
-        if (margin < 256)
-                config |= WDT_UNIT_SEC; /* else UNIT are MINUTES */
+        int units = margin;
+
+        /* Switch to minutes precision if the configured margin
+         * value does not fit within the register width.
+         */
+        if (units <= max_units) {
+                config |= WDT_UNIT_SEC; /* else UNIT is MINUTES */
+                printk(KERN_INFO NAME ": timer margin %d seconds\n", units);
+        } else {
+                units /= 60;
+                printk(KERN_INFO NAME ": timer margin %d minutes\n", units);
+        }
         superio_outb(config, WDT_CONFIG);
 
-        superio_outb((margin > 255) ? (margin / 60) : margin, WDT_TIMEOUT);
+        if (revision >= 0x08)
+                superio_outw(units, WDT_TIMEOUT);
+        else
+                superio_outb(units, WDT_TIMEOUT);
+}
+
+static int
+it8712f_wdt_get_status(void)
+{
+        if (superio_inb(WDT_CONTROL) & 0x01)
+                return WDIOF_CARDRESET;
+        else
+                return 0;
 }
 
 static void
@@ -234,7 +264,7 @@ it8712f_wdt_ioctl(struct inode *inode, struct file *file,
                 .firmware_version = 1,
                 .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
         };
-        int new_margin;
+        int value;
 
         switch (cmd) {
         default:
@@ -244,17 +274,27 @@ it8712f_wdt_ioctl(struct inode *inode, struct file *file,
                         return -EFAULT;
                 return 0;
         case WDIOC_GETSTATUS:
+                superio_enter();
+                superio_select(LDN_GPIO);
+
+                value = it8712f_wdt_get_status();
+
+                superio_exit();
+
+                return put_user(value, p);
         case WDIOC_GETBOOTSTATUS:
                 return put_user(0, p);
         case WDIOC_KEEPALIVE:
                 it8712f_wdt_ping();
                 return 0;
         case WDIOC_SETTIMEOUT:
-                if (get_user(new_margin, p))
+                if (get_user(value, p))
                         return -EFAULT;
-                if (new_margin < 1)
+                if (value < 1)
+                        return -EINVAL;
+                if (value > (max_units * 60))
                         return -EINVAL;
-                margin = new_margin;
+                margin = value;
                 superio_enter();
                 superio_select(LDN_GPIO);
 
@@ -262,6 +302,7 @@ it8712f_wdt_ioctl(struct inode *inode, struct file *file,
 
                 superio_exit();
                 it8712f_wdt_ping();
+                /* Fall through */
         case WDIOC_GETTIMEOUT:
                 if (put_user(margin, p))
                         return -EFAULT;
@@ -336,9 +377,18 @@ it8712f_wdt_find(unsigned short *address)
         }
 
         err = 0;
-        printk(KERN_DEBUG NAME ": Found IT%04xF chip revision %d - "
+        revision = superio_inb(DEVREV) & 0x0f;
+
+        /* Later revisions have 16-bit values per datasheet 0.9.1 */
+        if (revision >= 0x08)
+                max_units = 65535;
+
+        if (margin > (max_units * 60))
+                margin = (max_units * 60);
+
+        printk(KERN_INFO NAME ": Found IT%04xF chip revision %d - "
                 "using DogFood address 0x%x\n",
-                chip_type, superio_inb(DEVREV) & 0x0f, *address);
+                chip_type, revision, *address);
 
 exit:
         superio_exit();
diff --git a/drivers/watchdog/machzwd.c b/drivers/watchdog/machzwd.c
index e6e07b4575eb..6905135a776c 100644
--- a/drivers/watchdog/machzwd.c
+++ b/drivers/watchdog/machzwd.c
@@ -141,7 +141,7 @@ static unsigned long next_heartbeat = 0;
 #ifndef ZF_DEBUG
 #       define dprintk(format, args...)
 #else
-#       define dprintk(format, args...) printk(KERN_DEBUG PFX ":%s:%d: " format, __FUNCTION__, __LINE__ , ## args)
+#       define dprintk(format, args...) printk(KERN_DEBUG PFX ":%s:%d: " format, __func__, __LINE__ , ## args)
 #endif
 
 
diff --git a/drivers/watchdog/mtx-1_wdt.c b/drivers/watchdog/mtx-1_wdt.c
index 789831b3fa00..10b89f2703bd 100644
--- a/drivers/watchdog/mtx-1_wdt.c
+++ b/drivers/watchdog/mtx-1_wdt.c
@@ -59,9 +59,9 @@ static int ticks = 100 * HZ;
 
 static struct {
         struct completion stop;
-        volatile int running;
+        int running;
         struct timer_list timer;
-        volatile int queue;
+        int queue;
         int default_ticks;
         unsigned long inuse;
         unsigned gpio;
diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
index 0f3fd6c9c354..bf443d077a1e 100644
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -179,11 +179,11 @@ static void usb_pcwd_intr_done(struct urb *urb)
         case -ENOENT:
         case -ESHUTDOWN:
                 /* this urb is terminated, clean up */
-                dbg("%s - urb shutting down with status: %d", __FUNCTION__, urb->status);
+                dbg("%s - urb shutting down with status: %d", __func__, urb->status);
                 return;
         /* -EPIPE:  should clear the halt */
         default:                /* error */
-                dbg("%s - nonzero urb status received: %d", __FUNCTION__, urb->status);
+                dbg("%s - nonzero urb status received: %d", __func__, urb->status);
                 goto resubmit;
         }
 
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 5d1c15f83d23..7645e8812156 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -144,7 +144,7 @@ static int s3c2410wdt_start(void)
         }
 
         DBG("%s: wdt_count=0x%08x, wtcon=%08lx\n",
-            __FUNCTION__, wdt_count, wtcon);
+            __func__, wdt_count, wtcon);
 
         writel(wdt_count, wdt_base + S3C2410_WTDAT);
         writel(wdt_count, wdt_base + S3C2410_WTCNT);
@@ -167,7 +167,7 @@ static int s3c2410wdt_set_heartbeat(int timeout)
         count = timeout * freq;
 
         DBG("%s: count=%d, timeout=%d, freq=%d\n",
-            __FUNCTION__, count, timeout, freq);
+            __func__, count, timeout, freq);
 
         /* if the count is bigger than the watchdog register,
            then work out what we need to do (and if) we can
@@ -189,7 +189,7 @@ static int s3c2410wdt_set_heartbeat(int timeout)
         tmr_margin = timeout;
 
         DBG("%s: timeout=%d, divisor=%d, count=%d (%08x)\n",
-            __FUNCTION__, timeout, divisor, count, count/divisor);
+            __func__, timeout, divisor, count, count/divisor);
 
         count /= divisor;
         wdt_count = count;
@@ -355,7 +355,7 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         int ret;
         int size;
 
-        DBG("%s: probe=%p\n", __FUNCTION__, pdev);
+        DBG("%s: probe=%p\n", __func__, pdev);
 
         dev = &pdev->dev;
         wdt_dev = &pdev->dev;
diff --git a/drivers/watchdog/shwdt.c b/drivers/watchdog/shwdt.c
index 61dde863bd40..1277f7e9cc54 100644
--- a/drivers/watchdog/shwdt.c
+++ b/drivers/watchdog/shwdt.c
@@ -298,7 +298,7 @@ static int sh_wdt_mmap(struct file *file, struct vm_area_struct *vma)
         if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
                                PAGE_SIZE, vma->vm_page_prot)) {
                 printk(KERN_ERR PFX "%s: io_remap_pfn_range failed\n",
-                       __FUNCTION__);
+                       __func__);
                 return -EAGAIN;
         }